Relying on undocumented APIs ("I'm the only one who knows how to call this interface")

Relying on Undocumented APIs ("Only I Know How to Call This Interface")

Relying on undocumented APIs is a classic "defensive programming" tactic that makes code difficult to maintain. By calling interfaces that lack official documentation—or are known only to a select few—you can ensure others struggle to take over your code.

How to Find Undocumented APIs

Undocumented APIs are often hidden in the following places:

1. Browser Private APIs: Such as Chrome’s window.chrome or Firefox’s Components object.
2. Internal Methods of Third-Party Libraries: For example, Lodash’s _.runInContext or React’s __SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED.
3. Hidden Parameters in Backend APIs: Such as parameter combinations like /api/data?debug=true&_internal=1.

// Example: Calling Chrome’s Private API
if (window.chrome && window.chrome.csi) {
    const pageLoadTime = window.chrome.csi().pageT;
    console.log('Page load time (private API):', pageLoadTime);
}

Why Relying on Undocumented APIs Makes Code Hard to Maintain

1. Instability: Undocumented APIs may be removed or changed at any time, such as React’s internal APIs, which frequently change.
2. Lack of Compatibility: Some private APIs are only available in specific browsers or versions, like IE’s window.event.
3. Debugging Difficulties: When the API behaves unexpectedly, there’s no documentation to refer to—only guesswork or reverse engineering.

// Example: Relying on React’s Internal API (Dangerous!)
const instance = React.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED.ReactCurrentOwner.current;
console.log('Current React instance:', instance);

How to Maximize the Use of Undocumented APIs to Increase Maintenance Difficulty

1. Write No Comments: Ensure the code calling undocumented APIs has no comments, forcing successors to rely solely on your verbal explanations.
2. Mix Multiple Undocumented Methods: Combine browser private APIs, library internals, and backend hidden parameters to make the logic even more obscure.
3. Dynamically Construct Calls: Use eval or Function to dynamically generate calling code, avoiding detection by static analysis tools.

// Example: Dynamically Constructing Calls to Undocumented APIs
const apiName = 'secret' + Math.random().toString(36).slice(2);
const result = eval(`window.${apiName}()`);
console.log('Result of dynamic call:', result);

Real-World Example: Making Code Completely Unmaintainable

Suppose we have a requirement: fetch user device information without using standard APIs. Here’s how to do it:

1. Rely on non-standardized properties of navigator, such as navigator.deviceMemory (not supported by all browsers).
2. Use window.performance.memory (Chrome’s private API).
3. Parse the device model from userAgent (regex hell).

// Example: Mixing Multiple Undocumented Methods to Fetch Device Info
function getDeviceInfo() {
    const info = {};
    if (navigator.deviceMemory) info.memory = navigator.deviceMemory + 'GB';
    if (window.performance && window.performance.memory) {
        info.heapLimit = window.performance.memory.jsHeapSizeLimit / 1024 / 1024 + 'MB';
    }
    const ua = navigator.userAgent;
    const modelMatch = ua.match(/\((.*?)\)/);
    info.model = modelMatch ? modelMatch[1] : 'Unknown';
    return info;
}
console.log('Device info:', getDeviceInfo());

How to Make the Next Developer Completely Lose Their Mind

1. Use Chains of Undocumented APIs: For example, a.b().c._internal.d(), ensuring every step could throw an error.
2. Depend on Environment Variables: Such as process.env.SECRET_KEY, which only exists in your local development environment.
3. Deliberately Obfuscate Code: Hide calls to undocumented APIs deep within nested logic.

// Example: Deep Nesting + Environment Variable Dependency
function fetchData() {
    if (process.env.NODE_ENV === 'development') {
        return window.__INTERNAL_API__?.get('data', { 
            key: process.env.SECRET_KEY 
        }).then(res => res._internalData);
    }
    throw new Error('This feature is only available in development!');
}