fix(auth): fix DPoP validation propagation in AuthFlowTester UI tests

[wmathurin]

Summary

• Fixes BaseAuthFlowTester test infrastructure so explicit useDPoP enablement correctly propagates through the full validation call chain (launchAndLogin → validate() → validateUser → assertRevokeAndRefreshWorks)
• Syncs README.md and overview.md with the actual test suite (missing tests, stale test names)
• All non-Beacon tests pass. Beacon tests (BEACON_OPAQUE / BEACON_JWT) fail pre-existing across all suites — same failures observed on Android (forcedotcom/SalesforceMobileSDK-Android#3005), pointing to an environment or server-side issue with the Beacon app configuration in the test sandbox rather than a code regression.

Root cause (DPoP validation)

SDK 14.0 made DPoP default-on: commit a9d333f01 changed self.useDPoP = NO → self.useDPoP = YES in resetAuthFlags. The validation logic in BaseAuthFlowTester derived whether to expect DPoP credentials solely from the app config name (isDPoP returns true only when the config name contains _dpop). Tests that explicitly enable DPoP via Login Options (e.g. DPoPLoginTests operating on ecaOpaque) called validate() with useDPoP: true, but validateUser and assertRevokeAndRefreshWorks still consulted userAppConfig.isDPoP — always false for ecaOpaque — so DPoP credentials were validated against Bearer expectations, causing assertion failures.

Root cause (WelcomeLoginTests / parallel flakiness)

WelcomeLoginTests non-beacon tests (testWelcomeDiscovery_RegularAuthLoginHost, _DynamicConfig) appeared to consistently fail all 3 retries when run in parallel with Beacon tests. Beacon tests each time out after 109s × 3 retries = ~327s per test, saturating the simulator pool. The same two tests pass reliably when run in isolation (117s, 118s). No code change was required; the failures were a parallelism artefact, not a product regression.

Fix

Propagate useDPoP through the BaseAuthFlowTester call chain so explicit DPoP enablement overrides the config-name-derived default:

• launchAndLogin and loginOtherUser (no-validate variant) — added useDPoP: Bool = false, forwarded to login()
• validateUser — added expectDP: Bool? = nil; resolves to expectDP ?? userAppConfig.isDPoP
• validate() (private) — computes effectiveExpectDP = useDPoP || userAppConfig.isDPoP and passes it to both validateUser and assertRevokeAndRefreshWorks

No SDK production code was changed — only test infrastructure (BaseAuthFlowTester.swift, 15 lines).

Test results

All AuthFlowTester UI test suites run on simulator (iPhone 16, iOS 18.6). All non-Beacon tests pass. Beacon tests fail pre-existing across all suites; the same failures are seen on Android (#3005), pointing to a server-side / environment issue with the Beacon app configuration in the test sandbox rather than a code regression. git diff origin/dev shows zero changes to Beacon test files or Beacon app configuration.

Some tests required 1–2 retries due to network flakiness against the shared test sandbox (token endpoint timeouts at ~110s). All eventually passed within the built-in retry budget.

In WelcomeLoginTests, testWelcomeDiscovery_RegularAuthLoginHost and testWelcomeDiscovery_RegularAuthLoginHost_DynamicConfig fail when run in parallel with Beacon timeouts but pass reliably in isolation (117s, 118s). Root cause: Beacon tests time out after 109s × 3 retries each, exhausting simulator concurrency.

Test plan

• All 10 runnable DPoPLoginTests pass (2 skipped — W-22512846 and pending server-side fix)
• All ECALoginTests pass (9/9)
• All LegacyLoginTests pass (7/7)
• Non-Beacon MultiUserLoginTests pass (2/2; testBothStatic_SameApp_SameScopes needed 2 retries)
• Non-Beacon RefreshTokenMigrationTests pass (3/3; 2 tests needed 2 retries each)
• Non-Beacon WelcomeLoginTests pass in isolation (2/2; fail under parallel Beacon load — parallelism artefact, not a regression)
• Non-Beacon LoginWithRestartTests pass (6/6; all first-attempt)
• Non-Beacon RefreshTokenMigrationWithRestartTests pass (2/2; all first-attempt)
• Beacon failures confirmed pre-existing and cross-platform (Android PR Sign In with Apple requirements #3005); no Beacon test code was modified

[sfdctaka]

LGTM!

