@hanzo/event 0.3.3 → 0.3.5

package/src/dsn.test.ts

@@ -0,0 +1,62 @@
+import { describe, it, expect, afterEach } from 'vitest'
+
+import { createAnalytics } from './core'
+import { PRODUCT_DSN, dsnForProduct } from './dsn'
+import { parseDsn } from './sentry'
+
+const ENV = 'NEXT_PUBLIC_HANZO_EVENT_DSN'
+const OVERRIDE = 'https://1:aaaa@api.hanzo.ai/v1/sentry/env-project'
+const EXPLICIT = 'https://1:bbbb@api.hanzo.ai/v1/sentry/explicit-project'
+
+afterEach(() => {
+  delete process.env[ENV]
+})
+
+describe('the product registry', () => {
+  it('resolves a registered product to its DSN', () => {
+    expect(dsnForProduct('console')).toBe(PRODUCT_DSN.console)
+    expect(dsnForProduct('app')).toBe(PRODUCT_DSN.app)
+    expect(dsnForProduct('site')).toBe(PRODUCT_DSN.site)
+  })
+
+  it('returns undefined for an unregistered or missing product, rather than guessing', () => {
+    expect(dsnForProduct('not-a-product')).toBeUndefined()
+    expect(dsnForProduct(undefined)).toBeUndefined()
+    expect(dsnForProduct('')).toBeUndefined()
+  })
+
+  it('registers only DSNs that actually parse — a typo here would silently disable a surface', () => {
+    for (const [product, dsn] of Object.entries(PRODUCT_DSN)) {
+      const parsed = parseDsn(dsn)
+      expect(parsed, `${product} DSN must parse`).not.toBeNull()
+      expect(parsed!.projectId, `${product} needs a project id`).toBeTruthy()
+      expect(parsed!.publicKey, `${product} needs a public key`).toBeTruthy()
+    }
+  })
+})
+
+describe('DSN precedence — most specific source wins', () => {
+  it('lights up the error plane from `product` alone, with no dsn and no env', () => {
+    const a = createAnalytics({ product: 'console', enabled: false })
+    expect(a.errorPlaneEnabled).toBe(true)
+    expect(a.errorIngestUrl).toContain(parseDsn(PRODUCT_DSN.console)!.projectId)
+  })
+
+  it('prefers an explicit dsn over both the env and the registry', () => {
+    process.env[ENV] = OVERRIDE
+    const a = createAnalytics({ product: 'console', dsn: EXPLICIT, enabled: false })
+    expect(a.errorIngestUrl).toContain('explicit-project')
+  })
+
+  it('prefers the env override over the registry, so a deploy can repoint a surface', () => {
+    process.env[ENV] = OVERRIDE
+    const a = createAnalytics({ product: 'console', enabled: false })
+    expect(a.errorIngestUrl).toContain('env-project')
+  })
+
+  it('stays inert for an unregistered product — never posts one surface into another project', () => {
+    const a = createAnalytics({ product: 'not-a-product', enabled: false })
+    expect(a.errorPlaneEnabled).toBe(false)
+    expect(a.errorIngestUrl).toBeUndefined()
+  })
+})

package/src/dsn.ts

@@ -0,0 +1,45 @@
+/**
+ * The product → Sentry DSN registry.
+ *
+ * An app declares WHAT it is (`product: 'console'`); this module knows WHERE its
+ * errors go. That split is the whole point: no surface has to learn a DSN, carry
+ * a build argument, or grow a config file to report errors — declaring the
+ * product it already declares is enough.
+ *
+ * A Sentry DSN is PUBLIC by construction. It ships inside the client bundle and
+ * is readable in devtools on any deployed page, and it grants exactly one
+ * capability: submitting new events. It cannot read issues, projects, or any
+ * other data. So committing it is not leaking a secret — it is recording a public
+ * identifier next to the code that needs it. (Contrast the server-side collector
+ * DSN in the `team-analytics-sentry` Secret, which is HMAC-derived and revocable
+ * precisely because a server-side credential is NOT public.)
+ *
+ * Why a literal map instead of deriving `hanzo-${product}`: the projects predate
+ * this registry and do not derive cleanly — `site` lives in `hanzo-ai`, not
+ * `hanzo-site`. An explicit map is honest about that; a derivation rule plus an
+ * exception table is the same data with a trap in it.
+ *
+ * Projects are org-scoped and named `<org>-<app>`. To add one: create the project
+ * (POST /v1/sentry/projects with X-Org-Id), then add its `dsn` here keyed by the
+ * product name the app passes to `createAnalytics`.
+ */
+
+/** PRODUCT_DSN maps a `product` to the DSN its errors are submitted to. */
+export const PRODUCT_DSN: Readonly<Record<string, string>> = Object.freeze({
+  // hanzo-console — console.hanzo.ai (also served embedded by the cloud binary)
+  console:
+    'https://1:0c8054dbde157f4f420c56b58660052b2ad782293c4de1d606ef8fbc46a0bf34@api.hanzo.ai/v1/sentry/019fa40b-94ae-7f1d-8f7b-e92f123fad42',
+  // hanzo-app — hanzo.app
+  app: 'https://1:b3e1173125568c80f91ef4b1fabbbd2d7e22341de02b33ce7e22ef4fc16a196e@api.hanzo.ai/v1/sentry/019f9b1e-57eb-7171-9d92-72c0b85e4b4b',
+  // hanzo-ai — hanzo.ai (the marketing site; `site` is the product name it declares)
+  site: 'https://1:d9cbfb844958bd7ef2a455600f00fbf237fbd71b75c1504f137773096d6aa53f@api.hanzo.ai/v1/sentry/019f9b1e-5785-7359-ad0b-f75db8e58c99',
+})
+
+/** dsnForProduct resolves the registered DSN for a product, or undefined when the
+ *  product has no project yet — which leaves the error plane inert rather than
+ *  guessing a destination and silently posting a surface's errors into the wrong
+ *  project. */
+export function dsnForProduct(product: string | undefined): string | undefined {
+  if (!product) return undefined
+  return PRODUCT_DSN[product]
+}

package/src/index.ts

@@ -9,6 +9,7 @@
 
 export { Analytics, createAnalytics, VERSION, getCohort, getFirstTouch } from './core'
 export { parseDsn, buildSentryEvent, buildEnvelope, framesFromStack } from './sentry'
+export { PRODUCT_DSN, dsnForProduct } from './dsn'
 export type { ErrorIdentity } from './sentry'
 export { scrubText, redactSecrets, scrubPII } from './scrub'
 export { EVENTS, PAGEVIEW } from './events'