@automattic/vip 4.1.5 → 4.1.6

package/internal/telemetry/pendo_test.go

@@ -1,252 +0,0 @@
-package telemetry
-
-import (
-	"encoding/json"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-// captureRequest runs a PendoClient.TrackEvent call against a local httptest
-// server and returns the decoded request payload plus the raw HTTP request.
-func captureRequest(t *testing.T, c *PendoClient, name string, props map[string]any) (pendoPayload, *http.Request) {
-	t.Helper()
-	var captured pendoPayload
-	var capturedReq *http.Request
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		capturedReq = r
-		b, _ := io.ReadAll(r.Body)
-		if err := json.Unmarshal(b, &captured); err != nil {
-			t.Fatalf("could not decode Pendo payload: %v\nbody: %s", err, b)
-		}
-		w.WriteHeader(200)
-	}))
-	t.Cleanup(srv.Close)
-
-	c.Endpoint = srv.URL
-	c.GetToken = func() (string, error) { return "fixture-token", nil }
-	if err := c.TrackEvent(name, props); err != nil {
-		t.Fatalf("TrackEvent returned unexpected error: %v", err)
-	}
-	if capturedReq == nil {
-		t.Fatal("no request received by test server")
-	}
-	return captured, capturedReq
-}
-
-func TestPendoRejectsHTTPFailure(t *testing.T) {
-	for _, status := range []int{401, 403, 429, 500} {
-		t.Run(http.StatusText(status), func(t *testing.T) {
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				w.WriteHeader(status)
-				_, _ = w.Write([]byte("private response body"))
-			}))
-			defer srv.Close()
-			c := &PendoClient{Endpoint: srv.URL, HTTP: srv.Client(), UserID: "fixture", GetToken: func() (string, error) { return "fixture-token", nil }}
-			if err := c.TrackEvent("test", nil); err == nil {
-				t.Fatal("failed delivery was reported as successful")
-			}
-		})
-	}
-}
-
-// TestPendoClientPostsExpectedPayload verifies that TrackEvent sends a POST
-// with the correct JSON body matching Node's send() output: event name (prefixed),
-// type "track", visitorId, accountId, context fields, and properties.
-func TestPendoClientPostsExpectedPayload(t *testing.T) {
-	c := &PendoClient{
-		UserID:      "test-anon-uuid-1234",
-		UserAgent:   "vip-cli/test-0.1",
-		EventPrefix: TracksEventPrefix,
-	}
-	props := map[string]any{
-		"command":  "vip whoami",
-		"org_slug": "my-org",
-		"org_sfid": "SF-999",
-	}
-
-	payload, req := captureRequest(t, c, "whoami_command_execute", props)
-
-	// --- HTTP method and Content-Type ---
-	if req.Method != "POST" {
-		t.Errorf("HTTP method = %q, want POST", req.Method)
-	}
-	ct := req.Header.Get("Content-Type")
-	if ct != "application/json" {
-		t.Errorf("Content-Type = %q, want application/json", ct)
-	}
-	if req.Header.Get("User-Agent") != "vip-cli/test-0.1" {
-		t.Errorf("User-Agent = %q, want vip-cli/test-0.1", req.Header.Get("User-Agent"))
-	}
-
-	// --- type field ---
-	if payload.Type != "track" {
-		t.Errorf("type = %q, want track", payload.Type)
-	}
-
-	// --- event name: should be auto-prefixed ---
-	wantEvent := "vip_cli_whoami_command_execute"
-	if payload.Event != wantEvent {
-		t.Errorf("event = %q, want %q", payload.Event, wantEvent)
-	}
-
-	// --- visitorId == userId ---
-	if payload.VisitorID != "test-anon-uuid-1234" {
-		t.Errorf("visitorId = %q, want test-anon-uuid-1234", payload.VisitorID)
-	}
-
-	// --- accountId == org_sfid ---
-	if payload.AccountID != "SF-999" {
-		t.Errorf("accountId = %q, want SF-999", payload.AccountID)
-	}
-
-	// --- context.userId == userId ---
-	if payload.Context.UserID != "test-anon-uuid-1234" {
-		t.Errorf("context.userId = %q, want test-anon-uuid-1234", payload.Context.UserID)
-	}
-
-	// --- context.userAgent ---
-	if payload.Context.UserAgent != "vip-cli/test-0.1" {
-		t.Errorf("context.userAgent = %q, want vip-cli/test-0.1", payload.Context.UserAgent)
-	}
-
-	// --- properties are passed through ---
-	if v, ok := payload.Properties["command"]; !ok || v != "vip whoami" {
-		t.Errorf("properties[command] = %v, want vip whoami", v)
-	}
-
-	// --- timestamp is non-zero ---
-	if payload.Timestamp == 0 {
-		t.Errorf("timestamp = 0, want non-zero Unix milliseconds")
-	}
-}
-
-// TestPendoClientCarriesUserIdentity verifies that the anonymous UUID appears
-// in both visitorId (top-level) and context.userId, matching Node's behavior
-// where visitorId = `${ this.context.userId }` and context.userId = this.userId.
-func TestPendoClientCarriesUserIdentity(t *testing.T) {
-	const anonID = "deadbeef-cafe-babe-0000-111122223333"
-	c := &PendoClient{
-		UserID:      anonID,
-		UserAgent:   "vip-cli/test-0.1",
-		EventPrefix: TracksEventPrefix,
-	}
-
-	payload, _ := captureRequest(t, c, "some_event", nil)
-
-	if payload.VisitorID != anonID {
-		t.Errorf("visitorId = %q, want %q", payload.VisitorID, anonID)
-	}
-	if payload.Context.UserID != anonID {
-		t.Errorf("context.userId = %q, want %q", payload.Context.UserID, anonID)
-	}
-}
-
-// TestPendoClientHonorsExplicitPrefix verifies that a name already carrying
-// the prefix is not double-prefixed (mirrors Node: if (!eventName.startsWith(this.eventPrefix))).
-func TestPendoClientHonorsExplicitPrefix(t *testing.T) {
-	c := &PendoClient{
-		UserID:      "u",
-		UserAgent:   "x",
-		EventPrefix: TracksEventPrefix,
-	}
-
-	payload, _ := captureRequest(t, c, "vip_cli_already_prefixed", nil)
-
-	if payload.Event != "vip_cli_already_prefixed" {
-		t.Errorf("event = %q (must not double-prefix)", payload.Event)
-	}
-}
-
-// TestPendoClientOrgContextFields verifies that org_id, org_slug, and org_sfid
-// from eventProps are copied into the context (Node: this.context.org_id = eventProps.org_slug).
-func TestPendoClientOrgContextFields(t *testing.T) {
-	c := &PendoClient{
-		UserID:      "u",
-		UserAgent:   "x",
-		EventPrefix: TracksEventPrefix,
-	}
-	props := map[string]any{
-		"org_slug": "acme",
-		"org_sfid": "SF-001",
-	}
-
-	payload, _ := captureRequest(t, c, "test_event", props)
-
-	// org_id and org_slug should both equal eventProps.org_slug (Node behavior).
-	if payload.Context.OrgID != "acme" {
-		t.Errorf("context.org_id = %v, want acme", payload.Context.OrgID)
-	}
-	if payload.Context.OrgSlug != "acme" {
-		t.Errorf("context.org_slug = %v, want acme", payload.Context.OrgSlug)
-	}
-	if payload.Context.OrgSfid != "SF-001" {
-		t.Errorf("context.org_sfid = %v, want SF-001", payload.Context.OrgSfid)
-	}
-	if payload.AccountID != "SF-001" {
-		t.Errorf("accountId = %q, want SF-001", payload.AccountID)
-	}
-}
-
-// TestPendoClientReportsNetworkError verifies failures are observable to the
-// tracker without including raw transport errors or request data.
-func TestPendoClientReportsNetworkError(t *testing.T) {
-	c := &PendoClient{
-		GetToken:    func() (string, error) { return "fixture-token", nil },
-		Endpoint:    "http://127.0.0.1:1", // nothing listening
-		UserID:      "u",
-		UserAgent:   "x",
-		EventPrefix: TracksEventPrefix,
-	}
-	if err := c.TrackEvent("test", nil); err == nil || err.Error() != "Request failed" {
-		t.Errorf("expected safe network error, got %v", err)
-	}
-}
-
-// TestPendoClientLazyUserIDResolved verifies that GetUserID is not called at
-// construction time — only at TrackEvent call time.
