@daemonitor/plugins 1.1.39 → 1.1.41

package/dist/plugins/monitoring/Ga4Plugin.js

@@ -10,7 +10,9 @@ import { getJson, googleAccessToken, shiftDate, todayIn } from "./AdsensePlugin.
 // property asks the Data API for: active users right now (realtime), users,
 // sessions and page views for today, yesterday and the last 7 days, and 30
 // days of daily figures. 7-day users come from GA itself, never from summing
-// days: one person on three days is one user, not three.
+// days: one person on three days is one user, not three. Each property also
+// says which sites it covers (its web streams) and its most viewed pages, so a
+// site in daemonitor can show only its own.
 //
 // The report carries its own 30-day history, so the server stores no history
 // rows for this type. Hiding properties and nicknames live in the portal.
@@ -38,9 +40,10 @@ const totals = (row) => row ? { users: num(row.metricValues?.[0]), sessions: num
  * batchRunReports response -> the figures the portal shows.
  * Report 0: no dimensions, three named date ranges (today, yesterday, last7).
  * Report 1: one row per date over the last 30 days.
+ * Reports 2 and 3: the most viewed pages over 30 days and since yesterday.
  */
 export function parseProperty(batch, now = new Date()) {
-    const [summary, byDate] = batch?.reports || [];
+    const [summary, byDate, popular, trending] = batch?.reports || [];
     // A multi-range report adds a "dateRange" dimension holding each range's name.
     const range = (name) => totals((summary?.rows || []).find((r) => r?.dimensionValues?.[0]?.value === name));
     // Gap-fill the 30 days in the property's own time zone: GA leaves days with
@@ -65,11 +68,87 @@ export function parseProperty(batch, now = new Date()) {
             sessions: days.map((d) => d.sessions),
             views: days.map((d) => d.views),
         },
+        pages: { popular: parsePages(popular), trending: parsePages(trending) },
     };
 }
 /** runRealtimeReport -> users active in the last 30 minutes. No rows means zero. */
 export const parseRealtime = (r) => num(r?.rows?.[0]?.metricValues?.[0]);
-export const BATCH_BODY = {
+// What a list of top pages leaves out: the home page, section fronts (a single
+// path segment) and archives, which outrank every article and say nothing.
+export const EXCLUDE_REGEX = ["^/([^/]+)?/?$", "^/(calendar|category|tag|author)/.*$"];
+// Per host, per list: a property's reports stay small enough to send every poll.
+const PAGES_PER_HOST = 10;
+/** A runReport request for a date range's most viewed pages. `/a` and `/a/` are one page, so both are excluded. */
+export function pagesRequest(startDate, exclude = []) {
+    const exact = exclude.flatMap((p) => [p.replace(/\/$/, ""), `${p.replace(/\/$/, "")}/`]);
+    return {
+        dateRanges: [{ startDate, endDate: "today" }],
+        dimensions: [{ name: "hostName" }, { name: "pagePath" }, { name: "pageTitle" }],
+        metrics: [{ name: "screenPageViews" }],
+        orderBys: [{ metric: { metricName: "screenPageViews" }, desc: true }],
+        limit: 50,
+        dimensionFilter: {
+            notExpression: {
+                orGroup: {
+                    expressions: [
+                        ...(exact.length ? [{ filter: { fieldName: "pagePath", inListFilter: { values: exact } } }] : []),
+                        ...EXCLUDE_REGEX.map((value) => ({ filter: { fieldName: "pagePath", stringFilter: { matchType: "FULL_REGEXP", value } } })),
+                    ],
+                },
+            },
+        },
+    };
+}
+const bareHost = (h) => h.trim().toLowerCase().replace(/^www\./, "");
+/**
+ * A pages report -> the most viewed pages per host. `/a` and `/a/` add up, and a
+ * site name most titles end in (" | The Architect's Newspaper") comes off.
+ */
+export function parsePages(report) {
+    const rows = (report?.rows || []).map((r) => ({
+        host: bareHost(String(r?.dimensionValues?.[0]?.value || "")),
+        path: String(r?.dimensionValues?.[1]?.value || "").replace(/(.)\/$/, "$1"),
+        title: String(r?.dimensionValues?.[2]?.value || ""),
+        views: num(r?.metricValues?.[0]),
+    }));
+    const tails = new Map();
+    for (const r of rows) {
+        const m = /\s[|–—-]\s[^|–—-]+$/.exec(r.title);
+        if (m)
+            tails.set(m[0], (tails.get(m[0]) ?? 0) + 1);
+    }
+    const [tail, n] = [...tails].sort((a, b) => b[1] - a[1])[0] ?? ["", 0];
+    const shared = n >= 2 && n >= rows.length * 0.6 ? tail : "";
+    const by = new Map();
+    for (const r of rows) {
+        const key = `${r.host}${r.path}`;
+        const had = by.get(key);
+        if (had)
+            had.views += r.views;
+        else
+            by.set(key, { ...r, title: shared && r.title.endsWith(shared) ? r.title.slice(0, -shared.length) : r.title });
+    }
+    const counts = new Map();
+    return [...by.values()].sort((a, b) => b.views - a.views).filter((p) => {
+        const c = (counts.get(p.host) ?? 0) + 1;
+        counts.set(p.host, c);
+        return c <= PAGES_PER_HOST;
+    });
+}
+/** dataStreams response -> the sites a property covers: each web stream's host, without www. */
+export function parseDomains(r) {
+    const uris = (r?.dataStreams || []).map((s) => s?.webStreamData?.defaultUri).filter(Boolean);
+    const hosts = uris.flatMap((u) => {
+        try {
+            return [bareHost(new URL(u.includes("://") ? u : `https://${u}`).hostname)];
+        }
+        catch {
+            return [];
+        }
+    });
+    return [...new Set(hosts)];
+}
+export const batchBody = (exclude = []) => ({
     requests: [
         {
             dateRanges: [
@@ -85,8 +164,11 @@ export const BATCH_BODY = {
             metrics: METRICS,
             limit: DAYS + 5,
         },
+        // Popular over 30 days, trending since yesterday, as the site's own lists are.
+        pagesRequest("30daysAgo", exclude),
+        pagesRequest("1daysAgo", exclude),
     ],
-};
+});
 async function inBatches(items, size, fn) {
     const out = [];
     for (let i = 0; i < items.length; i += size)
@@ -120,11 +202,12 @@ export function createGa4Plugin() {
             account.properties = await inBatches(account.properties, CONCURRENCY, async (p) => {
                 // One property failing (no access to its data, quota) must not hide the rest.
                 try {
-                    const [batch, realtime] = await Promise.all([
-                        post(`${DATA}/properties/${p.id}:batchRunReports`, BATCH_BODY),
+                    const [batch, realtime, streams] = await Promise.all([
+                        post(`${DATA}/properties/${p.id}:batchRunReports`, batchBody(cfg.excludePages)),
                         post(`${DATA}/properties/${p.id}:runRealtimeReport`, { metrics: [{ name: "activeUsers" }] }).catch(() => null),
+                        get(`${ADMIN}/properties/${p.id}/dataStreams?pageSize=50`).catch(() => null),
                     ]);
-                    return { ...p, ...parseProperty(batch), activeNow: realtime ? parseRealtime(realtime) : null };
+                    return { ...p, ...parseProperty(batch), activeNow: realtime ? parseRealtime(realtime) : null, domains: parseDomains(streams) };
                 }
                 catch (e) {
                     return { ...p, error: String(e?.message || e).slice(0, 160) };

