Skip to content

fix: stop push notifications after session expires without explicit logout - #248

Open
deaflynx wants to merge 1 commit into
thingsboard:develop/1.9.0from
deaflynx:fix/push-notifications-after-logout-304
Open

fix: stop push notifications after session expires without explicit logout#248
deaflynx wants to merge 1 commit into
thingsboard:develop/1.9.0from
deaflynx:fix/push-notifications-after-logout-304

Conversation

@deaflynx

Copy link
Copy Markdown
Contributor

Fixes thingsboard/flutter_thingsboard_pe_app#304

Problem

When the session ends without an explicit logout (refresh token expires while the app is unused), the FCM token stays registered on the platform and the device keeps receiving alarm push notifications after the automatic logout.

Solution

  • Persist a push_notifications_registered flag (TbStorage) whenever the FCM token is registered with the platform — on a fresh saveMobileSession and when init() finds an existing valid session (covers installs upgrading to this version).
  • New NotificationService.handleSessionExpired(): if the flag is set, runs the full push cleanup and clears the flag. Deleting the local FCM token is what actually stops delivery — the JWT is already invalid at this point, so the server-side removeMobileSession call usually cannot succeed; subsequent pushes to the deleted token bounce with UNREGISTERED and the platform purges the mobile session on the next delivery attempt.
  • Login.handleUserLoaded() triggers the cleanup whenever it detects an unauthenticated client with Firebase configured. Because the trigger is the persisted flag (not the in-memory login state), it works on cold start — the main reported scenario (app killed, token expired days ago) — as well as when the expiry happens while the app is running. It is a no-op on fresh installs, after manual logout, and on subsequent logged-out launches.
  • NotificationService.logout() now awaits removeMobileSession inside a try/catch: previously the call was fire-and-forget and produced an unhandled async error exactly in the expired-token case.

Limitations

Pushes delivered between the token expiry and the next app launch cannot be stopped from the client — closing that gap requires a platform-side change (tying mobile session lifetime to the auth session), which is being discussed separately.

Testing

  • Unit tests for the handleSessionExpired flag logic (test/utils/services/notification_service_test.dart) — the repo's first unit tests, mocktail-based.
  • flutter analyze — no new findings on touched files.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant