Repository navigation
Add visitor analytics panel to /admin - #25
Closed
JonasFocus wants to merge 2 commits into
Closed
JonasFocus wants to merge 2 commits into
JonasFocus wants to merge 2 commits into
Conversation
npm audit --omit=dev --audit-level=high fails on main for GHSA-wq5f-xc86-pv6w (sharp) and GHSA-68fv-2mgg-jv7q (source-map-js). Lockfile-only change from npm audit fix. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HLGs668b9KBEBwBxa7zFNh
Adds a cookieless first-party tracker (page views, clicks, scroll depth, form submits, engaged time), a /api/track beacon route, an owner-only Analytics tab in /admin with daily visits, average and median time on site, top pages, sources, clicks, devices, a live event log and a per-visit timeline. No raw IPs are stored; visitors are counted with a daily rotating HMAC key. Data is kept for 180 days. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HLGs668b9KBEBwBxa7zFNh
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Jonas · project thread
Before: /admin had no way to see what visitors do on jonasinfocus.com.
After: a new Analytics tab in /admin shows visits, visitors, page views, average and median time on site, pages per visit, bounce rate, a visits-per-day chart, top pages, sources, clicks and form submits, countries, devices, browsers, a live log of recent events, and a list of visits that opens a per-visit timeline. A range filter switches between 24 hours, 7, 30 and 90 days.
Time on site counts only while the tab is open and visible (engaged time), so a tab left in the background does not inflate the average.
How: a small client tracker in the root layout (skipped on /admin) sends batched beacons to
/api/trackon each page view, click, scroll milestone, form submit and every 15 seconds while visible. The route drops bots, checks the origin, and calls atrack_visitfunction (service role only) that writesvisitor_sessionsandvisitor_events. Both tables are owner-read only under RLS;visitor_statsbuilds the dashboard summary in SQL. Privacy: no cookies, no raw IPs (visitors are a daily-rotating HMAC of IP and user agent), no form contents, GPC/Do Not Track respected, the owner's own browser is skipped after opening /admin, and data older than 180 days is pruned. The privacy page now describes this. Abuse limits: 30 events per beacon, 1000 events per session, sessions end after 12 hours, 30 new sessions per visitor per hour.Also includes a lockfile-only
npm audit fixfor two new high advisories (sharp GHSA-wq5f-xc86-pv6w, source-map-js GHSA-68fv-2mgg-jv7q) that currently fail the audit step on main too.Deploy note: apply
supabase/migrations/20261007180000_visitor_analytics.sqlto production before merging, or the tracker beacons are silently dropped and the Analytics tab errors. Access uses the existing owner sign-in.🤖 Generated with Claude Code
https://claude.ai/code/session_01HLGs668b9KBEBwBxa7zFNh
Generated by Claude Code