fix: merge the anonymous user on composite login

Composite login creates the user directly, so data set on the anonymous user
before login was left behind. It now sends the anonymous user's onesignal_id
with the external ID, and Create User attaches the external ID to that user,
matching what login(externalId) does through SetAlias. A 409 means the external
ID already belongs to another user, so it retries without the onesignal_id.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: AR Abdul Azeez

OneSignalSDK/detekt/detekt-baseline-core.xml

@@ -8,7 +8,7 @@
     <ID>ComplexMethod:ConfigModelStoreListener.kt$ConfigModelStoreListener$private fun fetchParams()</ID>
     <ID>ComplexMethod:HttpClient.kt$HttpClient$private suspend fun makeRequestIODispatcher( url: String, method: String?, jsonBody: JSONObject?, timeout: Int, headers: OptionalHeaders?, ): HttpResponse</ID>
     <ID>ComplexMethod:IdentityOperationExecutor.kt$IdentityOperationExecutor$override suspend fun execute(operations: List&lt;Operation>): ExecutionResponse</ID>
-    <ID>ComplexMethod:LoginUserOperationExecutor.kt$LoginUserOperationExecutor$private suspend fun createUser( createUserOperation: LoginUserOperation, operations: List&lt;Operation>, ): ExecutionResponse</ID>
+    <ID>ComplexMethod:LoginUserOperationExecutor.kt$LoginUserOperationExecutor$private suspend fun createUser( createUserOperation: LoginUserOperation, operations: List&lt;Operation>, mergeIntoOnesignalId: String? = null, ): ExecutionResponse</ID>
     <ID>ComplexMethod:OSDatabase.kt$OSDatabase$@Synchronized private fun internalOnUpgrade( db: SQLiteDatabase, oldVersion: Int, newVersion: Int, )</ID>
     <ID>ComplexMethod:OperationModelStore.kt$OperationModelStore$override fun create(jsonObject: JSONObject?): Operation?</ID>
     <ID>ComplexMethod:OperationRepo.kt$OperationRepo$internal suspend fun executeOperations(ops: List&lt;OperationQueueItem>)</ID>
@@ -194,7 +194,7 @@
     <ID>LongMethod:FeatureFlagsBackendService.kt$FeatureFlagsBackendService$override suspend fun fetchRemoteFeatureFlags(appId: String): RemoteFeatureFlagsFetchOutcome</ID>
     <ID>LongMethod:HttpClient.kt$HttpClient$private suspend fun makeRequestIODispatcher( url: String, method: String?, jsonBody: JSONObject?, timeout: Int, headers: OptionalHeaders?, ): HttpResponse</ID>
     <ID>LongMethod:IdentityOperationExecutor.kt$IdentityOperationExecutor$override suspend fun execute(operations: List&lt;Operation>): ExecutionResponse</ID>
-    <ID>LongMethod:LoginUserOperationExecutor.kt$LoginUserOperationExecutor$private suspend fun createUser( createUserOperation: LoginUserOperation, operations: List&lt;Operation>, ): ExecutionResponse</ID>
+    <ID>LongMethod:LoginUserOperationExecutor.kt$LoginUserOperationExecutor$private suspend fun createUser( createUserOperation: LoginUserOperation, operations: List&lt;Operation>, mergeIntoOnesignalId: String? = null, ): ExecutionResponse</ID>
     <ID>LongMethod:LoginUserOperationExecutor.kt$LoginUserOperationExecutor$private suspend fun loginUser( loginUserOp: LoginUserOperation, operations: List&lt;Operation>, ): ExecutionResponse</ID>
     <ID>LongMethod:OperationRepo.kt$OperationRepo$internal suspend fun executeOperations(ops: List&lt;OperationQueueItem>)</ID>
     <ID>LongMethod:OperationRepo.kt$OperationRepo$private fun internalEnqueue( queueItem: OperationQueueItem, flush: Boolean, addToStore: Boolean, index: Int? = null, )</ID>
@@ -293,7 +293,7 @@
     <ID>NestedBlockDepth:IdentityOperationExecutor.kt$IdentityOperationExecutor$override suspend fun execute(operations: List&lt;Operation>): ExecutionResponse</ID>
     <ID>NestedBlockDepth:InfluenceManager.kt$InfluenceManager$private fun attemptSessionUpgrade( entryAction: AppEntryAction, directId: String? = null, )</ID>
     <ID>NestedBlockDepth:JSONUtils.kt$JSONUtils$fun compareJSONArrays( jsonArray1: JSONArray?, jsonArray2: JSONArray?, ): Boolean</ID>
-    <ID>NestedBlockDepth:LoginUserOperationExecutor.kt$LoginUserOperationExecutor$private suspend fun createUser( createUserOperation: LoginUserOperation, operations: List&lt;Operation>, ): ExecutionResponse</ID>
+    <ID>NestedBlockDepth:LoginUserOperationExecutor.kt$LoginUserOperationExecutor$private suspend fun createUser( createUserOperation: LoginUserOperation, operations: List&lt;Operation>, mergeIntoOnesignalId: String? = null, ): ExecutionResponse</ID>
     <ID>NestedBlockDepth:RefreshUserOperationExecutor.kt$RefreshUserOperationExecutor$private suspend fun getUser(op: RefreshUserOperation): ExecutionResponse</ID>
     <ID>NestedBlockDepth:ServiceRegistration.kt$ServiceRegistrationReflection$override fun resolve(provider: IServiceProvider): Any?</ID>
     <ID>NestedBlockDepth:ServiceRegistration.kt$ServiceRegistrationReflection$private fun doesHaveAllParameters( constructor: Constructor&lt;*>, provider: IServiceProvider, ): Boolean</ID>

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/operations/impl/executors/LoginUserOperationExecutor.kt

@@ -99,6 +99,11 @@ internal class LoginUserOperationExecutor(
             // rewrite the call to identify by the new (not-yet-registered) `external_id`, producing
             // a 404 or idempotent success against the wrong user. createUser's identities-map path
             // handles the merge correctly through backend upsert semantics.
+            anonymousUserToMerge(loginUserOp, alias)?.let { anonymousId ->
+                val merged = createUser(loginUserOp, operations, anonymousId)
+                // 409: the external ID already belongs to another user, so there is nothing to merge into.
+                if (merged.httpStatusCode != HTTP_CONFLICT) return merged
+            }
             return createUser(loginUserOp, operations)
         } else {
             // before we create a user we attempt to associate the user defined by existingOnesignalId with the
@@ -178,8 +183,10 @@ internal class LoginUserOperationExecutor(
     private suspend fun createUser(
         createUserOperation: LoginUserOperation,
         operations: List<Operation>,
+        mergeIntoOnesignalId: String? = null,
     ): ExecutionResponse {
         val identities = mutableMapOf<String, String>()
+        mergeIntoOnesignalId?.let { identities[IdentityConstants.ONESIGNAL_ID] = it }
         var subscriptions = mapOf<String, SubscriptionObject>()
         val properties =
             PropertiesObject(
@@ -447,6 +454,13 @@ internal class LoginUserOperationExecutor(
         return op.existingOnesignalId == null || alias == null
     }
 
+    // A profile login sends the anonymous user's ID with the new external ID, so Create User attaches
+    // the external ID to that user instead of creating a new one, like the SetAlias path does.
+    private fun anonymousUserToMerge(op: LoginUserOperation, alias: String?): String? {
+        if (!op.hasProfileFields() || _identityVerificationService.ivBehaviorActive || alias == null) return null
+        return op.existingOnesignalId?.takeUnless { IDManager.isLocalId(it) }
+    }
+
     private fun backendExecutionResponse(
         result: ExecutionResult,
         ex: BackendException,
@@ -459,6 +473,7 @@ internal class LoginUserOperationExecutor(
 
     companion object {
         const val LOGIN_USER = "login-user"
+        private const val HTTP_CONFLICT = 409
     }
 }
 

OneSignalSDK/onesignal/core/src/test/java/com/onesignal/user/internal/operations/LoginUserOperationExecutorTests.kt

