implement telemetry opt-in/out via token bridge

aaspinwall · aaspinwall · commit 9a9eb2d38c80 · 2026-07-02T14:16:13.000-04:00
diff --git a/packages/addon/public/token-bridge.js b/packages/addon/public/token-bridge.js
@@ -18,6 +18,14 @@ const OPEN_MANAGEMENT_PAGE = 'OPEN_MANAGEMENT_PAGE';
 //   PENDING_ADDON_TOKEN_RESPONSE : background → bridge → web page ("here it is")
 const GET_PENDING_ADDON_TOKEN = 'TB/GET_PENDING_ADDON_TOKEN';
 const PENDING_ADDON_TOKEN_RESPONSE = 'TB/PENDING_ADDON_TOKEN_RESPONSE';
+// Telemetry pref bridge (issue #952). The hosted Send dashboard cannot call the
+// browser.Telemetry experiment API, so it asks the background for the pref:
+//   GET_TELEMETRY_STATE      : web page → bridge → background
+//   TELEMETRY_STATE_RESPONSE : background → bridge → web page
+//   TELEMETRY_STATE_CHANGED  : background → bridge → web page (runtime change)
+const GET_TELEMETRY_STATE = 'TB/GET_TELEMETRY_STATE';
+const TELEMETRY_STATE_RESPONSE = 'TB/TELEMETRY_STATE_RESPONSE';
+const TELEMETRY_STATE_CHANGED = 'TB/TELEMETRY_STATE_CHANGED';
 
 window.postMessage({ type: BRIDGE_READY }, window.location.origin);
 console.log(`[🌉 token-bridge] the token bridge has loaded.`);
@@ -136,6 +144,13 @@ window.addEventListener('message', (e) => {
       type: GET_PENDING_ADDON_TOKEN,
     });
   }
+
+  // ----- Web to add-on: hosted dashboard asks for the telemetry pref -----
+  if (e?.data?.type === GET_TELEMETRY_STATE) {
+    browser.runtime.sendMessage({
+      type: GET_TELEMETRY_STATE,
+    });
+  }
 });
 
 // Listen for responses from background script and forward to web app
@@ -179,4 +194,18 @@ browser.runtime.onMessage.addListener((message) => {
       window.location.origin
     );
   }
+
+  // ----- Add-on to Web: telemetry pref value / runtime change (issue #952) -----
+  if (
+    message.type === TELEMETRY_STATE_RESPONSE ||
+    message.type === TELEMETRY_STATE_CHANGED
+  ) {
+    window.postMessage(
+      {
+        type: message.type,
+        enabled: message.enabled,
+      },
+      window.location.origin
+    );
+  }
 });
diff --git a/packages/addon/src/background.ts b/packages/addon/src/background.ts
@@ -18,6 +18,7 @@ import {
   FORCE_CLOSE_WINDOW,
   GET_LOGIN_STATE,
   GET_PENDING_ADDON_TOKEN,
+  GET_TELEMETRY_STATE,
   LOGIN_STATE_RESPONSE,
   OIDC_TOKEN,
   OIDC_USER,
@@ -31,6 +32,8 @@ import {
   SIGN_IN_COMPLETE,
   SIGN_OUT,
   STORAGE_KEY_AUTH,
+  TELEMETRY_STATE_CHANGED,
+  TELEMETRY_STATE_RESPONSE,
 } from '@send-frontend/lib/const';
 
 import init from '@send-frontend/lib/init';
@@ -447,6 +450,28 @@ browser.runtime.onMessage.addListener(async (message, sender) => {
       break;
     }
 
