Delete SvelteKit Source Maps after Upload

[Lms24]

Problem Statement

In light of the conversation in sveltejs/kit#10068 we should think about deleting source maps after they were uploaded to Sentry.

Solution Brainstorm

I think the best course of action would be:

• By default, our plugin would delete all maps if it was our plugin that enabled source maps generation. It's important to note here that we cannot say with certainty that in this case users actually didn't want source maps generated. Vice versa, we also cannot say that users would have wanted source maps if it was already enabled (another plugin before or after us can interfere here).
• Provide an option in the sentrySvelteKit plugin factory function: deleteSourceMapsAfterUpload: boolean. This option, if specified, overrides our deletion decision described above.

Alternatives considered:

• No default behaviour and users have to explcitly enable/disable deleteSourceMapsAfterUpload. Default value TBD.
• We leave deletion up to users and do nothing in this regard

[github-actions]

This issue has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you label it Status: Backlog or Status: In Progress, I will leave it alone ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

[salmoro]

Would be useful. At a minimum let people know that with the Sentry plugin they might be uploading source code to production which they otherwise wouldn't have. Seems like a serious vulnerability issue.

[salmoro]

I see there was a new option added in recent versions which make this possible:

sourceMapsUploadOptions: {
  ...
  sourcemaps: {
    filesToDeleteAfterUpload: ['./build/**/*.map']
    }
  }

Might be a good idea to make this the default behavior.

[Lms24]

Might be a good idea to make this the default behavior.

That's a bit tricky because what if users actually want source maps? or enabled them themselves? We've been down this route with NextJS before so I'll talk to @lforst what our behaviour is there at the moment.

I agree that we should at least log out that we enable source maps generation and this option can be used to remove them again. Thx for calling this out!