-func TestPendoClientLazyUserIDResolved(t *testing.T) {
-	var calls int
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(200)
-	}))
-	defer srv.Close()
-
-	c := &PendoClient{
-		Endpoint:    srv.URL,
-		GetToken:    func() (string, error) { return "fixture-token", nil },
-		GetUserID:   func() string { calls++; return "lazy-uuid" },
-		UserAgent:   "vip-next/test",
-		EventPrefix: TracksEventPrefix,
-	}
-	// Before TrackEvent: GetUserID must not be called.
-	if calls != 0 {
-		t.Errorf("GetUserID called %d times before TrackEvent; want 0", calls)
-	}
-	if err := c.TrackEvent("test", nil); err != nil {
-		t.Fatalf("TrackEvent: %v", err)
-	}
-	if calls != 1 {
-		t.Errorf("GetUserID called %d times after TrackEvent; want 1", calls)
-	}
-}
-
-// TestPendoClientPrefersExplicitUserID verifies that GetUserID is never called
-// when UserID is already set explicitly.
-func TestPendoClientPrefersExplicitUserID(t *testing.T) {
-	c := &PendoClient{
-		UserID:      "explicit",
-		GetUserID:   func() string { t.Error("GetUserID must not be called when UserID is set"); return "" },
-		UserAgent:   "x",
-		EventPrefix: TracksEventPrefix,
-	}
-	payload, _ := captureRequest(t, c, "test_event", nil)
-	if payload.VisitorID != "explicit" {
-		t.Errorf("visitorId = %q, want explicit", payload.VisitorID)
-	}
-	if payload.Context.UserID != "explicit" {
-		t.Errorf("context.userId = %q, want explicit", payload.Context.UserID)
-	}
-}

package/internal/telemetry/scrub.go

@@ -1,90 +0,0 @@
-package telemetry
-
-import (
-	"os"
-	"path/filepath"
-	"regexp"
-	"sort"
-	"strings"
-
-	"github.com/Automattic/vip/internal/redact"
-)
-
-// userPathRE matches the home-directory roots whose next path segment is a
-// username. Anchored on the platform conventions rather than on "any absolute
-// path", because /usr/local/bin and /etc/hosts are not sensitive and stripping
-// them would gut the payload.
-var userPathRE = regexp.MustCompile(`(?i)(/Users/|/home/|[A-Z]:\\Users\\)([^/\\:;,'"` + "`" + `\s]+)`)
-
-// ScrubErrorText removes personally identifying and credential material from
-// the text of an error before it is attached to a telemetry event.
-//
-// This exists because cmd/vip-next/main.go registers a cli_error hook that
-// posts err.Error() to public-api.wordpress.com. That hook is Go-only — the
-// Node CLI has no equivalent and never sends error text anywhere — so every
-// byte it carries is surface the rewrite added. vip-next errors routinely
-// interpolate absolute paths (import sql, import media, dev-env, and every
-// wrapped os.Open failure), and an absolute path carries the account name,
-// which is often the user's real name, and the directory tree, which is often a
-// client's name.
-//
-// Removed, in order:
-//
-//  1. credentials, via internal/redact — presigned query strings, URL userinfo,
-//     JWTs, Bearer tokens;
-//  2. this process's working directory, temp directory and home directory,
-//     longest match first so a cwd nested inside home does not decay to
-//     "$HOME/clients/acme-corp";
-//  3. any remaining /Users/<name>, /home/<name> or C:\Users\<name>, which is
-//     the net for paths that came from a config file, instance data or a server
-//     response rather than from this process.
-//
-// Kept: everything else. A scrubbed message still names the operation, the
-// filename, the host and the failure, which is the whole justification for
-// scrubbing rather than dropping the hook.
-func ScrubErrorText(s string) string {
-	s = redact.Text(s)
-	for _, r := range scrubRoots() {
-		s = strings.ReplaceAll(s, r.path, r.placeholder)
-	}
-	return userPathRE.ReplaceAllString(s, "$1<redacted-user>")
-}
-
-type scrubRoot struct {
-	path        string
-	placeholder string
-}
-
-// scrubRoots returns the directories to anonymise, longest first.
-//
-// Each root is offered in both its literal and symlink-resolved form: on macOS
-// os.TempDir() reports /var/folders/... while anything that actually opened a
-// file there reports /private/var/folders/..., and the two must both go.
