RN SDK release prep: awaitable logout + timeout, native bump (1.3.36/1.3.12), multi-target SPM - #104
Merged
Merged
Conversation
…sion actually ends The bridge logout was fire-and-forget on both platforms: iOS called auth.logout() without the completion overload; Android ignored the SDK's callback parameter. JS had no way to know when the session was actually gone and relied solely on the auth-state event — which can be lost when logout coincides with app-level teardown, leaving the JS state authenticated forever and breaking the next login's state-transition detection (observed on-device). Both native SDKs already expose completion callbacks (iOS FronteggAuth.logout(_ completion:), Android logout(callback:)); the bridge just didn't use them. logout() now returns a Promise that resolves when the native SDK reports completion, and iOS pushes the final auth state to JS before resolving. The JS export is typed Promise<void>. Existing callers that ignore the return value are unaffected.
logout(promise) resolved only from the SDK completion callback, so `await logout()` would hang forever if that callback never fired. Add a 10s timeout fallback (parity with the iOS bridge) and an atomic compare-and-set guard so the promise resolves exactly once, even though the SDK callback and the timeout may run on different threads. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Harden the awaitable logout() so `await logout()` can never hang if the SDK completion never fires: add a 10s main-queue timeout fallback and a `settled` guard so the promise resolves exactly once. Companion to the Android change; both platforms now share the same 10s settle behavior. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Carried from #97 (closed). startObserving() replayed the current auth state to JS only when a change was missed while unobserved (pendingObservingState). Because the JS-side state copy starts from a default and is only corrected by events, a (re)subscribe that races a native state change left JS permanently stale — e.g. a logout during app-level teardown left useAuth() stuck authenticated. Replay unconditionally so a listener attach always resyncs JS. The companion subscribe() sink-disposal fix from #97 already landed via #100 (FR-25940); this carries only the remaining startObserving() piece. Co-Authored-By: Adam Rowe <52685+airowe@users.noreply.github.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Picks up the July 2026 mobile-SDK audit fixes shipped in the native releases: iOS 1.3.12 and Android 1.3.36.
…lper (multi-target workspaces)
ios/frontegg_spm.rb text-patches the host's Pods.xcodeproj with object
IDs sized for a single app target. Workspaces with many app targets
(white-label products build dozens from one workspace) can't use it —
the script writes references for a target layout that doesn't match.
React Native >= 0.75 ships an official mechanism for exactly this:
spm_dependency() in a library podspec, applied by
react_native_post_install to every target that consumes the pod, with
no pbxproj text manipulation. Declare FronteggSwift there, guarded by
defined?() so autolinking's out-of-process [!] A specification path is required.
Usage:
$ pod ipc spec PATH
Converts a podspec to JSON and prints it to STDOUT.
Options:
--allow-root Allows CocoaPods to run as root
--silent Show nothing
--verbose Show more debugging information
--no-ansi Show output without ANSI codes
--help Show help banner of specified command evaluation
(which doesn't load react_native_pods.rb) still parses the spec;
frontegg_spm.rb remains the documented fallback for older RN.
Validated on a 50-target workspace (RN 0.81.5, static linkage):
pod install injects one XCRemoteSwiftPackageReference; Debug and
Release builds of two app targets with different team/bundle IDs
succeed with no per-target configuration.
Align the spm_dependency pin and the Package.swift reference manifest to 1.3.12, matching the native-SDK bump in #92 (which covers frontegg_spm.rb and android/build.gradle). Keeps all iOS SPM integration paths on one version. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Update all iOS SPM integration paths (podspec spm_dependency, Package.swift reference manifest, and the frontegg_spm.rb fallback) from 1.3.12 to the newly released FronteggSwift 1.3.13. Android SDK pin unchanged (1.3.36). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidates the three remaining RN-SDK release-prep PRs into one (replaces #101, #92, and #103). All three touch disjoint files and cherry-picked onto current
masterwith zero conflicts; authorship is preserved (Adam Rowe on the two upstream commits).1. Awaitable
logout()+ always-settle timeout — both platforms (from #101; logout base by @airowe, iOS replay carried from #97)logout()resolves from the native SDK's logout completion instead of fire-and-forget; typedPromise<void>in JS.AtomicBoolean.compareAndSeton Android,settledon iOS) soawait logout()can never hang if the completion never fires.startObserving()now unconditionally replays auth state on listener attach, so a (re)subscribe that races a native state change can't leave JS permanently stale.2. Native SDK bump — Android 1.3.36 / iOS 1.3.12 (from #92)
android/build.gradle→com.frontegg.sdk:android:1.3.36ios/frontegg_spm.rbPACKAGE_VERSION→1.3.123. Multi-target SPM via
spm_dependency, pinned 1.3.12 (from #103, originally #99 by @airowe)spm_dependencyhelper (RN ≥ 0.75) soreact_native_post_installinjects the package into every app target — unblocking multi-target / white-label workspaces the hardcoded-target script can't handle.defined?guard keepsfrontegg_spm.rbas the older-RN fallback.FronteggRN.podspecpin andios/Package.swiftreference manifest set to 1.3.12 — so all iOS SPM paths (podspec,Package.swift,frontegg_spm.rb) now agree.Validation
Supersedes
#101, #92, #103 (and #99, already closed in favor of #103).
🤖 Generated with Claude Code