skadi 0.4.0.beta.1

data/app/assets/builds/skadi.js

@@ -0,0 +1 @@
+var e=[],t=[],n=-1,r,i,a=!1,o={},s=window,c=document,l=`-contentful-paint`,u=`first${l}`,d=`largest${l}`,f={...c.currentScript.dataset},p=()=>{r??=setTimeout(m,500)},m=()=>{r&&=(clearTimeout(r),null),navigator.sendBeacon(f.endpoint,new Blob([JSON.stringify({view:f.view,demographics:e,events:t,consent:o,...a&&{exit_page:i}})],{type:`application/json`}))&&(e=[],t=[],o={})},h=(e,t)=>{if(e<=0)return null;if(e<t[0])return`< ${t[0]}ms`;for(let n=1;n<t.length;n++)if(e<=t[n])return`${t[n-1]}ms to ${t[n]}ms`;return`> ${t[3]}ms`},g=(t,n,r=!1)=>{if(n===null)return;let i={name:t,value:n.toString()};r&&(i.uri=f.uri),e.push(i)};new PerformanceObserver(e=>{let t=e.getEntries().at(-1);t&&(n=t.startTime)}).observe({type:d,buffered:!0}),new PerformanceObserver((e,t)=>{let n=e.getEntriesByName(u)[0];n&&(g(u,h(n.startTime,[1e3,1800,3e3,4500]),!0),t.disconnect())}).observe({type:`paint`,buffered:!0}),s.addEventListener(`load`,()=>{f.visit===`1`&&(g(`timezone`,Intl.DateTimeFormat().resolvedOptions().timeZone),g(`locale`,Intl.NumberFormat().resolvedOptions().locale),g(`screen-size`,`${s.innerWidth}x${s.innerHeight}`),g(`input-device`,s.matchMedia(`(pointer: fine)`).matches?`mouse`:`touch`)),p()}),c.addEventListener(`click`,e=>{let t=e.target?.closest(`a`);t?.href&&(t.target===`_blank`||e.ctrlKey||e.metaKey||(i=t.href))}),s.addEventListener(`pagehide`,()=>{g(d,h(n,[1500,2500,4e3,6e3]),!0),a=!0,m()}),s.addEventListener(`visibilitychange`,()=>{r&&m()}),s.skadi={event:(e,n={})=>{t.push({name:e,properties:n}),p()},demographic:(e,t,n=!1)=>{g(e,t,n),p()},consent:e=>{o=e,m()}};

data/app/controllers/skadi/application_controller.rb

@@ -0,0 +1,4 @@
+module Skadi
+  class ApplicationController < ActionController::Base
+  end
+end

data/app/controllers/skadi/asset_controller.rb

@@ -0,0 +1,28 @@
+module Skadi
+  # Controller to serve assets directly so Skadi assets can be loaded regardless of asset pipeline
+  class AssetController < ActionController::Metal
+    include ActionController::ConditionalGet
+    include ActionController::DataStreaming
+
+    def tracking_script
+      serve_built_asset("skadi.js")
+    end
+
+    def dashboard_js
+      serve_built_asset("dashboard.js")
+    end
+
+    def dashboard_css
+      serve_built_asset("dashboard.css", type: "text/css")
+    end
+
+    private def serve_built_asset(file_name, type: "application/javascript")
+      file_path = Engine.root.join("app", "assets", "builds", file_name)
+
+      # Set a long expiry time - the include helper will append the app version number ensuring any changes will be loaded
+      expires_in 1.year, public: true, must_revalidate: false
+
+      send_file file_path, disposition: nil, type: type
+    end
+  end
+end

data/app/controllers/skadi/dashboard_controller.rb

@@ -0,0 +1,105 @@
+module Skadi
+  class DashboardController < ::ApplicationController
+    layout false
+
+    do_not_track! if defined?(do_not_track!)
+
+    before_action :set_dashboard
+    before_action :set_dashboard_permissions
+
+    def show
+      return head :forbidden unless can_view
+
+      render :show, locals: {
+        dashboard_configuration: @dashboard.configuration,
+        dataset_schema: Skadi::Schema.frontend_schema,
+        can_edit: can_edit,
+        can_dangerously_use_sql: can_dangerously_use_sql,
+      }
+    end
+
+    def data
+      return head :forbidden unless can_view
+
+      query_filters = params.permit(:date_from, :date_to, :page)
+
+      if can_edit && params[:configuration].present?
+        return custom_chart_data(query_filters)
+      end
+
+      unless params[:chart_id].present?
+        return render json: { error: "The chart_id parameter must be specified" }, status: :unprocessable_content
+      end
+
+      return render json: @dashboard.chart_data(params[:chart_id], query_filters.to_h)
+    rescue ActiveRecord::StatementInvalid => e
+      message = can_dangerously_use_sql ? e.message : "Something went wrong fetching the data. Please contact a site admin."
+      render json: { error: message }, status: :unprocessable_content
+    rescue Skadi::Dashboard::Error => e
+      render json: { error: e.message }, status: :unprocessable_content
+    end
+
+    def update
+      return head :forbidden unless can_view && can_edit
+
+      # The dashboard validator will strongly check the structure of :configuration
+      @dashboard.configuration = params.to_unsafe_h[:configuration]
+
+      if @dashboard.save
+        head :ok
+      else
+        render json: { error: "Dashboard validation failed. #{@dashboard.errors.full_messages.join("\n")}" }, status: :unprocessable_content
+      end
+    end
+
+    private def custom_chart_data(query_filters)
+      # The dashboard validator will strongly check the structure of :configuration
+      chart_configuration = params[:configuration].to_unsafe_h
+
+      # Temporarily add the chart to the current dashboard so we can validate it, ensuring it's in the right format and that no illegal SQL has been added.
+      chart_configuration["id"] = "temporary-chart"
+      @dashboard.configuration[0]["children"] << chart_configuration
+
+      unless @dashboard.valid?
+        return render json: { error: "Invalid chart configuration:\n#{@dashboard.errors.full_messages.join("\n")}" }, status: :unprocessable_content
+      end
+
+      return render json: @dashboard.chart_data("temporary-chart", query_filters.to_h)
+    end
+
+    private def set_dashboard
+      @dashboard = Skadi::Dashboard.first_or_create!(name: "Default dashboard", configuration: Skadi::Dashboard.default_configuration)
+    end
+
+    private def set_dashboard_permissions
+      @dashboard.can_dangerously_use_sql = can_dangerously_use_sql
+    end
+
+    private def can_view
+      return @can_view if defined?(@can_view)
+
+      return false if Skadi.configuration.dashboard_view_controller_method.nil?
+      return false unless respond_to?(Skadi.configuration.dashboard_view_controller_method, true)
+
+      return @can_view = send(Skadi.configuration.dashboard_view_controller_method)
+    end
+
+    private def can_edit
+      return @can_edit if defined?(@can_edit)
+
+      return false if Skadi.configuration.dashboard_edit_controller_method.nil?
+      return false unless respond_to?(Skadi.configuration.dashboard_edit_controller_method, true)
+
+      return @can_edit = send(Skadi.configuration.dashboard_edit_controller_method)
+    end
+
+    private def can_dangerously_use_sql
+      return @can_dangerously_use_sql if defined?(@can_dangerously_use_sql)
+
+      return false if Skadi.configuration.dashboard_dangerously_use_sql_controller_method.nil?
+      return false unless respond_to?(Skadi.configuration.dashboard_dangerously_use_sql_controller_method, true)
+
+      return @can_dangerously_use_sql = send(Skadi.configuration.dashboard_dangerously_use_sql_controller_method)
+    end
+  end
+end

