Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions frontend/common/utils/onboardingEntry.ts
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,13 @@ export type OnboardingEntryDecision = {
* the logged-in user, and the routing it should have driven has happened.
* Call `persistOnboardingEntry` with an accepted decision.
*/
export async function decideOnboardingEntry(): Promise<OnboardingEntryDecision> {
export async function decideOnboardingEntry(
email?: string,
): Promise<OnboardingEntryDecision> {
// Only used to match segment overrides, not for bucketing. An override on
// another trait needs that trait passed here too.
// @ts-expect-error transient is missing from the SDK's identify type
await flagsmith.identify('', {}, true)
await flagsmith.identify('', email ? { email } : {}, true)
Comment on lines 28 to +29

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

tmp_dir="$(mktemp -d)"
trap 'rm -rf "$tmp_dir"' EXIT

npm pack --silent --ignore-scripts \
  --pack-destination "$tmp_dir" \
  '`@flagsmith/flagsmith`@12.1.0' >/dev/null

tarball="$(find "$tmp_dir" -maxdepth 1 -name '*.tgz' -print -quit)"
tar -xzf "$tarball" -C "$tmp_dir"

rg -n -C 6 'identify|transient' "$tmp_dir/package"
rg -n -C 4 'flagsmith\.identify|decideOnboardingEntry' frontend

Repository: Flagsmith/flagsmith

Length of output: 50376


🏁 Script executed:

#!/bin/bash
set -euo pipefail

tmp_dir="$(mktemp -d)"
trap 'rm -rf "$tmp_dir"' EXIT

npm pack --silent --ignore-scripts \
  --pack-destination "$tmp_dir" \
  '`@flagsmith/flagsmith`@12.1.0' >/dev/null

tarball="$(find "$tmp_dir" -maxdepth 1 -name '*.tgz' -print -quit)"
tar -xzf "$tarball" -C "$tmp_dir"

printf '%s\n' '--- package declarations ---'
rg -n -C 8 'identify\s*\(' "$tmp_dir/package" --glob '*.d.ts' --glob '*.ts' --glob '*.js' --glob '*.mjs' | head -n 240

printf '%s\n' '--- transient handling ---'
rg -n -C 10 'transient' "$tmp_dir/package" --glob '*.d.ts' --glob '*.ts' --glob '*.js' --glob '*.mjs' | head -n 260

printf '%s\n' '--- repository dependency and call site ---'
rg -n -C 5 '`@flagsmith/flagsmith`|flagsmith\.identify|decideOnboardingEntry' frontend package.json package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null | head -n 180

Repository: Flagsmith/flagsmith

Length of output: 50376


🏁 Script executed:

#!/bin/bash
set -euo pipefail

tmp_dir="$(mktemp -d)"
trap 'rm -rf "$tmp_dir"' EXIT

npm pack --silent --ignore-scripts \
  --pack-destination "$tmp_dir" \
  '`@flagsmith/flagsmith`@12.1.0' >/dev/null

tarball="$(find "$tmp_dir" -maxdepth 1 -name '*.tgz' -print -quit)"
tar -tzf "$tarball" | grep -E '\.(d\.ts|ts)$' | head -n 80
tar -xzf "$tarball" -C "$tmp_dir"

printf '%s\n' '--- identify declarations ---'
find "$tmp_dir/package" -type f \( -name '*.d.ts' -o -name '*.ts' \) -print0 |
  xargs -0 grep -n -H -E 'identify[[:space:]]*\(' || true

printf '%s\n' '--- package metadata ---'
python3 - "$tmp_dir/package/package.json" <<'PY'
import json, sys
with open(sys.argv[1]) as f:
    data = json.load(f)
for key in ("name", "version", "types", "typings", "main", "module"):
    print(f"{key}: {data.get(key)}")
PY

printf '%s\n' '--- repository dependency and call site ---'
rg -n -C 4 '`@flagsmith/flagsmith`|flagsmith\.identify|decideOnboardingEntry' \
  frontend package.json package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null | head -n 180

Repository: Flagsmith/flagsmith

Length of output: 15134


🏁 Script executed:

#!/bin/bash
set -euo pipefail

tmp_dir="$(mktemp -d)"
trap 'rm -rf "$tmp_dir"' EXIT

npm pack --silent --ignore-scripts \
  --pack-destination "$tmp_dir" \
  '`@flagsmith/flagsmith`@12.1.0' >/dev/null

tarball="$(find "$tmp_dir" -maxdepth 1 -name '*.tgz' -print -quit)"
tar -xzf "$tarball" -C "$tmp_dir"

printf '%s\n' '--- public declarations ---'
for file in "$tmp_dir/package/index.d.ts" \
            "$tmp_dir/package/flagsmith-core.d.ts" \
            "$tmp_dir/package/types.d.ts" \
            "$tmp_dir/package/src/flagsmith-core.d.ts"; do
  if [ -f "$file" ]; then
    echo "--- $file"
    cat -n "$file" | grep -E -C 8 'identify|transient' | head -n 180 || true
  fi
done

printf '%s\n' '--- package documentation ---'
find "$tmp_dir/package" -maxdepth 1 -type f -iname 'readme*' -print0 |
  xargs -0 grep -n -i -C 8 'transient' || true

printf '%s\n' '--- relevant source methods ---'
python3 - "$tmp_dir/package/src/flagsmith-core.ts" <<'PY'
import sys
path = sys.argv[1]
lines = open(path).read().splitlines()
for start, end in ((600, 630), (740, 775)):
    print(f"--- {path}:{start}-{end}")
    for number in range(start, min(end, len(lines)) + 1):
        print(f"{number}: {lines[number-1]}")
PY

Repository: Flagsmith/flagsmith

Length of output: 4226


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- transient-related source locations ---'
rg -n -C 4 '\btransient\b' . \
  -g '*.py' -g '*.ts' -g '*.tsx' -g '*.js' -g '*.jsx' \
  -g '!frontend/package-lock.json' -g '!**/node_modules/**' \
  | head -n 320

Repository: Flagsmith/flagsmith

Length of output: 27428


Replace the broad type suppression with a narrow type fix.

@flagsmith/flagsmith 12.1.0 declares only two identify parameters, although its implementation supports the third transient parameter. Add a narrow type augmentation or update the SDK declaration. The empty identifier and true correctly create a fully transient identity, so the email trait is not persisted.

const flag = flagsmith.getExperimentFlag('onboarding_quickstart_flow')
const identifier = flagsmith.getContext().identity?.identifier
const variant: OnboardingVariant =
Expand Down
4 changes: 3 additions & 1 deletion frontend/web/components/App.js
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,9 @@ const App = class extends Component {
// instead of blocking the redirect.
Promise.race([
AccountStore.getUser()?.isGettingStarted
? decideOnboardingEntry().catch(() => null)
? decideOnboardingEntry(AccountStore.getUser()?.email).catch(
() => null,
)
: Promise.resolve(null),
new Promise((resolve) => setTimeout(() => resolve(null), 2000)),
]).then((decision) => {
Expand Down
Loading