[CI] (1776c51) angular/angular-saas

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 1776c51
App: angular/angular-saas
App directory: apps/angular/angular-saas
Workbench branch: wizard-ci-1776c51-angular-angular-saas
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-07-10T23:22:36.071Z
Duration: 639.0s

YARA Scanner

✓ 118 tool calls scanned, 0 violations detected

No violations: ✓ 118 clean scans

[wizard-ci-bot]

---

PR Evaluation Report

Summary

This PR integrates PostHog into an Angular SaaS application via a well-structured singleton PostHogService initialized outside Angular's zone. It instruments 13 meaningful product events across authentication, dashboard, billing, profile, settings, and security flows, plus exception tracking through an HTTP error interceptor.

Files changed	Lines added	Lines removed
20	+224	-8

Confidence score: 4/5 👍

• No reverse proxy configured: Client-side posthog-js is used without a reverse proxy, making event requests susceptible to ad blockers. A reverse proxy (or Next.js rewrites equivalent for Angular) should be set up. [MEDIUM]
• No identify call for returning visitors: posthog.identify() is only called on fresh login and profile save. A returning user who is already authenticated and reloads the page will remain anonymous until they log in again. The app.component.ts ngOnInit should check credentials and call identify if the user is already authenticated. [MEDIUM]
• No .env.example file: The NG_APP_POSTHOG_PROJECT_TOKEN and NG_APP_POSTHOG_HOST env vars are not documented in a .env.example or equivalent. While the env.d.ts declares types, collaborators won't know what values to set. [LOW]

---

File changes

Filename	Score	Description
posthog.service.ts	5/5	New singleton service using NgZone.runOutsideAngular, SSR-safe with platform checks, Proxy fallback for safe no-op on server
app.component.ts	3/5	Initializes PostHog correctly but misses re-identifying returning authenticated users
login.component.ts	5/5	Identifies user on login with res.id, captures login success/failure with properties
logout.component.ts	5/5	Captures logout event and calls posthog.reset() correctly
error-handler.interceptor.ts	5/5	Captures HTTP errors via captureException
billing.component.ts	5/5	Adds plan selection tracking with enriched properties
dashboard.component.ts	5/5	Tracks modal opens with context properties
profile.component.ts	5/5	Re-identifies user on profile update, captures profile_updated
security-settings.component.ts	5/5	Tracks 2FA toggle and session revocation with properties
environment.ts / environment.prod.ts	4/5	Loads from env vars with sensible fallback
shared/services/index.ts	4/5	Replaced bottomSheet export (confirmed unused) with posthog export
env.d.ts	5/5	Proper type declarations for env variables

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	Setup report confirms successful build
Preserves existing env vars & configs	Yes	Existing environment configs preserved; bottomSheet.service was already absent
No syntax or type errors	Yes	TypeScript is valid, proper Angular inject() pattern used
Correct imports/exports	Yes	All imports resolve to correct packages
Minimal, focused changes	Yes	All changes relate to PostHog integration
Pre-existing issues	None	No pre-existing issues detected

Issues

• No .env.example file: The new NG_APP_POSTHOG_PROJECT_TOKEN and NG_APP_POSTHOG_HOST environment variables are not documented in a .env.example file. Collaborators won't know what to configure. [LOW]

Other completed criteria

• Build configuration valid — posthog-js added to package.json dependencies correctly
• Environment variables use env['NG_APP_POSTHOG_PROJECT_TOKEN'] pattern consistent with the app's existing .env import mechanism
• env.d.ts properly declares ImportMetaEnv types for the new variables
• credentials.service.ts addition of syncCredentials() is minimal and used by profile component

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js ^1.399.2 added to package.json
PostHog client initialized	Yes	Initialized in app.component.ts via PostHogService.init() with NgZone.runOutsideAngular per Angular docs
capture()	Yes	13 meaningful capture calls across auth, dashboard, billing, profile, and settings flows
identify()	Yes	Called on login with res.id as distinct_id and person properties; re-called on profile update
Error tracking	Yes	captureException in HTTP error interceptor, login error handler, logout error handler; capture_exceptions: true in init config
Reverse proxy	No	No reverse proxy configured; client-side posthog-js requests will be blocked by ad blockers

Issues

• No reverse proxy: posthog-js events are sent directly to us.i.posthog.com from the browser. Ad blockers will intercept these requests. Configure a reverse proxy through your web server or CDN. [MEDIUM]
• Missing identify on page load for returning users: posthog.identify() is only called during login and profile save. When an already-authenticated user refreshes the page or opens a new tab, their session events are anonymous. Add an identify call in app.component.ts ngOnInit when credentialsService.isAuthenticated() is true. [MEDIUM]

Other completed criteria

• API key loaded from environment variable via env['NG_APP_POSTHOG_PROJECT_TOKEN'], not hardcoded
• Host correctly configured to https://us.i.posthog.com with environment variable override
• posthog.reset() correctly called on logout
• SSR-safe implementation with isPlatformBrowser checks and Proxy fallback
• defaults: '2026-05-30' config option set per current docs

---

PostHog insights and events ✅

Filename	PostHog events	Description
login.component.ts	user_logged_in, user_login_failed, captureException	Tracks login success with redirect context and roles count; captures login failures
logout.component.ts	user_logged_out, captureException	Tracks logout and resets identity; captures logout errors
dashboard.component.ts	create_project_modal_opened, add_member_modal_opened	Tracks dashboard workflow entry points with current counts
create-project-modal.component.ts	project_created	Tracks project creation with ID, status, and description presence
add-member-modal.component.ts	team_member_added	Tracks team member addition with role and avatar
billing.component.ts	billing_plan_selected	Tracks plan selection with plan ID, period, and price
profile.component.ts	profile_updated	Tracks profile saves with changed fields count
account-settings.component.ts	account_settings_saved	Tracks account settings with updated fields and password change flag
security-settings.component.ts	two_factor_toggled, session_revoked, all_other_sessions_revoked	Tracks security actions with contextual properties
error-handler.interceptor.ts	captureException	Global HTTP error exception tracking

Issues

No issues — events are well-designed and actionable.

Other completed criteria

• Events represent real user actions across the full product lifecycle (auth → workspace → settings)
• Events enable product insights: login→dashboard→project_created funnel, billing conversion, security feature adoption
• Events include relevant contextual properties (plan IDs, field counts, device info, role data)
• No PII in capture properties — email/name only in identify() person properties
• Consistent snake_case naming convention throughout

---

Reviewed by wizard workbench PR evaluator