fix: scope local store cache by full user context, not keyId alone (#10)

* fix: scope local store cache by full user context, not keyId alone

ReactNativeStore persisted its offline cache keyed only by user.keyId,
so re-identifying the same anonymous key with different
customizedProperties (e.g. a "region" attribute changing between app
sessions) served a stale evaluation cached under the previous
attribute set — the sync protocol treats the client as already
up-to-date since the flag definition itself hasn't changed.

Upstream fixed the same issue for LocalStorageStore/InMemoryStore via
hashSerializeUser() (featbit-js-client-sdk#fbcd618). This uses plain
serializeUser() instead, since crypto.subtle isn't reliably available
on React Native's JS engine without an extra polyfill dependency.

Also adds a `prepare` script so this installs correctly as a git
dependency (dist/ is gitignored and only built at npm-publish time).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Use hashSerializeUser instead of serializeUser

* more fix

* Update package-lock.json

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: cosmos-explorer <88151306+cosmos-explorer@users.noreply.github.com>

Author: 3 people

examples/ExpoApp/package-lock.json

@@ -2,6 +2,16 @@
 module.exports = {
   testEnvironment: 'node',
   testMatch: ['**/__tests__/**/*.test.ts'],
+  // @featbit/react-client-sdk ships ESM-only (no CJS build), which Jest's
+  // default CJS module system can't require() directly. It publishes its
+  // TypeScript source alongside dist though, so map the package to that —
+  // ts-jest (already configured below) transforms it like any other .ts file.
+  moduleNameMapper: {
+    '^@featbit/react-client-sdk$': '<rootDir>/node_modules/@featbit/react-client-sdk/src/index.ts',
+  },
+  // The mapped path above still lives under node_modules, so it needs an
+  // explicit carve-out from Jest's default "never transform node_modules" rule.
+  transformIgnorePatterns: ['/node_modules/(?!@featbit/react-client-sdk)'],
   transform: {
     '^.+\\.tsx?$': [
       'ts-jest',

jest.config.js

@@ -1,6 +1,6 @@
 {
   "name": "@featbit/react-native-sdk",
-  "version": "4.3.0",
+  "version": "4.3.3",
   "description": "FeatBit client SDK for React Native",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -12,6 +12,7 @@
   "scripts": {
     "prebuild": "node -p \"'export const version = \\\"' + require('./package.json').version + '\\\"; export const name = \\\"' + require('./package.json').name + '\\\";'\" > src/version.ts",
     "build": "npx tsc",
+    "prepare": "npm run build",
     "test": "jest",
     "test:e2e": "cross-env FEATBIT_E2E=1 jest --config jest.e2e.config.js --runInBand"
   },
@@ -48,8 +49,8 @@
     "ws": "^8.21.0"
   },
   "dependencies": {
-    "@featbit/react-client-sdk": "4.3.0",
-    "@react-native-async-storage/async-storage": "^1.23.1"
+    "@featbit/react-client-sdk": "4.3.3",
+    "@react-native-async-storage/async-storage": "^1.23.1 || ^2.0.0"
   },
   "overrides": {
     "js-yaml": "^4.2.0",

package-lock.json

@@ -4,7 +4,7 @@ import {
   IStoreDataStorage,
   CurrentUserStorageKey,
   StoreStorageKey,
-  serializeUser, BaseStore
+  serializeUser, BaseStore, hashSerializeUser
 } from "@featbit/react-client-sdk";
 
 import AsyncStorage from './ConditionalAsyncStorage';
@@ -42,14 +42,26 @@ export default class ReactNativeStore extends BaseStore {
     }
   }
 
-  protected override async dumpStoreToStorage(): Promise<void> {
-    const storageKey = `${StoreStorageKey}-${this._user.keyId}`;
+  // Keyed by the hashed full serialized user (keyId + name + customizedProperties),
+  // not just keyId. Two identify() calls with the same keyId but different
+  // attributes (e.g. a custom "region" property changing) must not collide
+  // on the same cached entry, or a stale evaluation from the previous
+  // attribute set gets served after the flag's sync protocol treats the
+  // client as already up to date (see upstream featbit-js-client-sdk#fbcd618,
+  // which fixed the same issue for LocalStorageStore/InMemoryStore via a
+  // hashSerializeUser()-keyed cache).
+  private async storageKeyForCurrentUser(): Promise<string> {
+    const userHash = await hashSerializeUser(this._user);
+    return `${StoreStorageKey}-${userHash}`;
+  }
 
