feat(web): associate Sentry errors with users

[brendan-kellam]

Summary

• associate browser-side Sentry events with the active NextAuth user
• associate server-side Sentry events after resolving the request session
• clear identity for unauthenticated sessions and only include email/name when PII telemetry is enabled

Testing

• yarn workspace @sourcebot/web test (1,074 tests passed)
• yarn workspace @sourcebot/web lint (passes with 4 pre-existing warnings)

---

Note

Medium Risk
Touches central auth resolution and may send user PII to Sentry when telemetry PII is enabled; behavior is additive and covered by tests.

Overview
Adds setSentryUser so Sentry events can be tied to the current user: always id, and email/name only when SOURCEBOT_TELEMETRY_PII_COLLECTION_ENABLED is on; null clears context on sign-out.

Client: new SentryUserProvider in the root layout watches NextAuth session (skips while loading) and updates Sentry as auth changes.

Server: auth() sets context from the session user; getAuthContext sets it from the resolved user (session, API key, or OAuth) so server-side errors match the real caller.

Unit tests cover PII on/off, clearing, provider loading behavior, and getAuthContext wiring.

^{Reviewed by Cursor Bugbot for commit 9aac610. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• New Features
  • Added end-user Sentry user context tracking that syncs with authentication state using a new session-aware provider.
  • Sentry user id is set by default; email/username are included only when telemetry PII collection is enabled.
  • Sentry user context is cleared when the session is unauthenticated.
• Refactor
  • Consolidated Sentry user association so it’s set consistently during auth context resolution.
• Tests
  • Added/expanded unit tests to cover Sentry user setting (PII on/off, clearing), provider loading behavior, and auth/middleware instrumentation.

[github-actions]

@brendan-kellam your pull request is missing a changelog!

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 61f8688b-4d86-4f5e-b5c1-4d0e6bf0a05a

📥 Commits

Reviewing files that changed from the base of the PR and between b7ad88c and 9aac610.

📒 Files selected for processing (4)

• packages/web/src/auth.ts
• packages/web/src/lib/sentryUser.ts
• packages/web/src/middleware/withAuth.test.ts
• packages/web/src/middleware/withAuth.ts

---

Walkthrough

Adds Sentry user context tracking across client sessions and server authentication. A helper maps user data with optional PII, while client and server authentication flows synchronize Sentry with authenticated users or null.

Changes

Sentry user context

Layer / File(s)	Summary
Sentry user mapping packages/web/src/lib/sentryUser.ts, packages/web/src/lib/sentryUser.test.ts	Adds SentryUser and setSentryUser to set or clear Sentry users, conditionally including email and username; tests cover non-PII, PII-enabled, and unauthenticated cases.
Client session wiring packages/web/src/app/sentryUserProvider.tsx, packages/web/src/app/sentryUserProvider.test.tsx, packages/web/src/app/layout.tsx	Adds a client provider that waits for session resolution before updating Sentry and renders it inside SessionProvider with telemetry-based PII configuration; tests loading and authentication transitions.
Server authentication wiring packages/web/src/auth.ts, packages/web/src/middleware/withAuth.ts, packages/web/src/middleware/withAuth.test.ts	Updates session resolution and authentication context handling to synchronize resolved users or null with Sentry using the telemetry PII flag; tests authenticated, unauthenticated, and API-key scenarios.

Estimated code review effort: 2 (Simple) | ~12 minutes

Sequence Diagram(s)

sequenceDiagram
  participant SessionProvider
  participant SentryUserProvider
  participant setSentryUser
  participant Sentry
  SessionProvider->>SentryUserProvider: provide session status and user
  SentryUserProvider->>setSentryUser: update resolved user and PII flag
  setSentryUser->>Sentry: set or clear user context

Loading

sequenceDiagram
  participant Request
  participant auth
  participant getAuthContext
  participant setSentryUser
  participant Sentry
  Request->>auth: resolve session
  auth->>setSentryUser: pass session user or null and PII flag
  Request->>getAuthContext: resolve authentication context
  getAuthContext->>setSentryUser: pass authenticated user or null and PII flag
  setSentryUser->>Sentry: set or clear user context

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: associating Sentry errors with users in the web app.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch brendan/associate-sentry-errors-with-users

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/web/src/middleware/withAuth.ts`:
- Around line 87-94: Move the setSentryUser call in the withAuth middleware to
immediately after authResult resolves the principal and before the organization
lookup, preserving the existing PII flag and unauthenticated null behavior.
Ensure lookup failures are captured with the authenticated user context.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 69b9026b-7932-4238-b19a-aa4b1ec44c1e

📥 Commits

Reviewing files that changed from the base of the PR and between 49d0429 and 87756c8.

📒 Files selected for processing (1)

• packages/web/src/middleware/withAuth.ts

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit b7ad88c. Configure here.}