Skip to content

fix(llc): fix userId for guest - #128

Open
renefloor wants to merge 4 commits into
mainfrom
renefloor/flu-373-guest-and-anonymous-login
Open

fix(llc): fix userId for guest#128
renefloor wants to merge 4 commits into
mainfrom
renefloor/flu-373-guest-and-anonymous-login

Conversation

@renefloor

@renefloor renefloor commented Jul 10, 2026

Copy link
Copy Markdown
Collaborator

Submit a pull request

Linear: FLU-373

CLA

  • I have signed the Stream CLA (required).
  • The code changes follow best practices
  • Code changes are tested (add some information if not applicable)

Description of the pull request

When logging in as guest user the backend generates a userId for you. That's in the token, but not available when constructing the tokenManager. By getting it from the token directly we are always sure to have the right user id.

Neede for: GetStream/stream-feeds-flutter#113

Summary by CodeRabbit

  • Breaking Changes

    • Authentication requests now resolve the current token manager and user identity dynamically. Integrations must provide a token manager provider.
  • Bug Fixes

    • Kept request user IDs aligned with the authenticated token.
    • Prevented automatic retries after token-expired server errors.
  • Tests

    • Added coverage for token-manager replacement, user identity handling, token expiration, and WebSocket reconnection behavior.

@renefloor
renefloor requested a review from a team as a code owner July 10, 2026 10:19
@coderabbitai

coderabbitai Bot commented Jul 10, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b5c29abd-1045-4711-b9e2-c30617eef731

📥 Commits

Reviewing files that changed from the base of the PR and between 7ce30eb and 5dc20d8.

📒 Files selected for processing (1)
  • packages/stream_core/test/api/interceptors/auth_interceptor_test.dart

📝 Walkthrough

Walkthrough

AuthInterceptor now resolves the current TokenManager through a provider. Tests cover request identity, static token expiration, manager replacement, and WebSocket reconnection behavior. The changelog records the breaking constructor change.

Changes

Dynamic authentication runtime

Layer / File(s) Summary
Dynamic token manager contract
packages/stream_core/lib/src/api/interceptors/auth_interceptor.dart, packages/stream_core/CHANGELOG.md
AuthInterceptor accepts a TokenManagerProvider and resolves the active manager during request handling. Documentation records the constructor change and identity consistency requirement.
Authentication request and refresh validation
packages/stream_core/test/api/interceptors/auth_interceptor_test.dart
Tests capture requests, generate JWT-like tokens, verify manager replacement and identity propagation, and confirm that static providers do not refresh or retry expired requests.
WebSocket reconnection state validation
packages/stream_core/test/ws/client/web_socket_connection_state_test.dart
Tests verify that token-expired disconnects disable reconnection and generic retryable server errors preserve reconnection.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant AuthInterceptor
  participant TokenManagerProvider
  participant TokenManager
  participant HTTPRequest
  AuthInterceptor->>TokenManagerProvider: Resolve current manager
  TokenManagerProvider-->>AuthInterceptor: Return TokenManager
  AuthInterceptor->>TokenManager: Load token and userId
  AuthInterceptor->>HTTPRequest: Set authorization and user_id
Loading

Suggested reviewers: brazol

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the primary change: fixing the guest user's userId.
Description check ✅ Passed The description includes the required ticket, CLA confirmations, and a clear explanation of the guest userId fix.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renefloor/flu-373-guest-and-anonymous-login

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Jul 10, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 80.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 58.89%. Comparing base (36559fb) to head (5dc20d8).
⚠️ Report is 17 commits behind head on main.

Files with missing lines Patch % Lines
...ore/lib/src/api/interceptors/auth_interceptor.dart 80.00% 1 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff             @@
##             main     #128       +/-   ##
===========================================
+ Coverage   45.80%   58.89%   +13.08%     
===========================================
  Files         178      187        +9     
  Lines        7243     7617      +374     
===========================================
+ Hits         3318     4486     +1168     
+ Misses       3925     3131      -794     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Comment on lines +26 to +31
// Use the resolved token's own user id rather than
// `_tokenManager.userId`: some token providers (e.g. guest exchanges)
// can resolve to a different id than the one originally requested, and
// this must stay consistent with the identity in the `Authorization`
// header below.
options.queryParameters['user_id'] = token.userId;

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In my opinion the token should always match the id set in the token manager. if its different we should expire the current token and get a new token for the user id set in the manager.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/stream_core/lib/src/api/interceptors/auth_interceptor.dart`:
- Around line 80-84: Bind token-expiration handling to the dispatched request by
storing the resolved token manager in RequestOptions.extra immediately after
token loading. In onError, compare that stored manager with the current
_tokenManager and only expire and retry when they are identical; otherwise
forward the error, while preserving the static-provider path. Add a regression
test covering a manager swap after dispatch.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 66c5109e-d536-4207-bad4-c499e1c4ff19

📥 Commits

Reviewing files that changed from the base of the PR and between 25f34b5 and 7ce30eb.

📒 Files selected for processing (4)
  • packages/stream_core/CHANGELOG.md
  • packages/stream_core/lib/src/api/interceptors/auth_interceptor.dart
  • packages/stream_core/test/api/interceptors/auth_interceptor_test.dart
  • packages/stream_core/test/ws/client/web_socket_connection_state_test.dart

Comment thread packages/stream_core/lib/src/api/interceptors/auth_interceptor.dart
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants