fix(dashboard): isolate self-host behavior from hosted deployments

[izadoesdev]

Summary

Keep the self-host setup changes behind SELFHOST=true. With the flag absent or false, restore the previous hosted auth cookies and verification emails, alarm sender, registration flow, generated setup snippets, AI setup prompt, and security headers.

Move the existing boolean parser into a side-effect-free export and use it for the new mode checks. Checking SELFHOST no longer initializes unrelated URL configuration in Redis, billing, telemetry, or process startup.

Validation

• Root lint, all 33 typecheck tasks, and all 29 test tasks pass.
• Regression cases cover SELFHOST absent, false, and true; hosted email/cookie differences were reproduced before the fixes.
• Chromium registration completion passes in both modes with synthetic signup responses.
• Nine hosted snippet variants, the hosted setup prompt, and hosted security headers match their pre-self-host output exactly.
• Independent runtime and dashboard review found no remaining hosted behavior differences in the audited paths.

Scope

Runtime isolation only. Independent init-image publishing landed in #824. No dependency on an unmerged PR. #790 is adjacent to billing resolution; this PR changes its boolean import only and does not alter the hosted billing fallback. No production deployment or image publication is included.

AI-assisted implementation and review under the maintainer workflow.

---

Summary by cubic

Isolates self-host configuration behind SELFHOST=true so hosted deployments keep their existing behavior. With SELFHOST unset or false, restores hosted auth cookies and verification emails, alarm sender, registration flow, generated setup snippets, AI setup prompt, and security headers.

Details

• Moves readBooleanEnv to @databuddy/env/boolean so checking the mode doesn't initialize unrelated URL config.
• Hosted tracking snippets no longer include custom API URLs or custom CSP origins.
• Adds regression tests covering SELFHOST absent, false, and true, including CSP origin membership checks.

^{Written for commit 7ac621d. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
dashboard	Ready	Preview	Sep 17, 2026 9:39am UTC
databuddy-status	Ready	Preview	Sep 17, 2026 9:39am UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
documentation	Skipped		Sep 17, 2026 9:39am UTC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d7fafe28-11d8-4d4a-a7f0-b62a70976a07

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[unkey-deploy]

The latest updates on your projects. Learn more about Unkey Deploy

Name	Status	Preview	Inspect	Updated (UTC)
links (preview)	Ready	Visit Preview	Inspect	Sep 17, 2026 9:38am

[izadoesdev]

@greptileai review this

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with no outstanding correctness, security, or repository-rule findings.

Findings

1.  Sign-in hidden after registration ▶
2.  Prompt recommends disallowed tools ▶
3.  Prompt uses non-null assertion ▶
4.  Mock Data Violates Requirements ▶
5.  Barrel Export Violates Requirements ▶

Summary

This PR isolates self-host-specific behavior behind an explicit SELFHOST=true check while preserving established hosted behavior.

• Moves boolean environment parsing into a side-effect-free package export.
• Restores hosted authentication, notification, registration, billing, setup-snippet, AI-prompt, and CSP behavior.
• Adds deployment-mode regression coverage for unset, false, and true flag values.
• The final commits strengthen CSP tests by checking complete source tokens rather than substrings.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Env[SELFHOST environment value] --> Parse[Side-effect-free boolean parser]
  Parse --> Mode{Exactly true?}
  Mode -->|Yes| SelfHost[Self-host behavior]
  Mode -->|No or unset| Hosted[Preserved hosted behavior]
  SelfHost --> Custom[Custom URLs, snippets, CSP origins, auth and billing configuration]
  Hosted --> Defaults[Hosted cookies, verification email, alarm sender, snippets, prompt, billing, and CSP defaults]

Loading

_{Reviews (3) · Last reviewed commit: "test(dashboard): assert CSP origin membe..."}

[izadoesdev]

@greptileai review this

Please review final head 7ac621d. The last two commits only tighten CSP regression assertions. The replies on the three hosted-behavior findings cite the original pre-self-host code and explain the explicit requirement to preserve hosted output; please assess those reasons alongside any remaining defects.