-func scrubRoots() []scrubRoot {
-	var roots []scrubRoot
-	add := func(path, placeholder string) {
-		path = strings.TrimSuffix(filepath.Clean(path), string(filepath.Separator))
-		if path == "" || path == string(filepath.Separator) {
-			return
-		}
-		roots = append(roots, scrubRoot{path: path, placeholder: placeholder})
-		if resolved, err := filepath.EvalSymlinks(path); err == nil && resolved != path {
-			roots = append(roots, scrubRoot{path: resolved, placeholder: placeholder})
-		}
-	}
-
-	if cwd, err := os.Getwd(); err == nil {
-		add(cwd, "<cwd>")
-	}
-	add(os.TempDir(), "<tmp>")
-	if home, err := os.UserHomeDir(); err == nil {
-		add(home, "<home>")
-	}
-
-	// Longest first: the working directory is usually inside the home
-	// directory, and replacing home first would leave the project path visible.
-	sort.SliceStable(roots, func(i, j int) bool {
-		return len(roots[i].path) > len(roots[j].path)
-	})
-	return roots
-}

package/internal/telemetry/scrub_test.go

@@ -1,131 +0,0 @@
-package telemetry
-
-import (
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"testing"
-)
-
-// TestScrubErrorTextRemovesTheHomeDirectory is the finding that motivated this
-// function: the cli_error hook ships err.Error() verbatim to
-// public-api.wordpress.com, and vip-next errors interpolate absolute paths
-// constantly (import sql, import media, dev-env, every os.Open failure). The
-// home directory contains the user's account name, which is PII on its own and
-// frequently their real name.
-func TestScrubErrorTextRemovesTheHomeDirectory(t *testing.T) {
-	home, err := os.UserHomeDir()
-	if err != nil {
-		t.Skipf("no home directory available: %v", err)
-	}
-	path := filepath.Join(home, "clients", "acme-corp", "db-dump.sql")
-
-	got := ScrubErrorText("open " + path + ": permission denied")
-
-	if strings.Contains(got, home) {
-		t.Errorf("home directory survived:\n\t%s", got)
-	}
-	if !strings.Contains(got, "permission denied") {
-		t.Errorf("the actual failure was lost:\n\t%s", got)
-	}
-}
-
-// TestScrubErrorTextRemovesTheWorkingDirectory pins the ordering. The working
-// directory is usually INSIDE the home directory, so a scrubber that replaced
-// home first would emit "$HOME/clients/acme-corp/...", still naming the client.
-// Longest prefix must win.
-func TestScrubErrorTextRemovesTheWorkingDirectory(t *testing.T) {
-	cwd, err := os.Getwd()
-	if err != nil {
-		t.Skipf("no working directory available: %v", err)
-	}
-
-	got := ScrubErrorText("could not read " + filepath.Join(cwd, "wp-config.php"))
-
-	if strings.Contains(got, cwd) {
-		t.Errorf("working directory survived:\n\t%s", got)
-	}
-	if !strings.Contains(got, "wp-config.php") {
-		t.Errorf("the filename was lost; it is the diagnostic part:\n\t%s", got)
-	}
-}
-
-func TestScrubErrorTextRemovesTheTempDirectory(t *testing.T) {
-	tmp := os.TempDir()
-
-	got := ScrubErrorText("staging file " + filepath.Join(tmp, "vip-import-9271", "chunk.0") + " vanished")
-
-	if strings.Contains(got, tmp) {
-		t.Errorf("temp directory survived:\n\t%s", got)
-	}
-}
-
-// TestScrubErrorTextRemovesForeignHomePaths is the safety net. Not every
-// absolute path in an error came from THIS process's home: paths are read out
-// of config files, instance data, SQL dumps and server responses. The username
-// is the sensitive part, so it goes regardless of which root it hangs off.
-func TestScrubErrorTextRemovesForeignHomePaths(t *testing.T) {
-	cases := []string{
-		"/Users/jsmith/Sites/client/wp-content",
-		"/home/jsmith/sites/client/wp-content",
-	}
-	if runtime.GOOS == "windows" {
-		cases = append(cases, `C:\Users\jsmith\Sites\client`)
-	}
-	for _, path := range cases {
-		got := ScrubErrorText("no such file: " + path)
-		if strings.Contains(got, "jsmith") {
-			t.Errorf("username survived in %q:\n\t%s", path, got)
-		}
-		if !strings.Contains(got, "no such file") {
-			t.Errorf("message body lost for %q:\n\t%s", path, got)
-		}
-	}
-}
-
-// TestScrubErrorTextAlsoRemovesCredentials confirms the path scrubbing is
-// layered on top of internal/redact rather than replacing it. An earlier slice
-// found proxy errors carrying socks5://user:pass@host into this exact hook and
-// redacted them at the source; this is the second line of defence, for the
-// sources nobody has audited yet.
-func TestScrubErrorTextAlsoRemovesCredentials(t *testing.T) {
-	got := ScrubErrorText(`Get "https://vip.s3.amazonaws.com/export.sql?X-Amz-Signature=abc123def456": timeout`)
-	if strings.Contains(got, "X-Amz-Signature") || strings.Contains(got, "abc123def456") {
-		t.Errorf("presigned credential survived:\n\t%s", got)
-	}
-
-	got = ScrubErrorText("proxy socks5://alice:hunter2@corp.example:1080 refused")
-	if strings.Contains(got, "hunter2") {
-		t.Errorf("proxy password survived:\n\t%s", got)
-	}
-}
-
-// TestScrubErrorTextKeepsOrdinaryMessagesIntact is the counterweight: the whole
-// point of scrubbing rather than dropping the hook is that the payload stays
-// useful. If this test starts failing, the scrubber has become too aggressive
-// and removing the hook (Node has none) is the better trade.
-func TestScrubErrorTextKeepsOrdinaryMessagesIntact(t *testing.T) {
-	for _, msg := range []string{
-		"appctx: GraphQL client not configured",
-		"environment my-site is not running; run `vip dev-env start`",
-		"failed to reach public-api.wordpress.com: connection refused",
-		"import sql: file is not a valid SQL export",
-	} {
-		if got := ScrubErrorText(msg); got != msg {
-			t.Errorf("scrubber rewrote a message with nothing sensitive in it:\n\tin:  %s\n\tout: %s", msg, got)
-		}
-	}
-}
-
-func TestScrubErrorTextIsIdempotent(t *testing.T) {
-	home, err := os.UserHomeDir()
-	if err != nil {
-		t.Skipf("no home directory available: %v", err)
-	}
-	in := "open " + filepath.Join(home, "a", "b.sql") + ": denied"
-	once := ScrubErrorText(in)
-	if twice := ScrubErrorText(once); twice != once {
-		t.Errorf("not idempotent:\n\t1x: %s\n\t2x: %s", once, twice)
-	}
-}

package/internal/telemetry/tracker.go

@@ -1,102 +0,0 @@
-package telemetry
-
-import (
-	"context"
-	"fmt"
-	"os"
-)
-
-// Client is the common interface satisfied by TracksClient and PendoClient.
-type Client interface {
-	TrackEvent(name string, props map[string]any) error
-}
-
-// Tracker fans out analytics events to all configured Clients.
-// Set Disabled to suppress all events without removing the clients.
-// isDoNotTrack() also suppresses events when the environment signals opt-out.
-type Tracker struct {
-	Clients   []Client
-	UUIDStore *UUIDStore
-	Disabled  bool
-}
-
-// SetPendoTokenSource binds Pendo to the invocation's credential store before
-// login can emit events. Tracks has its own authentication scheme.
-func (t *Tracker) SetPendoTokenSource(getToken func() (string, error)) {
-	if t == nil {
-		return
-	}
-	for _, client := range t.Clients {
-		if pendo, ok := client.(*PendoClient); ok {
-			pendo.GetToken = getToken
-		}
-	}
-}
-
-// SetContext attaches the parsed command's diagnostics before command events.
-func (t *Tracker) SetContext(ctx context.Context) {
-	if t == nil {
-		return
-	}
-	for _, client := range t.Clients {
-		if pendo, ok := client.(*PendoClient); ok {
-			pendo.Context = ctx
-		}
-	}
-}
-
-// TrackEvent emits name with props to every configured Client.
-// It is a no-op when the tracker is disabled or DO_NOT_TRACK / test env vars are set.
-func (t *Tracker) TrackEvent(name string, props map[string]any) {
-	if t.Disabled || isDoNotTrack() {
-		return
-	}
-	for _, c := range t.Clients {
-		_ = c.TrackEvent(name, props)
-	}
-}
-
-// AliasUser emits a special "_alias_user" event that links the anonymous UUID
-// to the authenticated VIP user ID, then updates the UUID store so subsequent
-// events carry the user's real identity — mirroring aliasUser() in tracker.ts.
