fix(iv): expose new public methods on OneSignal facade + log hygiene

Three review-driven fixes on the IV public-API surface:

1. OneSignal.kt: add @JvmStatic wrappers for updateUserJwt,
   addUserJwtInvalidatedListener, removeUserJwtInvalidatedListener, and
   updateUserJwtSuspend. Without these, the four new IOneSignal methods
   were unreachable from app code (the OneSignal object is the documented
   Java/Kotlin entry point and "implements IOneSignal in spirit"). Mirrors
   the convention from reference branch #2599.

2. OneSignalImp.kt: mask jwtBearerToken in login()/loginSuspend() DEBUG
   logs (...${jwtBearerToken?.takeLast(8)}). Pre-PR the parameter was a
   no-op (LoginHelper had a TODO) so the leak was theoretical; this PR
   wires the token through to JwtTokenStore.putJwt, so a live bearer
   credential now flows through Logging.log at DEBUG. updateUserJwt
   already masks; mirror that.

3. UserManager.kt: restore Logging.warn(msg, ex) form on the two new
   runCatching.onFailure handlers in fireJwtInvalidated and
   addJwtInvalidatedListener. Interpolating ${ex.message} drops the
   stack trace; Logging.warn already accepts a Throwable second arg
   that propagates through to log listeners and Otel — same pattern
   restored in JwtTokenStore via e76fb60.

Also refreshes detekt baseline for the new MagicNumber (takeLast(8)),
ConstructorParameterNaming (_jwtTokenStore on UserManager), TooManyFunctions
(UserManager now also implements IJwtUpdateListener), and UseCheckOrError
on the 4 new IllegalStateException throws.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: nan-li

