Skip to content

Email bypass: enable all boolean Remote Config flags for @mobilitydata.org users #99

Open
Copilot wants to merge 4 commits intomainfrom
copilot/enable-firebase-configs-for-mobilitydata-users
Open

Email bypass: enable all boolean Remote Config flags for @mobilitydata.org users #99
Copilot wants to merge 4 commits intomainfrom
copilot/enable-firebase-configs-for-mobilitydata-users

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 7, 2026

Closes #69

Summery

This PR handles an admin bypass for the firebase feature flags. The logic of this bypass are set in the remote config featureFlagBypass which is currently just users with mobilitydata.org email addresses.

This PR sets stronger standards on how server, client and static components consume firebase remote configs.

Client components: Get the firebase configs from the server
Server components: If not passed down, must fetch. (added improved server caching of the firebase remote configs 1h)
Static pages: Are set at build time. If firebase remote configs are changed, it's advisable to redeploy the app

Extra details (human)

To note

For static pages, the remote configs are called and set at build time and will be the same for the remainder of the static page's cache. (ex: About Us / Feed Detail (non auth))

When remote configs change (they rarily do), it is recommended to redploy the app as that will trigger a new cache for all pages (specifically the static pages), that will include the updated remote configs

What this also means is that client components will be able to access the firebase remote configs using the Context but server components will have to fetch them each time. This isn't a big deal as the firebase remote configs are cached (for 1 hour on the server)

Testing tips

  1. In a logged off state, visit a feed detail page or even take note of the header (specifically the language change option)
  2. Log into your mobilitydata email account
  3. In the header you should see the language changer and in the feed detail page you should see the status badge
  4. Log out
  5. Log into a non mobilitydata email account
  6. You shouldn't see the language change or status badge
image Screenshot 2026-04-08 at 08 20 11 image

@vercel
Copy link
Copy Markdown

vercel bot commented Apr 7, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
mobilitydatabase-web Ready Ready Preview, Comment Apr 8, 2026 0:34am

Request Review

…ta.org users in production

Agent-Logs-Url: https://github.com/MobilityData/mobilitydatabase-web/sessions/e6a580fe-9b54-4e2a-86ce-65951372163a

Co-authored-by: Alessandro100 <18631060+Alessandro100@users.noreply.github.com>
@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Apr 7, 2026

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ Alessandro100
❌ Copilot
You have signed the CLA already but the status is still pending? Let us recheck it.

Copilot AI changed the title [WIP] Fix email bypass for @mobilitydata.org users Email bypass: enable all boolean Remote Config flags for @mobilitydata.org users in production Apr 7, 2026
Copilot AI requested a review from Alessandro100 April 7, 2026 14:45
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR introduces an internal-user “feature flag bypass” so authenticated users can have all boolean Firebase Remote Config flags forced to true, and updates the Remote Config fetching/caching approach to use Next.js Data Cache primitives.

Changes:

  • Switched server-side Remote Config caching from in-memory to unstable_cache + revalidateTag, and added user-aware helpers (getRemoteConfigValuesForUser, getUserRemoteConfigValues, applyAdminBypass).
  • Updated Remote Config context/provider flow to apply bypass client-side after auth resolves; reordered top-level providers to support this.
  • Added Jest coverage for the bypass logic and documented Remote Config behavior in the README.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 7 comments.

Show a summary per file
File Description
src/lib/remote-config.server.ts Introduces Next.js Data Cache-backed Remote Config fetch + user-aware bypass helpers.
src/lib/remote-config.server.spec.ts Adds unit tests for bypass matching, bypass application, and refresh behavior.
src/app/screens/Feed/components/DataQualitySummary.tsx Fetches Remote Config using request-user-aware helper for server rendering.
src/app/providers.tsx Reorders providers so RemoteConfigProvider can consume auth session state.
src/app/interface/RemoteConfig.ts Adds matchesFeatureFlagBypass() parsing/matching helper for bypass rules.
src/app/context/RemoteConfigProvider.tsx Applies bypass on the client once auth is ready to handle static/ISR output.

Applied guidance: vercel-react-best-practices (custom)

Comment on lines +28 to +38
function applyAdminBypass(config: RemoteConfigValues): RemoteConfigValues {
const overridden = { ...config };
for (const key of Object.keys(overridden) as Array<
keyof RemoteConfigValues
>) {
if (typeof overridden[key] === 'boolean') {
(overridden as Record<string, unknown>)[key] = true;
}
}
return overridden;
}
Copy link

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

applyAdminBypass is implemented both here and in src/lib/remote-config.server.ts. This duplication risks the server/client behavior drifting over time (e.g., if new flag types are introduced). Consider extracting a shared helper (in a non-server-only module) that both server and client can import.

