[analytics] use dummy static key for untrusted (#17293)

instead of real to unblock Node.js Segment SDK

Author: akosyakov

components/proxy/plugins/analytics/analytics.go

@@ -24,6 +24,8 @@ import (
 
 const (
 	moduleName = "gitpod.analytics"
+	// static key for untrusted segment requests
+	dummyUntrustedSegmentKey = "untrusted-dummy-key"
 )
 
 func init() {
@@ -96,11 +98,9 @@ func (a *Analytics) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddy
 		a.segmentProxy.ServeHTTP(w, r)
 		return nil
 	}
-	shouldProxyToUntrustedSegment := a.untrustedSegmentKey != "" && (segmentKey == "" || segmentKey == a.untrustedSegmentKey)
+	shouldProxyToUntrustedSegment := a.untrustedSegmentKey != "" && (segmentKey == "" || segmentKey == dummyUntrustedSegmentKey)
 	if shouldProxyToUntrustedSegment {
-		if segmentKey == "" {
-			r.SetBasicAuth(a.untrustedSegmentKey, "")
-		}
+		r.SetBasicAuth(a.untrustedSegmentKey, "")
 		a.segmentProxy.ServeHTTP(w, r)
 		return nil
 	}

components/proxy/plugins/analytics/analytics_test.go

@@ -35,12 +35,20 @@ func TestServeHTTP(t *testing.T) {
 			expectedResponseBodyPrefix: "trusted",
 		},
 		{
-			name:                       "untrusted segment key",
+			name:                       "untrusted dummy segment key",
 			trustedSegmentKey:          "trusted-key",
 			untrustedSegmentKey:        "untrusted-key",
-			providedSegmentKey:         "untrusted-key",
+			providedSegmentKey:         dummyUntrustedSegmentKey,
 			expectedResponseBodyPrefix: "untrusted",
 		},
+		{
+			name:                "untrusted segment key",
+			trustedSegmentKey:   "trusted-key",
+			untrustedSegmentKey: "untrusted-key",
+			providedSegmentKey:  "untrusted-key",
+			// on purpose to ensure that cliens remove references to untrusted keys
+			expectedResponseBodyPrefix: "mock",
+		},
 		{
 			name:                       "empty segment key",
 			trustedSegmentKey:          "trusted-key",
@@ -66,7 +74,7 @@ func TestServeHTTP(t *testing.T) {
 			name:                       "only trusted key empty",
 			trustedSegmentKey:          "",
 			untrustedSegmentKey:        "untrusted-key",
-			providedSegmentKey:         "",
+			providedSegmentKey:         dummyUntrustedSegmentKey,
 			expectedResponseBodyPrefix: "untrusted",
 		},
 		{