[CI] (4c70a79) fastapi/fastapi3-ai-saas

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 4c70a79
App: fastapi/fastapi3-ai-saas
App directory: apps/fastapi/fastapi3-ai-saas
Workbench branch: wizard-ci-4c70a79-fastapi-fastapi3-ai-saas
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-09T22:13:02.460Z
Duration: 406.4s

YARA Scanner

✓ 167 tool calls scanned, 0 violations detected

No violations: ✓ 167 clean scans

[wizard-ci-bot]

---

PR Evaluation Report

Summary

This PR integrates PostHog into a FastAPI AI SaaS application by adding the Python SDK, initializing a Posthog() client in the lifespan handler, creating custom ASGI middleware for request-scoped context/identification, and adding capture calls across auth, content generation, API key, and settings routes.

Files changed	Lines added	Lines removed
9	+151	-8

Confidence score: 4/5 👍

• Debug mode crash on missing PostHog config: The elif settings.debug block raises RuntimeError when PostHog env vars are not configured. Since debug defaults to True, the app will crash on startup for any developer who hasn't set PostHog env vars — breaking backward compatibility. [CRITICAL]
• Double shutdown call: Both atexit.register(posthog_client.shutdown) and an explicit posthog_client.shutdown() in the lifespan teardown will trigger shutdown twice. The SDK handles this gracefully, but it's redundant. [LOW]

---

File changes

Filename	Score	Description
app/main.py	4/5	PostHog client initialization with Posthog() constructor, enable_exception_autocapture, atexit, and lifespan shutdown. Debug crash logic is problematic.
app/middleware.py	4/5	Custom ASGI middleware resolving authenticated user from signed session cookie and binding PostHog context. Well-structured.
app/config.py	5/5	Adds posthog_project_token and posthog_host as optional Pydantic Settings fields.
.env.example	5/5	Documents both PostHog env vars.
requirements.txt	5/5	Adds posthog dependency.
app/routers/auth.py	4/5	Captures login, signup, logout events with proper context identification for login/signup.
app/routers/generate.py	5/5	Captures content_generated with rich properties.
app/routers/api_keys.py	4/5	Captures API key create/revoke events, though no properties attached.
app/routers/settings.py	4/5	Captures email_updated and password_changed. Minor unrelated import cleanup.

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	Valid syntax, correct imports, posthog added to requirements.txt
Preserves existing env vars & configs	No	Debug-mode RuntimeError crashes the app when PostHog env vars are absent — the app previously started fine without them
No syntax or type errors	Yes	All code is syntactically valid
Correct imports/exports	Yes	All imports resolve correctly (posthog, identify_context, new_context, tag, etc.)
Minimal, focused changes	Yes	Cookie name refactor in auth.py is related to middleware needing consistent cookie access; import cleanup in settings.py is trivial
Pre-existing issues	None	—

Issues

• Debug mode startup crash: The elif settings.debug block in main.py raises RuntimeError when neither POSTHOG_PROJECT_TOKEN nor POSTHOG_HOST is configured. Since debug defaults to True, this crashes the app for any developer who hasn't set PostHog env vars. The check should only warn (not crash) or should only fire when configuration is partially set (one var present, the other missing). [CRITICAL]
• Double shutdown: atexit.register(posthog_client.shutdown) and the explicit posthog_client.shutdown() in the lifespan teardown both fire. The SDK tolerates this, but one registration should be removed. [LOW]

Other completed criteria

• Environment variables documented in .env.example
• Build configuration valid — posthog added to requirements.txt
• Code quality follows existing codebase patterns

---

PostHog implementation ✅

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog added to requirements.txt
PostHog client initialized	Yes	Uses Posthog() instance constructor with enable_exception_autocapture=True in the lifespan handler
capture()	Yes	8 meaningful capture calls across auth, generation, API key, and settings routes
identify()	N/A	Server-only app
Error tracking	Yes	enable_exception_autocapture=True in constructor; middleware context wraps requests so exceptions are auto-captured
Reverse proxy	N/A	Server-only app

Issues

No PostHog-specific implementation issues.

Other completed criteria

• API key loaded from environment via Pydantic Settings (posthog_project_token)
• Host loaded from environment via Pydantic Settings (posthog_host)
• atexit.register(posthog_client.shutdown) ensures event flush on exit
• Middleware uses new_context() + identify_context() per the Python SDK context API
• Auth routes create fresh contexts with identify_context() for login/signup events where the middleware context is still anonymous

---

PostHog insights and events ✅

Filename	PostHog events	Description
app/middleware.py	Context setup	Binds authenticated user to PostHog context for all requests; auto-captures exceptions via context
app/routers/auth.py	user_logged_in, user_signed_up, user_logged_out	Auth lifecycle events; login/signup include properties (auth_method, signup_method) and use dedicated contexts with identify_context
app/routers/generate.py	content_generated	Core product event with generation_type, credits_used, credits_remaining properties
app/routers/api_keys.py	api_key_created, api_key_revoked	API key management events, no additional properties
app/routers/settings.py	email_updated, password_changed	Profile settings events, no additional properties

Issues

No event quality issues.

Other completed criteria

• Events represent real user actions (signup, login, content generation, API key management, settings changes)
• Events enable product insights — can build signup → login → generate funnels, retention analysis
• Key events enriched with properties (content_generated has type, credits used/remaining)
• No PII in capture properties — email is tagged via context (tag()), which is the documented pattern
• Event naming is consistent snake_case and descriptive

---

Reviewed by wizard workbench PR evaluator