feat: [JWT-5] bind each Delta to the user that owns it

iOS_SDK/OneSignalSDK/OneSignal.xcodeproj/project.pbxproj

@@ -283,6 +283,7 @@
 		475F474A2B8E3B4600EC05B3 /* OneSignalLiveActivities.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 475F471E2B8E398D00EC05B3 /* OneSignalLiveActivities.framework */; platformFilter = ios; };
 		475F474F2B8E3B5400EC05B3 /* OneSignalLiveActivities.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 475F471E2B8E398D00EC05B3 /* OneSignalLiveActivities.framework */; };
 		475F47502B8E3B5400EC05B3 /* OneSignalLiveActivities.framework in Embed Frameworks */ = {isa = PBXBuildFile; fileRef = 475F471E2B8E398D00EC05B3 /* OneSignalLiveActivities.framework */; settings = {ATTRIBUTES = (CodeSignOnCopy, RemoveHeadersOnCopy, ); }; };
+		4E8E880086C66B4120CC0CD4 /* OSDeltaTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 557653D2007BFF86EA8342E4 /* OSDeltaTests.swift */; };
 		50C4F7CFEC46836131011004 /* XCTestCase+WaitUntil.swift in Sources */ = {isa = PBXBuildFile; fileRef = 03A81CCA8DFA43C8AEA738B8 /* XCTestCase+WaitUntil.swift */; };
 		5B053FBC2CAE07EB002F30C4 /* OneSignalOSCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 3C115161289A259500565C41 /* OneSignalOSCore.framework */; };
 		5B053FC32CAE0843002F30C4 /* OSConsistencyManagerTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5BC1DE672C90C23E00CA8807 /* OSConsistencyManagerTests.swift */; };
@@ -368,6 +369,7 @@
 		91F60F7D1E80E4E400706E60 /* UncaughtExceptionHandler.m in Sources */ = {isa = PBXBuildFile; fileRef = 91F60F7C1E80E4E400706E60 /* UncaughtExceptionHandler.m */; };
 		9224347AAE3E092B5743380D /* UserJwtApiTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 80DC5517E6EB5B26CF980CC5 /* UserJwtApiTests.swift */; };
 		94D9F5AFE86B16453A36C9A2 /* MockUserJwtInvalidatedListener.swift in Sources */ = {isa = PBXBuildFile; fileRef = 1F214EE6C5FE133672D6622F /* MockUserJwtInvalidatedListener.swift */; };
+		99B1615D0132AFAA981A9AD3 /* DeltaOwnershipTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 3881024646E7F0DE05158442 /* DeltaOwnershipTests.swift */; };
 		9D3300FA23149DAE000F0A83 /* CoreGraphics.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 9D3300F923149DAE000F0A83 /* CoreGraphics.framework */; };
 		9D348537233C669E00EB81C9 /* CoreLocation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 9D348536233C669E00EB81C9 /* CoreLocation.framework */; };
 		9D34853A233D2E3600EB81C9 /* OneSignalLocationOverrider.m in Sources */ = {isa = PBXBuildFile; fileRef = 9D348539233D2E3600EB81C9 /* OneSignalLocationOverrider.m */; };
@@ -1351,6 +1353,7 @@
 		2F2FC6C922FF8104F3197DD4 /* OSUserJwtInvalidatedEvent.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; path = OSUserJwtInvalidatedEvent.swift; sourceTree = "<group>"; };
 		37747F9319147D6500558FAD /* libOneSignal.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = libOneSignal.a; sourceTree = BUILT_PRODUCTS_DIR; };
 		37E6B2BA19D9CAF300D0C601 /* UIKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = UIKit.framework; path = System/Library/Frameworks/UIKit.framework; sourceTree = SDKROOT; };
+		3881024646E7F0DE05158442 /* DeltaOwnershipTests.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; path = DeltaOwnershipTests.swift; sourceTree = "<group>"; };
 		3C01518E2C2E298E0079E076 /* OneSignalInAppMessagesTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = OneSignalInAppMessagesTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
 		3C01519B2C2E29F90079E076 /* IAMRequestTests.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = IAMRequestTests.m; sourceTree = "<group>"; };
 		3C0EF49D28A1DBCB00E5434B /* OSUserInternalImpl.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = OSUserInternalImpl.swift; sourceTree = "<group>"; };
@@ -1542,6 +1545,7 @@
 		475F47202B8E398E00EC05B3 /* OneSignalLiveActivities.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = OneSignalLiveActivities.h; sourceTree = "<group>"; };
 		475F47482B8E3A4400EC05B3 /* Info.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
 		4CCE2C93100CAFEE8EB39C77 /* OneSignalUserManagerImpl+Jwt.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; path = "OneSignalUserManagerImpl+Jwt.swift"; sourceTree = "<group>"; };
+		557653D2007BFF86EA8342E4 /* OSDeltaTests.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; path = OSDeltaTests.swift; sourceTree = "<group>"; };
 		5953656ACCC21358BC0CF2F0 /* OSIdentityModelTests.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; path = OSIdentityModelTests.swift; sourceTree = "<group>"; };
 		5B053FB82CAE07EB002F30C4 /* OneSignalOSCoreTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = OneSignalOSCoreTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
 		5B58E4F3237CE7B3009401E0 /* UIDeviceOverrider.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UIDeviceOverrider.h; sourceTree = "<group>"; };
@@ -2434,6 +2438,7 @@
 				5953656ACCC21358BC0CF2F0 /* OSIdentityModelTests.swift */,
 				B5809B47EB4F2478099697CE /* OSUserJwtRepoTests.swift */,
 				80DC5517E6EB5B26CF980CC5 /* UserJwtApiTests.swift */,
+				3881024646E7F0DE05158442 /* DeltaOwnershipTests.swift */,
 			);
 			path = OneSignalUserTests;
 			sourceTree = "<group>";
@@ -2612,6 +2617,7 @@
 				03A81CCA8DFA43C8AEA738B8 /* XCTestCase+WaitUntil.swift */,
 				4795885CE6CFFB1998AC7D09 /* Feature */,
 				5B47CE0CE255AC7128442FFF /* Jwt */,
+				557653D2007BFF86EA8342E4 /* OSDeltaTests.swift */,
 			);
 			path = OneSignalOSCoreTests;
 			sourceTree = "<group>";
@@ -4595,6 +4601,7 @@
 				B5FBED8247288744EB484CB5 /* OSIdentityModelTests.swift in Sources */,
 				2DB99C76F3532383C3B81D09 /* OSUserJwtRepoTests.swift in Sources */,
 				9224347AAE3E092B5743380D /* UserJwtApiTests.swift in Sources */,
+				99B1615D0132AFAA981A9AD3 /* DeltaOwnershipTests.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -4673,6 +4680,7 @@
 				2F32272222E88DF0C2C18B53 /* OSFeatureManagerTests.swift in Sources */,
 				9FF50E2A40C88E4533033A38 /* OSIdentityVerificationServiceTests.swift in Sources */,
 				8E949FF4C7A7A2C7182E53EA /* OSUserJwtConfigTests.swift in Sources */,
+				4E8E880086C66B4120CC0CD4 /* OSDeltaTests.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};

