PR feedback

Author: heatlikeheatwave

packages/nextjs/src/app-router/keyless-actions.ts

@@ -6,7 +6,6 @@ import { redirect, RedirectType } from 'next/navigation';
 import { errorThrower } from '../server/errorThrower';
 import { detectClerkMiddleware } from '../server/headers-utils';
 import { getKeylessCookieName, getKeylessCookieValue } from '../server/keyless';
-import { detectKeylessEnvDrift } from '../server/keyless-telemetry';
 import { canUseKeyless } from '../utils/feature-flags';
 
 type SetCookieOptions = Parameters<Awaited<ReturnType<typeof cookies>>['set']>[2];
@@ -62,8 +61,8 @@ export async function createOrReadKeylessAction(): Promise<null | Omit<Accountle
     return null;
   }
 
-  // Detect environment variable drift and fire telemetry events
-  await detectKeylessEnvDrift();
+  // Detect environment variable drift and fire telemetry event
+  void import('../server/keyless-telemetry.js').then(m => m.detectKeylessEnvDrift()).catch(() => {});
 
   const { clerkDevelopmentCache, createKeylessModeMessage } = await import('../server/keyless-log-cache.js');
 

packages/nextjs/src/server/keyless-telemetry.ts

@@ -25,36 +25,33 @@ function getTelemetryFlagFilePath(): string {
 }
 
 /**
- * Checks if the telemetry event has already been fired by looking for a flag file.
- */
-async function hasTelemetryEventBeenFired(): Promise<boolean> {
-  try {
-    await fs.access(getTelemetryFlagFilePath());
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Creates a flag file to mark that the telemetry event has been fired.
+ * Atomically attempts to create a telemetry flag file to prevent duplicate events.
+ * This uses the 'wx' flag to ensure only one process can successfully create the file.
+ *
+ * @returns true if this process won the race and created the flag file, false if it already exists
  */
-async function markTelemetryEventAsFired(): Promise<void> {
+async function tryCreateTelemetryFlag(): Promise<boolean> {
   try {
     // Ensure the directory exists
     const dir = join(process.cwd(), '.clerk/.tmp');
     await fs.mkdir(dir, { recursive: true });
 
-    // Create the flag file with timestamp
+    // Create the flag file with timestamp using 'wx' flag for atomic creation
     const flagData = {
       firedAt: new Date().toISOString(),
       event: EVENT_KEYLESS_ENV_DRIFT_DETECTED,
     };
 
-    await fs.writeFile(getTelemetryFlagFilePath(), JSON.stringify(flagData, null, 2));
-  } catch (error) {
-    // Silently handle errors to avoid breaking the application
+    await fs.writeFile(getTelemetryFlagFilePath(), JSON.stringify(flagData, null, 2), { flag: 'wx' });
+    return true; // Successfully created the file - we won the race
+  } catch (error: any) {
+    if (error.code === 'EEXIST') {
+      // File already exists - another process won the race
+      return false;
+    }
+    // Other errors (permission issues, etc.) - silently handle to avoid breaking the application
     console.warn('Failed to create telemetry flag file:', error);
+    return false;
   }
 }
 
@@ -77,11 +74,6 @@ export async function detectKeylessEnvDrift(): Promise<void> {
   }
 
   try {
-    // Check if telemetry event has already been fired
-    if (await hasTelemetryEventBeenFired()) {
-      return;
-    }
-
     // Dynamically import server-side dependencies to avoid client-side issues
     const { safeParseClerkFile } = await import('./keyless-node.js');
 
@@ -101,7 +93,7 @@ export async function detectKeylessEnvDrift(): Promise<void> {
     const keylessFileHasKeys = Boolean(keylessFile?.publishableKey && keylessFile?.secretKey);
 
     if (envVarsMissing && keylessFileHasKeys) {
-      // Environment variables are missing but keyless file has keys - this is normal for keyless mode
+      // Environment variables are missing and keyless file has keys. This is expected for keyless mode
       return;
     }
 
@@ -114,22 +106,23 @@ export async function detectKeylessEnvDrift(): Promise<void> {
     // Check if there's a drift (mismatch between env vars and keyless file)
     const hasDrift = !publicKeyMatch || !secretKeyMatch;
 
-    const payload: EventKeylessEnvDriftPayload = {
-      publicKeyMatch,
-      secretKeyMatch,
-      envVarsMissing,
-      keylessFileHasKeys,
-      keylessPublishableKey: keylessFile.publishableKey,
-      envPublishableKey: envPublishableKey as string,
-    };
+    // Only emit telemetry if there's drift and we can atomically create the flag file
+    if (hasDrift && (await tryCreateTelemetryFlag())) {
+      const payload: EventKeylessEnvDriftPayload = {
+        publicKeyMatch,
+        secretKeyMatch,
+        envVarsMissing,
+        keylessFileHasKeys,
+        keylessPublishableKey: keylessFile.publishableKey,
+        envPublishableKey: envPublishableKey as string,
+      };
 
-    // Create a clerk client to access telemetry
-    const clerkClient = createClerkClientWithOptions({
-      publishableKey: keylessFile.publishableKey,
-      secretKey: keylessFile.secretKey,
-    });
+      // Create a clerk client to access telemetry
+      const clerkClient = createClerkClientWithOptions({
+        publishableKey: keylessFile.publishableKey,
+        secretKey: keylessFile.secretKey,
+      });
 
-    if (hasDrift) {
       // Fire drift detected event
       const driftDetectedEvent: TelemetryEventRaw<EventKeylessEnvDriftPayload> = {
         event: EVENT_KEYLESS_ENV_DRIFT_DETECTED,
@@ -138,9 +131,6 @@ export async function detectKeylessEnvDrift(): Promise<void> {
       };
 
       clerkClient.telemetry?.record(driftDetectedEvent);
-
-      // Mark the telemetry event as fired to prevent future executions
-      await markTelemetryEventAsFired();
     }
   } catch (error) {
     // Silently handle errors to avoid breaking the application