fix(experiments): scope legacy runtime adoption to the client app

Author: LiorMazig

src/client.ts

@@ -183,6 +183,7 @@ export function createClient(config: CreateClientConfig): Base44Client {
       pageUrl: experimentsContext?.pageUrl,
   });
   const experiments = createExperimentsModule({
+    appId,
     getAuth: () => userAuthModule,
     trackExposure: exposureTracker.track,
     flushExposures: exposureTracker.flush,

src/modules/experiments-runtime.types.ts

@@ -18,8 +18,13 @@ export interface ExperimentsRuntime {
 }
 
 /** @internal */
-export function getExperimentsRuntime(): ExperimentsRuntime | undefined {
+export function getExperimentsRuntime(appId?: string): ExperimentsRuntime | undefined {
   if (typeof window === "undefined" || typeof document === "undefined") return;
-  return (window as Window & { __B44_EXPERIMENTS__?: ExperimentsRuntime })
-    .__B44_EXPERIMENTS__;
+  const page = window as Window & {
+    __B44_EXPERIMENTS__?: ExperimentsRuntime;
+    __B44_EXPERIMENTS_BOOTSTRAP__?: { config: { app_id: string } };
+  };
+  // The legacy evaluator has no app ID; its companion bootstrap identifies its owner.
+  if (appId !== undefined && page.__B44_EXPERIMENTS_BOOTSTRAP__?.config?.app_id !== appId) return;
+  return page.__B44_EXPERIMENTS__;
 }

src/modules/experiments.ts

@@ -18,11 +18,13 @@ const EMPTY: ExperimentsSnapshot = Object.freeze({
 
 /** @internal */
 export function createExperimentsModule({
+  appId,
   getAuth,
   trackExposure,
   flushExposures = async () => {},
   context,
 }: {
+  appId: string;
   getAuth: () => InternalAuthModule;
   trackExposure: ReturnType<typeof createExposureTracker>["track"];
   flushExposures?: () => Promise<void>;
@@ -93,7 +95,7 @@ export function createExperimentsModule({
   function activate() {
     if (disposed) return;
     active = true;
-    if (!context) runtime = getExperimentsRuntime();
+    if (!context) runtime = getExperimentsRuntime(appId);
     if (!runtime) {
       publish();
       return;
@@ -109,7 +111,7 @@ export function createExperimentsModule({
     if (disposed) return;
     state = next;
     if (!active) return;
-    if (!context) runtime = getExperimentsRuntime();
+    if (!context) runtime = getExperimentsRuntime(appId);
     applyIdentity();
   }
 

tests/unit/experiments-auth.test.ts

@@ -22,11 +22,12 @@ function setup(token?: string) {
   };
   vi.stubGlobal("window", {
     __B44_EXPERIMENTS__: runtime,
+    __B44_EXPERIMENTS_BOOTSTRAP__: { config: { app_id: "app-id" } },
     localStorage: { setItem: vi.fn(), removeItem: vi.fn() },
     location: { href: "https://example.test/dashboard" },
   });
   vi.stubGlobal("document", {});
-  const bridge = createExperimentsModule({ getAuth: () => auth, trackExposure: vi.fn() });
+  const bridge = createExperimentsModule({ appId: "app-id", getAuth: () => auth, trackExposure: vi.fn() });
   const auth = createAuthModule(api, axios.create(), "app-id", {
     serverUrl: "https://example.test", appBaseUrl: "https://example.test",
     onAuthStateChange: bridge.onAuthStateChange,

tests/unit/experiments-client.test.ts

@@ -3,6 +3,7 @@ import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
 import { createClient, createClientFromRequest } from "../../src/client.js";
 import { resetAnalyticsSessionContext } from "../../src/modules/analytics.js";
 import type { ExperimentsContext } from "../../src/modules/experiments-config.types.js";
+import { createExperimentsRuntime } from "../../src/modules/experiments-context.js";
 import { getSharedInstance } from "../../src/utils/sharedInstance.js";
 
 vi.mock("partysocket", () => ({ WebSocket: class {} }));
@@ -43,6 +44,38 @@ function captureAnalytics() {
 }
 
 describe("client experiments integration", () => {
+  test.each(["other-app", "unidentified"])("does not adopt an %s legacy runtime or send its exposures", async (owner) => {
+    vi.useFakeTimers();
+    const published: ExperimentsContext = {
+      ...context, identity: { visitorId: "visitor-a", userId: null, status: "anonymous" },
+      config: { ...context.config, experiments: [{ ...context.config.experiments[0], assign_by: "visitor" }] },
+    };
+    const runtime = createExperimentsRuntime(published);
+    vi.stubGlobal("window", {
+      __B44_EXPERIMENTS__: runtime,
+      __B44_EXPERIMENTS_BOOTSTRAP__: owner === "other-app" ? published : undefined,
+      location: { origin: "https://app.example", pathname: "/", search: "" },
+      localStorage: { getItem: () => null, setItem: () => {} },
+      addEventListener: vi.fn(), removeEventListener: vi.fn(),
+    });
+    vi.stubGlobal("document", { referrer: "" });
+    const adapter = captureAnalytics();
+    const client = createClient({ appId: "second-app" });
+    try {
+      expect(client.experiments.getSnapshot()).toEqual({ flags: {}, isLoading: false });
+      expect(client.experiments.isEnabled("checkout")).toBe(false);
+      expect(client.experiments.isEnabled("checkout", true)).toBe(true);
+      await client.experiments.ready();
+      await client.experiments.flush();
+      await vi.advanceTimersByTimeAsync(1500);
+      expect(adapter).not.toHaveBeenCalled();
+      expect(runtime.flags.checkout).toBe(true);
+      expect(runtime.userId).toBeNull();
+    } finally {
+      client.cleanup();
+    }
+  });
+
   test("three distinct feature reads and a goal share one request-scoped Analytics batch", async () => {
     const create = axios.create.bind(axios);
     const adapter = vi.fn(async (config) => ({