package/dist/plugins/monitoring/LogWatchPlugin.js

@@ -42,15 +42,16 @@ const BASE64_BLOB = /[A-Za-z0-9+/]{40,}={0,2}/;
 const UPLOADS_PHP = /\/wp-content\/uploads\/.*\.php$/i;
 const PLUGIN_PHP = /\/wp-content\/(?:plugins|mu-plugins)\/.*\.php$/i;
 const BATCH_PATH = /^\/wp-json\/batch\/v1|rest_route=\/?batch\/v1/i;
+// The omnisend-integration mu-plugin's wp_send_json_error "Security check
+// failed" logs as 79 bytes direct from Cloudflare and 90 through cloudflared
+// (since 2026-10-28); success logs as 77 and 88. Matching on size is the only
+// signal the access log carries, so a change to that message, to nginx's gzip
+// settings or to the proxy in front silences this rule.
+const SUBSCRIBE_FAIL_BYTES = new Set([79, 90]);
+const SUBSCRIBE_REFERER = /\/subscribe\/?(?:[?#]|$)/;
 // wp-admin paths that answer 2xx to anonymous callers, so a 2xx on them proves
 // nothing about being logged in. Everything else under /wp-admin/ redirects a
 // logged-out visitor to the login form.
-// The omnisend-integration mu-plugin's wp_send_json_error "Security check
-// failed" gzips to exactly 79 bytes; success gzips to 77. Matching on size is
-// the only signal the access log carries, so a change to that message or to
-// nginx's gzip settings silences this rule.
-const SUBSCRIBE_FAIL_BYTES = 79;
-const SUBSCRIBE_REFERER = /\/subscribe\/?(?:[?#]|$)/;
 const ANON_ADMIN = /^\/wp-admin\/(?:admin-ajax|admin-post|load-styles|load-scripts|install|setup-config)\.php$|^\/wp-admin\/(?:css|js|images|fonts)\//i;
 // Read new bytes since last offset, advancing state. Handles rotation (file
 // shrank → restart at 0) and partial trailing lines (buffered in remainder).
@@ -173,7 +174,7 @@ export function analyze(lines, cfg, windowSec, st) {
         // every WP site is probed constantly for my.php / academy.php / etc., and
         // those hits 404 (not there) or 403 (WAF-blocked). Alerting on the probes
         // is pure noise; alert only when the shell actually RAN.
-        if (e.method === "POST" && pathNoQuery === "/wp-admin/admin-ajax.php" && e.bytes === SUBSCRIBE_FAIL_BYTES && SUBSCRIBE_REFERER.test(e.referer)) {
+        if (e.method === "POST" && pathNoQuery === "/wp-admin/admin-ajax.php" && SUBSCRIBE_FAIL_BYTES.has(e.bytes) && SUBSCRIBE_REFERER.test(e.referer)) {
             subscribeFail.set(e.ip, (subscribeFail.get(e.ip) || 0) + 1);
             noteHost(e.ip, e.host);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daemonitor/plugins",
-  "version": "1.1.39",
+  "version": "1.1.41",
   "description": "daemonitor plugins",
   "types": "types/index.d.ts",
   "main": "dist/index.js",