use locks for safer thread safety with purchase/restore continuations

[salami]

Note

Medium Risk
Touches purchase/restore bridging on both Android and iOS; concurrency/locking changes can affect transaction completion paths and are hard to test exhaustively, but scope is limited to continuation management.

Overview
Improves thread-safety of the React Native purchase/restore bridge on Android and iOS by guarding active continuations with locks and making completion a single-consumer take*Continuation() operation.

Replaces ad-hoc clearing with safe set/take/conditional-clear helpers, cancels any orphaned in-flight continuation when a new one starts, and adds warnings when result handlers are invoked without an active continuation.

^{Reviewed by Cursor Bugbot for commit f47c326. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Refactor
  • Enhanced internal stability and resource management for purchase and restore operations across Android and iOS platforms.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6c7a7938-0a9a-4b8a-963d-4485216f6d24

📥 Commits

Reviewing files that changed from the base of the PR and between f8febce and f47c326.

📒 Files selected for processing (2)

• android/src/main/java/com/paywallsdkreactnative/HeliumBridge.kt
• ios/HeliumSwiftInterface.swift

---

📝 Walkthrough

Walkthrough

Thread-safety improvements to the purchase and restore continuation management in both Android and iOS bridges. Replaced unsynchronized public continuation fields with privately-backed variables protected by locks, and introduced atomic accessor methods (set, take, clear) to manage continuation lifecycle safely across threads.

Changes

Cohort / File(s)	Summary
Android Continuation Synchronization android/src/main/java/com/paywallsdkreactnative/HeliumBridge.kt	Replaced public purchaseContinuation and restoreContinuation fields with private _purchaseContinuation and _restoreContinuation backed by a shared continuationLock. Added atomic accessor methods: set*Continuation(), take*Continuation(), and clear*ContinuationIf(). Updated handlePurchaseResult/handleRestoreResult to consume continuations atomically via take*. Refactored CustomPaywallDelegate callbacks to register continuations safely and clear only when expected.
iOS Continuation Synchronization ios/HeliumSwiftInterface.swift	Replaced public activePurchaseContinuation and activeRestoreContinuation properties with locked private _activePurchaseContinuation and _activeRestoreContinuation. Implemented set*Continuation() (resumes orphaned continuations before storing new ones) and take*Continuation() (atomically retrieves and clears). Updated bridge result handlers and async delegate methods to use atomic operations for safe continuation lifecycle management.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• HEL-3368 Implement android interface #49: Updates thread-safety and lifecycle of purchase/restore continuations by replacing unsynchronized fields with locked private backing and atomic accessor methods in HeliumBridge.kt
• Interface updates #67: Modifies purchase/restore continuation handling patterns across both Android and iOS bridges using single-slot atomic access patterns
• HEL-5180 revamp ios to latest, using 4.3.0 sdk #68: Modifies the same iOS continuation-based purchase/restore bridging logic with guarded atomic setters and takers for safe lifecycle management

Suggested reviewers

• anishpdoshi
• koyinusa

Poem

🐰 A lock guards each continuation tight,
No race conditions in the night—
Set, take, and clear with atomic grace,
Purchase flows at a safer pace! ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 15.79% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: replacing unsynchronized fields with lock-protected storage for purchase/restore continuations in both Android and iOS implementations.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch SDK-20-purchase-continuation-thread-safety

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}