-func (t *Tracker) AliasUser(vipUserID int64) {
-	if vipUserID == 0 || t.Disabled || isDoNotTrack() {
-		return
-	}
-	prevID := ""
-	if t.UUIDStore != nil {
-		prevID, _ = t.UUIDStore.Get()
-	}
-	t.TrackEvent("_alias_user", map[string]any{
-		"_ui":    vipUserID,
-		"_ut":    TracksUserType,
-		"anonid": prevID,
-	})
-	if t.UUIDStore != nil {
-		_ = t.UUIDStore.Set(fmt.Sprintf("%d", vipUserID))
-	}
-}
-
-// MakeCommandTracker returns a closure that emits "<command>_command_<eventType>"
-// events, merging baseInfo with any per-call data — mirroring makeCommandTracker()
-// in tracker.ts.
-func (t *Tracker) MakeCommandTracker(command string, info map[string]any) func(string, map[string]any) {
-	return func(eventType string, data map[string]any) {
-		merged := make(map[string]any, len(info)+len(data))
-		for k, v := range info {
-			merged[k] = v
-		}
-		for k, v := range data {
-			merged[k] = v
-		}
-		t.TrackEvent(fmt.Sprintf("%s_command_%s", command, eventType), merged)
-	}
-}
-
-// isDoNotTrack returns true when any of the standard opt-out environment
-// variables are set, matching the Node binary's behaviour.
-func isDoNotTrack() bool {
-	return os.Getenv("DO_NOT_TRACK") != "" ||
-		os.Getenv("GO_ENV") == "test" ||
-		os.Getenv("NODE_ENV") == "test"
-}

package/internal/telemetry/tracker_test.go

@@ -1,76 +0,0 @@
-package telemetry
-
-import (
-	"sync"
-	"testing"
-)
-
-type fakeClient struct {
-	mu     sync.Mutex
-	events []string
-	props  []map[string]any
-}
-
-func (f *fakeClient) TrackEvent(name string, props map[string]any) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	f.events = append(f.events, name)
-	f.props = append(f.props, props)
-	return nil
-}
-
-func TestTrackerFanOut(t *testing.T) {
-	a, b := &fakeClient{}, &fakeClient{}
-	tr := &Tracker{Clients: []Client{a, b}}
-	tr.TrackEvent("foo", map[string]any{"x": 1})
-	if len(a.events) != 1 || len(b.events) != 1 {
-		t.Errorf("expected fan-out; a=%d b=%d", len(a.events), len(b.events))
-	}
-}
-
-func TestTrackerDoNotTrackDisables(t *testing.T) {
-	c := &fakeClient{}
-	tr := &Tracker{Clients: []Client{c}, Disabled: true}
-	tr.TrackEvent("foo", nil)
-	if len(c.events) != 0 {
-		t.Error("expected no events when Disabled")
-	}
-}
-
-func TestMakeCommandTracker(t *testing.T) {
-	c := &fakeClient{}
-	tr := &Tracker{Clients: []Client{c}}
-	ct := tr.MakeCommandTracker("whoami", map[string]any{"command": "vip whoami"})
-	ct("execute", nil)
-	ct("success", map[string]any{"duration_ms": 42})
-	if len(c.events) != 2 {
-		t.Fatalf("expected 2 events, got %d", len(c.events))
-	}
-	if c.events[0] != "whoami_command_execute" || c.events[1] != "whoami_command_success" {
-		t.Errorf("event names = %v", c.events)
-	}
-	if c.props[1]["command"] != "vip whoami" || c.props[1]["duration_ms"] != 42 {
-		t.Errorf("merged props = %v", c.props[1])
-	}
-}
-
-func TestAliasUserEmitsAliasEvent(t *testing.T) {
-	c := &fakeClient{}
-	store := newTestUUIDStore()
-	store.Set("anon-id")
-	tr := &Tracker{Clients: []Client{c}, UUIDStore: store}
-	tr.AliasUser(99)
-	if len(c.events) != 1 || c.events[0] != "_alias_user" {
-		t.Errorf("expected _alias_user event, got %v", c.events)
-	}
-	if c.props[0]["_ui"] != int64(99) {
-		t.Errorf("_ui = %v, want 99", c.props[0]["_ui"])
-	}
-	if c.props[0]["anonid"] != "anon-id" {
-		t.Errorf("anonid = %v, want anon-id", c.props[0]["anonid"])
-	}
-	got, _ := store.Get()
-	if got != "99" {
-		t.Errorf("UUID after alias = %q, want %q", got, "99")
-	}
-}