feat(SDK-555): wire Android keychain encryption config

Add IterableConfig.keychainEncryption (default true) and apply it on the
Android bridge, deprecating encryptionEnforced which was never honored.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: jferrao-itrbl

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ### Updates
 
+- Added `IterableConfig.keychainEncryption` (default `true`, Android only) so React Native apps can control native `IterableConfig.Builder.setKeychainEncryption`. Deprecated `IterableConfig.encryptionEnforced`, which was serialized but never applied on Android (SDK-555).
 - Added `Iterable.disableDeviceForAllUsers()` to unregister this device's push token from every user associated with the device (SDK-550).
   - iOS: forwards to native `IterableAPI.disableDeviceForAllUsers()`.
   - Android: graceful no-op that logs a warning; use `disableDeviceForCurrentUser()` to disable push for the current user. There is no public native "all users" equivalent.

android/src/main/java/com/iterable/reactnative/Serialization.java

@@ -250,6 +250,14 @@ static IterableConfig.Builder getConfigFromReadableMap(ReadableMap iterableConte
                 configBuilder.setEnableEmbeddedMessaging(iterableContextJSON.optBoolean("enableEmbeddedMessaging"));
             }
 
+            boolean keychainEncryption = true;
+            if (iterableContextJSON.has("keychainEncryption")) {
+                keychainEncryption = iterableContextJSON.optBoolean("keychainEncryption");
+            } else if (iterableContextJSON.optBoolean("encryptionEnforced")) {
+                keychainEncryption = true;
+            }
+            configBuilder.setKeychainEncryption(keychainEncryption);
+
             if (iterableContextJSON.has("retryPolicy")) {
                 JSONObject retryPolicyJson = iterableContextJSON.getJSONObject("retryPolicy");
                 int maxRetry = retryPolicyJson.getInt("maxRetry");

src/core/classes/Iterable.test.ts

@@ -336,6 +336,7 @@ describe('Iterable', () => {
       expect(config.customActionHandler).toBe(undefined);
       expect(config.dataRegion).toBe(IterableDataRegion.US);
       expect(config.enableEmbeddedMessaging).toBe(false);
+      expect(config.keychainEncryption).toBe(true);
       expect(config.encryptionEnforced).toBe(false);
       expect(config.expiringAuthTokenRefreshPeriod).toBe(60.0);
       expect(config.inAppDisplayInterval).toBe(30.0);
@@ -355,6 +356,7 @@ describe('Iterable', () => {
       expect(configDict.customActionHandlerPresent).toBe(false);
       expect(configDict.dataRegion).toBe(IterableDataRegion.US);
       expect(configDict.enableEmbeddedMessaging).toBe(false);
+      expect(configDict.keychainEncryption).toBe(true);
       expect(configDict.encryptionEnforced).toBe(false);
       expect(configDict.expiringAuthTokenRefreshPeriod).toBe(60.0);
       expect(configDict.inAppDisplayInterval).toBe(30.0);
@@ -375,6 +377,23 @@ describe('Iterable', () => {
       expect(configDict.androidWakeDelayMs).toBe(1500);
       expect(configDict.authCallbackTimeoutMs).toBe(2500);
     });
+
+    it('should allow opting out of Android keychain encryption', () => {
+      const config = new IterableConfig();
+      config.keychainEncryption = false;
+      const configDict = config.toDict();
+      expect(config.keychainEncryption).toBe(false);
+      expect(configDict.keychainEncryption).toBe(false);
+    });
+
+    it('should keep keychainEncryption enabled when only deprecated encryptionEnforced is set', () => {
+      const config = new IterableConfig();
+      config.encryptionEnforced = true;
+      const configDict = config.toDict();
+      expect(config.keychainEncryption).toBe(true);
+      expect(configDict.keychainEncryption).toBe(true);
+      expect(configDict.encryptionEnforced).toBe(true);
+    });
   });
 
   describe('urlHandler', () => {

src/core/classes/IterableConfig.ts

@@ -324,6 +324,16 @@ export class IterableConfig {
   pushPlatform: IterablePushPlatform = IterablePushPlatform.auto;
 
   /**
+   * Android only: whether Iterable encrypts PII (email, userId, auth token) in on-device keychain storage.
+   * When `true` (the default), data is encrypted; when `false`, it is stored in plaintext.
+   * iOS always uses the system Keychain and ignores this option.
+   */
+  keychainEncryption = true;
+
+  /**
+   * @deprecated Use {@link IterableConfig.keychainEncryption} instead. This field is still serialized for
+   * back-compat on Android when `keychainEncryption` is absent from the bridge payload.
+   *
    * Android only feature: This controls whether the SDK should enforce encryption for all PII stored on disk.
    * By default, the SDK will not enforce encryption and may fallback to unencrypted storage in case the encryption fails.
    */
@@ -482,6 +492,7 @@ export class IterableConfig {
       useInMemoryStorageForInApps: this.useInMemoryStorageForInApps,
       dataRegion: this.dataRegion,
       pushPlatform: this.pushPlatform,
+      keychainEncryption: this.keychainEncryption,
       encryptionEnforced: this.encryptionEnforced,
       retryPolicy: this.retryPolicy,
       enableEmbeddedMessaging: this.enableEmbeddedMessaging,