Copilot uses AI. Check for mistakes.
README.md Outdated

Firebase remoet configs help us toggle new features on and off. Due to the nature of static pages, there are some nuances. For static pages, the remote configs are called and set at build time and will be the same for the remainder of the static page's cache.

When remote configs change (they rarily do), it is recommended to redploy the app as that will trigger a new cache for all pages, that will include the updated remote configs
Copy link

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo: “rarily” should be “rarely”.

Suggested change
When remote configs change (they rarily do), it is recommended to redploy the app as that will trigger a new cache for all pages, that will include the updated remote configs
When remote configs change (they rarely do), it is recommended to redploy the app as that will trigger a new cache for all pages, that will include the updated remote configs

Copilot uses AI. Check for mistakes.
README.md Outdated
Comment on lines +90 to +94
Firebase remoet configs help us toggle new features on and off. Due to the nature of static pages, there are some nuances. For static pages, the remote configs are called and set at build time and will be the same for the remainder of the static page's cache.

When remote configs change (they rarily do), it is recommended to redploy the app as that will trigger a new cache for all pages, that will include the updated remote configs

What this also means is that client components will be able to access the firebase remote configs using the Context but server components will have to fetch them each time. This isn't a big deal as the firebase remote configs are cached (for 1 hour on the server)
Copy link

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new README section states remote config is “called and set at build time” for static pages, but this PR also introduces server-side caching/revalidation (unstable_cache + revalidateTag) which updates values without a redeploy for dynamic/ISR renders. Consider clarifying that the “build time” limitation only applies to fully static routes, while server-rendered routes will revalidate per the cache settings.

Suggested change
Firebase remoet configs help us toggle new features on and off. Due to the nature of static pages, there are some nuances. For static pages, the remote configs are called and set at build time and will be the same for the remainder of the static page's cache.
When remote configs change (they rarily do), it is recommended to redploy the app as that will trigger a new cache for all pages, that will include the updated remote configs
What this also means is that client components will be able to access the firebase remote configs using the Context but server components will have to fetch them each time. This isn't a big deal as the firebase remote configs are cached (for 1 hour on the server)
Firebase remote configs help us toggle new features on and off. Due to the nature of static pages, there are some nuances. For fully static pages, the remote configs are fetched and set at build time and will remain the same for the lifetime of that static page cache.
When remote configs change (they rarely do), redeploying the app is recommended for fully static pages because it triggers a new build/cache that includes the updated remote config values. However, this build-time limitation does not apply to server-rendered or revalidated routes: those routes use the server-side cached remote config values and will pick up updates based on the configured cache revalidation behavior, without requiring a full redeploy.
In practice, client components can access the Firebase remote configs through Context, while server components read them on the server. Those server-side values are cached (for example, for up to 1 hour on the server), so they are not refetched on every request unless the cache is revalidated.

Copilot uses AI. Check for mistakes.
@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 8, 2026

*Lighthouse ran on https://mobilitydatabase-f0tospehw-mobility-data.vercel.app/ * (Desktop)
⚡️ HTML Report Lighthouse report for the changes in this PR:

Performance Accessibility Best Practices SEO
🟢 98 🟢 94 🟢 96 🟢 100

*Lighthouse ran on https://mobilitydatabase-f0tospehw-mobility-data.vercel.app/feeds * (Desktop)
⚡️ HTML Report Lighthouse report for the changes in this PR:

Performance Accessibility Best Practices SEO
🟠 85 🟠 87 🟢 96 🟢 100

*Lighthouse ran on https://mobilitydatabase-f0tospehw-mobility-data.vercel.app/feeds/gtfs/mdb-2126 * (Desktop)
⚡️ HTML Report Lighthouse report for the changes in this PR:

Performance Accessibility Best Practices SEO
🟠 50 🟢 94 🟢 96 🟢 100

*Lighthouse ran on https://mobilitydatabase-f0tospehw-mobility-data.vercel.app/feeds/gtfs_rt/mdb-2585 * (Desktop)
⚡️ HTML Report Lighthouse report for the changes in this PR:

Performance Accessibility Best Practices SEO
🟠 86 🟠 84 🟢 96 🟢 100

*Lighthouse ran on https://mobilitydatabase-f0tospehw-mobility-data.vercel.app/feeds/gbfs/gbfs-flamingo_porirua * (Desktop)
⚡️ HTML Report Lighthouse report for the changes in this PR:

Performance Accessibility Best Practices SEO
🟠 79 🟢 94 🟢 96 🟢 100

@Alessandro100 Alessandro100 changed the title Email bypass: enable all boolean Remote Config flags for @mobilitydata.org users in production Email bypass: enable all boolean Remote Config flags for @mobilitydata.org users Apr 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Email Bypass for @mobilitydata.org users

4 participants