refactor: merge OpenAPI changes#1809
Open
MartinCupela wants to merge 12 commits into
Open
Conversation
## Summary - Add explicit least-privilege `permissions` blocks to workflow files flagged by CodeQL. - Scopes derived from workflow operations (build, artifacts, Danger, release git push). - Resolves **6** open `actions/missing-workflow-permissions` alerts. ## Linear - Parent: [APPSEC-164](https://linear.app/stream/issue/APPSEC-164) ## Test plan - [x] CI green - [ ] Code scanning alerts close after merge
## CLA - [ ] I have signed the [Stream CLA](https://docs.google.com/forms/d/e/1FAIpQLScFKsKkAJI7mhCr7K9rEIOpqIDThrWxuvxnwUq2XkHyG154vQ/viewform) (required). - [ ] Code changes are tested ## Description of the changes, What, Why and How? Fixes [this issue](https://getstream.slack.com/archives/C02GBL5M1BK/p1782247679872819). Even though it's benign, it is entirely possible that `ThreadManager.reload()` can be invoked specifically when connection is recovered without actually using threads or having ever loaded the `ThreadList`. Since the actual query is also gated behind `activate()` invocations, we can use this approach to see if it's been activated at least once. The `active` state can unfortunately not be used as we'll often actually want to reload threads in the background, even while the `ThreadManager` might not necessarily be active. ## Changelog -
## [9.50.1](v9.50.0...v9.50.1) (2026-07-09) ### Bug Fixes * prevent reload if ThreadManager has never been activated ([#1798](#1798)) ([affbb9c](affbb9c))
…ions (#1800) Adds an ability to bypass default permission checks for custom upload functions.
## [9.50.2](v9.50.1...v9.50.2) (2026-07-16) ### Bug Fixes * **AttachmentManager:** add permission bypass for custom upload functions ([#1800](#1800)) ([30e6bc4](30e6bc4))
#1760) Merge origin/release-v10 (OpenAPI generated-client integration) into the message-paginator branch, keeping our paginator architecture and adapting to the generated client surface. Source (yarn types clean, 191 -> 0 errors): - Channel extends ChannelApi / StreamChat extends ChatApi; generated methods take a single typed request object instead of positional args. - Sort format -> SortParamRequest[]; normalizeQuerySort/makeComparator accept both record and array term forms. - Date-aligned timestamps (Date, not ISO strings) across message/read state. - queryChannels returns the raw response; queryChannelsAndHydrate returns hydrated Channel[]. client.post/get/logger removed in favor of the gen client + chatLoggerSystem. - Restore Channel constructor `this.data = data` init (reactive data view), which the merge had dropped. Tests: resolved all 12 conflicted files. channel/channel_state kept on the paginator architecture (theirs exercised the removed addMessagesSorted/ messageSets APIs); client query tests moved to queryChannelsAndHydrate. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Green the unit suite after the message-paginator <-> OpenAPI reconciliation
(2470 passing, 0 failing; was ~149 red).
Test updates:
- Paginator specs: queryUserGroups -> listUserGroups; getReplies/queryChannels
positional-arg assertions -> single request object; UserGroup created_at as Date.
- Orchestrator: mock queryChannelsAndHydrate (the paginator's actual call).
- threads: getThread mock returns { thread }; single-object call args.
- channel.test.js: single-object reaction/message APIs, client.api.sendRequest
mocks (client.post/get/logger removed), client.user setup, dropped tests for
validation that no longer exists in source.
- cleanData/messageComposer/MessagePaginator: null -> undefined expectations.
Source fixes required for correct behavior:
- Restore Channel constructor `this.data = data` (reactive data view the merge
had dropped; channel.data was undefined post-construction).
- formatMessage: error/quoted_message -> undefined (matches optional types).
- runDetached default error path -> chatLoggerSystem logger.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Delete `unformatMessage` from src/utils.ts: dead code (no callers, not exported) that the OpenAPI integration (#1760) had already removed on the release-v10 side; it only survived here from the message-paginator branch. - Resolve all `yarn eslint` problems (was 75: 14 errors, 61 warnings) with no runtime behavior change: - jsdoc/check-param-names: fix/remove stale @param names left by the single-object signature changes. - jsdoc/require-param-description: add concise param descriptions. - unused-imports/no-unused-vars: drop or `_`-prefix unused bindings; scoped, justified eslint-disable only for the destructure-to-omit block in localMessageToNewMessagePayload. - no-non-null-assertion: replace `type!` with `type as string` behind the existing guard. yarn lint clean, yarn types 0 errors, yarn test-unit 2470 passing. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
MartinCupela
requested review from
arnautov-anton,
isekovanic,
oliverlaz,
santhoshvai,
szuperaz and
vishalnarkhede
as code owners
July 24, 2026 15:57
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Goal
Merge OpenAPI changes into the message pagination state rewrite branch.