Fix the demo chat never connecting for built-in users

[andremion]

Goal

Fixes AND-1580

In the demo app, the call chat never loaded for a user from the built-in users list. The chat client connected as user.id but requested its token for user.custom["email"]. Built-in users have no email, so the token was for another user and the connection failed.

Implementation

• The chat TokenProvider in StreamVideoInitHelper.initializeStreamChat requests the token for the connected user id.
• The video TokenProvider in initializeStreamVideo also uses user.id directly. The email fallback it replaced always gave the same id, because only LoginViewModel.signInSuccess sets email, and it sets it to the same value as id.
• Removed the unused token parameter of initializeStreamChat.

Testing

1. Install a development debug build of the demo app.
2. Log in with a built-in user (for example andrerego).
3. Start a new call and join it.
4. Open the chat: the channel loads, and a sent message shows as sent.

Also check that a Google or email login still connects chat and video.

Validation: ./gradlew spotlessApply and :demo-app:compileDevelopmentDebugKotlin pass. Steps 1 to 4 were run on an API 35 emulator. The logcat shows the chat token request with user_id and no JWT mismatch error. The video provider only runs on token renewal, and that path was not triggered on device.

Summary by CodeRabbit

• Bug Fixes
  • Chat initialization and video token renewal now use the account’s user ID for authentication, rather than substituting an email address when one is available. This keeps authentication consistent across both processes.

[andremion]

@CodeRabbit review

[github-actions]

PR checklist ✅

All required conditions are satisfied:

• Title length is OK (or ignored by label).
• At least one pr: label exists.
• Sections ### Goal, ### Implementation, and ### Testing are filled, or the PR is bot-authored.
• An issue is linked (Linear ticket or GitHub issue), or the PR is bot-authored.

🎉 Great job! This PR is ready for review.

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[github-actions]

SDK Size Comparison 📏

SDK	Before	After	Difference	Status
stream-video-android-core	12.38 MB	12.38 MB	0.00 MB	🟢
stream-video-android-ui-xml	5.66 MB	5.66 MB	0.00 MB	🟢
stream-video-android-ui-compose	6.19 MB	6.19 MB	0.00 MB	🟢

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: bc5bd135-fce5-4c8b-8090-34c2ac0d160c

📥 Commits

Reviewing files that changed from the base of the PR and between 4da50b2 and 1824d52.

📒 Files selected for processing (1)

• demo-app/src/main/kotlin/io/getstream/video/android/util/StreamVideoInitHelper.kt

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

---

Walkthrough

Chat initialization and Stream Video token renewal now request auth data using the user’s ID. Chat initialization no longer passes a token parameter.

Changes

Auth lookup updates

Layer / File(s)	Summary
Use user IDs for auth lookups demo-app/src/main/kotlin/io/getstream/video/android/util/StreamVideoInitHelper.kt	Chat initialization no longer passes a token parameter. Chat and Stream Video token requests use the user’s ID instead of a custom email.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Suggested reviewers: rahul-lohra

Merge Risk: ⚪ Minimal · up to 1824d

Chat continues to obtain its token through the provider, and the changed lookups follow the user-ID convention used elsewhere in the app. No concrete merge-blocking regression is established.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 1824d

The change aligns token requests with the connected user’s ID. No new authentication bypass is demonstrated, and Chat already used provider-based token loading. Risk remains low rather than minimal because remote token ownership and some renewal and user-switching behavior could not be verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The immediate security scope is the demo app’s Chat connection and Video renewal for the selected user and environment. Downstream access depends on the returned credentials; the remote service’s maximum identity, project and environment authority cannot be established from the client contract.

Trust Boundaries and Controls

• observed — The client supplies the requested identity to the remote token authority and consumes its returned token. Aligning that request with the connected SDK ID removes the email substitution, but the available client code does not establish server-side authorization or response ownership.

Resilience and Maintainability Implications

• observed — Explicit sign-out requests Chat disconnection, clears the stored user, logs out Video and removes its client. reloadSdk instead removes only the Video client before reinitializing. These paths are unchanged by the identity-lookup edits; completion of cleanup and isolation during callback races remain unverified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the primary change: fixing demo chat connectivity for built-in users.
Description check	✅ Passed	The description explains the goal, implementation, testing steps, validation results, and linked issue. The UI Changes, contributor checklist, reviewer checklist, and GIF sections are not included, bu…

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the tokens bright
User IDs now guide the flight
Chat finds auth along its way
Video renews by ID each day
I nibble clover, hop, and cheer!}

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[stream-public-bot]

🚀 Available in v1.36.0