iOS_SDK/OneSignalSDK/OneSignalOSCore/Source/OSDelta.swift

@@ -36,6 +36,8 @@ open class OSDelta: NSObject, NSCoding {
     public let deltaId: String
     public let timestamp: Date
     public let identityModelId: String
+    /// The `external_id` of the user this change belongs to, `nil` if that user was anonymous.
+    public let externalId: String?
     public var model: OSModel
     public let property: String
     public let value: Any
@@ -44,11 +46,12 @@ open class OSDelta: NSObject, NSCoding {
         return "<OSDelta \(name) with property: \(property) value: \(value)>"
     }
 
-    public init(name: String, identityModelId: String, model: OSModel, property: String, value: Any) {
+    public init(name: String, identityModelId: String, externalId: String?, model: OSModel, property: String, value: Any) {
         self.name = name
         self.deltaId = UUID().uuidString
         self.timestamp = Date()
         self.identityModelId = identityModelId
+        self.externalId = externalId
         self.model = model
         self.property = property
         self.value = value
@@ -59,6 +62,7 @@ open class OSDelta: NSObject, NSCoding {
         coder.encode(deltaId, forKey: "deltaId")
         coder.encode(timestamp, forKey: "timestamp")
         coder.encode(identityModelId, forKey: "identityModelId")
+        coder.encode(externalId, forKey: "externalId")
         coder.encode(model, forKey: "model")
         coder.encode(property, forKey: "property")
         coder.encode(value, forKey: "value")
@@ -81,6 +85,7 @@ open class OSDelta: NSObject, NSCoding {
         self.deltaId = deltaId
         self.timestamp = timestamp
         self.identityModelId = identityModelId
+        self.externalId = coder.decodeObject(forKey: "externalId") as? String
         self.model = model
         self.property = property
         self.value = value

iOS_SDK/OneSignalSDK/OneSignalOSCore/Source/OSModelStoreListener.swift

@@ -33,7 +33,10 @@ public protocol OSModelStoreListener: OSModelStoreChangedHandler {
 
     var store: OSModelStore<TModel> { get }
 
-    init(store: OSModelStore<TModel>)
+    // Injected: the shared enqueue below lives in OSCore, which cannot reach the User Manager.
+    var operationRepo: OSOperationRepo { get }
+
+    init(store: OSModelStore<TModel>, operationRepo: OSOperationRepo)
 
     func getAddModelDelta(_ model: TModel) -> OSDelta?
 
@@ -57,13 +60,13 @@ extension OSModelStoreListener {
             return
         }
         if let delta = getAddModelDelta(addedModel) {
-            OSOperationRepo.sharedInstance.enqueueDelta(delta)
+            operationRepo.enqueueDelta(delta)
         }
     }
 
     public func onUpdated(_ args: OSModelChangedArgs) {
         if let delta = getUpdateModelDelta(args) {
-            OSOperationRepo.sharedInstance.enqueueDelta(delta)
+            operationRepo.enqueueDelta(delta)
         }
     }
 
@@ -74,7 +77,7 @@ extension OSModelStoreListener {
             return
         }
         if let delta = getRemoveModelDelta(removedModel) {
-            OSOperationRepo.sharedInstance.enqueueDelta(delta)
+            operationRepo.enqueueDelta(delta)
         }
     }
 }

iOS_SDK/OneSignalSDK/OneSignalOSCoreTests/OSDeltaTests.swift

@@ -0,0 +1,74 @@
+/*
+ Modified MIT License
+
+ Copyright 2026 OneSignal
+
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+
+ 1. The above copyright notice and this permission notice shall be included in
+ all copies or substantial portions of the Software.
+
+ 2. All copies of substantial portions of the Software may only be used in connection
+ with services provided by OneSignal.
+
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ THE SOFTWARE.
+ */
+
+import XCTest
+@testable import OneSignalOSCore
+
+/// Covers `OSDelta` archive round trips, including the owning user's external ID.
+final class OSDeltaTests: XCTestCase {
+
+    private func makeDelta(externalId: String?) -> OSDelta {
+        OSDelta(
+            name: "test_delta",
+            identityModelId: "identity-model-a",
+            externalId: externalId,
+            model: OSModel(changeNotifier: OSEventProducer()),
+            property: "language",
+            value: "en"
+        )
+    }
+
+    private func archiveThenUnarchive(_ delta: OSDelta) throws -> OSDelta {
+        let data = try NSKeyedArchiver.archivedData(withRootObject: delta, requiringSecureCoding: false)
+        let unarchiver = try NSKeyedUnarchiver(forReadingFrom: data)
+        unarchiver.requiresSecureCoding = false
+        defer { unarchiver.finishDecoding() }
+        return try XCTUnwrap(unarchiver.decodeObject(forKey: NSKeyedArchiveRootObjectKey) as? OSDelta)
+    }
+
+    func testExternalIdSurvivesAnArchiveRoundTrip() throws {
+        let delta = makeDelta(externalId: "user-a")
+
+        let decoded = try archiveThenUnarchive(delta)
+
+        XCTAssertEqual(decoded.externalId, "user-a")
+        XCTAssertEqual(decoded.identityModelId, "identity-model-a")
+        XCTAssertEqual(decoded.deltaId, delta.deltaId)
+    }
+
+    /// Decode must succeed when externalId is absent, or queued work is dropped on upgrade.
+    func testADeltaWithoutAnExternalIdStillDecodes() throws {
+        let delta = makeDelta(externalId: nil)
+
+        let decoded = try archiveThenUnarchive(delta)
+
+        XCTAssertNil(decoded.externalId)
+        XCTAssertEqual(decoded.identityModelId, "identity-model-a")
+        XCTAssertEqual(decoded.property, "language")
+        XCTAssertEqual(decoded.value as? String, "en")
+    }
+}

