Is Dupe.com: Find similar products for less safe?

const TINYBIRD_ENDPOINT = "https://api.us-east.tinybird.co/v0/events?name=extension_events",
  TINYBIRD_TOKEN = "<redacted>",           // hardcoded bearer token, identical for every install
  FEATURE_FLAG_KEY = "extension-tinybird-events",
  FLUSH_INTERVAL_MS = 1e4,                  // 10 seconds
  FLUSH_BATCH_SIZE = 20,
  BUFFER_STORAGE_KEY = "dupe:event-buffer",
  MAX_BUFFERED = 500;

class EventEmitter {
  constructor(token) {
    this.queue = [];
    this.enabled = false;
    this.flushTimer = null;
    this.token = token || TINYBIRD_TOKEN;
  }

  async init() {
    if (!this.token) return;
    try {
      this.enabled = !!(await FeatureFlags.getFeatureFlag(FEATURE_FLAG_KEY, 9e5)); // 900s cache, remote-controlled
    } catch { this.enabled = false; }
    if (!this.enabled) return;               // no-op entirely when the remote flag is off
    await this.restoreBuffer();
    this.flushTimer = setInterval(() => this.flush(), FLUSH_INTERVAL_MS);
  }

  async track(event) {
    if (!this.enabled) return;
    const enveloped = await this.envelope(event);
    this.queue.push(enveloped);
    if (this.queue.length >= FLUSH_BATCH_SIZE) this.flush();
  }

  async flush() {
    if (this.queue.length === 0) return;
    const batch = this.queue.splice(0);
    const ndjsonBody = batch.map(e => JSON.stringify(e)).join("\n");
    try {
      const res = await fetch(TINYBIRD_ENDPOINT, {
        method: "POST",
        headers: { Authorization: `Bearer ${this.token}`, "Content-Type": "application/x-ndjson" },
        body: ndjsonBody
      });
      if (!res.ok) throw new Error(`TinyBird HTTP ${res.status}`);
    } catch { await this.bufferEvents(batch); }
  }

  async envelope(event) {
    const session = (await chrome.storage.session.get("dupe:shopping-session"))["dupe:shopping-session"];
    const sessionId = session?.startedAt ? `s_${session.startedAt}` : this.fallbackSessionId;
    const user = await Auth.getActiveUser();
    const tempUserId = await Auth.getTempUserId();
    return {
      ...event,
      timestamp: new Date().toISOString(),
      session_id: sessionId,
      user_id: user?.uid || null,            // your signed-in Dupe account ID, when logged in
      temp_user_id: tempUserId,              // persistent pseudo-anonymous ID otherwise
      extension_version: chrome.runtime.getManifest().version,
      browser: "chrome"
    };
  }
}
const tinybirdEmitter = new EventEmitter();

// Fired from the product-detail-page detector on every PDP view:
tinybirdEmitter.track({
  event_type: "pdp_view",
  shop_key: shopKey,
  url: stripTrackingParams(pageUrl),
  image_url: metadata?.imageUrl,
  title: metadata?.title,
  price: metadata?.price,
  currency: metadata?.currency,
  brand: metadata?.brand,
  category: metadata?.category,
  selected_color: metadata?.selectedColor,
  selected_size: metadata?.selectedSize,
  gender: metadata?.gender,
  seller: metadata?.seller,
  sku: metadata?.sku,
  material: metadata?.material,
  shipping: metadata?.shipping,
  returns: metadata?.returns,
  warranty: metadata?.warranty,
  has_color: Array.isArray(metadata?.colors) && metadata.colors.length > 0 ? 1 : 0,
  has_size: Array.isArray(metadata?.sizes) && metadata.sizes.length > 0 ? 1 : 0,
  has_specs: metadata?.specs ? 1 : 0,
  specs_json: metadata?.specs ? JSON.stringify(metadata.specs) : null,
  has_rating: metadata?.rating != null ? 1 : 0,
  rating: metadata?.rating,
  review_count: metadata?.reviewCount,
  review_summary: metadata?.reviewSummary,
  review_snippets_json: Array.isArray(metadata?.reviewSnippets) && metadata.reviewSnippets.length > 0
    ? JSON.stringify(metadata.reviewSnippets.slice(0, 5))
    : null
});

// Internal message handler — any component in the extension can trigger
// a Tinybird event by sending a TRACK_TINYBIRD message, with no field
// validation applied before it's enveloped and queued:
onMessage(Messages.TRACK_TINYBIRD, async ({ data }) => {
  tinybirdEmitter.track(data);
  return { status: "ok" };
});

const { isPdp: i, pageChanged: r } = pv(),
  n = async s => {
    const c = `https://dupe.com/${s}`;
    await yi(vi.OPEN_TAB, { url: c })
  };

return Ra.useEffect(() => {
  typeof i > "u" || (async () => {
    const s = of(window.location.href),
      c = await Zh(),                // extractMetadata(): title, price, currency, imageUrl, brand, description...
      d = !!ov.get("stand-down");
    Y0.track(Wt.ExtensionPageViewed, {
      medium: "extension",
      shopKey: s,                    // per-domain key derived from the URL
      url: window.location.href,     // the FULL current page address
      isPdp: i,                      // true only on a detected product page
      metadata: c,                   // OG title/price/currency/image when present
      standDown: d
    }, { skipPosthog: !0 })          // routed to GA only, not to PostHog
  })()
}, [i, r]), Ra.useEffect(() => {
  // ...separate listener for the "dupe this" context-menu action, omitted...
}, []), null

const EVENT_BATCH_KEY = "dupe:eventBatchViews",
  BATCH_SIZE = 3,
  GA_API_SECRET = "<redacted>",
  GA_MEASUREMENT_ID = "G-CZFTQBRF2Q",
  GA_ENDPOINT = "https://www.google-analytics.com/mp/collect",
  normalizeName = e => e.toLowerCase().replace(/\s/g, "_"),
  loadBatch = async () => await storage.get(EVENT_BATCH_KEY) || [],
  saveBatch = async e => { await storage.set(EVENT_BATCH_KEY, e) },
  clearBatch = async () => await storage.remove(EVENT_BATCH_KEY),
  postToGA = async (userId, events, clientId = "") => await fetch(
    `${GA_ENDPOINT}?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`,
    {
      method: "POST",
      body: JSON.stringify({
        client_id: clientId || userId,
        user_id: userId,
        events: events.map(n => ({ name: normalizeName(n.name), params: { ...n.params } }))
      })
    }
  );

function registerGaTrackHandler() {
  onMessage(GA_TRACK, async ({ data: e }) => {
    const { name: t, userId: r, properties: n, clientId: s } = e;
    try {
      const params = { ...n };
      const event = { userId: r || "anonymous", name: t, params };
      if (t === Events.ExtensionPageViewed) {
        const batch = await loadBatch() || [];
        batch.push(event);
        if (batch.length > 100) batch.splice(0, batch.length - 100);
        await saveBatch(batch);
        if (batch.length >= BATCH_SIZE) {          // flush once 3 page views have queued
          const res = await postToGA(r || "", batch, s);
          if (res.ok) await clearBatch();
          return res.statusText || {};
        }
        return {};
      }
      return (await postToGA(r || "", [event], s)).statusText || {};
    } catch (err) {
      return { status: "error", statusMessage: "An error occurred while trying to track the event" };
    }
  })
}