@@ -6,6 +6,7 @@ import br.com.colman.kotest.android.extensions.robolectric.RobolectricTest
 import com.onesignal.OneSignalUserProfile
 import com.onesignal.common.AndroidUtils
 import com.onesignal.common.DeviceUtils
+import com.onesignal.common.IDManager
 import com.onesignal.common.OneSignalUtils
 import com.onesignal.common.PIIHasher
 import com.onesignal.common.RootToolsInternalMethods
@@ -1579,6 +1580,63 @@ class LoginUserOperationExecutorTests : FunSpec({
         coVerify(exactly = 0) { identityExecutor.execute(any()) }
     }
 
+    test("composite login from an anonymous user sends its onesignal_id so the user is merged") {
+        val mockUserBackendService = mockk<IUserBackendService>()
+        coEvery { mockUserBackendService.createUser(any(), any(), any(), any()) } returns
+            CreateUserResponse(mapOf(IdentityConstants.ONESIGNAL_ID to "existing-osid"), PropertiesObject(), listOf())
+
+        val response =
+            profileExecutor(mockUserBackendService).execute(
+                listOf(LoginUserOperation(appId, localOneSignalId, "externalId", "existing-osid", OneSignalUserProfile(tags = mapOf("plan" to "pro")))),
+            )
+
+        response.result shouldBe ExecutionResult.SUCCESS
+        response.idTranslations shouldBe mapOf(localOneSignalId to "existing-osid")
+        coVerify(exactly = 1) {
+            mockUserBackendService.createUser(
+                appId,
+                mapOf(IdentityConstants.EXTERNAL_ID to "externalId", IdentityConstants.ONESIGNAL_ID to "existing-osid"),
+                any(),
+                any(),
+            )
+        }
+    }
+
+    test("composite login retries without onesignal_id when the external ID belongs to another user") {
+        val mockUserBackendService = mockk<IUserBackendService>()
+        val mergeIdentities = mapOf(IdentityConstants.EXTERNAL_ID to "externalId", IdentityConstants.ONESIGNAL_ID to "existing-osid")
+        val plainIdentities = mapOf(IdentityConstants.EXTERNAL_ID to "externalId")
+        coEvery { mockUserBackendService.createUser(appId, mergeIdentities, any(), any()) } throws BackendException(409, "user-1")
+        coEvery { mockUserBackendService.createUser(appId, plainIdentities, any(), any()) } returns
+            CreateUserResponse(mapOf(IdentityConstants.ONESIGNAL_ID to remoteOneSignalId), PropertiesObject(), listOf())
+
+        val response =
+            profileExecutor(mockUserBackendService).execute(
+                listOf(LoginUserOperation(appId, localOneSignalId, "externalId", "existing-osid", OneSignalUserProfile(tags = mapOf("plan" to "pro")))),
+            )
+
+        response.result shouldBe ExecutionResult.SUCCESS
+        response.idTranslations shouldBe mapOf(localOneSignalId to remoteOneSignalId)
+        coVerify(exactly = 1) { mockUserBackendService.createUser(appId, mergeIdentities, any(), any()) }
+        coVerify(exactly = 1) { mockUserBackendService.createUser(appId, plainIdentities, any(), any()) }
+    }
+
+    test("composite login does not merge when the anonymous user is still local, or under IV") {
+        for ((existingId, ivActive) in listOf(IDManager.createLocalId() to false, "existing-osid" to true)) {
+            val mockUserBackendService = mockk<IUserBackendService>()
+            coEvery { mockUserBackendService.createUser(any(), any(), any(), any(), any()) } returns
+                CreateUserResponse(mapOf(IdentityConstants.ONESIGNAL_ID to remoteOneSignalId), PropertiesObject(), listOf())
+
+            profileExecutor(mockUserBackendService, ivActive = ivActive).execute(
+                listOf(LoginUserOperation(appId, localOneSignalId, "externalId", existingId, OneSignalUserProfile(tags = mapOf("plan" to "pro")))),
+            )
+
+            coVerify(exactly = 1) {
+                mockUserBackendService.createUser(appId, mapOf(IdentityConstants.EXTERNAL_ID to "externalId"), any(), any(), any())
+            }
+        }
+    }
+
     test("identity-only login still associates via SetAlias when existingOnesignalId is set") {
         val mockUserBackendService = mockk<IUserBackendService>()
         val identityExecutor = mockk<IdentityOperationExecutor>()