data/app/controllers/skadi/tracking_controller.rb

@@ -0,0 +1,106 @@
+module Skadi
+  class TrackingController < ActionController::API
+    include ActionController::Cookies
+
+    # Disables the automatic wrapping of JSON parameters into a "tracking" hash
+    wrap_parameters false
+
+    prepend_before_action :limit_payload_size!
+
+    rate_limit to: 60, within: 1.minute, with: -> { head :too_many_requests }
+
+    before_action :set_params
+    before_action :set_view
+
+    def track
+      if @params["exit_page"].present? && @params["exit_page"].is_a?(String)
+        @view.exit_page = Skadi::Url.redact_and_normalise_url(@params["exit_page"])
+      end
+
+      handle_consent @params["consent"]
+
+      if @params["events"].present? && @params["events"].is_a?(Array)
+        handle_events @params["events"]
+      end
+
+      if @params["demographics"].present? && @params["demographics"].is_a?(Array)
+        handle_demographics @params["demographics"]
+      end
+
+      @view.verified = true
+      @view.visit.verified = true if @view.visit
+
+      skadi._persist
+
+      head :no_content
+    end
+
+    private def skadi
+      # Disable bot protection, since that will have been done when the visit/view was created
+      @_skadi ||= Skadi::ControllerDelegate.new(self, bot_protection: false)
+    end
+
+    private def set_params
+      @params = request.request_parameters
+    end
+
+    private def set_view
+      # Check that the view token is a valid UUID
+      unless @params["view"].is_a?(String) && @params["view"].length == 36
+        return head :bad_request
+      end
+
+      @view = Skadi::View.includes(:visit).find_by(view_token: @params["view"])
+
+      return head :not_found unless @view
+
+      return head :gone unless @view.created_at > Time.current - Skadi.configuration.visit_duration
+
+      # We're not using _prepare to generate the view/visit, so we have to set them manually
+      skadi._attach(view: @view, visit: @view.visit)
+    end
+
+    private def handle_consent(consent)
+      return unless consent.is_a?(Hash)
+
+      if consent["cookie"] == true || consent["cookie"] == false
+        skadi.cookie_consent!(consent["cookie"])
+      end
+
+      if consent["anonymity_set"] == true || consent["anonymity_set"] == false
+        skadi.anonymity_set_consent!(consent["anonymity_set"])
+      end
+
+      if consent["user"] == true || consent["user"] == false
+        skadi.user_consent!(consent["user"])
+      end
+    end
+
+    private def handle_events(events)
+      events.each do |event|
+        next unless event.is_a?(Hash)
+        next unless event["name"].is_a?(String) && event["name"].present?
+        next unless event["properties"].is_a?(Hash)
+
+        skadi.event(event["name"], event["properties"])
+      end
+    end
+
+    private def handle_demographics(demographics)
+      demographics.each do |demographic|
+        next unless demographic.is_a?(Hash)
+        next unless demographic["name"].is_a?(String) && demographic["name"].present?
+        next unless demographic["value"].is_a?(String) && demographic["value"].present?
+        next unless demographic["uri"].nil? || demographic["uri"].is_a?(String)
+
+        skadi.demographic(demographic["name"], demographic["value"], action_specific: true, uri: demographic["uri"] || "")
+      end
+    end
+
+    def limit_payload_size!
+      if request.content_length && request.content_length > Skadi.configuration.max_tracking_payload_size
+        render json: { error: "Payload too large" }, status: :content_too_large
+      end
+    end
+  end
+end

