title: Unexpected behavior when refreshing token of a user who is the unique member of a device group
body: <p>I implemented the mapping between devices, registration ids, and groups as explained <a href="https://stackoverflow.com/questions/40140201/handling-refresh-tokens-for-fcm-device-groups/40158260#40158260">here</a></p>
  
  <p>Basically came up with a table where to store the device reg id and the notification key of the group to which it is registered (if any) , and added to my user table two fields to keep track of the number of devices that user has logged into and what is his pre determined group name.</p>
  
  <p>Unfortunately, while testing, I incurred into a very strange behavior when refreshing the token of a user, who is also the only member of a device group.</p>
  
  <p>as explained in the comments to the question i asked <a href="https://stackoverflow.com/questions/43503813/firebase-delete-a-device-group-without-knowing-the-registration-ids-of-its-mem/43509026?noredirect=1#comment74344011_43509026">here</a></p>
  
  <blockquote>
    <p>if the previous token was the only member of a device group, after getting refreshed it is invalidated but the group keeps existing and somehow the new token gets added to it. i can even successfully remove the new token from the group thus deleting it, or i can notify the group "waking it up" and making it to auto remove itself</p>
  </blockquote>
  
  <p>in the couple of tries i have done right now before posting this is what happened:</p>
  
  <ol>
  <li>get a new token say <code>reg_id1</code></li>
  <li>register <code>reg_id1</code> to device group <code>test_group</code> (creating it)</li>
  </ol>
  
  <p>code to create group:</p>
  
  <pre><code>curl --header "Authorization: your_key" 
  --header Content-Type:"application/json" 
  -H "project_id:your_id"   https://android.googleapis.com/gcm/notification 
  -d "{ \"operation\": \"create\", \"notification_key_name\": 
  \"test_group\", \"registration_ids\": [\"reg_id1\" ] }"
  </code></pre>
  
  <ol start="3">
  <li>test that the group exists</li>
  </ol>
  
  <p>with this</p>
  
  <pre><code>curl -v -H "Content-Type:application/json" -H "Authorization:key=your_key" 
  -H "project_id:your_id"
  https://android.googleapis.com/gcm/notification?notification_key_name=test_group
  </code></pre>
  
  <ol start="4">
  <li>refresh <code>reg_id1</code> with the way you prefer (deleting app data if on android or requesting new token if on web app )</li>
  <li>check what happened to the group with the command at point 3</li>
  </ol>
  
  <p>the group still exists (even if the only token there is now invalid)</p>
  
  <ol start="6">
  <li>try deleting old token. what should happen? well, the answer is reasonable..the token we are trying to remove is not valid anymore</li>
  </ol>
  
  <p>code to remove</p>
  
  <pre><code>curl --header "Authorization: key=your_key" 
  --header Content-Type:"application/json" -H "project_id:your_id" 
  https://android.googleapis.com/gcm/notification 
  -d "{ \"operation\": \"remove\", \"notification_key_name\": 
  \"test_group\", \"notification_key\": \"group_key\", 
  \"registration_ids\": [\"reg_id1\" ] }"
  </code></pre>
  
  <ol start="7">
  <li>Here comes the fun: try deleting the new refreshed token from the same group ! you will get a notification key in return , meaning that there were no errors..but wait ! how could it be?</li>
  <li>ping the group again with command at point 3 and.. the group still exists?! (<strong>previously, at the time of the problem in original question, while removing the new token from android, the group would cease to exist after this point</strong>..now with curl it continues living)</li>
  <li>try notifying the group then!</li>
  </ol>
  
  <p>code</p>
  
  <pre><code>curl -X POST -H "your_key" 
  -H "Content-Type: application/json" 
  -d '{ 
  "notification": {
   "title": "Portugal vs. Denmark",
   "body": "5 to 1",
   "icon": "firebase-logo.png",
   "click_action": "http://localhost:8081"
  },
  "to": "group_key"
  }' "https://fcm.googleapis.com/fcm/send"
  </code></pre>
  
  <ol start="10">
  <li>what happens now is that you get 1 failure (which is ok) and if you try to ping the group again it will be magically disappeared..</li>
  </ol>
  
  <p>Sorry for being so long but i wanted to write all the steps so that you can reproduce the behavior easily.</p>
  
  <p>Can someone explain all of this? 
  In my android app if the user deletes app data he will need to login again, since the creation/add to a device group is upon login, i need to delete the old token from the group (and delete the group if it was the last) so that he will be able to re-enter the group again (or create it).
  But i can't remove the old token directly because it is invalid.
  still, the group continues existing even if its only member is invalid. should i just notify it to <code>wake it up</code> and make it delete itself?
  should i remove the new token from the group as well ? (in android this would strangely lead to deleting the group)</p>
  
  <p>EDIT:
  after testing this morning i have a new use case:</p>
  
  <ol>
  <li>Create group with reg_id1 subscribed to it</li>
  <li>refresh reg_id1</li>
  <li>recreation of group says that group exists ( i can ping it ad receive a notification key in response)</li>
  <li>try to delete new token from group gives error 500</li>
  <li>notification test to the group gives <strong>0 success and 0 failure</strong></li>
  <li>try to remove old token from group gives back notification key (should be a positive answer) </li>
  <li>now group doesn't exist anymore</li>
  </ol>
  
  <p>EDIT2:</p>
  
  <p>after lots and lots of testing i came to these conclusions:</p>
  
  <ul>
  <li>refreshing a token on android application invalidates it, if it was the only member of a device group, a simple notification to that group will wake it up and make it auto delete itself.</li>
  <li>refreshing a token on a web application does not invalidate the token, if it was the only member of a device group, notifying the group will result in a 0 success 0 failure. while being invisible the token is still registered to the group and the group will cease to exist only when the old token will be removed. in this case, even if still there the old token won't concur to the limit of 20 devices ( i successfully registered and refreshed 25 tokens to the same group).
  What is needed now is a way to retrieve the old token to remove it from the group , in a web application scenario. this is crucial since a web application doesn't have a unique id therefore it can't be mapped as in android (with the android id) to the registration token, and the old token won't even appear as a failure when notifying, meaning that it's almost impossible to retrieve it after it was refreshed.</li>
  </ul>