[CI] (bdb7658) angular/angular-saas

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: bdb7658
App: angular/angular-saas
App directory: apps/angular/angular-saas
Workbench branch: wizard-ci-bdb7658-angular-angular-saas
Wizard branch: refactor/agent-runner-split
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-06-19T21:07:08.484Z
Duration: 2585.3s

[wizard-ci-bot]

---

PR Evaluation Report

Summary

This PR integrates PostHog analytics into an Angular SaaS application by adding a PostHogService singleton wrapper with SSR safety, initializing PostHog in AppComponent, capturing 10 business-critical events across 9 files, identifying users on login, resetting on logout, and capturing HTTP errors via the existing error interceptor.

Files changed	Lines added	Lines removed
19	+134	-6

Confidence score: 5/5 🧙

• PII in capture event properties: username is sent in user_logged_in capture properties — person-identifying data should only be in identify() person properties, not in event properties. [MEDIUM]
• No reverse proxy configured: No reverse proxy is set up to route PostHog requests through the app's domain, which means ad blockers can block analytics in the browser. [MEDIUM]
• No identify on returning sessions: identify() is only called on fresh login. Returning users with existing credentials will have anonymous sessions until they log in again. The report itself acknowledges this gap. [MEDIUM]

---

File changes

Filename	Score	Description
src/app/services/posthog.service.ts	5/5	New singleton service wrapping PostHog with SSR-safe isPlatformBrowser checks and a no-op Proxy fallback
src/app/app.component.ts	5/5	Initializes PostHog in ngOnInit with platform check, env-based API key and host
src/app/auth/login/login.component.ts	3/5	Identifies user and captures user_logged_in, but leaks username as event property
src/app/auth/logout/logout.component.ts	5/5	Captures user_logged_out and calls reset() correctly
src/app/@core/interceptors/error-handler.interceptor.ts	5/5	Adds captureException for HTTP errors
src/app/pages/billing/billing.component.ts	5/5	Captures billing_plan_upgrade_clicked with rich plan properties
src/app/pages/billing/billing.component.html	5/5	Adds click handler to wire up the new selectPlan method
src/app/pages/dashboard/dashboard.component.ts	5/5	Captures dashboard_viewed on init
src/app/pages/profile/profile.component.ts	4/5	Captures profile_updated but with no properties
src/app/pages/settings/components/account-settings/account-settings.component.ts	5/5	Captures account_settings_saved with meaningful changed_password property
src/app/pages/settings/components/security-settings/security-settings.component.ts	5/5	Captures two_factor_auth_toggled and session_revoked with context
src/app/shared/components/add-member-modal/add-member-modal.component.ts	5/5	Captures member_added with role
src/app/shared/components/create-project-modal/create-project-modal.component.ts	5/5	Captures project_created with project details
src/environments/environment.ts	5/5	Adds posthogKey and posthogHost from env vars
src/environments/environment.prod.ts	5/5	Same env var pattern for production
src/environments/.env.ts	5/5	Documents new env vars with null defaults
package.json	5/5	Adds posthog-js dependency
.gitignore	5/5	Adds .env to gitignore

---

App sanity check ✅

Criteria	Result	Description
App builds and runs	Yes	Valid Angular patterns, correct imports, no syntax issues
Preserves existing env vars & configs	Yes	All existing environment properties preserved, only PostHog keys added
No syntax or type errors	Yes	TypeScript types are correct, Angular DI patterns are properly used
Correct imports/exports	Yes	All imports resolve correctly, posthog-js imported properly for browser use
Minimal, focused changes	Yes	All changes relate to PostHog integration with minimal template modification
Pre-existing issues	None	No pre-existing issues observed

Issues

No issues.

Other completed criteria

• Environment variables documented in .env.ts with NG_APP_POSTHOG_PROJECT_TOKEN and NG_APP_POSTHOG_HOST
• .env added to .gitignore to prevent secret leakage
• Build configuration valid — posthog-js added to package.json dependencies
• SSR-safe implementation via isPlatformBrowser checks

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js@^1.391.2 added to package.json
PostHog client initialized	Yes	Initialized in AppComponent.ngOnInit() with isPlatformBrowser guard, using env-based API key and host, with capture_exceptions: true
capture()	Yes	10 meaningful capture calls across 9 files covering login, logout, dashboard view, project creation, billing, settings, etc.
identify()	Yes	Called on login with res.username as distinct_id and person properties (email, username, firstName, lastName). However, only called on fresh login — returning sessions are not re-identified
Error tracking	Yes	captureException() in HTTP error interceptor and capture_exceptions: true in init config for automatic exception capture
Reverse proxy	No	No reverse proxy configured — browser PostHog requests will be blocked by ad blockers

Issues

• No reverse proxy: PostHog requests go directly to us.i.posthog.com and will be blocked by ad blockers. A reverse proxy should be configured in the Angular app's server or build config. [MEDIUM]
• No re-identification on app reload: identify() is only called during login. Users returning with existing credentials will generate anonymous events until they log in again. Consider calling identify in AppComponent.ngOnInit() if credentials exist. [MEDIUM]

Other completed criteria

• API key loaded from environment variable NG_APP_POSTHOG_PROJECT_TOKEN, not hardcoded
• API host defaults to https://us.i.posthog.com, configurable via NG_APP_POSTHOG_HOST
• posthog.reset() correctly called on logout
• SSR-safe service with Proxy fallback prevents server-side errors

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
login.component.ts	user_logged_in, identify	Identifies user and captures login event with username
logout.component.ts	user_logged_out, reset	Captures logout and resets PostHog identity
dashboard.component.ts	dashboard_viewed	Tracks when users view the main dashboard
create-project-modal.component.ts	project_created	Captures project creation with name, status, has_description
add-member-modal.component.ts	member_added	Captures team member addition with role
billing.component.ts	billing_plan_upgrade_clicked	Captures upgrade intent with plan details and current plan
profile.component.ts	profile_updated	Captures profile save (no properties)
account-settings.component.ts	account_settings_saved	Captures settings save with password change indicator
security-settings.component.ts	two_factor_auth_toggled, session_revoked	Captures 2FA toggle state and session revocation with device/location
error-handler.interceptor.ts	captureException	Captures HTTP errors as exceptions

Issues

• PII in event properties: user_logged_in event includes username as an event property. PII like usernames should only be set via identify() person properties, not in capture() event properties. Remove username from the capture call. [MEDIUM]

Other completed criteria

• Events represent real user actions (login, logout, project creation, billing upgrade, etc.)
• Events enable product insights — can build funnels like login → dashboard → project_created
• Most events include relevant contextual properties (plan details, role, 2FA state, device info)
• Event names are descriptive, consistent snake_case naming convention

---

Reviewed by wizard workbench PR evaluator