Project: privacy-safe support and measurement

Last updated: 5 Oct 20268 min read

project

Build a case-review page with an optional support widget and a product-measurement event for Export starts. Inventory every external request before and after the widget opens, including requests initiated by vendor code. The core review flow must complete when the vendor is blocked. The widget cannot rely on unrestricted third-party cookies, and its fallback opens a controlled top-level support path or local contact route. The host does not pass a session token or raw case note into a frame message. The optional event carries only an approved name, coarse route class, release, and outcome. A preference change stops new optional event creation, clears or suppresses queued batches under the product policy, and reaches other tabs and server jobs within a stated bound. Previously transferred data is handled according to the approved retention contract, not described as remotely retractable.

Build contract

Capture request graphs on signed-out and private routes, before and after support activation.
Block vendor network and storage access; verify case review, save, and support fallback outcomes.
Reject unknown event fields, private notes, raw URLs, and reviewer identifiers before queuing.
Change preference across active and suspended tabs, offline replay, and a running server job; measure enforcement delay.

Implementation checkpoint

function optionalMeasurementAllowed(preference, eventVersion) {
  return preference.enabled && preference.version === eventVersion;
}
console.log(optionalMeasurementAllowed({ enabled: false, version: 9 }, 8));
// Output: false

Cost and boundaries

Each external script adds transfer, parse, and execution cost; on-demand loading can avoid that work for people who never request support. Event validation is O(k) for k fields, and clearing n queued optional events is O(n). Rechecking a server-backed preference on every event adds reads, so a bounded cache or version invalidation may be appropriate if its delay matches the product promise. Request inventories take review time because vendor destinations may change independently of application code. Measure unexpected hosts, bytes, long tasks, denied widget starts, event leakage, and preference propagation delay.

Failure drill

Load support on page start and inspect whether a private case route reaches the vendor before user action. Block third-party storage and confirm the widget does not loop forever or block the case form. Send an unexpected caseNote property through the event builder and confirm the schema rejects it. Queue events in two tabs, change the preference in one, suspend the other, then wake it and inspect outgoing requests. Let a server job start before the preference change and ensure its later optional sends follow the defined cutoff. Replace the widget frame origin in a test and verify no host credential is posted.

Acceptance checks

Observed external requests have a named purpose, owner, and allowed data contract.
Vendor failure and blocked storage do not block the primary task.
Event payloads reject private or unknown fields before transfer.
Preference changes stop optional sends across tabs and server paths within the stated bound.

Common Mistakes

Trusting a package list instead of observing runtime requests.
Passing a host token to an embedded widget.
Disabling a dashboard while leaving event collection active.
Assuming a sleeping tab has received a broadcast.

web-tech

web-development