Skip to content

Fix Play Store user ID hashing - #449

Merged
ianrumac merged 3 commits into
developfrom
codex/fix-play-store-user-id-hash
Aug 11, 2026
Merged

Fix Play Store user ID hashing#449
ianrumac merged 3 commits into
developfrom
codex/fix-play-store-user-id-hash

Conversation

@Makisuo

@Makisuo Makisuo commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Summary

  • hash the stringToSha lambda input instead of DependencyContainer.toString()
  • reuse a SHA-256 hex helper that produces stable two-character bytes
  • strengthen the identity test to verify the user ID reaches the hash function
  • add a deterministic SHA-256 test vector

Root cause

The DependencyContainer lambda used this.toString() inside its body. In that scope, this was the DependencyContainer instance rather than the user ID parameter, so the external account ID was independent of the user and changed with the container instance.

Checks

  • git diff --check
  • standalone Kotlin 2.0.21 compile of String+SHA256.kt
  • verified user-123 hashes to fcdec6df4d44dbc637c7c5b58efface52a7f8a88535423430255be0bb89bedd8 and differs from user-456

Full Gradle tests could not be configured in this environment because no Android SDK or sdk.dir is installed. Java 21 configuration succeeded up to the Android SDK check.

@ianrumac
ianrumac marked this pull request as ready for review August 10, 2026 13:03
claude and others added 2 commits August 10, 2026 13:34
The test asserted externalAccountId equals sha256-of-user-123 but never
stubbed storage.read(AppUserId), so userId fell back to the generated
anonymous alias. Stub the stored app user ID like the sibling test does.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UL13jCN87cPLKtmZnTYUrb
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants