feat: Add alias for sha256 identities by jamesnrokt · Pull Request #1252 · mParticle/mparticle-web-sdk

jamesnrokt · 2026-04-21T21:58:23Z

Background

Currently clients have to use other for Sha256 identity types. This PR adds explicit aliases to other for clarity

What Has Changed

Add aliases for sha256 identity types

Screenshots/Video

N/A

Checklist

I have performed a self-review of my own code.
I have made corresponding changes to the documentation.
I have added tests that prove my fix is effective or that my feature works.
I have tested this locally.

Additional Notes

N/A

Reference Issue (For employees only. Ignore if you are an outside contributor)

Closes N/A

cursor · 2026-04-21T21:58:28Z

PR Summary

Medium Risk
Touches identity request preprocessing and change-detection logic used by identify/login/modify flows; regressions could trigger extra or skipped identity calls if normalization/comparison is wrong. Changes are localized and covered by new unit tests, but impact core identity behavior.

Overview
Adds support for partner-friendly sha256 identity aliases by normalizing email_sha256 → other and mobile_sha256 → other2 during identity request preprocessing and when checking whether an identity request has changed.

Updates hasIdentityRequestChanged to compare identities order-independently after normalization (avoiding false positives caused by key insertion order differences), and extends IdentityType.getIdentityType to recognize the new alias keys.

Bumps @types/mparticle__web-sdk and adjusts runtime model typings (e.g., SDKProduct required fields, SDKInitConfig omit list), with added Jest/Mocha coverage for the new alias + comparison behavior.

^{Reviewed by Cursor Bugbot for commit b97f566. Bugbot is set up for automated code reviews on this repo. Configure here.}

rmi22186 · 2026-05-01T15:36:44Z

Updated to include mobilesha --> Other2 mapping

An identify request of:

const identifyRequest = {
    userIdentities: { 
        email_sha256: 'emailsha',
        mobile_sha256: 'mobilenumber',
    } 
}

now maps to

rmi22186 · 2026-05-04T19:10:31Z

 // and the two will be merged in once the Store module is refactored
 export interface SDKInitConfig
-    extends Omit<MPConfiguration, 'dataPlan' | 'logLevel'> {
+    extends Omit<MPConfiguration, 'dataPlan' | 'logLevel' | 'identityCallback'> {


This was required due to build issues with definitelytyped - the local SDK is actually typed more strongly and is more accurate than DT's definition. Once we deprecated DT, this will be resolved.

Address Cursor Bugbot finding (PR #1252): the previous `Readonly<UserIdentities>` typing constrained keys to identity names but accepted `string | null | undefined` for values — modeling them as identity *values* rather than canonical key names. That left the map vulnerable to a silent corruption: a future maintainer setting an alias to `null` would compile, then at runtime `normalized[null] = value` coerces the index to the literal string "null", silently dropping the user's hash on the wire. Switch to `Readonly<Partial<Record<keyof UserIdentities, keyof UserIdentities>>>` so both keys *and* values must be valid identity key names. `null`, undefined, or arbitrary strings now fail type-check at the declaration site. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 61c828b. Configure here.}

- mobile_sha256 now maps to other2 (was: other) so it no longer collides with email_sha256 in the same canonical slot. - Null on an alias passes through to the canonical slot instead of being dropped, so a Modify call with `<alias>: null` actually clears the slot — matching the null=clear contract honored by removeFalsyIdentityValues and the identity validator. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- hasIdentityRequestChanged now normalizes the new request before stringify-compare; fixes spurious identify-on-restore when SDKConfig.identifyRequest uses sha256 aliases. - Move the declare module augmentation to public-types.ts (the file shipped via package.json types). Marked for removal once DefinitelyTyped/DefinitelyTyped#74955 publishes. - Type SHA256_IDENTITY_ALIASES as Readonly<UserIdentities> to drop three downstream casts in normalizeUserIdentityKeys. - Add hasIdentityRequestChanged regression test for the alias→canonical round-trip. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

@types/mparticle__web-sdk@2.66.0 (DefinitelyTyped/DefinitelyTyped#74955) includes email_sha256 and mobile_sha256 on UserIdentities, so the local augmentation in public-types.ts is no longer needed. The bump also tightens two interfaces in ways the SDK already overrides: - IMParticleUser now extends Omit<User, 'getCart'>. DT 2.66.0 makes Product.Name required, breaking the existing override of getCart().getCartProducts() that returns SDKProduct[] (Name optional). Cart APIs are deprecated; the override stays as the canonical SDK shape. - SDKInitConfig adds 'identityCallback' to its Omit<MPConfiguration> escape list. DT 2.66.0's IdentityCallback uses change_results.identity_type: string; the SDK uses SDKIdentityTypeEnum and already redeclares identityCallback locally. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

@types/mparticle__web-sdk@2.66.0 made Product.{Name,Sku,Price} required. The SDK's createProduct factory already requires all three at runtime (rejects with an error and returns null otherwise), so promoting them to required on SDKProduct matches the actual API contract. Also drop `| null` from SDKProduct.Attributes — no code path in src/ or test/ assigned null to it, and DT's Product.Attributes is `?: Record<...>` without the null variant. With SDKProduct now structurally assignable to DT's Product, the Omit<User, 'getCart'> escape on IMParticleUser is no longer needed — revert to `extends User`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Address Cursor Bugbot finding (PR #1252): the previous `Readonly<UserIdentities>` typing constrained keys to identity names but accepted `string | null | undefined` for values — modeling them as identity *values* rather than canonical key names. That left the map vulnerable to a silent corruption: a future maintainer setting an alias to `null` would compile, then at runtime `normalized[null] = value` coerces the index to the literal string "null", silently dropping the user's hash on the wire. Switch to `Readonly<Partial<Record<keyof UserIdentities, keyof UserIdentities>>>` so both keys *and* values must be valid identity key names. `null`, undefined, or arbitrary strings now fail type-check at the declaration site. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ntities keys The previous tightening typed the alias map as keyof UserIdentities → keyof UserIdentities, which broke the build because email_sha256/mobile_sha256 are input alias names that don't exist on the UserIdentities interface — they map TO UserIdentities keys. Introduce a Sha256IdentityAlias literal union for the keys, and widen normalizeUserIdentityKeys' input to accept the aliases. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The previous JSON.stringify-based comparison was sensitive to object key insertion order. The current-user side iterates a numeric IdentityType map (yielding keys in IdentityType ascending order), while the new-request side reflects partner-supplied / alias-normalized order. Equivalent identity sets in different orders produced different stringified output, flagging spurious changes and triggering unnecessary identify API calls on session resume — the bugbot finding on PR #1252. Replace the stringify with a structural compare that checks key-set equality and per-key value equality, independent of order. Add hasIdentityRequestChanged spec covering null inputs, order-mismatched matches (with and without sha256 aliases), and genuine value/key changes. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

sonarqubecloud · 2026-05-06T13:58:26Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

jamesnrokt requested a review from a team as a code owner April 21, 2026 21:58

cursor Bot reviewed Apr 21, 2026

View reviewed changes

Comment thread src/identity-utils.ts

rmi22186 force-pushed the feat/add-alias-for-sha256-identities branch 2 times, most recently from babd33c to 2961807 Compare May 1, 2026 15:32

alexs-mparticle requested changes May 1, 2026

View reviewed changes

Comment thread src/identity-utils.ts Outdated

Comment thread src/identity-utils.ts Outdated

Comment thread src/identity-utils.ts Outdated

Comment thread src/identity-utils.ts Outdated

Comment thread src/identity-utils.ts Outdated

rmi22186 mentioned this pull request May 4, 2026

[mparticle__web-sdk] Add SHA256 identity aliases and Rokt.onShoppableAdsReady DefinitelyTyped/DefinitelyTyped#74955

Merged

16 tasks

rmi22186 reviewed May 4, 2026

View reviewed changes

Comment thread src/identity.js Outdated

rmi22186 reviewed May 4, 2026

View reviewed changes

cursor Bot reviewed May 4, 2026

View reviewed changes

Comment thread src/identity-utils.ts

cursor Bot reviewed May 4, 2026

View reviewed changes

Comment thread src/identity-utils.ts

jamesnrokt and others added 9 commits May 6, 2026 07:49

feat: Add alias for sha256 identities

ee5e888

Add types for aliases

81f7352

Apply suggestion from @rmi22186

0341a90

rmi22186 force-pushed the feat/add-alias-for-sha256-identities branch from 61c828b to 308f87b Compare May 6, 2026 13:06

alexs-mparticle approved these changes May 6, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Add alias for sha256 identities#1252

feat: Add alias for sha256 identities#1252
jamesnrokt wants to merge 10 commits intodevelopmentfrom
feat/add-alias-for-sha256-identities

jamesnrokt commented Apr 21, 2026

Uh oh!

cursor Bot commented Apr 21, 2026 •

edited

Loading

Uh oh!

Uh oh!

rmi22186 commented May 1, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rmi22186 May 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

sonarqubecloud Bot commented May 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

jamesnrokt commented Apr 21, 2026

Background

What Has Changed

Screenshots/Video

Checklist

Additional Notes

Reference Issue (For employees only. Ignore if you are an outside contributor)

Uh oh!

cursor Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Uh oh!

rmi22186 commented May 1, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rmi22186 May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sonarqubecloud Bot commented May 6, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

cursor Bot commented Apr 21, 2026 •

edited

Loading

rmi22186 May 4, 2026 •

edited

Loading