Fix race condition: stamp externalId synchronously before async enqueue

The externalId was being stamped inside internalEnqueue which runs on
the OperationRepo coroutine thread. When LogoutHelper set
isDisabledInternally=true (triggering an UpdateSubscriptionOperation)
then immediately called createAndSwitchToNewUser(), the identity model's
externalId could be cleared before the coroutine ran, leaving the
operation with externalId=null and permanently blocked.

Move stamping to enqueue()/enqueueAndWait() on the caller's thread so
the externalId is captured at the moment the operation is created.

Made-with: Cursor

Author: nan-li

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/operations/impl/OperationRepo.kt

@@ -129,6 +129,7 @@ internal class OperationRepo(
         Logging.log(LogLevel.DEBUG, "OperationRepo.enqueue(operation: $operation, flush: $flush)")
 
         operation.id = UUID.randomUUID().toString()
+        stampExternalId(operation)
         scope.launch {
             internalEnqueue(OperationQueueItem(operation, bucket = enqueueIntoBucket), flush, true)
         }
@@ -141,6 +142,7 @@ internal class OperationRepo(
         Logging.log(LogLevel.DEBUG, "OperationRepo.enqueueAndWait(operation: $operation, force: $flush)")
 
         operation.id = UUID.randomUUID().toString()
+        stampExternalId(operation)
         val waiter = WaiterWithValue<Boolean>()
         scope.launch {
             internalEnqueue(OperationQueueItem(operation, waiter, bucket = enqueueIntoBucket), flush, true)
@@ -154,19 +156,24 @@ internal class OperationRepo(
      *
      * @returns true if the OperationQueueItem was added, false if not
      */
+    /**
+     * Capture the externalId from the current identity model onto the operation
+     * synchronously on the caller's thread, before the async enqueue coroutine runs.
+     * Operations that already set externalId in their constructor (e.g. LoginUserOperation)
+     * are left unchanged.
+     */
+    private fun stampExternalId(operation: Operation) {
+        if (operation.externalId == null) {
+            operation.externalId = _identityModelStore.model.externalId
+        }
+    }
+
     private fun internalEnqueue(
         queueItem: OperationQueueItem,
         flush: Boolean,
         addToStore: Boolean,
         index: Int? = null,
     ) {
-        // Stamp externalId on new operations from the current identity model.
-        // Operations loaded from persistence (addToStore=false) already have their externalId.
-        // Operations that set externalId in their constructor (e.g. LoginUserOperation) are skipped.
-        if (addToStore && queueItem.operation.externalId == null) {
-            queueItem.operation.externalId = _identityModelStore.model.externalId
-        }
-
         synchronized(queue) {
             val hasExisting = queue.any { it.operation.id == queueItem.operation.id }
             if (hasExisting) {

OneSignalSDK/onesignal/core/src/test/java/com/onesignal/core/internal/operations/OperationRepoTests.kt

@@ -960,6 +960,70 @@ class OperationRepoTests : FunSpec({
         handlerCalledWith shouldBe "test-user"
     }
 
+    test("enqueue stamps externalId synchronously before async dispatch") {
+        // Verifies the fix for a race condition where createAndSwitchToNewUser()
+        // could clear the identity model's externalId before the async internalEnqueue
+        // had a chance to stamp it.
+
+        // Given
+        val identityModel = com.onesignal.user.internal.identity.IdentityModel()
+        identityModel.id = "-singleton"
+        identityModel.onesignalId = "onesignal-id"
+        identityModel.externalId = "old-user"
+
+        val identityModelStore = mockk<com.onesignal.user.internal.identity.IdentityModelStore>(relaxed = true)
+        every { identityModelStore.model } returns identityModel
+
+        val configModelStore =
+            MockHelper.configModelStore {
+                it.useIdentityVerification = true
+            }
+        val jwtTokenStore = mockk<JwtTokenStore>(relaxed = true)
+        every { jwtTokenStore.getJwt("old-user") } returns "valid-jwt"
+
+        val operationModelStore =
+            run {
+                val operationStoreList = mutableListOf<Operation>()
+                val mock = mockk<OperationModelStore>()
+                every { mock.loadOperations() } just runs
+                every { mock.list() } answers { operationStoreList.toList() }
+                every { mock.add(any()) } answers { operationStoreList.add(firstArg<Operation>()) }
+                every { mock.remove(any()) } answers {
+                    val id = firstArg<String>()
+                    operationStoreList.removeIf { it.id == id }
+                }
+                mock
+            }
+
+        val executor = mockk<IOperationExecutor>()
+        every { executor.operations } returns listOf("DUMMY_OPERATION")
+        coEvery { executor.execute(any()) } returns ExecutionResponse(ExecutionResult.SUCCESS)
+
+        val operationRepo =
+            spyk(
+                OperationRepo(
+                    listOf(executor),
+                    operationModelStore,
+                    configModelStore,
+                    Time(),
+                    getNewRecordState(configModelStore),
+                    jwtTokenStore,
+                    identityModelStore,
+                ),
+                recordPrivateCalls = true,
+            )
+
+        val operation = mockOperation()
+        // externalId starts null — stampExternalId should fill it from the identity model
+
+        // When — enqueue then immediately switch user (simulating LogoutHelper's pattern)
+        operationRepo.enqueue(operation)
+        identityModel.externalId = null
+
+        // Then — the operation should have captured "old-user" before the switch
+        operation.externalId shouldBe "old-user"
+    }
+
     test("FAIL_UNAUTHORIZED drops operations for anonymous user") {
         // Given
         val mocks = Mocks()