iOS_SDK/OneSignalSDK/OneSignalOSCoreTests/OSOperationRepoFlushTests.swift

@@ -133,6 +133,7 @@ final class OSOperationRepoFlushTests: XCTestCase {
         OSDelta(
             name: name,
             identityModelId: UUID().uuidString,
+            externalId: nil,
             model: OSModel(changeNotifier: OSEventProducer()),
             property: property,
             value: property

iOS_SDK/OneSignalSDK/OneSignalUser/Source/OSIdentityModelStoreListener.swift

@@ -31,9 +31,11 @@ import OneSignalOSCore
 
 class OSIdentityModelStoreListener: OSModelStoreListener {
     var store: OSModelStore<OSIdentityModel>
+    let operationRepo: OSOperationRepo
 
-    required init(store: OSModelStore<OSIdentityModel>) {
+    required init(store: OSModelStore<OSIdentityModel>, operationRepo: OSOperationRepo) {
         self.store = store
+        self.operationRepo = operationRepo
     }
 
     func getAddModelDelta(_ model: OSIdentityModel) -> OSDelta? {
@@ -50,6 +52,7 @@ class OSIdentityModelStoreListener: OSModelStoreListener {
     func getUpdateModelDelta(_ args: OSModelChangedArgs) -> OSDelta? {
         // TODO: Let users call addAliases with "" IDs? If so, this will change...
         guard
+            let identityModel = args.model as? OSIdentityModel,
             let aliasesDict = args.newValue as? [String: String],
             let (_, id) = aliasesDict.first
         else {
@@ -60,8 +63,9 @@ class OSIdentityModelStoreListener: OSModelStoreListener {
 
         return OSDelta(
             name: name,
-            identityModelId: args.model.modelId,
-            model: args.model,
+            identityModelId: identityModel.modelId,
+            externalId: identityModel.externalId,
+            model: identityModel,
             property: args.property,
             value: args.newValue
         )

iOS_SDK/OneSignalSDK/OneSignalUser/Source/OSPropertiesModelStoreListener.swift

@@ -31,9 +31,11 @@ import OneSignalOSCore
 
 class OSPropertiesModelStoreListener: OSModelStoreListener {
     var store: OSModelStore<OSPropertiesModel>
+    let operationRepo: OSOperationRepo
 
-    required init(store: OSModelStore<OSPropertiesModel>) {
+    required init(store: OSModelStore<OSPropertiesModel>, operationRepo: OSOperationRepo) {
         self.store = store
+        self.operationRepo = operationRepo
     }
 
     func getAddModelDelta(_ model: OSPropertiesModel) -> OSDelta? {
@@ -45,15 +47,19 @@ class OSPropertiesModelStoreListener: OSModelStoreListener {
     }
 
     func getUpdateModelDelta(_ args: OSModelChangedArgs) -> OSDelta? {
+        // Drop if this isn't the current user's properties model, the user has switched since
         guard let _ = OSPropertiesSupportedProperty(rawValue: args.property),
-              let userInstance = OneSignalUserManagerImpl.sharedInstance._user
+              let userInstance = OneSignalUserManagerImpl.sharedInstance._user,
+              userInstance.propertiesModel.modelId == args.model.modelId
         else {
-            OneSignalLog.onesignalLog(.LL_ERROR, message: "OSPropertiesModelStoreListener.getUpdateModelDelta encountered unsupported property: \(args.property) or no user instance")
+            OneSignalLog.onesignalLog(.LL_ERROR, message: "OSPropertiesModelStoreListener.getUpdateModelDelta encountered unsupported property: \(args.property), no user instance, or a properties model that is not the current user's")
             return nil
         }
+        let identityModel = userInstance.identityModel
         return OSDelta(
             name: OS_UPDATE_PROPERTIES_DELTA,
-            identityModelId: userInstance.identityModel.modelId,
+            identityModelId: identityModel.modelId,
+            externalId: identityModel.externalId,
             model: args.model,
             property: args.property,
             value: args.newValue

iOS_SDK/OneSignalSDK/OneSignalUser/Source/OSSubscriptionModelStoreListener.swift

@@ -31,19 +31,26 @@ import OneSignalOSCore
 
 class OSSubscriptionModelStoreListener: OSModelStoreListener {
     var store: OSModelStore<OSSubscriptionModel>
+    let operationRepo: OSOperationRepo
 
-    required init(store: OSModelStore<OSSubscriptionModel>) {
+    required init(store: OSModelStore<OSSubscriptionModel>, operationRepo: OSOperationRepo) {
         self.store = store
+        self.operationRepo = operationRepo
     }
 
     func getAddModelDelta(_ model: OSSubscriptionModel) -> OSDelta? {
-        guard let userInstance = OneSignalUserManagerImpl.sharedInstance._user else {
-            OneSignalLog.onesignalLog(.LL_ERROR, message: "OSSubscriptionModelStoreListener.getAddModelDelta has no user instance")
+        // Stale - drop if the model is no longer in this store, the user has switched since
+        guard let userInstance = OneSignalUserManagerImpl.sharedInstance._user,
+              store.getModel(modelId: model.modelId) != nil
+        else {
+            OneSignalLog.onesignalLog(.LL_ERROR, message: "OSSubscriptionModelStoreListener.getAddModelDelta has no user instance or the model is not in the current store")
             return nil
         }
+        let identityModel = userInstance.identityModel
         return OSDelta(
             name: OS_ADD_SUBSCRIPTION_DELTA,
-            identityModelId: userInstance.identityModel.modelId,
+            identityModelId: identityModel.modelId,
+            externalId: identityModel.externalId,
             model: model,
             property: model.type.rawValue, // push, email, sms
             value: model.address ?? ""
@@ -52,15 +59,18 @@ class OSSubscriptionModelStoreListener: OSModelStoreListener {
 
     /**
      The `property` and `value` is not needed for a remove operation, so just pass in some model data as placeholders.
+     Stamps the current user: `onRemoved` runs after the model has left the store, so membership can't be checked.
      */
     func getRemoveModelDelta(_ model: OSSubscriptionModel) -> OSDelta? {
         guard let userInstance = OneSignalUserManagerImpl.sharedInstance._user else {
             OneSignalLog.onesignalLog(.LL_ERROR, message: "OSSubscriptionModelStoreListener.getRemoveModelDelta has no user instance")
             return nil
         }
+        let identityModel = userInstance.identityModel
         return OSDelta(
             name: OS_REMOVE_SUBSCRIPTION_DELTA,
-            identityModelId: userInstance.identityModel.modelId,
+            identityModelId: identityModel.modelId,
+            externalId: identityModel.externalId,
             model: model,
             property: model.type.rawValue, // push, email, sms
             value: model.address ?? ""
@@ -78,14 +88,16 @@ class OSSubscriptionModelStoreListener: OSModelStoreListener {
             OneSignalLog.onesignalLog(.LL_ERROR, message: "OSSubscriptionModelStoreListener.getUpdateModelDelta has no user instance")
             return nil
         }
-        if let onesignalId = userInstance.identityModel.onesignalId {
+        let identityModel = userInstance.identityModel
+        if let onesignalId = identityModel.onesignalId {
             let condition = OSIamFetchReadyCondition.sharedInstance(withId: onesignalId)
             condition.setSubscriptionUpdatePending(value: true)
         }
 
         return OSDelta(
             name: OS_UPDATE_SUBSCRIPTION_DELTA,
-            identityModelId: userInstance.identityModel.modelId,
+            identityModelId: identityModel.modelId,
+            externalId: identityModel.externalId,
             model: args.model,
             property: args.property,
             value: args.newValue