feat(iv): logout IV behavior + RYW plumbing for IAM consistency

Logout under IV-required (Step A):
- Add SubscriptionModel.isDisabledInternally — internal-only flag that
  tells SubscriptionModelStoreListener to suppress backend ops for the
  marked subscription.
- LogoutHelperIvExtensions.switchUserIv: when ivBehaviorActive, mark
  the current push sub as internally disabled and switchUser with
  suppressBackendOperation=true. The new device-scoped (anonymous) user
  can't authenticate without a JWT, so we must NOT enqueue an anonymous
  LoginUserOperation that would block the queue.
- LogoutHelper.switchUser: outer gate (newCodePathsRun) dispatches to
  the extension; legacy logout flow runs untouched for Phase 1/3.

RYW plumbing (Step B):
- CreateUserResponse.rywData (nullable) — backend sends ryw_token under
  IV so InAppMessagesManager can await user-record propagation before
  the IAM fetch.
- JSONConverter.convertToCreateUserResponse parses ryw_token / ryw_delay.
- LoginUserOperationExecutor.createUser sets RYW data in
  ConsistencyManager (gated on newCodePathsRun) so the IamFetchRywToken
  condition resolves and unblocks the IAM fetch.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: nan-li

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/internal/OneSignalImp.kt

@@ -17,6 +17,7 @@ import com.onesignal.core.internal.application.IApplicationService
 import com.onesignal.core.internal.application.impl.ApplicationService
 import com.onesignal.core.internal.config.ConfigModel
 import com.onesignal.core.internal.config.ConfigModelStore
+import com.onesignal.core.internal.config.impl.IdentityVerificationService
 import com.onesignal.core.internal.features.FeatureFlag
 import com.onesignal.core.internal.features.IFeatureManager
 import com.onesignal.core.internal.operations.IOperationRepo
@@ -235,6 +236,8 @@ internal class OneSignalImp(
             userSwitcher = userSwitcher,
             operationRepo = operationRepo,
             configModel = configModel,
+            subscriptionModelStore = subscriptionModelStore,
+            identityVerificationService = services.getService<IdentityVerificationService>(),
             lock = loginLogoutLock,
         )
     }

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/LogoutHelper.kt

@@ -1,15 +1,19 @@
 package com.onesignal.user.internal
 
 import com.onesignal.core.internal.config.ConfigModel
+import com.onesignal.core.internal.config.impl.IdentityVerificationService
 import com.onesignal.core.internal.operations.IOperationRepo
 import com.onesignal.user.internal.identity.IdentityModelStore
 import com.onesignal.user.internal.operations.LoginUserOperation
+import com.onesignal.user.internal.subscriptions.SubscriptionModelStore
 
-class LogoutHelper(
+internal class LogoutHelper(
     private val identityModelStore: IdentityModelStore,
     private val userSwitcher: UserSwitcher,
     private val operationRepo: IOperationRepo,
     private val configModel: ConfigModel,
+    private val subscriptionModelStore: SubscriptionModelStore,
+    private val identityVerificationService: IdentityVerificationService,
     private val lock: Any,
 ) {
     internal data class LogoutEnqueueContext(
@@ -29,11 +33,26 @@ class LogoutHelper(
                 return null
             }
 
+            // Outer gate: dispatch to IV extension only on new code paths. The extension's
+            // inner gate (ivBehaviorActive) keeps Phase 3 users on the legacy logout flow.
+            val handled =
+                identityVerificationService.newCodePathsRun &&
+                    switchUserIv(
+                        userSwitcher,
+                        subscriptionModelStore,
+                        configModel,
+                        identityVerificationService.ivBehaviorActive,
+                    )
+            if (handled) {
+                // IV-required: subscription is internally disabled and the user-switch
+                // suppressed backend op enqueue. Don't enqueue anonymous LoginUserOperation —
+                // the anonymous user cannot authenticate without a JWT.
+                return null
+            }
+
             // Create new device-scoped user (clears external ID)
             userSwitcher.createAndSwitchToNewUser()
 
