@bakery-framework/plugin-analytics 2.0.0-alpha.4 → 2.0.0-alpha.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bakery-framework/plugin-analytics",
-  "version": "2.0.0-alpha.4",
+  "version": "2.0.0-alpha.6",
   "description": "Bakery analytics plugin.",
   "keywords": [
     "bakery",
@@ -25,6 +25,7 @@
   "main": "./src/index.ts",
   "exports": {
     ".": "./src/index.ts",
+    "./setup": "./src/setup.ts",
     "./stats": "./src/endpoints/stats.ts",
     "./package.json": "./package.json"
   },
@@ -34,7 +35,7 @@
     "!src/tests"
   ],
   "dependencies": {
-    "@bakery-framework/core": "^2.0.0-alpha.4"
+    "@bakery-framework/core": "^2.0.0-alpha.6"
   },
   "engines": {
     "bun": ">=1.3.14"

package/src/endpoints/stats.ts

@@ -2,6 +2,7 @@ import { Bakery } from '@bakery-framework/core/core/bakery'
 import { Session } from '@bakery-framework/core/session'
 import type { JsonResponseData } from '@bakery-framework/core/utils/common'
 import {
+  type AuthorizeFn,
   requestHasCredential,
   response,
 } from '@bakery-framework/core/utils/http'
@@ -83,8 +84,12 @@ export type AnalyticsStats = ReturnType<typeof computeStats>
  * A request predicate, for apps that gate by their own roles rather than (or
  * as well as) a shared key. Returning `true` admits; throwing or returning
  * anything else denies (convention 2).
+ *
+ * Re-exported from core rather than declared here: the dashboard and
+ * db-explorer plugins need the same type, and three byte-identical copies of a
+ * security type drift the way the guards themselves already had.
  */
-export type AuthorizeFn = (req: Request) => boolean | Promise<boolean>
+export type { AuthorizeFn } from '@bakery-framework/core/utils/http'
 
 /**
  * Analytics owns the auth for its endpoints, and the dashboard delegates to

package/src/index.ts

@@ -1,4 +1,5 @@
 import { definePlugin } from '@bakery-framework/core/plugins'
+import { parsedUrl } from '@bakery-framework/core/utils/http'
 import { recordErrorPageHit, recordRouteHit } from './core'
 
 export {
@@ -52,7 +53,7 @@ export default function analyticsPlugin(options: AnalyticsPluginOptions = {}) {
       })
     },
     onRoute(req) {
-      const url: URL = (req as any).__parsedUrl || new URL(req.url)
+      const url = parsedUrl(req)
       recordRouteHit(req.method, url.pathname, url.search)
     },
     onStart: async server => {

package/src/setup.ts

@@ -187,14 +187,43 @@ export function handleAnalyticsRequest(
 
 let registered = false
 
-export function setupAnalytics(
-  options: { credential?: string; authorize?: AuthorizeFn } = {},
-) {
-  // Auth is (re)applied every call — last config wins — so the dashboard
-  // bringing analytics up with the shared key overrides a bare
-  // `analyticsPlugin()`, whichever order they registered in.
-  setAnalyticsCredential(options.credential)
-  setAnalyticsAuthorize(options.authorize)
+export interface AnalyticsAuthOptions {
+  credential?: string
+  authorize?: AuthorizeFn
+}
+
+/**
+ * The auth half of `setupAnalytics`, split out from the once-only half.
+ *
+ * Auth is (re)applied on every call — last config wins — so the dashboard
+ * bringing analytics up with the shared key overrides a bare
+ * `analyticsPlugin()`, whichever order they registered in.
+ *
+ * "Whichever order" is what the `!== undefined` buys, and it is the whole
+ * reason each option is applied conditionally rather than assigned straight
+ * through. Both plugins forward their options here and an application
+ * configures whichever of the two it thinks of as the console, so under a
+ * plain assignment the answer would depend on registration order: in
+ * `apps/example`, `analyticsPlugin({ credential })` runs after
+ * `dashboardPlugin({ authorize })` and would have wiped the predicate,
+ * shutting the console it was registered to open. A call that carries a value
+ * wins; a bare call is a no-op against auth rather than a silent disarm.
+ * Turning a door off means not registering the plugin, or passing the empty
+ * string — never omitting the option.
+ *
+ * It is separate, and exported, because `setupAnalytics` cannot be called from
+ * a test: it also registers two handlers, installs a shutdown hook and kicks
+ * off a data load, none of them restorable (convention 9).
+ */
+export function applyAnalyticsAuth(options: AnalyticsAuthOptions): void {
+  if (options.credential !== undefined) {
+    setAnalyticsCredential(options.credential)
+  }
+  if (options.authorize !== undefined) setAnalyticsAuthorize(options.authorize)
+}
+
+export function setupAnalytics(options: AnalyticsAuthOptions = {}) {
+  applyAnalyticsAuth(options)
 
   // The rest runs once. Analytics is now a hard dependency of the dashboard,
   // so both may set it up in one process; the handler registrations are