[github-actions]

	Tests	Passed ☑️	Skipped ⚠️	Failed ❌️
AuthFlowTester UI Test Results all	110 ran	69 ✅	4 ⚠️	37 ❌

Test	Result
AuthFlowTester UI Test Results all
AuthFlowTesterUITests.xctest
DPoPLoginTests.testLogin_DPoP_ECA_Without_DPoP_Fails()	❌ failure
DPoPLoginTests.test_givenDPoPSession_whenDowngradeFromDPoP_thenBearerUnbound()	❌ failure
DPoPLoginTests.test_givenBearerSession_whenUpgradeToDPoP_thenDPoPBound()	❌ failure
DPoPLoginTests.test_givenTwoDPoPUsers_whenSwitchAndRefresh_thenTokensAndNoncesAreIsolated()	❌ failure
ForceAdvancedAuthTests.testForceAdvancedAuth_AddAdditionalUser_BackButtonAccessible()	❌ failure
AdvancedAuthBeaconLoginTests.testBeaconOpaque_AllScopes()	❌ failure
AdvancedAuthBeaconLoginTests.testBeaconJwt_DefaultScopes()	❌ failure
AdvancedAuthBeaconLoginTests.testBeaconJwt_SubsetScopes()	❌ failure
AdvancedAuthBeaconLoginTests.testBeaconJwt_AllScopes()	❌ failure
AdvancedAuthBeaconLoginTests.testBeaconOpaque_DefaultScopes()	❌ failure
AdvancedAuthBeaconLoginTests.testBeaconOpaque_SubsetScopes()	❌ failure
LoginWithRestartTests.testBeaconOpaque_DefaultScopes_WithRestart()	❌ failure
LoginWithRestartTests.testAdvancedAuth_WithRestart()	❌ failure
LoginWithRestartTests.testBeaconJwt_DefaultScopes_DynamicConfiguration_WithRestart()	❌ failure
LoginWithRestartTests.testWelcomeDiscovery_WithRestart()	❌ failure
LoginWithRestartTests.testBeaconJwt_SubsetScopes_DynamicConfiguration_WithRestart()	❌ failure
RefreshTokenMigrationTests.testMigrateCAToBeaconAndBack()	❌ failure
RefreshTokenMigrationTests.testMigrateCAToBeacon()	❌ failure
RefreshTokenMigrationTests.testMigrateBeaconOpaqueToJWTAndBack()	❌ failure
RefreshTokenMigrationTests.testMigrateBeacon_AddMoreScopes()	❌ failure
RefreshTokenMigrationTests.testMigrateCAUserAgentToBeaconWebServer()	❌ failure
RefreshTokenMigrationTests.testMigrateBeaconToCA()	❌ failure
RefreshTokenMigrationTests.testFlagDiversity_MigratedBeaconJwtVsNonHybridOpaque()	❌ failure
RefreshTokenMigrationWithRestartTests.testMigrateBeaconScopeAddition_WithRestart()	❌ failure
RefreshTokenMigrationWithRestartTests.testMigrateMultipleUsers_WithRestart()	❌ failure
RefreshTokenMigrationWithRestartTests.testMigrateCAToBeacon_WithRestart()	❌ failure
MultiUserLoginTests.testFlagDiversity_BeaconNonHybridJwtVsHybridOpaque()	❌ failure
MultiUserLoginTests.testBeaconAndNonBeacon_MultiUser()	❌ failure
MultiUserLoginTests.testAdvancedAuthUser_HasBWFlag_RegularAuthUser_DoesNot()	❌ failure
BeaconLoginTests.testBeaconOpaque_SubsetScopes()	❌ failure
BeaconLoginTests.testBeaconOpaque_AllScopes()	❌ failure
BeaconLoginTests.testBeaconOpaque_DefaultScopes()	❌ failure
BeaconLoginTests.testBeaconJwt_AllScopes()	❌ failure
BeaconLoginTests.testBeaconJwt_SubsetScopes()	❌ failure
BeaconLoginTests.testBeaconJwt_DefaultScopes()	❌ failure
WelcomeLoginTests.testWelcomeDiscovery_AdvancedAuthLoginHost_DynamicConfig()	❌ failure
WelcomeLoginTests.testWelcomeDiscovery_AdvancedAuthLoginHost()	❌ failure

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.61%. Comparing base (ada8024) to head (32e55d2).
⚠️ Report is 5 commits behind head on dev.

Additional details and impacted files

@@            Coverage Diff             @@
##              dev    #4144      +/-   ##
==========================================
- Coverage   71.80%   71.61%   -0.20%     
==========================================
  Files         254      254              
  Lines       22837    22837              
==========================================
- Hits        16399    16355      -44     
- Misses       6438     6482      +44     

Components	Coverage Δ
Analytics	70.78% <ø> (ø)
Common	70.79% <ø> (-0.19%)	⬇️
Core	67.35% <ø> (-0.28%)	⬇️
SmartStore	73.45% <ø> (ø)
MobileSync	88.84% <ø> (ø)
see 4 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.