-            // TODO: remove JWT Token for all future requests.
-
             return LogoutEnqueueContext(configModel.appId, identityModelStore.model.onesignalId)
         }
     }

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/LogoutHelperIvExtensions.kt

@@ -0,0 +1,40 @@
+package com.onesignal.user.internal
+
+import com.onesignal.core.internal.config.ConfigModel
+import com.onesignal.user.internal.subscriptions.SubscriptionModelStore
+
+/**
+ * IV-specific behavior for [LogoutHelper]. The base-class call site dispatches via
+ * `if (newCodePathsRun) switchUserIv(...) else legacyLogout()`; this extension
+ * internally short-circuits on `ivBehaviorActive` to keep Phase 3 users (new code path on,
+ * IV behavior off) on the legacy logout flow.
+ */
+
+/**
+ * Performs the IV-aware logout user-switch when [ivBehaviorActive] is true.
+ *
+ * Under IV-required, the new device-scoped (anonymous) user can't authenticate against
+ * the backend without a JWT. To prevent the model-store listener from generating create-
+ * subscription ops that would 401/permanently-block the queue:
+ * 1. Mark the current push subscription as internally disabled.
+ * 2. Switch users with [UserSwitcher.createAndSwitchToNewUser] in `suppressBackendOperation`
+ *    mode so subscription replacement does NOT propagate to listeners that would enqueue
+ *    backend ops.
+ *
+ * Returns `true` when IV-specific handling was applied (caller skips legacy enqueue),
+ * or `false` when IV behavior is inactive (caller falls through to the legacy logout).
+ */
+internal fun switchUserIv(
+    userSwitcher: UserSwitcher,
+    subscriptionModelStore: SubscriptionModelStore,
+    configModel: ConfigModel,
+    ivBehaviorActive: Boolean,
+): Boolean {
+    if (!ivBehaviorActive) return false
+
+    configModel.pushSubscriptionId?.let { pushSubId ->
+        subscriptionModelStore.get(pushSubId)?.let { it.isDisabledInternally = true }
+    }
+    userSwitcher.createAndSwitchToNewUser(suppressBackendOperation = true)
+    return true
+}

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/IUserBackendService.kt

@@ -84,4 +84,11 @@ class CreateUserResponse(
      * The subscriptions for the user.
      */
     val subscriptions: List<SubscriptionObject>,
+    /**
+     * Read-your-write data for IAM fetch consistency, when the backend supplies it.
+     * Populated under Identity Verification so [com.onesignal.inAppMessages] can await
+     * the user record's propagation before fetching IAMs. `null` for non-IV apps and
+     * older backends that don't include `ryw_token` in the response.
+     */
+    val rywData: com.onesignal.common.consistency.RywData? = null,
 )

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/backend/impl/JSONConverter.kt

@@ -1,5 +1,6 @@
 package com.onesignal.user.internal.backend.impl
 
+import com.onesignal.common.consistency.RywData
 import com.onesignal.common.expandJSONArray
 import com.onesignal.common.putJSONArray
 import com.onesignal.common.putMap
@@ -8,6 +9,7 @@ import com.onesignal.common.safeBool
 import com.onesignal.common.safeDouble
 import com.onesignal.common.safeInt
 import com.onesignal.common.safeJSONObject
+import com.onesignal.common.safeLong
 import com.onesignal.common.safeString
 import com.onesignal.common.toMap
 import com.onesignal.user.internal.backend.CreateUserResponse
@@ -55,7 +57,12 @@ object JSONConverter {
                 return@expandJSONArray null
             }
 
-        return CreateUserResponse(respIdentities, respProperties, respSubscriptions)
+        // Backend may include `ryw_token` (and optional `ryw_delay`) under Identity Verification
+        // so InAppMessagesManager can gate IAM fetch on read-your-write consistency.
+        val rywToken = jsonObject.safeString("ryw_token")
+        val rywData = rywToken?.let { RywData(it, jsonObject.safeLong("ryw_delay")) }
+
+        return CreateUserResponse(respIdentities, respProperties, respSubscriptions, rywData)
     }
 
     fun convertToJSON(properties: PropertiesObject): JSONObject {

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/LoginUserOperationExecutor.kt