+    case GET_TELEMETRY_STATE: {
+      // The hosted Send dashboard (send.js) runs as a web page and cannot call
+      // the browser.Telemetry experiment API directly, so it requests the
+      // Thunderbird telemetry pref here via the token-bridge (issue #952).
+      // getUploadEnabled() already fails closed to false on error.
+      let enabled = false;
+      try {
+        enabled = await browser.Telemetry.getUploadEnabled();
+      } catch (e) {
+        console.warn('[onMessage] Failed to read telemetry pref:', e);
+      }
+      if (sender?.tab?.id) {
+        browser.tabs
+          .sendMessage(sender.tab.id, {
+            type: TELEMETRY_STATE_RESPONSE,
+            enabled,
+          })
+          .catch(() => {});
+      }
+      break;
+    }
+
     // ----- Add-On to Web — Step 6: Read staged token and respond to tab -----
     // The /addon-auth page (running as a normal web tab) cannot call
     // browser.storage.local directly. It sends GET_PENDING_ADDON_TOKEN via
@@ -765,6 +790,30 @@ function initAccountHubListener() {
   });
 }
 
+// ==============================================
+// Broadcast Thunderbird telemetry pref changes to hosted Send pages (issue
+// #952). The dashboard (send.js) runs as a web page without the
+// browser.Telemetry experiment API, so it can't observe the pref itself. We
+// watch it here and push changes through the token-bridge so telemetry can
+// start/stop at runtime without a reload.
+function initTelemetryListener() {
+  browser.Telemetry.onChanged.addListener(async (enabled) => {
+    const tabs = await browser.tabs.query({});
+    tabs.forEach((tab) => {
+      if (tab.id) {
+        browser.tabs
+          .sendMessage(tab.id, {
+            type: TELEMETRY_STATE_CHANGED,
+            enabled,
+          })
+          .catch(() => {
+            // Ignore tabs that can't receive messages.
+          });
+      }
+    });
+  });
+}
+
 (async function main() {
   await checkAndUninstallIfDeprecated();
   initMenu();
@@ -790,6 +839,7 @@ function initAccountHubListener() {
   }
   initStorageWatcher();
   initAccountHubListener();
+  initTelemetryListener();
 })().catch((error) => {
   console.error('Error initializing background.js', error);
 });
diff --git a/packages/send/frontend/src/lib/const.ts b/packages/send/frontend/src/lib/const.ts
@@ -55,3 +55,14 @@ export const STORAGE_KEY_AUTH = 'STORAGE_KEY_AUTH';
 export const PENDING_ADDON_TOKEN = 'tbpro-pending-addon-token';
 export const GET_PENDING_ADDON_TOKEN = 'TB/GET_PENDING_ADDON_TOKEN';
 export const PENDING_ADDON_TOKEN_RESPONSE = 'TB/PENDING_ADDON_TOKEN_RESPONSE';
+
+// Telemetry pref bridge (issue #952). The hosted Send dashboard (send.js) runs
+// as a web page without access to the `browser.Telemetry` experiment API, so it
+// asks the background script for the Thunderbird telemetry pref via the
+// token-bridge instead of reading it directly.
+//   GET_TELEMETRY_STATE      : web page → bridge → background ("what's the pref?")
+//   TELEMETRY_STATE_RESPONSE : background → bridge → web page ("{ enabled }")
+//   TELEMETRY_STATE_CHANGED  : background → bridge → web page (runtime pref change)
+export const GET_TELEMETRY_STATE = 'TB/GET_TELEMETRY_STATE';
+export const TELEMETRY_STATE_RESPONSE = 'TB/TELEMETRY_STATE_RESPONSE';
+export const TELEMETRY_STATE_CHANGED = 'TB/TELEMETRY_STATE_CHANGED';
diff --git a/packages/send/frontend/src/lib/telemetryConsent.test.ts b/packages/send/frontend/src/lib/telemetryConsent.test.ts
@@ -1,4 +1,8 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
+import {
+  GET_TELEMETRY_STATE,
+  TELEMETRY_STATE_RESPONSE,
+} from './const';
 import { isTelemetryAllowed } from './telemetryConsent';
 
 function setUserAgent(ua: string) {
@@ -8,6 +12,23 @@ function setUserAgent(ua: string) {
   });
 }
 
