feat(llc): Sanitize X-Stream-Client to prevent customers overriding internal values

[VelikovPetar]

Submit a pull request

CLA

• I have signed the Stream CLA (required).
• The code changes follow best practices
• Code changes are tested (add some information if not applicable)

Description of the pull request

Sanitizes the X-Stream-Client header so SDK consumers can't spoof the identifying fields:

• SystemEnvironmentManager.updateEnvironment now passes the incoming SystemEnvironment through a _sanitize step that locks sdkName, sdkVersion, and osName to internal
  defaults while letting appName, appVersion, osVersion, and deviceModel pass through.
• sdkIdentifier is gated by a new _SdkIdentifier extension type with a precedence ranking — only a dart → flutter promotion is accepted; demotions and unknown values fall
  back to the current identifier.
• The constructor now routes a user-supplied environment through the same updateEnvironment sanitization path instead of trusting it wholesale.
• WebSocket query-string assembly reorders the map so X-Stream-Client is appended after queryParameters, preventing callers from overwriting it.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c853ecee-3858-41e7-bd07-1eb7acaba68d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/sanitize_x_stream_header_client

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}