@harshankur/viewcounter 3.0.1 → 3.2.0

package/admin/site.webmanifest

@@ -0,0 +1,20 @@
+{
+  "name": "ViewCounter Admin",
+  "short_name": "ViewCounter",
+  "start_url": "./",
+  "icons": [
+    {
+      "src": "icon-192.png",
+      "sizes": "192x192",
+      "type": "image/png"
+    },
+    {
+      "src": "icon-512.png",
+      "sizes": "512x512",
+      "type": "image/png"
+    }
+  ],
+  "theme_color": "#0a0f0c",
+  "background_color": "#0a0f0c",
+  "display": "standalone"
+}

package/config/index.js

@@ -4,6 +4,7 @@ const path = require('path');
 require('dotenv').config({ quiet: true });
 
 const {
+    ADMIN,
     DATABASE,
     INSECURE_DEFAULTS,
     NODE_ENV,
@@ -12,6 +13,7 @@ const {
     SERVER,
 } = require('../constants');
 const { filterValidAppIds } = require('../utils/appIdUtils');
+const { parseDuration, formatDuration } = require('../utils/durationUtils');
 const { getError, logWarning, ErrorType, WarningType } = require('../utils/errorUtils');
 const { LogLevel } = require('../utils/logger');
 
@@ -70,7 +72,7 @@ function readJsonFile(filePath) {
  *
  * CONFIG.md §4: never a shallow spread of a nested object. The previous
  * implementation returned the parsed file verbatim, so a `dbInfo.json` missing
- * `host` produced `host: undefined` instead of falling back — and an
+ * `host` produced `host: undefined` instead of falling back, and an
  * `allowed.json` missing `appId` produced `undefined`, which then threw on
  * `.join()` at startup.
  *
@@ -96,13 +98,17 @@ class Config {
         this.allowed = this.loadAllowed();
         this.auth = this.loadAuthConfig();
         this.privacy = this.loadPrivacyConfig();
+        this.admin = this.loadAdminConfig();
+        // Optional: an .mmdb city database (DB-IP City Lite or GeoLite2 City)
+        // for each view's region and city. Without it, country only.
+        this.geo = { cityDatabase: this.env.GEOIP_CITY_DB || null };
     }
 
     /**
      * Server, logging, and proxy settings.
      *
      * `nodeEnv` defaults to production. It previously defaulted to
-     * development, which is also what the setup wizard wrote into `.env` — and
+     * development, which is also what the setup wizard wrote into `.env`, and
      * ten route handlers echo raw database error text to the caller when the
      * environment is development. A deploy that forgot to set NODE_ENV leaked
      * table names and SQL fragments to anonymous callers.
@@ -207,7 +213,7 @@ class Config {
      *
      * Two sources, because they serve different deployments:
      *  - `READ_API_KEYS` (env): unscoped keys that can read every app. This is
-     *    the single-operator case — all the apps are yours anyway.
+     *    the single-operator case: all the apps are yours anyway.
      *  - `apiKeys` in allowed.json: `{ "<key>": ["blog"] }`, scoped to named
      *    apps. This is the multi-tenant case, where one customer's key must
      *    not read another customer's analytics. Use `"*"` for an unscoped key.
@@ -273,7 +279,7 @@ class Config {
         // Resolved lazily, on first read rather than at construction.
         //
         // This module is imported by index.js, and index.js is the package
-        // entry point — so an application that only wants to mount
+        // entry point, so an application that only wants to mount
         // createAnalyticsRouter would otherwise generate and persist a secret
         // purely as a side effect of `require('@harshankur/viewcounter')`, writing it into
         // node_modules where the next `npm ci` wipes it. Embedders supply their
@@ -293,6 +299,82 @@ class Config {
         };
     }
 
