Handle pre-HYDRATE logout edge case and redact JWT from logs

LogoutHelper: add explicit null branch for unknown IV state (pre-HYDRATE).
Disables push subscription and suppresses backend op (like IV=ON) while also
enqueuing a LoginUserOperation so the anonymous user is created on the backend
if IV turns out to be OFF. If IV=ON, removeOperationsWithoutExternalId() purges
the anonymous op at HYDRATE. Known IV=ON and IV=OFF paths are unchanged.

HttpClient: filter Authorization header from requestProperties before passing
to logHTTPSent() so the full Bearer token is not written to debug logs.

OneSignalImp: redact token in updateUserJwt/updateUserJwtSuspend debug logs.
Made-with: Cursor

Author: nan-li

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/core/internal/http/impl/HttpClient.kt

@@ -187,7 +187,7 @@ internal class HttpClient(
                         con.setRequestProperty("Authorization", "Bearer ${headers.jwt}")
                     }
 
-                    logHTTPSent(con.requestMethod, con.url, jsonBody, con.requestProperties)
+                    logHTTPSent(con.requestMethod, con.url, jsonBody, con.requestProperties.filterKeys { it != "Authorization" })
 
                     if (jsonBody != null) {
                         val strJsonBody = JSONUtils.toUnescapedEUIDString(jsonBody)

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/internal/OneSignalImp.kt

@@ -425,7 +425,7 @@ internal class OneSignalImp(
         externalId: String,
         token: String,
     ) {
-        Logging.log(LogLevel.DEBUG, "updateUserJwt(externalId: $externalId, token: $token)")
+        Logging.log(LogLevel.DEBUG, "updateUserJwt(externalId: $externalId, token: <redacted>)")
 
         if (isBackgroundThreadingEnabled) {
             waitForInit(operationName = "updateUserJwt")
@@ -444,7 +444,7 @@ internal class OneSignalImp(
         externalId: String,
         token: String,
     ) = withContext(runtimeIoDispatcher) {
-        Logging.log(LogLevel.DEBUG, "updateUserJwtSuspend(externalId: $externalId, token: $token)")
+        Logging.log(LogLevel.DEBUG, "updateUserJwtSuspend(externalId: $externalId, token: <redacted>)")
 
         suspendUntilInit(operationName = "updateUserJwt")
 

OneSignalSDK/onesignal/core/src/main/java/com/onesignal/user/internal/LogoutHelper.kt

@@ -27,9 +27,28 @@ class LogoutHelper(
                 }
 
                 userSwitcher.createAndSwitchToNewUser(suppressBackendOperation = true)
-            } else {
+            } else if (configModel.useIdentityVerification == false) {
                 userSwitcher.createAndSwitchToNewUser()
 
+                operationRepo.enqueue(
+                    LoginUserOperation(
+                        configModel.appId,
+                        identityModelStore.model.onesignalId,
+                        null,
+                    ),
+                )
+            } else {
+                // IV state unknown (pre-HYDRATE). Take the safe path: disable push
+                // and suppress backend op (like IV=ON), but also enqueue a LoginUserOperation
+                // so the anonymous user is created on the backend if IV turns out to be OFF.
+                // If IV=ON, removeOperationsWithoutExternalId() will purge the anonymous op.
+                configModel.pushSubscriptionId?.let { pushSubId ->
+                    subscriptionModelStore.get(pushSubId)
+                        ?.let { it.isDisabledInternally = true }
+                }
+
+                userSwitcher.createAndSwitchToNewUser(suppressBackendOperation = true)
+
                 operationRepo.enqueue(
                     LoginUserOperation(
                         configModel.appId,