fix: [SDK-5330] reject null, empty, and NUL identity strings

[abdulraqeeb33]

Description

1 Line Summary

Reject null, empty, and NUL identity strings in the website SDK before they are stored.

Details

Part of SDK-5327. Web has no native SDK underneath, so the guard lives here.

isMissing logs and returns when a value is null, "", or contains a null byte. Whitespace is still allowed.

• init app id. An empty app id still throws the existing invalid-app-id error. A null byte does too, since it fails the UUID check.
• login(externalId)
• addAlias / addAliases (label and id). Alias format checks are unchanged.
• removeAlias / removeAliases
• addEmail / removeEmail and addSms / removeSms
• addTag / addTags (key only). An empty tag value is allowed, including one that contains a null byte. A null tag value is rejected.
• removeTag / removeTags
• trackEvent(name)

Wrong types still throw. One blank map or list entry rejects the whole call.

Behavior changes

• addAlias, removeAlias, addEmail, addSms, removeEmail, removeSms, addTag, and removeTag used to throw an empty-argument error for "". They now log and return.
• trackEvent used to send any name unchecked. A non-string name now throws a wrong-type error, like the rest of the User API.
• Log messages name the method, e.g. removeTags: key is required.

Systems Affected

• WebSDK
• Backend
• Dashboard

Validation

Tests

Info

vp test (557 tests passed). vp check (0 errors, 5 pre-existing warnings in unrelated tests).

Cases cover empty and NUL login, a kept whitespace login, empty tag values, a NUL tag key, and empty or NUL setLanguage.

Not run in a browser. The guards return before storage, and the unit tests assert that.

Checklist

• All the automated tests pass or I explained why that is not possible
• I have personally tested this on my machine or explained why that is not possible
• I have included test coverage for these changes or explained why they are not needed

Programming Checklist
Interfaces:

• Don't use default export
• New interfaces are in model files

Functions:

• Don't use default export
• All function signatures have return types
• Helpers should not access any data but rather be given the data to operate on.

Typescript:

• No Typescript warnings
• Avoid silencing null/undefined warnings with the exclamation point

Other:

• Iteration: refrain from using elem of array syntax. Prefer forEach or use map
• Avoid using global OneSignal accessor for context if possible. Instead, we can pass it to function/constructor so that we don't call OneSignal.context

Screenshots

Info

No visual change.

Checklist

• I have included screenshots/recordings of the intended results or explained why they are not needed

---

Related Tickets

https://linear.app/onesignal/issue/SDK-5330

---

Made with Cursor

[sherwinski]

PR description — addAlias, removeAlias, addEmail, addSms, removeEmail, removeSms, addTag, and removeTag used to throw an empty-argument error for "". They now log and return. Please state the old behavior in the description so the change shows in the release notes.

[fadi-george]

Updated the description with the old behavior under "Behavior changes".

[sherwinski]

💯