OneSignalSDK/detekt/detekt-baseline-core.xml

@@ -155,6 +155,7 @@
     <ID>ConstructorParameterNaming:UserBackendService.kt$UserBackendService$private val _httpClient: IHttpClient</ID>
     <ID>ConstructorParameterNaming:UserManager.kt$UserManager$private val _customEventController: ICustomEventController</ID>
     <ID>ConstructorParameterNaming:UserManager.kt$UserManager$private val _identityModelStore: IdentityModelStore</ID>
+    <ID>ConstructorParameterNaming:UserManager.kt$UserManager$private val _jwtTokenStore: JwtTokenStore</ID>
     <ID>ConstructorParameterNaming:UserManager.kt$UserManager$private val _languageContext: ILanguageContext</ID>
     <ID>ConstructorParameterNaming:UserManager.kt$UserManager$private val _propertiesModelStore: PropertiesModelStore</ID>
     <ID>ConstructorParameterNaming:UserManager.kt$UserManager$private val _subscriptionManager: ISubscriptionManager</ID>
@@ -173,7 +174,6 @@
     <ID>ForbiddenComment:HttpClient.kt$HttpClient$// TODO: SHOULD RETURN OK INSTEAD OF NOT_MODIFIED TO MAKE TRANSPARENT?</ID>
     <ID>ForbiddenComment:IPreferencesService.kt$PreferenceOneSignalKeys$* (String) The serialized IAMs TODO: This isn't currently used, determine if actually needed for cold start IAM fetch delay</ID>
     <ID>ForbiddenComment:IUserBackendService.kt$IUserBackendService$// TODO: Change to send only the push subscription, optimally</ID>
-    <ID>ForbiddenComment:LoginHelper.kt$LoginHelper$// TODO: Set JWT Token for all future requests.</ID>
     <ID>ForbiddenComment:LogoutHelper.kt$LogoutHelper$// TODO: remove JWT Token for all future requests.</ID>
     <ID>ForbiddenComment:ParamsBackendService.kt$ParamsBackendService$// TODO: New</ID>
     <ID>ForbiddenComment:PermissionsActivity.kt$PermissionsActivity$// TODO after we remove IAM from being an activity window we may be able to remove this handler</ID>
@@ -248,6 +248,7 @@
     <ID>MagicNumber:OSDatabase.kt$OSDatabase$8</ID>
     <ID>MagicNumber:OSDatabase.kt$OSDatabase$9</ID>
     <ID>MagicNumber:OneSignalDispatchers.kt$OneSignalDispatchers$1024</ID>
+    <ID>MagicNumber:OneSignalImp.kt$OneSignalImp$8</ID>
     <ID>MagicNumber:OperationRepo.kt$OperationRepo$1_000</ID>
     <ID>MagicNumber:OutcomeEventsController.kt$OutcomeEventsController$1000</ID>
     <ID>MagicNumber:PermissionsActivity.kt$PermissionsActivity$23</ID>
@@ -412,7 +413,7 @@
     <ID>TooManyFunctions:OutcomeEventsController.kt$OutcomeEventsController : IOutcomeEventsControllerIStartableServiceISessionLifecycleHandler</ID>
     <ID>TooManyFunctions:PreferencesService.kt$PreferencesService : IPreferencesServiceIStartableService</ID>
     <ID>TooManyFunctions:SubscriptionManager.kt$SubscriptionManager : ISubscriptionManagerIModelStoreChangeHandlerISessionLifecycleHandler</ID>
-    <ID>TooManyFunctions:UserManager.kt$UserManager : IUserManagerISingletonModelStoreChangeHandler</ID>
+    <ID>TooManyFunctions:UserManager.kt$UserManager : IUserManagerISingletonModelStoreChangeHandlerIJwtUpdateListener</ID>
     <ID>UndocumentedPublicClass:AlertDialogPrepromptForAndroidSettings.kt$AlertDialogPrepromptForAndroidSettings$Callback</ID>
     <ID>UndocumentedPublicClass:AndroidUtils.kt$AndroidUtils</ID>
     <ID>UndocumentedPublicClass:AndroidUtils.kt$AndroidUtils$SchemaType</ID>
@@ -457,7 +458,6 @@
     <ID>UndocumentedPublicClass:JSONConverter.kt$JSONConverter</ID>
     <ID>UndocumentedPublicClass:JSONUtils.kt$JSONUtils</ID>
     <ID>UndocumentedPublicClass:Logging.kt$Logging</ID>
-    <ID>UndocumentedPublicClass:LoginHelper.kt$LoginHelper</ID>
     <ID>UndocumentedPublicClass:LogoutHelper.kt$LogoutHelper</ID>
     <ID>UndocumentedPublicClass:MigrationRecovery.kt$MigrationRecovery : IMigrationRecovery</ID>
     <ID>UndocumentedPublicClass:NetworkUtils.kt$NetworkUtils</ID>
@@ -626,13 +626,16 @@
     <ID>UnusedPrivateMember:AndroidUtils.kt$AndroidUtils$var requestPermission: String? = null</ID>
     <ID>UnusedPrivateMember:ApplicationService.kt$ApplicationService$val listenerKey = "decorViewReady:$runnable"</ID>
     <ID>UnusedPrivateMember:JSONUtils.kt$JSONUtils$`object`: Any</ID>
-    <ID>UnusedPrivateMember:LoginHelper.kt$LoginHelper$jwtBearerToken: String? = null</ID>
     <ID>UnusedPrivateMember:OSDatabase.kt$OSDatabase.Companion$private const val FLOAT_TYPE = " FLOAT"</ID>
     <ID>UnusedPrivateMember:OperationRepo.kt$OperationRepo$private val _time: ITime</ID>
     <ID>UseCheckOrError:OneSignalImp.kt$OneSignalImp$throw IllegalStateException("'initWithContext failed' before 'login'")</ID>
     <ID>UseCheckOrError:OneSignalImp.kt$OneSignalImp$throw IllegalStateException("'initWithContext failed' before 'logout'")</ID>
+    <ID>UseCheckOrError:OneSignalImp.kt$OneSignalImp$throw IllegalStateException("'initWithContext failed' before 'updateUserJwt'")</ID>
+    <ID>UseCheckOrError:OneSignalImp.kt$OneSignalImp$throw IllegalStateException("Must call 'initWithContext' before 'addUserJwtInvalidatedListener'")</ID>
     <ID>UseCheckOrError:OneSignalImp.kt$OneSignalImp$throw IllegalStateException("Must call 'initWithContext' before 'login'")</ID>
     <ID>UseCheckOrError:OneSignalImp.kt$OneSignalImp$throw IllegalStateException("Must call 'initWithContext' before 'logout'")</ID>
+    <ID>UseCheckOrError:OneSignalImp.kt$OneSignalImp$throw IllegalStateException("Must call 'initWithContext' before 'removeUserJwtInvalidatedListener'")</ID>
+    <ID>UseCheckOrError:OneSignalImp.kt$OneSignalImp$throw IllegalStateException("Must call 'initWithContext' before 'updateUserJwt'")</ID>
     <ID>UseCheckOrError:OneSignalImp.kt$OneSignalImp$throw IllegalStateException("Must call 'initWithContext' before use")</ID>
     <ID>UseCheckOrError:OneSignalImp.kt$OneSignalImp$throw initFailureException ?: IllegalStateException("Initialization failed. Cannot proceed.")</ID>
   </CurrentIssues>

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/OneSignal.kt

@@ -343,6 +343,40 @@ object OneSignal {
     @JvmStatic
     fun logout() = oneSignal.logout()
 
+    /**
+     * Update the JWT bearer token associated with [externalId]. Use this when your backend
+     * has issued a new JWT for an already-logged-in user (e.g. in response to a previous
+     * [IUserJwtInvalidatedListener.onUserJwtInvalidated] callback). Stores the JWT and
+     * wakes the operation queue so any deferred ops can dispatch with the fresh token.
+     *
+     * @param externalId The external ID the JWT belongs to.
+     * @param token The new JWT bearer token issued by your backend.
+     */
+    @JvmStatic
+    fun updateUserJwt(
+        externalId: String,
+        token: String,
+    ) = oneSignal.updateUserJwt(externalId, token)
+
+    /**
+     * Subscribe a listener for JWT-invalidated events. Fires on a background thread when
+     * the SDK detects that the stored JWT for a user is no longer valid (typically after
+     * a 401 from the OneSignal backend). Apps should respond by fetching a fresh JWT from
+     * their backend and supplying it via [updateUserJwt].
+     *
+     * Listener replay: if an invalidation has already occurred before this listener is
+     * registered, the most recent invalidation is delivered to the new listener so apps
+     * that subscribe late don't miss the signal.
+     */
+    @JvmStatic
+    fun addUserJwtInvalidatedListener(listener: IUserJwtInvalidatedListener) =
+        oneSignal.addUserJwtInvalidatedListener(listener)
+
+    /** Unsubscribe a listener previously registered via [addUserJwtInvalidatedListener]. */
+    @JvmStatic
+    fun removeUserJwtInvalidatedListener(listener: IUserJwtInvalidatedListener) =
+        oneSignal.removeUserJwtInvalidatedListener(listener)
+
     private val oneSignal: IOneSignal by lazy {
         OneSignalImp()
     }
@@ -405,6 +439,21 @@ object OneSignal {
         oneSignal.logoutSuspend()
     }
 
+    /**
+     * Update the JWT bearer token associated with [externalId] without blocking the calling
+     * thread. Suspend-safe version of [updateUserJwt].
+     *
+     * @param externalId The external ID the JWT belongs to.
+     * @param token The new JWT bearer token issued by your backend.
+     */
+    @JvmStatic
+    suspend fun updateUserJwtSuspend(
+        externalId: String,
+        token: String,
+    ) {
+        oneSignal.updateUserJwtSuspend(externalId, token)
+    }
+
     /**
      * Used to retrieve services from the SDK when constructor dependency injection is not an
      * option.

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/internal/OneSignalImp.kt

@@ -386,7 +386,7 @@ internal class OneSignalImp(
         externalId: String,
         jwtBearerToken: String?,
     ) {
-        Logging.log(LogLevel.DEBUG, "Calling deprecated login(externalId: $externalId, jwtBearerToken: $jwtBearerToken)")
+        Logging.log(LogLevel.DEBUG, "Calling deprecated login(externalId: $externalId, jwtBearerToken: ...${jwtBearerToken?.takeLast(8)})")
 
         if (isBackgroundThreadingEnabled) {
             waitForInit(operationName = "login")
@@ -703,7 +703,7 @@ internal class OneSignalImp(
         externalId: String,
         jwtBearerToken: String?,
     ) = withContext(runtimeIoDispatcher) {
-        Logging.log(LogLevel.DEBUG, "login(externalId: $externalId, jwtBearerToken: $jwtBearerToken)")
+        Logging.log(LogLevel.DEBUG, "login(externalId: $externalId, jwtBearerToken: ...${jwtBearerToken?.takeLast(8)})")
 
         suspendUntilInit(operationName = "login")
 

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/UserManager.kt

@@ -108,7 +108,7 @@ internal open class UserManager(
         // subscribe/unsubscribe/fire calls. Replay runs on the caller's thread (sync).
         pendingExternalId?.let {
             runCatching { listener.onUserJwtInvalidated(UserJwtInvalidatedEvent(it)) }
-                .onFailure { ex -> Logging.warn("UserManager: replayed jwt-invalidated listener threw: ${ex.message}") }
+                .onFailure { ex -> Logging.warn("UserManager: replayed jwt-invalidated listener threw", ex) }
         }
     }
 
@@ -127,7 +127,7 @@ internal open class UserManager(
                 jwtInvalidatedDispatchScope.launch {
                     jwtInvalidatedNotifier.fire { listener ->
                         runCatching { listener.onUserJwtInvalidated(UserJwtInvalidatedEvent(externalId)) }
-                            .onFailure { ex -> Logging.warn("UserManager: jwt-invalidated listener threw: ${ex.message}") }
+                            .onFailure { ex -> Logging.warn("UserManager: jwt-invalidated listener threw", ex) }
                     }
                 }
             } else {