data/app/helpers/skadi/application_helper.rb

@@ -0,0 +1,38 @@
+module Skadi
+  module ApplicationHelper
+    class InvalidSkadiTagType < StandardError; end
+
+    mattr_accessor :skadi_script_src
+
+    def skadi_tag(type = :inline)
+      return if skadi.do_not_track? || skadi.view.nil?
+
+      tag_attributes = {
+        data: {
+          uri: request.route_uri_pattern,
+          endpoint: Skadi::Engine.routes.url_helpers.tracking_endpoint_path,
+          view: skadi.view.token,
+        },
+        nonce: content_security_policy_nonce,
+      }
+      tag_attributes[:data][:visit] = "1" if skadi.new_visit?
+
+      case type
+        when :route
+          content_tag("script", "", {
+            src: Skadi::Engine.routes.url_helpers.tracking_script_path(v: Skadi::VERSION),
+            **tag_attributes,
+          })
+        when :inline
+          self.skadi_script_src ||= Engine.root.join("app", "assets", "builds", "skadi.js").read.html_safe
+          content_tag(
+            "script",
+            skadi_script_src,
+            tag_attributes,
+          )
+        else
+          raise InvalidSkadiTagType.new("Invalid type given to skadi_tag. Expecting :route, :inline, but got :#{type}.")
+      end
+    end
+  end
+end

data/app/models/skadi/application_record.rb

@@ -0,0 +1,5 @@
+module Skadi
+  class ApplicationRecord < ::ActiveRecord::Base
+    self.abstract_class = true
+  end
+end

data/app/models/skadi/dashboard.rb

@@ -0,0 +1,83 @@
+module Skadi
+  class Dashboard < ApplicationRecord
+    class Error < StandardError; end
+    class ChartNotFoundError < Error; end
+    class UnsupportedDatabaseError < Error; end
+    class UnsupportedOperatorError < Error; end
+    class DatasetConfigurationError < Error; end
+
+    validates_with DashboardValidator
+
+    # Used by the validator to prevent the unauthorised use of SQL, while allowing existing charts that use SQL to be duplicated.
+    attr_accessor :can_dangerously_use_sql
+
+    DEFAULT_CONFIGURATION = [
+      {
+        "id" => "7cec5a7a-7bf7-403f-b15e-b2e45944182c",
+        "title" => "Dashboard 1",
+        "children" => [
+          {
+            "id" => "7cec5a7a-7bf7-403f-b15e-b2e45944182d",
+            "type" => "line",
+            "title" => "Visits and Checkouts",
+            "time_series" => "weekly",
+
+            "verified_visits" => true,
+            "unique_by" => "visit",
+            "visit_tracking" => "any",
+
+            "datasets" => [
+              {
+                "id" => "7cec5a7a-7bf7-403f-b15e-b2e45944182e",
+                "label" => "Visits",
+                "type" => "visits",
+              }.freeze,
+            ].freeze,
+          }.freeze,
+        ].freeze,
+      }.freeze,
+    ].freeze
+
+    def self.default_configuration = DEFAULT_CONFIGURATION.deep_dup
+
+    def chart_data(chart_id, filters)
+      chart_configuration = find_chart_by_id(chart_id) unless chart_id.nil?
+
+      raise ChartNotFoundError.new("Unable to find chart with id #{chart_id.inspect}") unless chart_configuration
+
+      return DashboardQuery.chart_query(chart_configuration, filters)
+    end
+
+    # Returns an array containing the SQL queries in the _persisted_ record - i.e. those that non-permitted users can use/run
+    def sql_strings
+      return [] unless configuration_was.is_a?(Array)
+
+      charts = configuration_was.flat_map do |tab|
+        (tab.is_a?(Hash) && tab["children"].is_a?(Array)) ? tab["children"] : []
+      end
+      datasets = charts.flat_map do |chart|
+        (chart.is_a?(Hash) && chart["datasets"].is_a?(Array)) ? chart["datasets"] : []
+      end
+      return datasets.flat_map do |dataset|
+        next [] unless dataset.is_a?(Hash) && dataset["type"] == "sql" && dataset["sql"].is_a?(String)
+
+        [ dataset["sql"] ]
+      end
+    end
+
+    private def find_chart_by_id(chart_id) = find_item_by_id(configuration, chart_id)
+
+    private def find_item_by_id(items, id)
+      items.each do |item|
+        return item if item["id"] == id
+
+        if item["children"].is_a?(Array)
+          child_item = find_item_by_id(item["children"], id)
+          return child_item unless child_item.nil?
+        end
+      end
+
+      return nil
+    end
+  end
+end