fix(auth): run provider logout before host session end; show OAuth user name #17

Merged

james.maes merged 1 commits from fix/company-signout-before-session-end into main 2026-11-06 23:22:52 +00:00

Conversation 0 Commits 1 Files Changed 6

+260 -9

james.maes commented 2026-11-06 16:40:43 +00:00

Owner

Copy link

Copy source

Summary

Fixes Sign out of company on the production-signed APK. On the physical Zebra MC9400 (QQQ Mobile 1.0.1, real Authentik fixture over trusted HTTPS) company sign-out never opened the browser and reported "Company sign-out did not complete".

MC9400 finding. QViewModel.performLogout ran the host beforeLogout hook before the provider logout request. The scanner host's hook ends the device session (POST /qbit/mobile-scanners/sessions/current/end), and on the server that runs the core logout and removes the QQQ session. By the time the client sent POST /qqq/v1/logout with nativeLogout, there was no session left to describe, so nativeLogoutData was never returned and AppAuth's end-session browser never opened.

Change.

• Company sign-out now sends the provider logout request first, then ends the host session (a 401 from the device-session end is tolerated because the login already ended), then clears local state and opens the browser. Ordinary sign-out is unchanged: host hook first, then core logout.
• Browser (OAuth) login now adopts the server-reported values.user.name (ManageSessionResponse.userName), so the Account dialog no longer shows a blank current user after a browser sign-in.
• mobileapp unit tests get unitTests.isReturnDefaultValues = true so the ViewModel test can run on the JVM.
• Docs: docs/AUTHENTICATION.md (ordering note) and docs/SESSION-STATE.md (finding and status).

Validation

• Shared-library and scanner JVM tests passed: core 52, mobileapp 62 (includes new QViewModelLogoutTest: provider-before-host ordering, failing host end keeps the hint and clears locally, ordinary order unchanged, browser login adopts user name, userName parsing tolerates missing/non-object/blank user), scanner-host 125
• Scanner lint clean (lintRelease: 0 errors, 0 warnings)
• Native emulator tests: not run for this change
• Hardware: the fix is not yet installed on the MC9400; it ships in the planned 1.0.2 build. The remaining hardware check is a company sign-out on the production APK against the real Authentik server.

Compatibility and rollout

No API or metadata change. Uses the existing POST /qqq/v1/logout request and existing values.user.name. No server upgrade required. No credentials, cookies, tokens or barcodes included.

🤖 Generated with Claude Code

## Summary Fixes **Sign out of company** on the production-signed APK. On the physical Zebra MC9400 (QQQ Mobile 1.0.1, real Authentik fixture over trusted HTTPS) company sign-out never opened the browser and reported "Company sign-out did not complete". **MC9400 finding.** `QViewModel.performLogout` ran the host `beforeLogout` hook before the provider logout request. The scanner host's hook ends the device session (`POST /qbit/mobile-scanners/sessions/current/end`), and on the server that runs the core logout and removes the QQQ session. By the time the client sent `POST /qqq/v1/logout` with `nativeLogout`, there was no session left to describe, so `nativeLogoutData` was never returned and AppAuth's end-session browser never opened. **Change.** - Company sign-out now sends the provider logout request first, then ends the host session (a 401 from the device-session end is tolerated because the login already ended), then clears local state and opens the browser. Ordinary sign-out is unchanged: host hook first, then core logout. - Browser (OAuth) login now adopts the server-reported `values.user.name` (`ManageSessionResponse.userName`), so the Account dialog no longer shows a blank current user after a browser sign-in. - `mobileapp` unit tests get `unitTests.isReturnDefaultValues = true` so the ViewModel test can run on the JVM. - Docs: `docs/AUTHENTICATION.md` (ordering note) and `docs/SESSION-STATE.md` (finding and status). ## Validation - [x] Shared-library and scanner JVM tests passed: core 52, mobileapp 62 (includes new `QViewModelLogoutTest`: provider-before-host ordering, failing host end keeps the hint and clears locally, ordinary order unchanged, browser login adopts user name, `userName` parsing tolerates missing/non-object/blank user), scanner-host 125 - [x] Scanner lint clean (`lintRelease`: 0 errors, 0 warnings) - [ ] Native emulator tests: not run for this change - [ ] Hardware: the fix is not yet installed on the MC9400; it ships in the planned 1.0.2 build. The remaining hardware check is a company sign-out on the production APK against the real Authentik server. ## Compatibility and rollout No API or metadata change. Uses the existing `POST /qqq/v1/logout` request and existing `values.user.name`. No server upgrade required. No credentials, cookies, tokens or barcodes included. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

james.maes added 1 commit 2026-11-06 16:40:43 +00:00

fix(auth): run provider logout before host session end; show OAuth user name ... cf82dd5d78

Company sign-out on the MC9400 (production APK, real Authentik) never opened
the browser: QViewModel.performLogout ran the host beforeLogout hook (scanner
device-session end, which runs the core logout server-side) before the
provider logout request, so POST /qqq/v1/logout found no session and returned
no nativeLogoutData. Company sign-out now requests the provider material
first, then ends the host session (401 tolerated), then clears local state.
Ordinary sign-out keeps the host-hook-first order.

Browser login now adopts the server-reported values.user.name so Account no
longer shows a blank current user.

Adds QViewModelLogoutTest (ordering, failing host end, ordinary order, user
name adoption, ManageSessionResponse.userName parsing) and documents the
finding in AUTHENTICATION.md and SESSION-STATE.md.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

james.maes referenced this pull request 2026-11-06 16:46:37 +00:00

release(scanner): prepare 1.0.2 (versionCode 4) [depends on #17, #18] #19

james.maes merged commit f39f7a37d3 into main 2026-11-06 23:22:52 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

question

Further information is requested

wontfix

This will not be worked on

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

forge-recovery (Forge Recovery) james.maes (James Maes)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qqq-android#17