feat: [JWT-6] Identity Verification for the request pipeline

[nan-li]

Description

One Line Summary

Gate user-scoped request addressing and signing on Identity Verification — path alias + JWT from one user, hold the queue while the requirement is unknown, and drop anonymous work when IV is on — with Update Subscription intentionally exempt.

Details

Motivation

Everything that sends a user-scoped call needs one place to decide how to address and sign it. Under Identity Verification a user is named by external_id (app-chosen, so path segments are percent-encoded), and the alias and token must never come from different users. Sending unsigned while the requirement is still unknown would be rejected; sending signed too early is not possible — so queued work must wait, then flush when the answer arrives.

Scope

• OSRequestAuth / OSAliasPair — for a given user, which alias names them in the path and which token signs it, read together
• OSUrlPath — percent-encode Identity Verification path segments
• Requests carry the identity model that owns them rather than reading whoever is current at send time
• OSOperationRepo — hold while JWT requirement is unknown; flush when hydrated; drop work with no external ID when IV is on (anonymous users are never created on the server)
• Executors + user/subscription/custom-events request builders wired through that auth path
• Update Subscription deliberately exempt: a push subscription belongs to the device, not the signed-in user
• Logout while IV is on internally disables the push subscription (replacement anonymous user is never created); login / requirement hydrating to off clears that
• Test-only: MockNewRecordsState.holdWhilePresent so purge tests stay deterministic under zero OP_REPO_POST_CREATE_DELAY_SECONDS
• Unit / executor / lifecycle coverage for auth, path encoding, queue hold/flush, anonymous purge

Stacked on #1710 (nan/jwt-pr5-delta-ownership).

Testing

Unit testing

• OSRequestAuthTests, RequestPathEncodingTests
• OSOperationRepoIdentityVerificationTests, expanded flush tests / shared support
• ExecutorAnonymousPurgeTests, expanded UserExecutorTests / DeltaOwnershipTests
• UserJwtLifecycleTests
• Existing custom-events / concurrency / race / switch-user tests updated for auth ownership

Manual testing

Built in sequence as part of the local JWT stack against an iOS Simulator; this PR’s commits compiled on top of PR5.

Affected code checklist

• Notifications
  • Display
  • Open
  • Push Processing
  • Confirm Deliveries
• Outcomes
• Sessions
• In-App Messaging
• REST API requests
• Public API changes

Checklist

Overview

• I have filled out all REQUIRED sections above
• PR does one thing
• Any Public API changes are explained in the PR details and conform to existing APIs

Testing

• I have included test coverage for these changes, or explained why they are not needed
• All automated tests pass, or I explained why that is not possible
• I have personally tested this on my device, or explained why that is not possible

Final pass

• Code is as readable as possible.
• I have reviewed this PR myself, ensuring it meets each checklist item

Made with Cursor

[cursor]

Multi-model adversarial review (interrogate)

Intent

Gate user-scoped request addressing and signing on Identity Verification. For a given user, OSRequestAuth / OSAliasPair choose the path alias and JWT bearer together so they never come from different users; percent-encode IV path segments via OSUrlPath; requests carry their owning identity model; OSOperationRepo holds while the requirement is unknown, flushes on hydrate, and drops anonymous work when IV is on; Update Subscription is exempt; logout under IV disables push; test-only holdWhilePresent for purge determinism.

Reviewers

• A: claude-fable-5-thinking-xhigh — 9 findings
• B: gpt-5.6-sol-xhigh — 6 findings
• C: cursor-grok-4.5-high-fast — 6 findings
• D: claude-opus-5-thinking-high — 15 findings

Act On

1. Cold-start Identify User is dropped under IV instead of reshaped to Create User (C; related A) — uncacheUserRequests branch 3 treats prepare == false as permanent discard, but Identify's prepare intentionally fails under IV so reshape can promote it. When identityModelToUpdate is still the current user, the login is stranded with no onesignal_id / no Create User. The existing test locks in drop-without-Create and misses the “ToUpdate still current” path.
2. addsNewRecords decodes false for pre-upgrade Create User caches (A, C, D) — decodeBool on a missing key skips newRecordsState, weakening RYW and risking the 404 → logout path the cool-down exists to prevent.
3. Bearer JWTs land in VERBOSE request logs (B) — setBearer writes Authorization into additionalHeaders; OneSignalClient logs those headers in full.
4. awaitsToken false-positive stalls non-auth prepare failures (A) — cool-down / other prepare failures are treated as “waiting for JWT,” so the wait-only pass schedules no delayed retry and never asks for a token.
5. OneSignalUserManagerImpl.swift crosses 1k lines (987 → 1065) (A, B, C, D) — IV logout silencing, hydrate restore, and storeJwt wake belong in OneSignalUserManagerImpl+Jwt.swift (or a focused helper).

Consider

• ownerExternalId != nil || prepare on uncache is not gated on IV, so IV-off apps can retain forever-unsendable owned requests (D).
• Update Subscription now archives a full OSIdentityModel (including bearer) and can revive it into the token pool (D).
• Cached-requirement hydrate clears _isDisabledInternally before subscription listeners start, so IV-off restore can skip the server update (B).
• authorization(onesignalId:externalId:) / OSUserRequestAuthorization are unused in production; the doc claims IAM already consumes them (A, B, D) — demote or land with the caller; IAM wiring itself can stay stacked.
• Transient clearUserData anonymity can drop in-flight identified work under IV (A).
• Legacy FetchIdentityBySubscription migration is hard-dropped under IV (A, C).
• Unbounded 401 ↔ ask-for-token if the app keeps returning the same rejected JWT (D).

Noted

• Anonymous purge duplicated across executors; purge-on-every-flush overhead; OSUrlPath doc mentions Live Activities it does not encode; unlabeled OSAliasPair init.

Dismissed

• Must wire IAM fetches in this PR (B critical) — out of scope for the queued user-request pipeline; the unused public API / false “currently IAM” claim is still Act/Consider above.
• Logout silencing while requirement is .unknown (D) — intentional and covered by UserJwtLifecycleTests.
• Trusting a persisted non-unknown requirement across sessions (B) — established JWT-config cache contract from earlier stack PRs; not introduced uniquely here.

Agreement Map

Strong consensus on the 1k-line crossing and addsNewRecords upgrade decode. High-confidence solo/pair hits after lead verification: Identify cold-start drop (C), JWT logging (B), awaitsToken stall (A). Largest disagreement: B treated missing IAM wiring as a ship-blocker; lead scopes that to a later consumer PR while still rejecting the dead public surface claim.

  

_{Sent by Cursor Automation: Untitled}