+/**
+ * Simulates the token-bridge content script: when the page asks for the
+ * telemetry state, reply with the given value. Returns an uninstall function.
+ */
+function installFakeBridge(enabled: boolean) {
+  const bridge = (event: MessageEvent) => {
+    if (event.data?.type === GET_TELEMETRY_STATE) {
+      window.postMessage(
+        { type: TELEMETRY_STATE_RESPONSE, enabled },
+        window.location.origin
+      );
+    }
+  };
+  window.addEventListener('message', bridge);
+  return () => window.removeEventListener('message', bridge);
+}
+
 const THUNDERBIRD_UA =
   'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Thunderbird/140.0';
 const WEB_UA =
@@ -41,10 +62,38 @@ describe('isTelemetryAllowed', () => {
     await expect(isTelemetryAllowed()).resolves.toBe(false);
   });
 
-  it('fails closed inside Thunderbird when the experiment API is unavailable', async () => {
+  it('honors the pref via the token-bridge when the API is absent (dashboard) — enabled', async () => {
     setUserAgent(THUNDERBIRD_UA);
-    // No `browser.Telemetry` available.
-    await expect(isTelemetryAllowed()).resolves.toBe(false);
+    // No `browser.Telemetry` (hosted dashboard context), but the bridge answers.
+    const uninstall = installFakeBridge(true);
+    try {
+      await expect(isTelemetryAllowed()).resolves.toBe(true);
+    } finally {
+      uninstall();
+    }
+  });
+
+  it('honors the pref via the token-bridge when the API is absent (dashboard) — disabled', async () => {
+    setUserAgent(THUNDERBIRD_UA);
+    const uninstall = installFakeBridge(false);
+    try {
+      await expect(isTelemetryAllowed()).resolves.toBe(false);
+    } finally {
+      uninstall();
+    }
+  });
+
+  it('fails closed inside Thunderbird when neither the API nor the bridge answers', async () => {
+    setUserAgent(THUNDERBIRD_UA);
+    // No `browser.Telemetry` and no bridge listening: the request times out.
+    vi.useFakeTimers();
+    try {
+      const pending = isTelemetryAllowed();
+      await vi.advanceTimersByTimeAsync(2000);
+      await expect(pending).resolves.toBe(false);
+    } finally {
+      vi.useRealTimers();
+    }
   });
 
   it('fails closed inside Thunderbird when reading the pref throws', async () => {
diff --git a/packages/send/frontend/src/lib/telemetryConsent.ts b/packages/send/frontend/src/lib/telemetryConsent.ts
@@ -8,15 +8,30 @@
  * - Outside Thunderbird (public website): telemetry behaves as before (allowed).
  * - Inside Thunderbird, on an add-on (moz-extension) page: read the pref via the
  *   `browser.Telemetry` experiment API.
- * - Inside Thunderbird but the experiment API is unavailable / errors: fail
- *   closed (no telemetry).
+ * - Inside Thunderbird on the hosted Send dashboard (send.js runs as a web page
+ *   with no experiment API): ask the background script for the pref over the
+ *   token-bridge (issue #952).
+ * - Inside Thunderbird but neither the experiment API nor the bridge answers:
+ *   fail closed (no telemetry).
  *
  * The `browser.Telemetry` namespace is provided by the add-on's experiment API
  * (packages/addon/public/api/Telemetry). The frontend types come from
  * @types/firefox-webext-browser, which does not know about custom experiment
  * APIs, hence the `@ts-ignore` accesses below (matching extension-store.ts).
  */
 
+import {
+  GET_TELEMETRY_STATE,
+  TELEMETRY_STATE_CHANGED,
+  TELEMETRY_STATE_RESPONSE,
+} from './const';
+
+// How long to wait for the token-bridge to answer before failing closed. The
+// bridge content script is injected at document_start, so it is normally
+// present before this runs; the timeout covers the case where it is not (e.g.
+// the add-on isn't installed).
+const BRIDGE_TIMEOUT_MS = 2000;
+
 const isInsideThunderbird = (): boolean =>
   typeof navigator !== 'undefined' &&
   navigator.userAgent.includes('Thunderbird');
@@ -35,6 +50,41 @@ const getTelemetryApi = (): any => {
   return undefined;
 };
 