tests/unit/experiments-context.test.ts

@@ -28,6 +28,7 @@ describe("platform experiments context", () => {
     const me = vi.fn();
     const track = vi.fn();
     const make = (value: ExperimentsContext) => createExperimentsModule({
+      appId: "app",
       context: value, getAuth: () => ({ hasToken: () => true, me }) as unknown as InternalAuthModule, trackExposure: track,
     });
     const a = make(context);
@@ -49,6 +50,7 @@ describe("platform experiments context", () => {
     vi.stubGlobal("sessionStorage", { getItem: () => '{"checkout":true}' });
     const track = vi.fn();
     const sdk = createExperimentsModule({
+      appId: "app",
       context: getBrowserExperimentsContext("app"),
       getAuth: () => ({ hasToken: () => true }) as InternalAuthModule, trackExposure: track,
     });
@@ -63,6 +65,7 @@ describe("platform experiments context", () => {
   test("preserves server-rendered flags while common browser auth is still pending", () => {
     const serverFlags = { checkout: false };
     const sdk = createExperimentsModule({
+      appId: "app",
       context: { ...context, identity: { ...context.identity, userId: null, status: "pending" }, serverSnapshot: { flags: serverFlags, isLoading: false } },
       getAuth: () => ({ hasToken: () => true }) as InternalAuthModule, trackExposure: vi.fn(),
     });

tests/unit/experiments.test.ts

@@ -14,12 +14,14 @@ function setup(hasToken = false) {
       this.flags = { checkout: id !== null };
     },
   };
-  vi.stubGlobal("window", { __B44_EXPERIMENTS__: runtime });
+  const page = { __B44_EXPERIMENTS__: runtime, __B44_EXPERIMENTS_BOOTSTRAP__: { config: { app_id: "app" } } };
+  vi.stubGlobal("window", page);
   vi.stubGlobal("document", {});
   const requests: { resolve: (user: User) => void; reject: (error: Error) => void }[] = [];
   const me = vi.fn(() => new Promise<User>((resolve, reject) => requests.push({ resolve, reject })));
   const trackExposure = vi.fn();
   const bridge = createExperimentsModule({
+    appId: "app",
     getAuth: () => ({ hasToken: () => hasToken, me }) as InternalAuthModule,
     trackExposure,
   });
@@ -28,7 +30,7 @@ function setup(hasToken = false) {
     if (state.status === "authenticated") requests[index]?.resolve({ id: state.userId } as User);
     else requests[index]?.reject(new Error("lookup failed"));
   };
-  return { ...bridge, runtime, requests, settle, me, trackExposure };
+  return { ...bridge, runtime, page, requests, settle, me, trackExposure };
 }
 
 afterEach(() => vi.unstubAllGlobals());
@@ -139,11 +141,26 @@ describe("browser experiments", () => {
     b.module.getSnapshot();
     b.runtime.userId = "old-user";
     b.runtime.flags.checkout = true;
-    vi.stubGlobal("window", { __B44_EXPERIMENTS__: b.runtime });
+    vi.stubGlobal("window", b.page);
     expect(b.module.isEnabled("checkout")).toBe(false);
     expect(b.runtime.userId).toBeNull();
   });
 
+  test("auth updates cannot adopt a replacement runtime owned by another app", () => {
+    const b = setup();
+    expect(b.module.isEnabled("checkout")).toBe(false);
+    b.trackExposure.mockClear();
+    b.page.__B44_EXPERIMENTS_BOOTSTRAP__.config.app_id = "other-app";
+    const setUser = vi.spyOn(b.runtime, "setUser");
+
+    b.onAuthStateChange({ status: "authenticated", userId: "user-b" });
+    expect(b.module.getSnapshot()).toEqual({ flags: {}, isLoading: false });
+    b.onAuthStateChange({ status: "anonymous" });
+    expect(b.module.isEnabled("checkout", true)).toBe(true);
+    expect(setUser).not.toHaveBeenCalled();
+    expect(b.trackExposure).not.toHaveBeenCalled();
+  });
+
   test("cleanup and throwing subscribers cannot restore or interrupt identity", async () => {
     const b = setup(true);
     const listener = vi.fn(() => { throw new Error("render error"); });