@@ -2,6 +2,8 @@ package com.onesignal.user.internal.operations.impl.executors
 
 import android.os.Build
 import com.onesignal.common.AndroidUtils
+import com.onesignal.common.consistency.enums.IamFetchRywTokenKey
+import com.onesignal.common.consistency.models.IConsistencyManager
 import com.onesignal.common.DeviceUtils
 import com.onesignal.common.IDManager
 import com.onesignal.common.NetworkUtils
@@ -51,6 +53,7 @@ internal class LoginUserOperationExecutor(
     private val _languageContext: ILanguageContext,
     private val _jwtTokenStore: JwtTokenStore,
     private val _identityVerificationService: IdentityVerificationService,
+    private val _consistencyManager: IConsistencyManager,
 ) : IOperationExecutor {
     override val operations: List<String>
         get() = listOf(LOGIN_USER)
@@ -235,6 +238,16 @@ internal class LoginUserOperationExecutor(
                 backendSubscriptions.remove(backendSubscription)
             }
 
+            // Forward the create-user RYW data to ConsistencyManager so InAppMessagesManager
+            // can fetch IAMs once the user record has propagated. Gated on newCodePathsRun:
+            // Phase 1 users don't await RYW (legacy IAM fetch path), so storing it would be
+            // a no-op anyway. Backend only sends rywData under IV.
+            if (_identityVerificationService.newCodePathsRun) {
+                response.rywData?.let { rywData ->
+                    _consistencyManager.setRywData(backendOneSignalId, IamFetchRywTokenKey.USER, rywData)
+                }
+            }
+
             val wasPossiblyAnUpsert = identities.isNotEmpty()
             val followUpOperations =
                 if (wasPossiblyAnUpsert) {

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/listeners/SubscriptionModelStoreListener.kt

@@ -63,6 +63,13 @@ internal class SubscriptionModelStoreListener(
 
     companion object {
         fun getSubscriptionEnabledAndStatus(model: SubscriptionModel): Pair<Boolean, SubscriptionStatus> {
+            // Internal-disabled subscription (e.g. the post-logout anonymous user under IV)
+            // must not generate backend ops; report as disabled+unsubscribe regardless of
+            // optedIn/status. See [SubscriptionModel.isDisabledInternally].
+            if (model.isDisabledInternally) {
+                return Pair(false, SubscriptionStatus.UNSUBSCRIBE)
+            }
+
             val status: SubscriptionStatus
             val enabled: Boolean
 

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/subscriptions/SubscriptionModel.kt

@@ -92,6 +92,23 @@ class SubscriptionModel : Model() {
             setBooleanProperty(::optedIn.name, value)
         }
 
+    /**
+     * Internal-only flag (not surfaced via the public API) used to suppress backend
+     * subscription operations for this model. Set to `true` on logout under Identity
+     * Verification: the new device-scoped (anonymous) user can't authenticate without
+     * a JWT, so the SDK must not generate create-subscription ops for it. The
+     * [SubscriptionModelStoreListener] honors this flag by short-circuiting to
+     * `(enabled = false, status = UNSUBSCRIBE)` regardless of [optedIn] / [status].
+     *
+     * Defaults to `false`. On the next login, [com.onesignal.user.internal.UserSwitcher]
+     * creates a fresh model that does not carry this flag, restoring the real state.
+     */
+    var isDisabledInternally: Boolean
+        get() = getBooleanProperty(::isDisabledInternally.name) { false }
+        set(value) {
+            setBooleanProperty(::isDisabledInternally.name, value)
+        }
+
     var type: SubscriptionType
         get() = getEnumProperty(::type.name)
         set(value) {