+/**
+ * Requests the Thunderbird telemetry pref from the background script via the
+ * token-bridge, for contexts (the hosted Send dashboard) that lack the
+ * `browser.Telemetry` experiment API. Resolves false (fail closed) if the
+ * bridge does not answer within the timeout.
+ */
+function requestTelemetryStateViaBridge(): Promise<boolean> {
+  if (typeof window === 'undefined') {
+    return Promise.resolve(false);
+  }
+
+  return new Promise((resolve) => {
+    const cleanup = () => {
+      clearTimeout(timer);
+      window.removeEventListener('message', handler);
+    };
+
+    const timer = setTimeout(() => {
+      // Bridge absent or unresponsive — fail closed.
+      cleanup();
+      resolve(false);
+    }, BRIDGE_TIMEOUT_MS);
+
+    const handler = (event: MessageEvent) => {
+      if (event.data?.type === TELEMETRY_STATE_RESPONSE) {
+        cleanup();
+        resolve(Boolean(event.data.enabled));
+      }
+    };
+
+    window.addEventListener('message', handler);
+    window.postMessage({ type: GET_TELEMETRY_STATE }, window.location.origin);
+  });
+}
+
 /**
  * Resolves whether telemetry (Sentry + PostHog) is allowed to run.
  * Fails closed (false) when inside Thunderbird and the pref cannot be read.
@@ -46,16 +96,18 @@ export async function isTelemetryAllowed(): Promise<boolean> {
   }
 
   const api = getTelemetryApi();
-  if (!api?.getUploadEnabled) {
-    // Inside Thunderbird but the experiment API is unavailable: fail closed.
-    return false;
+  if (api?.getUploadEnabled) {
+    // moz-extension add-on page: read the pref directly.
+    try {
+      return Boolean(await api.getUploadEnabled());
+    } catch {
+      return false;
+    }
   }
 
-  try {
-    return Boolean(await api.getUploadEnabled());
-  } catch {
-    return false;
-  }
+  // Inside Thunderbird without the direct experiment API (the hosted Send
+  // dashboard runs as a web page): ask the background via the token-bridge.
+  return requestTelemetryStateViaBridge();
 }
 
 /**
@@ -67,18 +119,32 @@ export function onTelemetryChanged(
   cb: (enabled: boolean) => void
 ): () => void {
   const api = getTelemetryApi();
-  if (!api?.onChanged?.addListener) {
-    return () => {};
+  if (api?.onChanged?.addListener) {
+    // moz-extension add-on page: observe the pref directly.
+    const listener = (enabled: boolean) => cb(Boolean(enabled));
+    api.onChanged.addListener(listener);
+
+    return () => {
+      try {
+        api.onChanged.removeListener?.(listener);
+      } catch {
+        // ignore
+      }
+    };
   }
 
-  const listener = (enabled: boolean) => cb(Boolean(enabled));
-  api.onChanged.addListener(listener);
+  // Inside Thunderbird without the direct API (the hosted Send dashboard): the
+  // background pushes pref changes through the token-bridge as window messages.
+  if (isInsideThunderbird() && typeof window !== 'undefined') {
+    const handler = (event: MessageEvent) => {
+      if (event.data?.type === TELEMETRY_STATE_CHANGED) {
+        cb(Boolean(event.data.enabled));
+      }
+    };
+    window.addEventListener('message', handler);
+    return () => window.removeEventListener('message', handler);
+  }
 
-  return () => {
-    try {
-      api.onChanged.removeListener?.(listener);
-    } catch {
-      // ignore
-    }
-  };
+  // Public website (outside Thunderbird): nothing to observe.
+  return () => {};
 }
