@@ -185,6 +185,36 @@ describe('event tracking', () => {
185185 } )
186186 } )
187187
188+ test ( 'sends SHOPIFY_ environment variables in sensitive payload' , async ( ) => {
189+ const originalEnv = { ...process . env }
190+ process . env . SHOPIFY_TEST_VAR = 'test_value'
191+ process . env . SHOPIFY_ANOTHER_VAR = 'another_value'
192+ process . env . NOT_SHOPIFY_VAR = 'should_not_appear'
193+
194+ await inProjectWithFile ( 'package.json' , async ( args ) => {
195+ const commandContent = { command : 'dev' , topic : 'app' }
196+ await startAnalytics ( { commandContent, args, currentTime : currentDate . getTime ( ) - 100 } )
197+
198+ // When
199+ const config = {
200+ runHook : vi . fn ( ) . mockResolvedValue ( { successes : [ ] , failures : [ ] } ) ,
201+ plugins : [ ] ,
202+ } as any
203+ await reportAnalyticsEvent ( { config, exitMode : 'ok' } )
204+
205+ // Then
206+ const sensitivePayload = publishEventMock . mock . calls [ 0 ] ! [ 2 ]
207+ expect ( publishEventMock ) . toHaveBeenCalledOnce ( )
208+ expect ( sensitivePayload ) . toHaveProperty ( 'env_shopify_variables' )
209+ expect ( sensitivePayload . env_shopify_variables ) . toBeDefined ( )
210+
211+ const shopifyVars = JSON . parse ( sensitivePayload . env_shopify_variables as string )
212+ expect ( shopifyVars ) . toHaveProperty ( 'SHOPIFY_TEST_VAR' , 'test_value' )
213+ expect ( shopifyVars ) . toHaveProperty ( 'SHOPIFY_ANOTHER_VAR' , 'another_value' )
214+ expect ( shopifyVars ) . not . toHaveProperty ( 'NOT_SHOPIFY_VAR' )
215+ } )
216+ } )
217+
188218 test ( 'does nothing when analytics are disabled' , async ( ) => {
189219 await inProjectWithFile ( 'package.json' , async ( args ) => {
190220 // Given
0 commit comments