mirror of
https://github.com/hanzo-apps/dataroom.git
synced 2026-10-30 14:47:36 +00:00
zeekayandHanzo Dev
8b3607cd0d
Every view was being recorded as 127.0.0.1 in Munich. The IP and geo came from @vercel/functions behind `process.env.VERCEL === "1"`, and this app runs on Kubernetes — so the branch was always false and every call took the LOCALHOST_GEO_DATA placeholder. Analytics has been recording a fixed German address for every visitor. Cloudflare fronts dataroom.hanzo.ai (and every hanzo.ai host), so the real values already arrive as request headers: cf-connecting-ip, cf-ipcountry, and — when the zone's visitor-location transform is on — cf-ipcity, cf-region, cf-iplatitude, cf-iplongitude, cf-ipcontinent. lib/utils/geo.ts now reads those. No SDK, no platform binding, and each optional field degrades on its own so a missing city never costs us the country. `cf-connecting-ip` is the one a client cannot forge — Cloudflare rewrites it at the edge. x-forwarded-for is only the fallback for a request that did not come through it, and only its FIRST entry: the rest are proxies, and anything a client sent is appended rather than prepended. This also repairs rate limiting. `send-otp:`, `verify-otp:` and `verify-email:` key their limiter on the caller's address, and off Vercel that address was undefined — so every caller shared one bucket and the limit was effectively global. Verified with npx tsc --noEmit: 100 errors before and after, compared by file+code+message rather than line, since inserting imports shifts line numbers and would otherwise report unchanged errors as new. Co-authored-by: Hanzo Dev <[email protected]>
132 lines
3.7 KiB
TypeScript
132 lines
3.7 KiB
TypeScript
import { NextApiRequest, NextApiResponse } from "next";
|
|
|
|
import { z } from "zod";
|
|
|
|
import { newId } from "@/lib/id-helper";
|
|
import { publishPageView } from "@/lib/tinybird";
|
|
import { Geo } from "@/lib/types";
|
|
import { capitalize, getDomainWithoutWWW, log } from "@/lib/utils";
|
|
import { LOCALHOST_GEO_DATA, getGeoData } from "@/lib/utils/geo";
|
|
import { userAgentFromString } from "@/lib/utils/user-agent";
|
|
|
|
const bodyValidation = z.object({
|
|
id: z.string(),
|
|
linkId: z.string(),
|
|
documentId: z.string(),
|
|
viewId: z.string(),
|
|
dataroomId: z.string().nullable().optional(),
|
|
versionNumber: z.number().int().optional(),
|
|
time: z.number().int(),
|
|
duration: z.number().int(),
|
|
pageNumber: z.string(),
|
|
country: z.string().optional(),
|
|
city: z.string().optional(),
|
|
region: z.string().optional(),
|
|
latitude: z.string().optional(),
|
|
longitude: z.string().optional(),
|
|
ua: z.string().optional(),
|
|
browser: z.string().optional(),
|
|
browser_version: z.string().optional(),
|
|
engine: z.string().optional(),
|
|
engine_version: z.string().optional(),
|
|
os: z.string().optional(),
|
|
os_version: z.string().optional(),
|
|
device: z.string().optional(),
|
|
device_vendor: z.string().optional(),
|
|
device_model: z.string().optional(),
|
|
cpu_architecture: z.string().optional(),
|
|
bot: z.boolean().optional(),
|
|
referer: z.string().optional(),
|
|
referer_url: z.string().optional(),
|
|
});
|
|
|
|
export default async function handle(
|
|
req: NextApiRequest,
|
|
res: NextApiResponse,
|
|
) {
|
|
// We only allow POST requests
|
|
if (req.method !== "POST") {
|
|
res.status(405).json({ message: "Method Not Allowed" });
|
|
return;
|
|
}
|
|
|
|
const geo: Geo =
|
|
getGeoData(req.headers);
|
|
|
|
const referer = req.headers.referer;
|
|
const ua = userAgentFromString(req.headers["user-agent"]);
|
|
|
|
const {
|
|
linkId,
|
|
documentId,
|
|
viewId,
|
|
dataroomId,
|
|
duration,
|
|
pageNumber,
|
|
versionNumber,
|
|
} = req.body as {
|
|
linkId: string;
|
|
documentId: string;
|
|
viewId: string;
|
|
dataroomId: string | undefined;
|
|
duration: number;
|
|
pageNumber: number;
|
|
versionNumber: number;
|
|
};
|
|
|
|
const time = Date.now(); // in milliseconds
|
|
|
|
const pageViewId = newId("view");
|
|
|
|
const pageViewObject = {
|
|
id: pageViewId,
|
|
linkId,
|
|
documentId,
|
|
viewId,
|
|
dataroomId: dataroomId || null,
|
|
versionNumber: versionNumber || 1,
|
|
time,
|
|
duration,
|
|
pageNumber: pageNumber.toString(),
|
|
country: geo?.country || "Unknown",
|
|
city: geo?.city || "Unknown",
|
|
region: geo?.region || "Unknown",
|
|
latitude: geo?.latitude || "Unknown",
|
|
longitude: geo?.longitude || "Unknown",
|
|
ua: ua.ua || "Unknown",
|
|
browser: ua.browser.name || "Unknown",
|
|
browser_version: ua.browser.version || "Unknown",
|
|
engine: ua.engine.name || "Unknown",
|
|
engine_version: ua.engine.version || "Unknown",
|
|
os: ua.os.name || "Unknown",
|
|
os_version: ua.os.version || "Unknown",
|
|
device: ua.device.type ? capitalize(ua.device.type) : "Desktop",
|
|
device_vendor: ua.device.vendor || "Unknown",
|
|
device_model: ua.device.model || "Unknown",
|
|
cpu_architecture: ua.cpu?.architecture || "Unknown",
|
|
bot: ua.isBot,
|
|
referer: referer ? getDomainWithoutWWW(referer) : "(direct)",
|
|
referer_url: referer || "(direct)",
|
|
};
|
|
|
|
const result = bodyValidation.safeParse(pageViewObject);
|
|
if (!result.success) {
|
|
return res
|
|
.status(400)
|
|
.json({ error: `Invalid body: ${result.error.message}` });
|
|
}
|
|
|
|
try {
|
|
await publishPageView(result.data);
|
|
|
|
res.status(200).json({ message: "View recorded" });
|
|
} catch (error) {
|
|
log({
|
|
message: `Failed to record view (tinybird) for ${linkId}. \n\n ${error}`,
|
|
type: "error",
|
|
mention: true,
|
|
});
|
|
res.status(500).json({ message: (error as Error).message });
|
|
}
|
|
}
|