@iterable/react-native-sdk/lib/react-native-dev/JWT_ISSUES.md

Iterable SDK for React Native.

# JWT Issues

## iOS
- On iOS, `undefined` and `null` auth token are treated differently.  On Android
  they are treated the same.
- I don't believe it is respecting the `retryInterval`.  It seems much longer.
- *token == null*
  - Sometimes `onJWTError` will fire without any args.
  - Reason oscillates bw AUTH_TOKEN_NULL, AUTH_TOKEN_MISSING and AUTH_TOKEN_FORMAT_INVALID
  - `maxRetry` not respected (but pause works)
  - listener called multiple times per failure
- *token == invalid*
  - listener called multiple times per failure
  - sometimes returns AUTH_TOKEN_MISSING or AUTH_TOKEN_GENERIC_ERROR
  - Seems to be triggered one more than `maxRetry`
- *token == expired*
  - listener called multiple times per failure (not issue per akshay)
  - does not pause when `pauseAuthRetries` is called (now works)
<!-- - *token == more than a year*
  - does not retry or error  -->
<!-- - *token == includes invalid email*
  - does not retry or error, but fails initialization -->
- Seems like you have to login twice for the email in `setEmail` to persist by
  the time we log in

## Android
- If _first_ logging in with a valid token, then logging out, then logging in
  with a null token... the app will still log in with a valid token.  This will
  persist until I uninstall and reinstall.
- If _first_ logging in with an invalid token, then logging in with null token...
  the error message is always `invalid`.
- If _first_ logging in with an expired, then logging in with null token...
  the error message is always `expired` and the previous token is shown in the
  `onJWTError` callback props.  `pause` and `maxRetry` work, though.
- *token == expired*
  - does not respect `maxRetry`
  - does not respect pause
  - gets called multiple times (happens with some others too)
<!-- - *token == more than a year*
  - does not retry or error
- *token == includes invalid email*
  - does not retry or error -->

## Other 
- The login flow between iOS and Android is not consistent.  In iOS, the SDK
expects you to set the email or userId before calling initialize.  In Android, the SDK
expects you to call initialize before setting the email or userId.  This creates
an incredibly confusing flow for our clients.  We should document this, but I'm
hesitant to because it seems so unprofessional.
<!-- - Message showing triggered on each auth try if valid
- *token == expired*
  - does not pause when `pauseAuthRetries` is called -->


## Things I didn't think of
- changing the jwt type midway
[x] testing `expiringAuthTokenRefreshPeriod` (make expiration time or configurable)