+  protected override async dumpStoreToStorage(): Promise<void> {
+    const storageKey = await this.storageKeyForCurrentUser();
     await this.set(storageKey, JSON.stringify(this.store));
   }
 
   protected override async loadStoreFromStorage(): Promise<void> {
-    const storageKey = `${StoreStorageKey}-${this._user.keyId}`;
+    const storageKey = await this.storageKeyForCurrentUser();
     const dataStoreStr = await AsyncStorage.getItem(storageKey);
 
     let store: IStoreDataStorage | null = null;
@@ -71,4 +83,4 @@ export default class ReactNativeStore extends BaseStore {
       };
     }
   }
-}
+}

package.json

@@ -0,0 +1,103 @@
+jest.mock('../ConditionalAsyncStorage', () => {
+  const map = new Map<string, string>();
+  return {
+    __esModule: true,
+    default: {
+      getItem: jest.fn((key: string) => Promise.resolve(map.has(key) ? (map.get(key) as string) : null)),
+      setItem: jest.fn((key: string, value: string) => {
+        map.set(key, value);
+        return Promise.resolve();
+      }),
+      removeItem: jest.fn((key: string) => {
+        map.delete(key);
+        return Promise.resolve();
+      }),
+    },
+  };
+});
+
+import ReactNativeStore from '../ReactNativeStore';
+
+const FLAGS_KIND = { namespace: 'flags' };
+
+function buildLogger() {
+  return { debug: jest.fn(), error: jest.fn(), warn: jest.fn(), info: jest.fn() };
+}
+
+// Regression coverage for: same keyId re-identifying with different
+// customizedProperties (e.g. a "region" attribute changing between app
+// sessions) must not be served a stale evaluation cached under the
+// previous attribute set. Storage was previously keyed by keyId alone.
+describe('ReactNativeStore — storage key scoping', () => {
+  it('does not serve a previous session\'s cached flags when the same keyId re-identifies with different customizedProperties', async () => {
+    const store = new ReactNativeStore({ logger: buildLogger() } as any);
+
+    // Session 1: keyId 'user-1', region=US — cache a flag value.
+    await store.identify({
+      keyId: 'user-1',
+      customizedProperties: [{ name: 'region', value: 'US' }],
+    } as any);
+    await store.upsert(FLAGS_KIND, {
+      key: 'my-flag',
+      version: 1,
+      origin: 'Remote',
+      variation: 'email-only',
+    } as any);
+    expect(store.get(FLAGS_KIND, 'my-flag')?.variation).toBe('email-only');
+
+    // Session 2: SAME keyId, DIFFERENT region — re-identify.
+    await store.identify({
+      keyId: 'user-1',
+      customizedProperties: [{ name: 'region', value: 'IN' }],
+    } as any);
+
+    // Must NOT still see the US-cached value.
+    expect(store.get(FLAGS_KIND, 'my-flag')).toBeNull();
+    expect(store.version).toBe(0);
+  });
+
+  it('still serves cached flags across app restarts for the exact same user context', async () => {
+    const storeA = new ReactNativeStore({ logger: buildLogger() } as any);
+    await storeA.identify({
+      keyId: 'user-2',
+      customizedProperties: [{ name: 'region', value: 'US' }],
+    } as any);
+    await storeA.upsert(FLAGS_KIND, {
+      key: 'my-flag',
+      version: 1,
+      origin: 'Remote',
+      variation: 'email-only',
+    } as any);
+
+    // Simulate a fresh app restart: new store instance, identical user context.
+    const storeB = new ReactNativeStore({ logger: buildLogger() } as any);
+    await storeB.identify({
+      keyId: 'user-2',
+      customizedProperties: [{ name: 'region', value: 'US' }],
+    } as any);
+
+    expect(storeB.get(FLAGS_KIND, 'my-flag')?.variation).toBe('email-only');
+  });
+
+  it('scopes storage independently per keyId even with identical customizedProperties', async () => {
+    const storeA = new ReactNativeStore({ logger: buildLogger() } as any);
+    await storeA.identify({
+      keyId: 'user-a',
+      customizedProperties: [{ name: 'region', value: 'US' }],
+    } as any);
+    await storeA.upsert(FLAGS_KIND, {
+      key: 'my-flag',
+      version: 1,
+      origin: 'Remote',
+      variation: 'email-only',
+    } as any);
+
+    const storeB = new ReactNativeStore({ logger: buildLogger() } as any);
+    await storeB.identify({
+      keyId: 'user-b',
+      customizedProperties: [{ name: 'region', value: 'US' }],
+    } as any);
+
+    expect(storeB.get(FLAGS_KIND, 'my-flag')).toBeNull();
+  });
+});

src/ReactNativeStore.ts

@@ -1 +1 @@
-export const version = "4.3.0"; export const name = "@featbit/react-native-sdk";
+export const version = "4.3.3"; export const name = "@featbit/react-native-sdk";