Skip to content

feat(telemetry): add A1-A5/TM/JT/OT/BN per-user feature flag markers (W-23762052) - #4125

Open
wmathurin wants to merge 9 commits into
forcedotcom:devfrom
wmathurin:auth-type-token-format-flags
Open

feat(telemetry): add A1-A5/TM/JT/OT/BN per-user feature flag markers (W-23762052)#4125
wmathurin wants to merge 9 commits into
forcedotcom:devfrom
wmathurin:auth-type-token-format-flags

Conversation

@wmathurin

Copy link
Copy Markdown
Contributor

Summary

  • Add 9 new per-user feature flag markers: A1–A5 (auth type), TM (token migration), JT/OT (token format), BN (beacon child app)
  • A-markers use the same transient-global → per-user two-phase pattern as BW and L-markers
  • TM, JT/OT, BN are per-user only (no global phase), like DP
  • Update BaseAuthFlowTester.swift validateUserAgent to assert new flags

GUS story

W-23762052: https://gus.my.salesforce.com/lightning/r/ADM_Work__c/a07EE00002grYFgYAM/view

Test plan

  • SFSDKAppFeatureMarkersTests: all new tests pass
  • AuthFlowTester UI tests: build succeeds (run by reviewer)

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
1 Warning
⚠️ Static Analysis found an issue with one or more files you modified. Please fix the issue(s).

Clang Static Analysis Issues

File Type Category Description Line Col
SFOAuthCoordinator Nullability Memory error nil assigned to a pointer which is expected to have non-null value 124 19
SFOAuthCoordinator Nullability Memory error nil assigned to a pointer which is expected to have non-null value 295 15
SFUserAccountManager Nullability Memory error Null passed to a callee that requires a non-null 2nd parameter 1622 15
SFUserAccountManager Nullability Memory error Null passed to a callee that requires a non-null 2nd parameter 1637 15
SFUserAccountManager Nullability Memory error nil passed to a callee that requires a non-null 1st parameter 2307 21
SFUserAccountManager Nullability Memory error nil passed to a callee that requires a non-null 2nd parameter 2525 13

Generated by 🚫 Danger

…(W-23762052)

Add aMarkerFor() helper in BaseAuthFlowTester that computes A1–A4 from
useWebServerFlow/useHybridFlow. Thread expectedAMarker through validate(),
restartAndValidateUser(), switchToUserAndValidateUser(), migrateAndValidate(),
and the public assertRevokeAndRefreshWorks() overload. Add wasMigrated:true
on all migrateAndValidate() paths. Update RTRLoginTests and DPoPLoginTests
to pass useHybridFlow:false where the test uses a non-hybrid flow so the
revoke/refresh cycle asserts A3 instead of A2. Update direct validateUserAgent
calls in MultiUserLoginTests with the correct A2 marker.
@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
TestsPassed ✅SkippedFailed
SalesforceSDKCore iOS ^18 Test Results956 ran956 ✅
TestResult
No test annotations available

@codecov

codecov Bot commented Aug 7, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.46%. Comparing base (bac1029) to head (ffc7499).

❌ Your patch check has failed because the patch coverage (36.73%) is below the target coverage (80.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files
@@            Coverage Diff             @@
##              dev    #4125      +/-   ##
==========================================
+ Coverage   67.17%   71.46%   +4.28%     
==========================================
  Files         254      254              
  Lines       22570    22619      +49     
==========================================
+ Hits        15162    16164    +1002     
+ Misses       7408     6455     -953     
Components Coverage Δ
Analytics 70.78% <ø> (ø)
Common 71.06% <ø> (+0.18%) ⬆️
Core 67.05% <100.00%> (+6.47%) ⬆️
SmartStore 73.44% <ø> (ø)
MobileSync 88.82% <ø> (ø)
Files with missing lines Coverage Δ
...rceSDKCore/Classes/Common/SFSDKAppFeatureMarkers.m 100.00% <ø> (ø)
...lesforceSDKCore/Classes/OAuth/SFOAuthCoordinator.m 64.40% <100.00%> (+10.60%) ⬆️
...SDKCore/Classes/UserAccount/SFUserAccountManager.m 67.00% <100.00%> (+17.36%) ⬆️

... and 34 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

…23762052)

AppConfig gains isBeacon (hasPrefix "beacon_") matching the existing
issuesJwt/isRtr/isDPoP pattern. The private validate() helper now derives
isBeacon from userAppConfig and passes it to validateUser(), so beacon tests
assert BN is present without requiring per-callsite changes.
… (W-23762052)

Both overloads of assertRevokeAndRefreshWorks were omitting isJwt and
isBeacon, causing the post-revoke/refresh validateUserAgent call to
default both to false. This caused false failures on beacon and JWT apps
(BN or JT present in UA but test expected absent).
Add three tests whose users intentionally carry diverging A-markers and
companion flags (OT/JT, BN, TM) so that per-user flag leakage is
detectable.  All previous multi-user tests shared A2 for both users,
making such leakage invisible.

