Cache web purchase redemption CustomerInfo for the initiating App User ID (#4114)
## Description After making the API request to POST redeem web purchase, and receiving the response with the updated `CustomerInfo`, we reached back into the identityManager to get the current appUserID in order to cache the updated `CustomerInfo` for this app user ID. However theoretically the user ID could have changed between initiating the request and receiving the response. Possibly saving the updated `CustomerInfo` of user A under the cache key for user `B`, resulting in `CustomerInfo` data being shared between app user IDs ## Changes We're now capturing the initiating `appUserID` and reusing that value when storing the `CustomerInfo` in the cache. Ensuring that it's saved for the app user that originally initiated the request. Equivalent iOS PR: https://github.com/RevenueCat/purchases-ios/pull/7533 <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Changes customer-info cache keying for web redemption, which could affect entitlement data if wrong; the fix is narrowly scoped and covered by a regression test. > > **Overview** > Fixes a race where **web purchase redemption** could cache updated `CustomerInfo` under the wrong app user if `identityManager.currentAppUserID` changed between starting the redeem request and handling the async success. > > `CustomerInfoUpdateHandler` now exposes `cacheAndNotifyListeners(customerInfo, appUserID)`; the existing single-argument method delegates to the current ID. `WebPurchaseRedemptionHelper` captures `appUserID` when redemption starts and passes that same ID when caching after success. > > Tests were updated to expect the explicit user ID, plus a new case that simulates a user switch during the async callback and verifies cache writes use the **original** user ID. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 817d1221db7bde5304029a640d932c8862911650. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
R
Rick committed
f4af88bedc8dd51bdaf64fc2730c554e3eb1f8fa
Parent: fe644ec
Committed by GitHub <noreply@github.com>
on 8/27/2026, 2:06:42 PM