[fmartingr]

Summary

SessionManager.addSessionHeaders crashes the iOS app with SIGTRAP when the old session's invalidation callback arrives after the new session exists.

• addSessionHeaders invalidates the old Alamofire Session and creates a new one with the same SessionDelegate.
• Session.init sets delegate.stateProvider to the new Session, and the new Session gets its own serial root queue that targets the old one.
• The old URLSession then calls didBecomeInvalidWithError on the old root queue. The shared delegate forwards it to the new Session, and cancelRequestsForSessionInvalidation fails dispatchPrecondition(condition: .onQueue(rootQueue)).

The fix gives the recreated session a new ApiClientSessionDelegate. That class holds no state (it looks sessions up through SessionManager.default), so a new instance behaves the same. The old delegate keeps a weak reference to the old Session only.

Stack (Detox iOS E2E in mattermost-mobile#10149, and a local reproduction):

_dispatch_assert_queue_fail
_dispatchPreconditionTest(_:)
Alamofire.Session.cancelRequestsForSessionInvalidation(with:)   Session.swift:1453
Alamofire.SessionDelegate.urlSession(_:didBecomeInvalidWithError:)   SessionDelegate.swift:76
__NSCFURLSessionDelegateWrapper didBecomeInvalidWithError:

Testing

iOS 26.5 simulator, Release build of mattermost-mobile with this change applied via patch-package. A local server requires the X-Mattermost-Preauth-Secret header. Edit Server → change the pre-auth secret calls addHeaders.

Build	Saves	Crashes
Without fix, no delay	36	0 (timing-dependent)
Without fix, 0.5 s block on the old root queue before invalidateSession	3	3
With fix, same 0.5 s block	13	0
With fix, no delay	34	0

With the fix, the server log shows every request switch to the new header value after each save.

Android is not affected: OkHttp adds headers without recreating the session.

Ticket Link

https://mattermost.atlassian.net/browse/MM-70605

Change Impact: 🟡 Medium

Changes Breakdown:

+3 -1 Production Changes (100%)
+0 -0 Test Changes (0%)

Regression Risk: The change is limited to session recreation in SessionManager.addSessionHeaders, but it affects iOS session management. Test coverage for this path is not reported.

Generated by CodeRabbitAI

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: caab2617-5b57-454e-9e11-3dde89c91f44

📥 Commits

Reviewing files that changed from the base of the PR and between ba64ea4 and adff5a4.

📒 Files selected for processing: 1

• ios/SessionManager.swift

Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

addSessionHeaders now creates a new ApiClientSessionDelegate when it rebuilds a session after adding headers.

Changes: iOS session recreation

Layer / File(s)	Summary
Refresh the session delegate ios/SessionManager.swift	addSessionHeaders assigns a new ApiClientSessionDelegate to the replacement session instead of reusing the previous session’s delegate.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to adff5

A delayed invalidation callback remains associated with the old session instead of acting through its replacement. No unresolved product-facing risk is established.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the iOS fix and the main change: each recreated session receives its own delegate in addSessionHeaders.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[carlisgg]

lgtm