Delayed connect(), getProfiles() and refresh() responses can repopulate cleared SDK account state after disconnect. An old connect response also restores the SDK authorized flag although the provider remains unauthorized.
Fix: invalidate stale state-producing responses on authorization/session changes within the same provider. Keep provider events working.
Check: delay each response, complete disconnect, then release it and verify disconnected state remains intact.
Delayed connect(), getProfiles() and refresh() responses can repopulate cleared SDK account state after disconnect. An old connect response also restores the SDK authorized flag although the provider remains unauthorized.
Fix: invalidate stale state-producing responses on authorization/session changes within the same provider. Keep provider events working.
Check: delay each response, complete disconnect, then release it and verify disconnected state remains intact.