- testFlagDiversity_A1OtVsA2Jt (MultiUserLoginTests): A1+OT vs A2+JT
- testFlagDiversity_A1JtBnVsA2OtNoBn (MultiUserLoginTests): A1+JT+BN vs A2+OT
- testFlagDiversity_TmJtBnVsA1OtNoTm (RefreshTokenMigrationTests): post-migration A2+TM+JT+BN vs fresh A1+OT
…(W-23762052)

- MultiUserLoginTests: 11 → 13 tests; add A-marker isolation note and
  two new rows in the test table
- RefreshTokenMigrationTests: 11 → 12 tests; add testFlagDiversity_TmJtBnVsA1OtNoTm row
@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
TestsPassed ☑️Skipped ⚠️Failed ❌️
AuthFlowTester UI Test Results all104 ran31 ✅4 ⚠️69 ❌
TestResult
AuthFlowTester UI Test Results all
AuthFlowTesterUITests.xctest
LoginWithRestartTests.testBeaconJwt_SubsetScopes_DynamicConfiguration_WithRestart()❌ failure
LoginWithRestartTests.testECAOpaque_DefaultScopes_WithRestart()❌ failure
LoginWithRestartTests.testWelcomeDiscovery_WithRestart()❌ failure
LoginWithRestartTests.testECAJwt_DefaultScopes_DynamicConfiguration_WithRestart()❌ failure
LoginWithRestartTests.testAdvancedAuth_WithRestart()❌ failure
LoginWithRestartTests.testMultiUserRestart()❌ failure
LoginWithRestartTests.testBeaconJwt_DefaultScopes_DynamicConfiguration_WithRestart()❌ failure
LoginWithRestartTests.testECAJwt_SubsetScopes_DynamicConfiguration_WithRestart()❌ failure
LoginWithRestartTests.testBeaconOpaque_DefaultScopes_WithRestart()❌ failure
LoginWithRestartTests.testCAOpaque_DefaultScopes_WithRestart()❌ failure
MultiUserLoginTests.testDifferentAppTypes_LogoutCaUser_EcaUserUnaffected()❌ failure
MultiUserLoginTests.testFirstStatic_SecondDynamic_DifferentApps()❌ failure
MultiUserLoginTests.testFirstDynamic_SecondStatic_DifferentApps()❌ failure
MultiUserLoginTests.testFlagDiversity_NonHybridOpaqueVsHybridJwt()❌ failure
MultiUserLoginTests.testFlagDiversity_BeaconNonHybridJwtVsHybridOpaque()❌ failure
MultiUserLoginTests.testBothDynamic_DifferentApps()❌ failure
MultiUserLoginTests.testLogoutUserWithDynamicConfig_OtherUserUnaffected()❌ failure
MultiUserLoginTests.testBothStatic_SameApp_DifferentScopes()❌ failure
MultiUserLoginTests.testBothStatic_DifferentApps()❌ failure
MultiUserLoginTests.testBothStatic_SameApp_SameScopes()❌ failure
MultiUserLoginTests.testDifferentAppTypes_RevokeAccessForCaUser_EcaUserUnaffected()❌ failure
MultiUserLoginTests.testBeaconAndNonBeacon_MultiUser()❌ failure
MultiUserLoginTests.testRevokeAccessForUserWithDynamicConfig_OtherUserUnaffected()❌ failure
MultiUserLoginTests.testAdvancedAuthUser_HasBWFlag_RegularAuthUser_DoesNot()❌ failure
RTRLoginTests.testECAOpaqueRtr_NoHybrid_WithRestart()❌ failure
RTRLoginTests.testECAOpaqueRtr_Hybrid()❌ failure
RTRLoginTests.testECAJwtRtr_NoHybrid_WithRestart()❌ failure
RTRLoginTests.testECAJwtRtr_NoHybrid()❌ failure
RTRLoginTests.testECAOpaqueRtr_Hybrid_WithRestart()❌ failure
RTRLoginTests.testECAOpaqueRtr_NoHybrid()❌ failure
ECALoginTests.testECAOpaque_SubsetScopes()❌ failure
ECALoginTests.testECAJwt_SubsetScopes()❌ failure
ECALoginTests.testECAJwt_DefaultScopes()❌ failure
ECALoginTests.testDynamicConfigurationWithInvalidClientId()❌ failure
ECALoginTests.testECAOpaque_AllScopes()❌ failure
ECALoginTests.testECAOpaque_DefaultScopes()❌ failure
ECALoginTests.testECAJwt_AllScopes()❌ failure
ForceAdvancedAuthTests.testForceAdvancedAuth_MyDomainRegularHost_RemainsBrowser()❌ failure
RefreshTokenMigrationWithRestartTests.testMigrateBeaconScopeAddition_WithRestart()❌ failure
RefreshTokenMigrationWithRestartTests.testMigrateMultipleUsers_WithRestart()❌ failure
RefreshTokenMigrationWithRestartTests.testMigrateCAToECA_WithRestart()❌ failure
RefreshTokenMigrationWithRestartTests.testMigrateCAToBeacon_WithRestart()❌ failure
RefreshTokenMigrationWithRestartTests.testMigrateScopeAddition_WithRestart()❌ failure
LegacyLoginTests.testCAOpaque_SubsetScopes_WebServerFlow_InAppWebView()❌ failure
LegacyLoginTests.testCAOpaque_AllScopes_WebServerFlow_InAppWebView()❌ failure
LegacyLoginTests.testCAOpaque_DefaultScopes_WebServerFlow_InAppWebView()❌ failure
LegacyLoginTests.testCAOpaque_AllScopes_WebServerFlow()❌ failure
LegacyLoginTests.testCAOpaque_DefaultScopes_WebServerFlow()❌ failure
LoginForAdminTests.testLoginForAdmin_WebServerFlowEnabled()❌ failure
LoginForAdminTests.testLoginForAdmin_WebServerFlowDisabled()❌ failure
RefreshTokenMigrationTests.testMigrateCAUserAgentToBeaconWebServer()❌ failure
RefreshTokenMigrationTests.testMigrateBeaconToCA()❌ failure
RefreshTokenMigrationTests.testFlagDiversity_MigratedBeaconJwtVsNonHybridOpaque()❌ failure
RefreshTokenMigrationTests.testMigrateBeacon_AddMoreScopes()❌ failure
RefreshTokenMigrationTests.testMigrateOneUserOnly()❌ failure
RefreshTokenMigrationTests.testMigrateCA_AddMoreScopes()❌ failure
RefreshTokenMigrationTests.testMigrateCAUserAgentToECAWebServer()❌ failure
RefreshTokenMigrationTests.testMigrateCAToBeacon()❌ failure
RefreshTokenMigrationTests.testMigrateCAToECA()❌ failure
RefreshTokenMigrationTests.testMigrateBeaconOpaqueToJWTAndBack()❌ failure
RefreshTokenMigrationTests.testMigrateCAToBeaconAndBack()❌ failure
RefreshTokenMigrationTests.testMigrateECA_AddMoreScopes()❌ failure
DPoPLoginTests.test_givenDPoPUser_whenMigrateToDPoPRtr_thenRefreshTokenRotationEnabled()❌ failure
DPoPLoginTests.test_givenDPoPUserWithSubsetScopes_whenMigrateToAllScopes_thenDPoPBindingPreserved()❌ failure
DPoPLoginTests.test_givenDPoPNoHybrid_whenLogin_thenTokenTypeIsDPoPAndRefreshWorks()❌ failure
DPoPLoginTests.test_givenDPoPHybrid_whenLogin_thenTokenTypeIsDPoPAndRefreshWorks()❌ failure
DPoPLoginTests.test_givenDPoPRtrNoHybrid_whenLogin_thenRefreshTokenRotatesAndDPoPBindingHolds()❌ failure
DPoPLoginTests.test_givenDPoPECA_whenAdminLogin_thenDPoPBindingWorksThroughSafariVC()❌ failure
DPoPLoginTests.test_givenTwoDPoPUsers_whenSwitchAndRefresh_thenTokensAndNoncesAreIsolated()❌ failure

…ginWithRestartTests

restartAndValidateUser and switchToUserAndValidateUser both called
validateUser without deriving isBeacon from the app config, so the
BN flag check always defaulted to isBeacon: false. Look up the
app config in each helper and forward isBeacon: userAppConfig.isBeacon
to validateUser, matching the pattern already used in validate().
…r A-marker (W-23762052)

- Merged upstream/dev: AA flag now preserved on token refresh (W-23616382),
  AA promotion moved inside completedAuthType != SFOAuthTypeRefresh guard
- Resolved conflicts in SFUserAccountManager.m and SFSDKAppFeatureMarkersTests.m:
  kept A/TM/JT/OT/BN blocks; integrated new AA tests from upstream
- Added AdvancedBrowser A-marker: native browser flow always uses web-server grant,
  so SFOAuthTypeAdvancedBrowser now registers A1/A2 (fixes LoginForAdmin UI test failure)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant