Skip to content

feat(rokt): end the Rokt session when the mParticle user changes - #762

Closed
nickolas-dimitrakas wants to merge 1 commit into
mainfrom
rokt/kit-clear-session-on-identity-change
Closed

feat(rokt): end the Rokt session when the mParticle user changes#762
nickolas-dimitrakas wants to merge 1 commit into
mainfrom
rokt/kit-clear-session-on-identity-change

Conversation

@nickolas-dimitrakas

Copy link
Copy Markdown
Contributor

Why

The Rokt session is bound to a persisted JWT whose expiry extends on every request, and the kit's identity callbacks have always been empty — so a user change never ends a Rokt session, and on shared self-service terminals (kiosks, counter tablets) successive customers silently continue one another's session.

Android counterpart of #819. (Replaces mparticle-integrations/mparticle-android-integration-rokt#147, which targeted the standalone repo by mistake — the kit lives here.)

What

The kit now calls Rokt.clearSession() from onIdentifyCompleted / onLoginCompleted / onLogoutCompleted, with the MPID transition typed so only a departing known user ends a session:

Transition Action Why
anonymous → known keep session same person being identified (unknown on payment page, known on confirmation page) — in-session state survives
known → different known reset a different person — the kiosk case
known → anonymous reset logout — the recommended clean boundary between customers on shared terminals
anonymous → anonymous no-op placeholder churn, nobody was known

"Known" = holds any user identity or is logged in. IdentityType contains user identities only on Android, so identity-set emptiness is a safe anonymity signal. MPID 0 (the unassigned sentinel) is never recorded. onModifyCompleted stays empty — modify() cannot change the MPID.

Dependencies

Requires a Rokt Android SDK release containing Rokt.clearSession() (ROKT/sdk-android-source#1148) plus a roktSdkVersion bump here. Verified locally against mavenLocal core (CI sequence): the module compiles with exactly one expected unresolved reference — Rokt.clearSession against the released roktsdk:6.0.3 — which the version bump resolves. Same release ordering as #819.

Testing

  • The identical typed rule on iOS was validated end-to-end on simulators against production: startup identify (anonymous → known) no longer resets; same-user placements share one session; a customer switch mints a new one.
  • SDK-level reset semantics covered by unit tests in the SDK PR (538 green).
  • Kit-level unit tests for the trigger conditions are a follow-up alongside the version bump.

🤖 Generated with Claude Code

The Rokt session is bound to a persisted JWT and today survives every
identity change — on shared self-service terminals successive customers
silently continue one another's session.

The kit now calls Rokt.clearSession() from the identity callbacks, with
the MPID transition TYPED so only a departing known user ends a session:

- anonymous -> known: same person identified (payment page -> conf
  page) — session kept, in-session state survives
- known -> different known: different person (kiosk) — reset
- known -> anonymous: logout — reset
- anonymous -> anonymous: no-op

"Known" = holds any user identity or is logged in. Android's
IdentityType enum contains user identities only, so identity-set
emptiness is a safe anonymity signal. MPID 0 (unassigned sentinel) is
never recorded. onModifyCompleted stays empty: modify() cannot change
the MPID.

Requires a Rokt Android SDK release containing Rokt.clearSession()
(ROKT/sdk-android-source#1148) and a roktSdkVersion bump. Mirrors the
iOS kit change (#819).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant