fix(analytics): harden analytics opt-out and feedback surfaces (#423)

Server stops phoning Sentry home after opt-out (release-health sessions + client reports off); settings saves diff-send only changed keys so a stale tab cannot revert an instance-wide opt-out; disabling analytics hides the feedback UI immediately; optIn resumes PostHog after re-enable; onboarding survey writes time out at 15s; inline tool-feedback prompt arms a shown-cooldown.

tests/unit/web/analytics-no-leak.test.ts

@@ -234,4 +234,33 @@ describe("Analytics No-Leak Invariant (baked model)", () => {
       ).toBeNull();
     });
   });
+
+  describe("runtime opt-out / opt-in toggle", () => {
+    it("opts in to capturing when analytics initializes enabled (clears a stale persisted opt-out)", async () => {
+      await mod.initAnalytics(enabledConfig);
+      const instance = mockPosthogInit.mock.results.at(-1)?.value;
+      expect(instance.opt_in_capturing).toHaveBeenCalled();
+    });
+
+    it("optOut() stops track() and opts out of capturing", async () => {
+      await mod.initAnalytics(enabledConfig);
+      const instance = mockPosthogInit.mock.results.at(-1)?.value;
+      mockCapture.mockClear();
+      mod.optOut();
+      mod.track("tool_opened", { tool_id: "resize" });
+      expect(mockCapture).not.toHaveBeenCalled();
+      expect(instance.opt_out_capturing).toHaveBeenCalled();
+    });
+
+    it("optIn() resumes track() and opts back in after an optOut()", async () => {
+      await mod.initAnalytics(enabledConfig);
+      const instance = mockPosthogInit.mock.results.at(-1)?.value;
+      mod.optOut();
+      mockCapture.mockClear();
+      mod.optIn();
+      mod.track("tool_opened", { tool_id: "resize" });
+      expect(mockCapture).toHaveBeenCalledWith("tool_opened", { tool_id: "resize" });
+      expect(instance.opt_in_capturing).toHaveBeenCalled();
+    });
+  });
 });

tests/unit/web/settings-payload.test.ts

@@ -0,0 +1,40 @@
+import { describe, expect, it } from "vitest";
+import { changedSettings, writableSettings } from "@/lib/settings-payload";
+
+describe("writableSettings", () => {
+  it("strips server-managed read-only keys that the PUT rejects", () => {
+    expect(
+      writableSettings({ instance_id: "abc", cookie_secret: "shh", defaultTheme: "dark" }),
+    ).toEqual({ defaultTheme: "dark" });
+  });
+
+  it("strips masked secret placeholders so a real secret is never overwritten by the mask", () => {
+    expect(writableSettings({ oidc_client_secret: "********", fileUploadLimitMb: "100" })).toEqual({
+      fileUploadLimitMb: "100",
+    });
+  });
+});
+
+describe("changedSettings", () => {
+  it("returns only keys whose value differs from the original snapshot", () => {
+    const original = { analyticsEnabled: "true", defaultTheme: "system" };
+    const current = { analyticsEnabled: "true", defaultTheme: "dark" };
+    expect(changedSettings(original, current)).toEqual({ defaultTheme: "dark" });
+  });
+
+  it("omits an unchanged analyticsEnabled so a stale save cannot revert an instance-wide opt-out", () => {
+    const original = { analyticsEnabled: "true", fileUploadLimitMb: "100" };
+    const current = { analyticsEnabled: "true", fileUploadLimitMb: "250" };
+    expect("analyticsEnabled" in changedSettings(original, current)).toBe(false);
+  });
+
+  it("includes a key the user actually toggled", () => {
+    expect(changedSettings({ analyticsEnabled: "true" }, { analyticsEnabled: "false" })).toEqual({
+      analyticsEnabled: "false",
+    });
+  });
+
+  it("includes keys added since the snapshot was taken", () => {
+    expect(changedSettings({}, { defaultLocale: "fr" })).toEqual({ defaultLocale: "fr" });
+  });
+});

tests/unit/web/tool-feedback-prompt.test.tsx

@@ -139,6 +139,17 @@ describe("ToolFeedbackPrompt", () => {
     expect(screen.getByText("How did this tool work?")).toBeDefined();
   });
 
+  it("stops nagging on the next result once shown, even without interaction", () => {
+    const { unmount } = render(<ToolFeedbackPrompt toolId="resize" />);
+    expect(screen.getByText("How did this tool work?")).toBeDefined();
+    unmount();
+
+    // A different tool finishes moments later. The user never touched the first
+    // prompt, but it must not reappear on the very next result.
+    render(<ToolFeedbackPrompt toolId="convert" />);
+    expect(screen.queryByText("How did this tool work?")).toBeNull();
+  });
+
   it("supports Don't ask again suppression", () => {
     const { unmount } = render(<ToolFeedbackPrompt toolId="resize" />);
 

tests/unit/web/with-timeout.test.ts

@@ -0,0 +1,26 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { withTimeout } from "@/lib/with-timeout";
+
+beforeEach(() => {
+  vi.useFakeTimers();
+});
+
+afterEach(() => {
+  vi.useRealTimers();
+});
+
+describe("withTimeout", () => {
+  it("resolves with the promise value when it settles before the deadline", async () => {
+    await expect(withTimeout(Promise.resolve("ok"), 1000)).resolves.toBe("ok");
+  });
+
+  it("rejects when the promise is still pending past the deadline", async () => {
+    const neverSettles = new Promise<string>(() => {});
+    const settled = withTimeout(neverSettles, 1000).then(
+      () => "resolved",
+      (err: Error) => `rejected:${err.message}`,
+    );
+    await vi.advanceTimersByTimeAsync(1000);
+    expect(await settled).toMatch(/rejected:.*timed out/i);
+  });
+});