From bc84d0de44e6563d4f7f7774d467016d458f18ce Mon Sep 17 00:00:00 2001 From: Rhys Sullivan <39114868+RhysSullivan@users.noreply.github.com> Date: Sun, 25 Oct 2026 14:12:34 -0700 Subject: [PATCH] Keep the cloud e2e worker off the production PostHog project The e2e worker inherited the production PostHog key from wrangler.jsonc vars, so server-side flag gates evaluated live production flags for synthetic e2e users. Since google-oauth-review was widened in production, first-party-oauth fails on every run because Google is now listed. Clear the key in the e2e boot so each gate takes its no-flag-service path. --- e2e/scenarios/first-party-oauth.test.ts | 7 ++++--- e2e/setup/cloud.boot.ts | 7 +++++++ 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/e2e/scenarios/first-party-oauth.test.ts b/e2e/scenarios/first-party-oauth.test.ts index bee0c78daa..896d72b419 100644 --- a/e2e/scenarios/first-party-oauth.test.ts +++ b/e2e/scenarios/first-party-oauth.test.ts @@ -187,9 +187,10 @@ scenario( }); }); - // The Executor-owned Google app is withheld from every listing: it is no - // longer offered for new connections, so connecting Google means bringing - // your own OAuth app. It stays fully resolvable by slug, which the + // The Executor-owned Google app is listed only for users the + // `google-oauth-review` flag admits, and withheld whenever no flag service + // answers. The e2e stack configures no PostHog project (cloud.boot.ts), + // so here it is withheld. It stays fully resolvable by slug, which the // `oauth.start` cases below exercise — that is the guarantee for everyone // already connected through it. Its reviewed consumer scope bundle, no // longer introspectable from here, is asserted on the config it is built diff --git a/e2e/setup/cloud.boot.ts b/e2e/setup/cloud.boot.ts index 8314e7bc0b..ee4d7c98a0 100644 --- a/e2e/setup/cloud.boot.ts +++ b/e2e/setup/cloud.boot.ts @@ -128,6 +128,13 @@ export const bootCloud = async (options: CloudBootOptions): Promise // scope policy, and authorization URL construction end to end. FIRST_PARTY_GOOGLE_CLIENT_ID: "e2e-first-party-google", FIRST_PARTY_GOOGLE_CLIENT_SECRET: "e2e-first-party-google-secret", + // No PostHog project. wrangler.jsonc ships the production project key as a + // var, and the worker evaluates server-side feature flags with it (the + // Google OAuth listing, the enterprise-managed auth rollout). Inheriting it + // made e2e outcomes follow whatever those flags are set to in production + // and sent every synthetic e2e user to the production project. With no + // key, each gate takes its documented no-flag-service path. + VITE_PUBLIC_POSTHOG_KEY: "", // Shrink the per-org hourly execution cap (prod default 1000) to a number // the rate-limit-backstop scenario can actually exhaust with real // executions — but see execution-limits.ts: it must stay above every other