Show other members' active live locations when a channel loads

[gpunto]

Goal

Channel.activeLiveLocations was never populated from REST, so another member's active live location did not show when a channel or the channel list loaded, only after their next location update. The backend sends active_live_locations on the channel state, next to messages and members, but the SDK read it from the nested channel object. Port of #6742 to v6.

Closes AND-1576

Implementation

• Parse active_live_locations on the channel state response and map it onto the channel, for query channel, query channels and grouped channels. Drop the field from the nested channel DTO, where the backend never sends it.
• Add the channel's live locations to the global state when channel data is applied, which covers query channel results and channel list updates. ChannelState and QueryChannelsState read their live locations from there.
• Stop reading live locations from event channels, which never carry them.
• Don't restore active live locations from the stored channel. Stopping a live location does not update the stored list, so the cache could bring back a stopped one after a restart.

Testing

• Parsing tests for the three responses, MoshiChatApiTest rows per path, and a ChannelStateLogicTest case checking a queried channel's live location reaches the global state.
• On a device, a second user shared a live location in fresh channels the current user was a member of but not watching. Without the fix none of the locations reached the SDK. With it, the other member's location appeared in the queried channel, in ChannelState on channel load and in the channel list. Grouped channels is not available on the sample app, so it is covered by unit tests only.
• On a device, the sharer stopped and the app restarted: the stopped location stays gone, while before the change it came back from the cache. ChannelMapperTest covers it too.

🤖 Generated with Claude Code

[github-actions]

PR checklist ✅

All required conditions are satisfied:

• Title length is OK (or ignored by label).
• At least one pr: label exists.
• Sections ### Goal, ### Implementation, and ### Testing are filled (or ignored for dependabot PRs).

🎉 Great job! This PR is ready for review.

[github-actions]

SDK Size Comparison 📏

SDK	Before	After	Difference	Status
stream-chat-android-client	5.26 MB	5.32 MB	0.06 MB	🟢
stream-chat-android-offline	5.49 MB	5.54 MB	0.05 MB	🟢
stream-chat-android-ui-components	10.64 MB	10.76 MB	0.12 MB	🟢
stream-chat-android-compose	12.87 MB	13.15 MB	0.29 MB	🟡

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 52be5ef1-25da-4656-be1b-7866fb08f9f4

📥 Commits

Reviewing files that changed from the base of the PR and between 3eebaa4 and 6b7b100.

📒 Files selected for processing (12)

• stream-chat-android-client/src/main/java/io/getstream/chat/android/client/api2/MoshiChatApi.kt
• stream-chat-android-client/src/main/java/io/getstream/chat/android/client/api2/mapping/DomainMapping.kt
• stream-chat-android-client/src/main/java/io/getstream/chat/android/client/api2/model/dto/ChannelDtos.kt
• stream-chat-android-client/src/main/java/io/getstream/chat/android/client/api2/model/response/ChannelResponse.kt
• stream-chat-android-client/src/test/java/io/getstream/chat/android/client/api2/MoshiChatApiTest.kt
• stream-chat-android-client/src/test/java/io/getstream/chat/android/client/api2/MoshiChatApiTestArguments.kt
• stream-chat-android-client/src/test/java/io/getstream/chat/android/client/parser2/ChannelStateActiveLiveLocationsParsingTest.kt
• stream-chat-android-client/src/test/java/io/getstream/chat/android/client/parser2/testdata/ChannelTestData.kt
• stream-chat-android-state/src/main/java/io/getstream/chat/android/state/event/handler/internal/EventHandlerSequential.kt
• stream-chat-android-state/src/main/java/io/getstream/chat/android/state/plugin/logic/channel/internal/ChannelStateLogic.kt
• stream-chat-android-state/src/test/java/io/getstream/chat/android/state/event/handler/internal/EventHandlerSequentialTest.kt
• stream-chat-android-state/src/test/java/io/getstream/chat/android/state/plugin/logic/channel/internal/ChannelStateLogicTest.kt

💤 Files with no reviewable changes (4)

• stream-chat-android-client/src/main/java/io/getstream/chat/android/client/api2/mapping/DomainMapping.kt
• stream-chat-android-state/src/test/java/io/getstream/chat/android/state/event/handler/internal/EventHandlerSequentialTest.kt
• stream-chat-android-client/src/main/java/io/getstream/chat/android/client/api2/model/dto/ChannelDtos.kt
• stream-chat-android-state/src/main/java/io/getstream/chat/android/state/event/handler/internal/EventHandlerSequential.kt

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

Walkthrough

Channel responses now provide active live locations to domain channels. Channel state updates add those locations to global state. Parsing and state tests cover the response and update paths.

Changes

Active live-location mapping

Layer / File(s)	Summary
Channel response mapping stream-chat-android-client/src/main/java/.../api2/, stream-chat-android-client/src/test/java/.../api2/, stream-chat-android-client/src/test/java/.../parser2/	ChannelResponse now contains active_live_locations. MoshiChatApi maps those values to domain channel locations. Tests cover parsing and the queryChannel, queryChannels, and queryGroupedChannels paths.
Global state update stream-chat-android-state/src/main/java/.../, stream-chat-android-state/src/test/java/.../	ChannelStateLogic adds channel active live locations to global state. EventHandlerSequential no longer adds them from HasChannel events. State tests cover channel-query propagation; event tests retain shared-location cases for message events.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 6b7b1

This change loads other members' active live locations when a channel loads. No concrete merge-blocking risk was found in the supplied context.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 6b7b1

Channel loads now populate shared state with members’ live locations. A delayed response may make previously received coordinates appear active after sharing has ended. The identified exposure is limited to client-side state; request permissions are unchanged, and access by an unauthorized viewer has not been demonstrated.

Retained concerns

• Low · security · inferred: If a delayed channel response is applied after a newer ended-location event, its older future endAt can reinsert previously received coordinates into active live-location state. The merge has no freshness comparison or terminal marker. This PR extends that pre-existing merge behavior to routine channel loads; it does not demonstrate continued location collection or access by a new viewer.

Security review details

Security Blast Radius

• inferred — The identified transition risk affects previously received live-location data across queried channels in the client’s shared state and its channel/list consumers. The examined path changes neither the querying identity nor endpoint authority; it does not establish cross-tenant access, additional privileges or collection of fresh coordinates after sharing stops.

Security Findings and Attack Paths

• inferred — A query may capture a location with a future endAt, followed by an ended-location message event that removes it. Applying the earlier successful response afterward can restore it because insertion trusts that older endAt and retains no terminal marker. This is an inferred state-replay path, not a verified backend authorization vulnerability; the same merge was already used by explicit location queries.

Trust Boundaries and Controls

• observed — The source is a REST response carrying member-location data, and the sensitive outcome is its availability through client state. Existing query routing remains intact and channel consumers filter by cid. The mapper relies on server-supplied location identities; this repository evidence does not establish the backend authorization or enclosing-channel consistency guarantees.

Resilience and Maintainability Implications

• observed — Failed channel queries take an error path rather than importing locations. User disconnect invokes registry cleanup and clears the global location list. These controls bound normal failure and session teardown, but do not resolve ordering between an already successful snapshot and newer location events.

Hardening Proposals

• proposed — Define snapshot completeness and a common freshness rule for REST responses and events. Preserve terminal sharing state against older responses, for example through comparable versions or generation-scoped terminal markers, and validate delayed-response behavior after stop and newer updates. Do not prune omitted locations until the server’s snapshot authority is established.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 13.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 8 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly describes the primary change: showing other members' active live locations when channel data loads.
Description check	✅ Passed	The description includes complete Goal, Implementation, and Testing sections. It explains the bug, the response mapping changes, global-state behavior, regression coverage, device testing, and linked …

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit reads the channel stream,
And finds live dots inside the response.
They hop from channel into state,
While tests check each location’s path.
The rabbit thumps: “All mapped with care!”}

_{Comment @coderabbitai help to get the list of available commands.}

[andremion]

Looks good. One optional question inline.

[sonarqubecloud]

Quality Gate failed

Failed conditions
75.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

[stream-public-bot]

🚀 Available in v6.45.2