maro
65b6eeac51
Adds a first-party analytics system with no third-party trackers and no persistent per-visitor identifiers: events are grouped into sessions via a daily-rotating pseudonymous hash (IP+UA+host, HMAC-salted, never stored raw). - New "Analytics" section in the Payload admin, gated by a canViewAnalytics permission on Users, following the existing custom-admin-view pattern used by the calendar feature - Sessions, page views, unique visitors, top/entry/exit pages, events, device/browser breakdown, date range filter with period comparison - Raw events and daily aggregate rollups as their own collections, with configurable retention and a cron endpoint that rolls up before purging - Cookie consent banner (necessary/preferences/statistics) with categories and copy editable from a new CMS global; a track() helper that is a complete no-op without statistics consent, so nothing is ever sent before a visitor opts in - track() calls wired into the booking flow, contact form, and navigation
42 lines
1.5 KiB
TypeScript
42 lines
1.5 KiB
TypeScript
import { timingSafeEqual } from "node:crypto";
|
|
import { NextResponse } from "next/server";
|
|
import { getPayload } from "payload";
|
|
import config from "@payload-config";
|
|
import { runAnalyticsCleanup } from "@/lib/analytics/cleanup";
|
|
|
|
export const dynamic = "force-dynamic";
|
|
|
|
function safeEqual(a: string, b: string): boolean {
|
|
const bufA = Buffer.from(a);
|
|
const bufB = Buffer.from(b);
|
|
if (bufA.length !== bufB.length) return false;
|
|
return timingSafeEqual(bufA, bufB);
|
|
}
|
|
|
|
/**
|
|
* Intended to be called by an external cron job once daily, e.g.:
|
|
* curl -H "Authorization: Bearer $CRON_SECRET" https://anouma.org/api/cron/analytics-cleanup
|
|
* (a second, separate cron entry from /api/cron/event-reminders — reuses
|
|
* the same CRON_SECRET, no new secret needed)
|
|
*/
|
|
export async function GET(request: Request) {
|
|
const secret = process.env.CRON_SECRET;
|
|
if (!secret) {
|
|
return NextResponse.json({ error: "CRON_SECRET is not configured" }, { status: 500 });
|
|
}
|
|
|
|
const authHeader = request.headers.get("authorization");
|
|
if (!authHeader || !safeEqual(authHeader, `Bearer ${secret}`)) {
|
|
return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
|
|
}
|
|
|
|
try {
|
|
const payload = await getPayload({ config });
|
|
const result = await runAnalyticsCleanup(payload);
|
|
return NextResponse.json({ ok: true, ...result });
|
|
} catch (error) {
|
|
console.error("analytics-cleanup cron failed", error);
|
|
return NextResponse.json({ error: "Internal error" }, { status: 500 });
|
|
}
|
|
}
|