fix(iv): reorder switchUserIv to avoid unsubscribing the OLD user

Setting isDisabledInternally = true on the OLD push sub model BEFORE
createAndSwitchToNewUser fires a NORMAL-tagged change that propagates
through SubscriptionModelStoreListener.getUpdateOperation. The listener
reads the still-current OLD identity (alice / OS-A) and enqueues an
UpdateSubscriptionOperation(externalId = "alice", enabled = false,
status = UNSUBSCRIBE) — which then dispatches with alice's still-valid
JWT and unsubscribes the just-departed user server-side.

Reorder so the user-switch happens first (suppressBackendOperation = true
so the new model's add doesn't fire), then set the flag on the NEW push
sub with NO_PROPOGATE so the listener filters it. The new push sub
reuses the old id, so configModel.pushSubscriptionId after the switch
points at the new model.

Also fixes the secondary issue from the same review: previously the new
SubscriptionModel was created without isDisabledInternally, so the flag
never landed on the post-logout anonymous user. With the new ordering,
the flag is set directly on the new model.

Add tests for the ordering and the Phase 3 short-circuit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: nan-li

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/LogoutHelperIvExtensions.kt

@@ -1,6 +1,8 @@
 package com.onesignal.user.internal
 
+import com.onesignal.common.modeling.ModelChangeTags
 import com.onesignal.core.internal.config.ConfigModel
+import com.onesignal.user.internal.subscriptions.SubscriptionModel
 import com.onesignal.user.internal.subscriptions.SubscriptionModelStore
 
 /**
@@ -16,10 +18,18 @@ import com.onesignal.user.internal.subscriptions.SubscriptionModelStore
  * Under IV-required, the new device-scoped (anonymous) user can't authenticate against
  * the backend without a JWT. To prevent the model-store listener from generating create-
  * subscription ops that would 401/permanently-block the queue:
- * 1. Mark the current push subscription as internally disabled.
- * 2. Switch users with [UserSwitcher.createAndSwitchToNewUser] in `suppressBackendOperation`
- *    mode so subscription replacement does NOT propagate to listeners that would enqueue
- *    backend ops.
+ * 1. Switch to the anonymous user with [UserSwitcher.createAndSwitchToNewUser] in
+ *    `suppressBackendOperation` mode so subscription replacement does not propagate to
+ *    listeners that would enqueue backend ops.
+ * 2. Mark the new push subscription as internally disabled with [ModelChangeTags.NO_PROPOGATE]
+ *    so subsequent property mutations (FCM token refresh, permission change, etc.)
+ *    short-circuit through [com.onesignal.user.internal.operations.impl.listeners.SubscriptionModelStoreListener.getSubscriptionEnabledAndStatus]
+ *    instead of enqueueing real ops.
+ *
+ * Order matters: setting the flag on the OLD model first (with default NORMAL tag) would
+ * fire `getUpdateOperation` against the OLD user with their still-valid JWT — the listener
+ * would build an `UpdateSubscriptionOperation(externalId = OLD)` carrying `(false, UNSUBSCRIBE)`,
+ * dispatch it, and unsubscribe the just-departed user server-side.
  *
  * Returns `true` when IV-specific handling was applied (caller skips legacy enqueue),
  * or `false` when IV behavior is inactive (caller falls through to the legacy logout).
@@ -32,9 +42,13 @@ internal fun switchUserIv(
 ): Boolean {
     if (!ivBehaviorActive) return false
 
+    userSwitcher.createAndSwitchToNewUser(suppressBackendOperation = true)
     configModel.pushSubscriptionId?.let { pushSubId ->
-        subscriptionModelStore.get(pushSubId)?.let { it.isDisabledInternally = true }
+        subscriptionModelStore.get(pushSubId)?.setBooleanProperty(
+            SubscriptionModel::isDisabledInternally.name,
+            true,
+            ModelChangeTags.NO_PROPOGATE,
+        )
     }
-    userSwitcher.createAndSwitchToNewUser(suppressBackendOperation = true)
     return true
 }

OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/LogoutHelperTests.kt

@@ -6,6 +6,9 @@ import com.onesignal.debug.LogLevel
 import com.onesignal.debug.internal.logging.Logging
 import com.onesignal.mocks.MockHelper
 import com.onesignal.user.internal.operations.LoginUserOperation
+import com.onesignal.user.internal.subscriptions.SubscriptionModel
+import com.onesignal.user.internal.subscriptions.SubscriptionModelStore
+import com.onesignal.user.internal.subscriptions.SubscriptionType
 import io.kotest.core.spec.style.FunSpec
 import io.kotest.matchers.shouldBe
 import io.mockk.every
@@ -192,4 +195,51 @@ class LogoutHelperTests : FunSpec({
         verify(atLeast = 1) { mockUserSwitcher.createAndSwitchToNewUser() }
         verify(atLeast = 1) { mockOperationRepo.enqueue(any()) }
     }
+
+    test("switchUserIv switches user before marking new push sub as internally disabled") {
+        // Given - IV active, push sub model in store
+        val pushSubId = "push-sub-id"
+        val newPushSubModel =
+            SubscriptionModel().apply {
+                id = pushSubId
+                type = SubscriptionType.PUSH
+            }
+        val mockSubscriptionModelStore = mockk<SubscriptionModelStore>(relaxed = true)
+        every { mockSubscriptionModelStore.get(pushSubId) } returns newPushSubModel
+        val mockUserSwitcher = mockk<UserSwitcher>(relaxed = true)
+        val mockConfigModel = mockk<ConfigModel>()
+        every { mockConfigModel.pushSubscriptionId } returns pushSubId
+
+        // When
+        val handled = switchUserIv(mockUserSwitcher, mockSubscriptionModelStore, mockConfigModel, ivBehaviorActive = true)
+
+        // Then
+        handled shouldBe true
+
+        // Order: user-switch must happen BEFORE the flag is set on the new push sub.
+        // Setting the flag on the OLD model first would fire an UpdateSubscriptionOperation
+        // against the OLD user with their valid JWT and unsubscribe them server-side.
+        verifyOrder {
+            mockUserSwitcher.createAndSwitchToNewUser(suppressBackendOperation = true)
+            mockSubscriptionModelStore.get(pushSubId)
+        }
+
+        // The flag is set on the model (verified via the underlying property).
+        newPushSubModel.isDisabledInternally shouldBe true
+    }
+
+    test("switchUserIv returns false when IV behavior is inactive") {
+        // Given - Phase 3: new code path on, IV behavior off
+        val mockSubscriptionModelStore = mockk<SubscriptionModelStore>(relaxed = true)
+        val mockUserSwitcher = mockk<UserSwitcher>(relaxed = true)
+        val mockConfigModel = mockk<ConfigModel>(relaxed = true)
+
+        // When
+        val handled = switchUserIv(mockUserSwitcher, mockSubscriptionModelStore, mockConfigModel, ivBehaviorActive = false)
+
+        // Then - falls through to legacy logout flow; no IV-specific calls.
+        handled shouldBe false
+        verify(exactly = 0) { mockUserSwitcher.createAndSwitchToNewUser(suppressBackendOperation = any()) }
+        verify(exactly = 0) { mockSubscriptionModelStore.get(any()) }
+    }
 })