fix(iv): restore logout unsubscribe-on-OLD-user behavior

Revert the order swap from dc93995 — that commit reordered switchUserIv
to switch users first and then set isDisabledInternally on the new push
sub with NO_PROPOGATE, on the bot review's claim that firing an
UpdateSubscriptionOperation against the OLD user was a bug. It is not a
bug — it is the intentional behavior in reference branches #2599 and
#2613: setting the flag on the CURRENT push sub with the default NORMAL
tag fires an UpdateSubscriptionOperation that tells the backend "this
device is unsubscribing as the user logs out", dispatched with the OLD
user's still-valid JWT before the switch. Without this, logout under IV
silently leaves the just-departed user's push sub subscribed
server-side.

The new (anonymous) user's model not carrying isDisabledInternally is
fine: anon ops are filtered by hasValidJwtIfRequired (externalId=null
under IV-active), so they accumulate but never dispatch.

Update the test to verify the corrected order.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: nan-li

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/LogoutHelperIvExtensions.kt

@@ -1,8 +1,6 @@
 package com.onesignal.user.internal
 
-import com.onesignal.common.modeling.ModelChangeTags
 import com.onesignal.core.internal.config.ConfigModel
-import com.onesignal.user.internal.subscriptions.SubscriptionModel
 import com.onesignal.user.internal.subscriptions.SubscriptionModelStore
 
 /**
@@ -15,21 +13,17 @@ import com.onesignal.user.internal.subscriptions.SubscriptionModelStore
 /**
  * Performs the IV-aware logout user-switch when [ivBehaviorActive] is true.
  *
- * Under IV-required, the new device-scoped (anonymous) user can't authenticate against
- * the backend without a JWT. To prevent the model-store listener from generating create-
- * subscription ops that would 401/permanently-block the queue:
- * 1. Switch to the anonymous user with [UserSwitcher.createAndSwitchToNewUser] in
- *    `suppressBackendOperation` mode so subscription replacement does not propagate to
- *    listeners that would enqueue backend ops.
- * 2. Mark the new push subscription as internally disabled with [ModelChangeTags.NO_PROPOGATE]
- *    so subsequent property mutations (FCM token refresh, permission change, etc.)
- *    short-circuit through [com.onesignal.user.internal.operations.impl.listeners.SubscriptionModelStoreListener.getSubscriptionEnabledAndStatus]
- *    instead of enqueueing real ops.
- *
- * Order matters: setting the flag on the OLD model first (with default NORMAL tag) would
- * fire `getUpdateOperation` against the OLD user with their still-valid JWT — the listener
- * would build an `UpdateSubscriptionOperation(externalId = OLD)` carrying `(false, UNSUBSCRIBE)`,
- * dispatch it, and unsubscribe the just-departed user server-side.
+ * Order matters and is intentional (mirrors reference branches #2599 and #2613):
+ * 1. Set `isDisabledInternally = true` on the CURRENT push subscription with the default
+ *    NORMAL tag. This propagates through [com.onesignal.user.internal.operations.impl.listeners.SubscriptionModelStoreListener.getUpdateOperation],
+ *    which reads the still-current OLD identity and enqueues an `UpdateSubscriptionOperation`
+ *    carrying `(enabled = false, status = UNSUBSCRIBE)` — letting the backend know this device's
+ *    push subscription is unsubscribing as the user logs out. The OLD user's JWT is still valid
+ *    here, so the op dispatches successfully.
+ * 2. Switch to the new device-scoped (anonymous) user via
+ *    [UserSwitcher.createAndSwitchToNewUser] with `suppressBackendOperation = true` so the
+ *    subscription replacement does NOT propagate to listeners — the new anonymous user has no
+ *    JWT and any create-subscription op for it would 401 indefinitely.
  *
  * Returns `true` when IV-specific handling was applied (caller skips legacy enqueue),
  * or `false` when IV behavior is inactive (caller falls through to the legacy logout).
@@ -42,13 +36,9 @@ internal fun switchUserIv(
 ): Boolean {
     if (!ivBehaviorActive) return false
 
-    userSwitcher.createAndSwitchToNewUser(suppressBackendOperation = true)
     configModel.pushSubscriptionId?.let { pushSubId ->
-        subscriptionModelStore.get(pushSubId)?.setBooleanProperty(
-            SubscriptionModel::isDisabledInternally.name,
-            true,
-            ModelChangeTags.NO_PROPOGATE,
-        )
+        subscriptionModelStore.get(pushSubId)?.let { it.isDisabledInternally = true }
     }
+    userSwitcher.createAndSwitchToNewUser(suppressBackendOperation = true)
     return true
 }

OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/LogoutHelperTests.kt

@@ -196,16 +196,16 @@ class LogoutHelperTests : FunSpec({
         verify(atLeast = 1) { mockOperationRepo.enqueue(any()) }
     }
 
-    test("switchUserIv switches user before marking new push sub as internally disabled") {
+    test("switchUserIv marks current push sub as internally disabled before switching users") {
         // Given - IV active, push sub model in store
         val pushSubId = "push-sub-id"
-        val newPushSubModel =
+        val pushSubModel =
             SubscriptionModel().apply {
                 id = pushSubId
                 type = SubscriptionType.PUSH
             }
         val mockSubscriptionModelStore = mockk<SubscriptionModelStore>(relaxed = true)
-        every { mockSubscriptionModelStore.get(pushSubId) } returns newPushSubModel
+        every { mockSubscriptionModelStore.get(pushSubId) } returns pushSubModel
         val mockUserSwitcher = mockk<UserSwitcher>(relaxed = true)
         val mockConfigModel = mockk<ConfigModel>()
         every { mockConfigModel.pushSubscriptionId } returns pushSubId
@@ -216,16 +216,17 @@ class LogoutHelperTests : FunSpec({
         // Then
         handled shouldBe true
 
-        // Order: user-switch must happen BEFORE the flag is set on the new push sub.
-        // Setting the flag on the OLD model first would fire an UpdateSubscriptionOperation
-        // against the OLD user with their valid JWT and unsubscribe them server-side.
+        // Order: flag must be set on the OLD push sub BEFORE the user-switch — setting it
+        // with the default NORMAL tag fires an UpdateSubscriptionOperation against the OLD
+        // user with their still-valid JWT, telling the backend that this device's push
+        // subscription is unsubscribing as the user logs out.
         verifyOrder {
-            mockUserSwitcher.createAndSwitchToNewUser(suppressBackendOperation = true)
             mockSubscriptionModelStore.get(pushSubId)
+            mockUserSwitcher.createAndSwitchToNewUser(suppressBackendOperation = true)
         }
 
         // The flag is set on the model (verified via the underlying property).
-        newPushSubModel.isDisabledInternally shouldBe true
+        pushSubModel.isDisabledInternally shouldBe true
     }
 
     test("switchUserIv returns false when IV behavior is inactive") {