feat(rokt): add setSession/getSession with optional sessionToken

[jaissica12]

Background

• Expose MPRoktSession handoff (id + optional JWT) for native ↔ WebView continuity, matching Web launcherOptions. Kit seeds Rokt.setSession when a token is present and falls back to setSessionId for id-only.

What Has Changed

• Added MPRoktSession (sessionId, optional sessionToken, optional expiresAt) and public -[MPRokt setSession:] / -[MPRokt getSession], matching Web launcherOptions.
• Kit forwarding: non-empty id + token → +[Rokt setSession:]; id only → setSessionId; empty id is ignored. Token without id is ignored.
• Deprecated setSessionId / getSessionId in favor of the new APIs.
• Bumped the Rokt kit to Rokt-Widget ~> 5.4.0 (Package.swift from: "5.4.0") so native setSession / getSession compile and run.

Screenshots/Video

• {Include any screenshots or video demonstrating the new feature or fix, if applicable}

Checklist

• I have performed a self-review of my own code.
• I have made corresponding changes to the documentation.
• I have added tests that prove my fix is effective or that my feature works.
• I have tested this locally.

Additional Notes

• {Any additional information or context relevant to this PR}

Reference Issue (For employees only. Ignore if you are an outside contributor)

• Closes https://go/j/[ticket-number]

Summary by CodeRabbit

• New Features
  • Added Rokt session support, including session IDs, tokens, and expiration details.
  • Added APIs to set and retrieve complete Rokt sessions.
  • Added a hybrid WebView flow for sharing sessions between native and web experiences.
  • Added demo actions to view the current session and open the hybrid WebView.
• Bug Fixes
  • Improved session and placement request ordering for more consistent Rokt behavior.
• Tests
  • Added coverage for session forwarding, retrieval, validation, and request ordering.

[github-actions]

📦 SDK Size Impact Report

Measures how much the SDK adds to an app's size (with-SDK minus without-SDK).

Metric	Target Branch	This PR	Change
App Bundle Impact	1.81 MB	1.81 MB	+4 KB
Executable Impact	848 bytes	848 bytes	+N/A
XCFramework Size	6.52 MB	6.54 MB	+20 KB

➡️ SDK size impact change is minimal.

Raw measurements

Target branch (main):

{"baseline_app_size_kb":84,"baseline_executable_size_bytes":75464,"with_sdk_app_size_kb":1936,"with_sdk_executable_size_bytes":76312,"sdk_impact_kb":1852,"sdk_executable_impact_bytes":848,"xcframework_size_kb":6672}

This PR:

{"baseline_app_size_kb":84,"baseline_executable_size_bytes":75464,"with_sdk_app_size_kb":1940,"with_sdk_executable_size_bytes":76312,"sdk_impact_kb":1856,"sdk_executable_impact_bytes":848,"xcframework_size_kb":6692}

[cursor]

PR Summary

Medium Risk
Changes Rokt session semantics (JWT handoff) and async forwarding order; partners relying on main-queue setSessionId or id-only flows need to migrate carefully.

Overview
Adds full Rokt session handoff (id, JWT, expiry) via new public MPRoktSession and -[MPRokt setSession:] / getSession, aligned with Web launcherOptions. Legacy setSessionId / getSessionId are deprecated in favor of token-aware APIs.

The Rokt kit forwards complete sessions to Rokt iOS SDK 5.4 (+[Rokt setSession:]), ignores incomplete payloads, and keeps id-only paths behind deprecation-suppressed adapters. Rokt-Widget is pinned to ~> 5.4.0 in the kit podspec.

Core SDK behavior: setSession: and setSessionId: now dispatch on [MParticle messageQueue] (same ordering as selectPlacements) so a handoff always runs before the next placement.

The Example app adds a hybrid WebView demo (RoktHybridWebViewController, bundled rokt-hybrid.html) that injects window.__ROKT_HANDOFF, loads the Web SDK, and can post sessions back to native; menu actions expose current session and open the WebView. Example Podfile points local pods at the repo root, bumps Rokt-Widget / RoktUXHelper to 5.4 / 2.0, and comments out Media SDK (SDK 9 incompatibility).

Tests cover kit validation, getSession nil cases, and core forwarding / ordering for setSession then selectPlacements.

^{Reviewed by Cursor Bugbot for commit 2088e32. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9a35bbf. Configure here.}

[coderabbitai]

📝 Walkthrough

Walkthrough

The SDK adds MPRoktSession with token and expiry support. The Rokt kit forwards and retrieves these sessions. The example app adds a native-to-WebView Rokt handoff with session display, injection, message handling, and placement selection.

Changes

Rokt session handoff

Layer / File(s)	Summary
Session contract and framework wiring mParticle-Apple-SDK/Include/*, mParticle-Apple-SDK/MPRokt*.m, mParticle-Apple-SDK.xcodeproj/project.pbxproj	Adds the public MPRoktSession type, token-aware setSession: and getSession APIs, deprecates ID-only guidance, and includes the new files in the framework target.
Rokt kit session adapter and validation Kits/rokt/rokt/Sources/*, Kits/rokt/rokt/Tests/*, Kits/rokt/rokt/mParticle-Rokt.podspec	Maps token-aware and legacy Rokt sessions to MPRoktSession, validates complete session values, and tests full-session and unavailable-session behavior.
SDK forwarding and ordering UnitTests/ObjCTests/MPRoktTests.m	Tests session forwarding and verifies that session forwarding occurs before placement selection.
Native and WebView handoff Example/mParticleExample/RoktHybridWebViewController.*, Example/mParticleExample/rokt-hybrid.html, Example/mParticleExample/ViewController.m	Adds session display and WebView actions. The controller injects native session data, receives WebView session messages, updates the native session, and selects placements.
Example build and dependency wiring Example/Podfile, Example/mParticleExample.xcodeproj/project.pbxproj, Example/mParticleExample/AppDelegate.m	Updates SDK and Rokt dependencies, registers the controller and HTML resource, and switches example imports to the Objective-C SDK module.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant ViewController
  participant MPRokt
  participant RoktHybridWebViewController
  participant WKWebView
  participant mParticleWebSDK

