feat: [JWT-4] identity model JWT, the JWT repo, and the public API

[nan-li]

Description

One Line Summary

Add the Identity Verification public surface: JWT on the identity model, the JWT repo, and the app-facing API to supply a token and hear when it was invalidated.

Details

Motivation

Under Identity Verification, an app must hand the SDK a JWT for a user and learn when that token stopped being accepted. The SDK needs per–external-ID storage and ask-once semantics so the app is prompted once per user, not once per rejected request — including when a listener registers after start or login.

Scope

• OSIdentityModel / OSIdentityModelRepo — JWT field and persistence the public API needs
• OSUserJwtRepo — token per external ID; ask-once; late-listener catch-up
• OSUserJwtInvalidatedEvent + public API (updateUserJwt, addUserJwtInvalidatedListener, …)
• Removes unused beta surface: requiresUserAuth, onJwtExpired, and related handler typealiases
• Unit tests for identity model JWT, JWT repo, and public API
• No request-pipeline auth, queue release on storeJwt, IAM, or demo UI (later PRs)

Stacked on #1707 (nan/jwt-pr3-iv-gate).

Testing

Unit testing

• OSIdentityModelTests
• OSIdentityModelRepoTests
• OSUserJwtRepoTests
• UserJwtApiTests

Manual testing

Built in sequence as part of the local JWT stack against an iOS Simulator; this PR’s commit compiled on top of PR3.

Affected code checklist

• Notifications
  • Display
  • Open
  • Push Processing
  • Confirm Deliveries
• Outcomes
• Sessions
• In-App Messaging
• REST API requests
• Public API changes

Checklist

Overview

• I have filled out all REQUIRED sections above
• PR does one thing
• Any Public API changes are explained in the PR details and conform to existing APIs

Testing

• I have included test coverage for these changes, or explained why they are not needed
• All automated tests pass, or I explained why that is not possible
• I have personally tested this on my device, or explained why that is not possible

Final pass

• Code is as readable as possible.
• I have reviewed this PR myself, ensuring it meets each checklist item

[cursor]

Multimodal adversarial review (interrogate)

Skill: Cursor interrogate (pstack). Reviewers: claude-fable-5-thinking-xhigh, gpt-5.6-sol-xhigh, cursor-grok-4.5-high-fast, claude-opus-5-thinking-high. Lead judgment applied below — not a raw dump.

Intent

PR4 of the IV/JWT stack (on PR3). Add the Identity Verification surface an app talks to: supply a JWT for a user (updateUserJwt / login token), and get told when that token stopped being accepted (OSUserJwtRepo ask-once + late-listener catch-up + public listener API). Persist JWT fields on OSIdentityModel / repo with compare-and-swap invalidate. Remove unused beta surface (requiresUserAuth, onJwtExpired). Request-pipeline / queue release intentionally later.

Reviewers

• A: claude-fable-5-thinking-xhigh — 11 findings
• B: gpt-5.6-sol-xhigh — 6 findings
• C: cursor-grok-4.5-high-fast — 8 findings
• D: claude-opus-5-thinking-high — 14 findings

Act On

1. login(externalId:token:) bypasses storeJwt / ask re-arm (A/B/C/D) — storeJwt claims every app-supplied token arrives there, but login/createNewUser still assign jwtBearerToken directly. That never clears askedForToken, so answering an invalidation via login permanently silences later asks. Anonymous→identify also parks the token on the anonymous model while the new external-ID model stays tokenless, so validJwt(externalId:) is nil right after the primary IV login path. Same-user re-login early-returns and drops a refreshed token entirely.
2. Raw JWT logged in updateUserJwt (A/B/C/D) — Author TODO says omit before shipping; OSLogListeners still receive every level regardless of _nsLogLevel. Strip now.
3. Bearer token persisted to shared UserDefaults; secure-storage TODO deleted (A/B/C/D) — Encode path newly archives the live credential via OSModelStore → app-group defaults. At minimum restore a tracked TODO / keep real tokens memory-only and persist only the invalid sentinel; Keychain if cross-launch persistence is required.
4. No login(..., token:) coverage against the new JWT surface (A/C/D) — Repo/API tests seed models with externalId already set; they cannot catch (1). Add anonymous→identify, create-user, and same-user refresh cases asserting userJwtRepo.validJwt + ask re-arm.

Consider

• Ask/token TOCTOU (A/B/C/D) — invalidateJwt’s nil-check then askForToken is not atomic with updateJwt; concurrent replacement can leave a valid token + stuck ask.
• Late-listener catch-up (A/B/C/D) — Direct strong capture + main async bypasses OSObservable weak/remove semantics; concurrent ask can double-deliver.
• set(property: OS_JWT_BEARER_TOKEN) without preventServerUpdate: true (A/D) — Today alias cast fails; prefer explicit opt-out like OSSubscriptionModel.
• askedForToken survives logout (D) — Late listeners can be told to mint for a logged-out user.
• Silent drop when no model matches externalId (D) — Void API + ask uncleared is terminal for the session during clearData hydration windows.

Noted

• OSUserJwtProviding / unread identityVerificationService look like stacked-PR scaffolding (A/D).
• In-band OS_JWT_TOKEN_INVALID string checked at three layers (A/D) — fine for now; tighten when executors land.
• Lazy observer init race (B) — low practical risk for UI registration.

Dismissed

• Full JWT-state enum rewrite as a blocker for this PR — design preference; not required to ship the public surface if login routing + logging/persistence are fixed.
• Sticky-event observable redesign for catch-up — nicer long-term, overkill if membership/weak capture is fixed.
• Wrapper changelog as a hard block — PR body already documents beta API migration; still worth a release note.

Agreement Map

All four models independently flagged login-vs-storeJwt, JWT-in-logs, and plaintext persistence. Catch-up + ask/token races were also consensus (lower severity). D pushed hardest on silent drops / logout ask lifecycle; B on log-listener fanout and lazy observer init. Highest-confidence blockers are the login ingress contract break and shipping secrets to logs/disk.

  

_{Sent by Cursor Automation: Untitled}