  ViewController->>MPRokt: getSession
  MPRokt-->>ViewController: return MPRoktSession
  ViewController->>RoktHybridWebViewController: initialize with session
  RoktHybridWebViewController->>WKWebView: inject __ROKT_HANDOFF
  WKWebView->>mParticleWebSDK: initialize with launcherOptions
  mParticleWebSDK->>WKWebView: post roktSession message
  WKWebView->>RoktHybridWebViewController: deliver session payload
  RoktHybridWebViewController->>MPRokt: setSession and selectPlacements

Loading

Suggested reviewers: brandonstalnaker, thomson-t

Merge Risk: 🟡 Moderate · up to 2088e

Session tokens can be exposed through the example UI and logs, and reading a session immediately after setting it can return stale state. Resolve these behaviors before merging.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the primary change: adding Rokt session setter and getter APIs with optional session token support.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 4…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/rokt-session-token-handoff

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

Note

Quiet mode is enabled, so only the most important comments were posted inline. Other review comments are grouped below.

🟡 Other comments (1)

Kits/rokt/rokt/Sources/mParticle-Rokt/MPKitRokt.m-608-608 (1)

608-608: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Clear the full session before applying an ID-only session. MPSetRoktSessionId forwards to the deprecated ID-only API, which does not clear the transaction token. After Rokt.setSession:, getSession can return the previous token-bearing session. Call Rokt.clearSession before MPSetRoktSessionId(sessionId), and add a full-session → ID-only → getSession transition test.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: QUIET

Plan: Advanced

Run ID: d9e6e3d4-1470-4cc5-9514-ced5d7cf58d2

📥 Commits

Reviewing files that changed from the base of the PR and between 316f6f3 and d7ba2d8.

📒 Files selected for processing (17)

• Example/Podfile
• Example/mParticleExample.xcodeproj/project.pbxproj
• Example/mParticleExample/AppDelegate.m
• Example/mParticleExample/RoktHybridWebViewController.h
• Example/mParticleExample/RoktHybridWebViewController.m
• Example/mParticleExample/ViewController.m
• Example/mParticleExample/rokt-hybrid.html
• Kits/rokt/rokt/Sources/mParticle-Rokt/MPKitRokt.m
• Kits/rokt/rokt/Tests/mParticle-RoktObjCTests/mParticle_RoktTests.m
• Kits/rokt/rokt/mParticle-Rokt.podspec
• UnitTests/ObjCTests/MPRoktTests.m
• mParticle-Apple-SDK.xcodeproj/project.pbxproj
• mParticle-Apple-SDK/Include/MPRokt.h
• mParticle-Apple-SDK/Include/MPRoktSession.h
• mParticle-Apple-SDK/Include/mParticle.h
• mParticle-Apple-SDK/MPRokt.m
• mParticle-Apple-SDK/MPRoktSession.m

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

mParticle-Apple-SDK/MPRokt.m (1)

222-222: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Preserve read-after-write behavior for getSession.

Line 222 forwards setSession: asynchronously, but getSession reads the kit immediately. A caller that invokes setSession: and then getSession can receive the previous session or nil. Serialize session reads with writes, and add coverage for this immediate sequence.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: QUIET

Plan: Enterprise

Run ID: 79d310cf-317b-48e1-bb9d-a4291ab67924

📥 Commits

Reviewing files that changed from the base of the PR and between d7ba2d8 and afad498.

📒 Files selected for processing (5)

• Example/mParticleExample/rokt-hybrid.html
• Kits/rokt/rokt/Sources/mParticle-Rokt/MPKitRokt.m
• Kits/rokt/rokt/Tests/mParticle-RoktObjCTests/mParticle_RoktTests.m
• mParticle-Apple-SDK/Include/MPRokt.h
• mParticle-Apple-SDK/MPRokt.m

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

[coderabbitai]

Note

Quiet mode is enabled, so only the most important comments were posted inline. Other review comments are grouped below.

🟡 Other comments (1)

Example/mParticleExample/RoktHybridWebViewController.m-127-130 (1)

127-130: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Reject invalid expiration strings.

numberValue: converts a nonnumeric expiresAt string to @0. Line 127 accepts that value, so the controller constructs MPRoktSession and selects placements for malformed session data. Parse string values strictly and reject values that are not valid epoch-millisecond integers before creating the session.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: QUIET

Plan: Enterprise

Run ID: 979394ed-aa68-4d4e-aa2a-7e94d0633e4e

📥 Commits

Reviewing files that changed from the base of the PR and between afad498 and 2088e32.

📒 Files selected for processing (7)

• Example/mParticleExample/RoktHybridWebViewController.m
• Kits/rokt/rokt/Sources/mParticle-Rokt/MPKitRokt.m
• Kits/rokt/rokt/Tests/mParticle-RoktObjCTests/mParticle_RoktTests.m
• UnitTests/ObjCTests/MPRoktTests.m
• mParticle-Apple-SDK/Include/MPRokt.h
• mParticle-Apple-SDK/Include/MPRoktSession.h
• mParticle-Apple-SDK/MPRokt.m

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.