+    /**
+     * Admin UI credential and data-retention settings.
+     *
+     * `ADMIN_PASSWORD` is its own credential tier (SECURITY.md §3): it can
+     * read, edit, and delete every app's data, which neither a read key nor an
+     * ADMIN_API_KEYS provisioning key may do. It is read from the environment
+     * only, never from a config file, because it is a secret. The UI is
+     * disabled, failing closed, whenever it is absent.
+     *
+     * A password that is set but shorter than the minimum is kept (so
+     * validate() can refuse to boot on it in production) but never enables
+     * the UI.
+     *
+     * `TRASH_RETENTION_DAYS` bounds how long a soft-deleted view is kept before
+     * it is erased for good (GDPR Art. 5(1)(e), storage limitation). Zero keeps
+     * trash until an admin empties it by hand.
+     *
+     * `VIEW_LOG_RETENTION_DAYS` bounds the view register log, which gains a
+     * row for every accepted view. It holds no personal data, so this is about
+     * storage rather than law, but a log nobody bounds grows as large as all
+     * the app tables together. Zero keeps it forever. The admin log is never
+     * pruned: it is the record of who changed or erased what, and it grows only
+     * with admin activity.
+     *
+     * An out-of-range or unparseable retention falls back to the default.
+     *
+     * `ADMIN_SESSION_IDLE_TIMEOUT` and `ADMIN_SESSION_MAX_AGE` ("30m", "12h",
+     * "7d") bound how long a sign-in lasts: signed out after that long unused,
+     * and after that long regardless. Unlike a retention, a malformed timeout
+     * stops startup: silently using the default would give a typo like
+     * "30 min" a week-long session.
+     */
+    loadAdminConfig() {
+        const password = this.env.ADMIN_PASSWORD || '';
+        const longEnough = password.length >= ADMIN.MIN_PASSWORD_LENGTH;
+
+        const retention = (raw, fallback, max) => {
+            const days = parseIntOr(raw, fallback);
+            return days >= 0 && days <= max ? days : fallback;
+        };
+
+        const duration = (field, fallback, min, max) => {
+            const raw = this.env[field];
+            if (raw === undefined || raw === '') return fallback;
+            const ms = parseDuration(raw);
+            if (ms === null || ms < min || ms > max) {
+                throw getError(ErrorType.CONFIG_INVALID_VALUE, {
+                    field,
+                    reason: `must be a duration such as 30m, 12h, or 7d, from ${formatDuration(min)} to ${formatDuration(max)}`,
+                });
+            }
+            return ms;
+        };
+        const sessionIdleMs = duration('ADMIN_SESSION_IDLE_TIMEOUT',
+            ADMIN.SESSION_IDLE_TIMEOUT_MS, ADMIN.SESSION_IDLE_MIN_MS, ADMIN.SESSION_IDLE_MAX_MS);
+        const sessionMaxAgeMs = duration('ADMIN_SESSION_MAX_AGE',
+            ADMIN.SESSION_ABSOLUTE_TIMEOUT_MS, ADMIN.SESSION_MAX_AGE_MIN_MS, ADMIN.SESSION_MAX_AGE_MAX_MS);
+        if (sessionIdleMs > sessionMaxAgeMs) {
+            throw getError(ErrorType.CONFIG_INVALID_VALUE, {
+                field: 'ADMIN_SESSION_IDLE_TIMEOUT',
+                reason: `must not be longer than ADMIN_SESSION_MAX_AGE (${formatDuration(sessionMaxAgeMs)})`,
+            });
+        }
+
+        return {
+            password,
+            enabled: longEnough,
+            sessionIdleMs,
+            sessionMaxAgeMs,
+            trashRetentionDays: retention(
+                this.env.TRASH_RETENTION_DAYS, ADMIN.DEFAULT_TRASH_RETENTION_DAYS, ADMIN.MAX_TRASH_RETENTION_DAYS),
+            viewLogRetentionDays: retention(
+                this.env.VIEW_LOG_RETENTION_DAYS, ADMIN.DEFAULT_VIEW_LOG_RETENTION_DAYS, ADMIN.MAX_VIEW_LOG_RETENTION_DAYS),
+        };
+    }
+
     /**
      * Fail-fast startup validation (CONFIG.md §3, SECURITY.md §1).
      *
@@ -308,6 +390,8 @@ class Config {
         // persist it fails at startup rather than on its first request.
         void this.privacy.visitorSecret;
 
+        this.validateAdmin();
+
         if (!this.server.isProduction) {
             this.warnAboutDevelopmentDefaults();
             return this;
@@ -338,6 +422,40 @@ class Config {
         return this;
     }
 
+    /**
+     * Admin credential checks, shared by every environment.
+     *
+     * A password that is present but too short is a misconfiguration, not a
+     * choice, so production refuses to boot on it rather than silently leaving
+     * the UI off. Reusing an API key as the password collapses two tiers into
+     * one secret, which is worth a warning in any environment.
+     */
+    validateAdmin() {
+        const { password, enabled } = this.admin;
+
+        if (!password) {
+            logWarning(WarningType.ADMIN_UI_DISABLED);
+            return;
+        }
+
+        if (!enabled && this.server.isProduction) {
+            throw getError(ErrorType.CONFIG_INVALID_VALUE, {
+                field: 'ADMIN_PASSWORD',
+                reason: `must be at least ${ADMIN.MIN_PASSWORD_LENGTH} characters`,
+            });
+        }
+
+        if (!enabled) {
+            logWarning(WarningType.ADMIN_UI_DISABLED);
+            return;
+        }
+
+        const apiKeys = [...Object.keys(this.auth.readKeyScopes), ...this.auth.adminApiKeys];
+        if (apiKeys.includes(password)) {
+            logWarning(WarningType.ADMIN_PASSWORD_REUSED);
+        }
+    }
+
     /** Surface the same problems as warnings outside production. */
     warnAboutDevelopmentDefaults() {
         if (Object.keys(this.auth.readKeyScopes).length === 0) {

package/constants.js

@@ -14,9 +14,11 @@ const APP_SLUG = 'viewcounter';
 
 const HTTP_STATUS = {
     OK: 200,
+    NO_CONTENT: 204,
     BAD_REQUEST: 400,
     UNAUTHORIZED: 401,
     FORBIDDEN: 403,
+    NOT_FOUND: 404,
     UNPROCESSABLE_ENTITY: 422,
     TOO_MANY_REQUESTS: 429,
     INTERNAL_SERVER_ERROR: 500,
@@ -46,6 +48,18 @@ const FIELD_MAX_LENGTH = {
     DEVICE_TYPE: 20,
     SESSION_ID: 64,
     EVENT_TYPE: 50,
+    /** Free-text admin annotation on a single view. */
+    NOTE: 1000,
+    /** CHAR(36): the canonical textual form of a UUID. */
+    UUID: 36,
+    /** The longest a DNS name can be. */
+    HOSTNAME: 253,
+    /** A primary language subtag: two or three letters, rarely up to eight. */
+    LANGUAGE: 8,
+    /** Each of utm_source, utm_medium, utm_campaign, utm_term, utm_content. */
+    UTM: 100,
+    REGION: 100,
+    CITY: 100,
 };
 
 /** Bounds for user-supplied pagination and range parameters. */
@@ -83,7 +97,9 @@ const DATABASE = {
     QUERY_TIMEOUT_MS: 5_000,
     CONNECT_TIMEOUT_MS: 10_000,
     DEFAULT_PORT: 3306,
-    SCHEMA_VERSION: 'enhanced_schema_v3',
+    SCHEMA_VERSION: 'schema_v5',
+    /** Rows given a public_id per statement when backfilling an old table. */
+    BACKFILL_BATCH_SIZE: 500,
 };
 
 const SERVER = {
@@ -117,6 +133,296 @@ const PRIVACY = {
     MIN_ADMIN_KEY_LENGTH: 32,
 };
 
+/**
+ * Admin UI and API.
+ *
+ * The admin tier is a separate credential from both read keys and
+ * ADMIN_API_KEYS (SECURITY.md §3): it can read, edit, and delete every app's
+ * data, which neither of the other tiers may do.
+ */
+const ADMIN = {
+    /** Where the UI and its API are mounted. */
+    PATH_PREFIX: '/admin',
+    /** Relative to PATH_PREFIX. */
+    API_PATH: '/api',
+    SESSION_COOKIE: 'vc_admin_session',
+    CSRF_HEADER: 'x-csrf-token',
+    /** Long enough that the login rate limit makes guessing hopeless. */
+    MIN_PASSWORD_LENGTH: 16,
+    /** Longest submitted password even looked at; bounds the comparison cost. */
+    MAX_PASSWORD_INPUT_LENGTH: 1024,
+    SESSION_TOKEN_BYTES: 32,
+    CSRF_TOKEN_BYTES: 32,
+    /** Default for ADMIN_SESSION_IDLE_TIMEOUT: signed out after this long unused. */
+    SESSION_IDLE_TIMEOUT_MS: 7 * 24 * 60 * 60 * 1000,
+    /** Default for ADMIN_SESSION_MAX_AGE: signed out after this long regardless. */
+    SESSION_ABSOLUTE_TIMEOUT_MS: 30 * 24 * 60 * 60 * 1000,
+    SESSION_IDLE_MIN_MS: 5 * 60 * 1000,
+    SESSION_IDLE_MAX_MS: 90 * 24 * 60 * 60 * 1000,
+    SESSION_MAX_AGE_MIN_MS: 60 * 60 * 1000,
+    SESSION_MAX_AGE_MAX_MS: 365 * 24 * 60 * 60 * 1000,
+    /**
+     * A session's last-seen time is written at most this often, so an active
+     * admin costs one database write a minute rather than one per request.
+     */
+    SESSION_TOUCH_INTERVAL_MS: 60 * 1000,
+    /** Permanent erasure needs the password to have been entered this recently. */
+    REAUTH_WINDOW_MS: 15 * 60 * 1000,
+    /** Oldest sessions are evicted beyond this, bounding memory. */
+    MAX_SESSIONS: 50,
+    LOGIN_RATE_LIMIT_WINDOW_MS: 15 * 60 * 1000,
+    /** Failed attempts per IP per window. Successful logins do not count. */
+    LOGIN_RATE_LIMIT_MAX: 5,
+    RATE_LIMIT_WINDOW_MS: 60 * 1000,
+    /** Requests per IP per window across the whole admin surface. */
+    RATE_LIMIT_MAX: 600,
+    /** Upper bound on the rows one batch operation may touch. */
+    MAX_BATCH_IDS: 500,
+    /**
+     * JSON body ceiling for the admin API. A full batch of MAX_BATCH_IDS
+     * UUIDs is about 20 kB on its own, above the public endpoints' limit.
+     */
+    MAX_BODY_BYTES: 64 * 1024,
+    PAGE_SIZES: [25, 50, 100],
+    PAGE_SIZE_DEFAULT: 50,
+    PAGE_MAX: 100_000,
+    SEARCH_MAX_LENGTH: 200,
+    DEFAULT_TRASH_RETENTION_DAYS: 30,
+    MAX_TRASH_RETENTION_DAYS: 3650,
+    DEFAULT_VIEW_LOG_RETENTION_DAYS: 90,
+    MAX_VIEW_LOG_RETENTION_DAYS: 3650,
+    /** Rows removed per statement when pruning the view log, so no delete holds locks for long. */
+    VIEW_LOG_PRUNE_BATCH_SIZE: 5000,
+    /** How often expired trash and old view-log entries are checked for. */
+    RETENTION_INTERVAL_MS: 60 * 60 * 1000,
+    /** The tracking log's summary covers this many recent hours. */
+    TRACKING_SUMMARY_HOURS: 24,
+};
+
+/**
+ * Date ranges an admin listing and its analysis can be limited to, mapped to
+ * a number of days. `all` has no lower bound. Only these values reach SQL.
+ */
+const ADMIN_RANGE = {
+    DAY: '24h',
+    WEEK: '7d',
+    MONTH: '30d',
+    QUARTER: '90d',
+    YEAR: '1y',
+    ALL: 'all',
+};
+
+const ADMIN_RANGE_DAYS = {
+    [ADMIN_RANGE.DAY]: 1,
+    [ADMIN_RANGE.WEEK]: 7,
+    [ADMIN_RANGE.MONTH]: 30,
+    [ADMIN_RANGE.QUARTER]: 90,
+    [ADMIN_RANGE.YEAR]: 365,
+    [ADMIN_RANGE.ALL]: null,
+};
+
+/**
+ * Time-series bucket for the admin analysis, chosen from the span of the data
+ * actually in the filtered set, so a chart never has thousands of points.
+ */
+const TREND_BUCKET = {
+    HOUR: 'hour',
+    DAY: 'day',
+    WEEK: 'week',
+    MONTH: 'month',
+};
+
+/** Largest span, in days, charted per day and per week. */
+const TREND_BUCKET_MAX_DAYS = {
+    [TREND_BUCKET.HOUR]: 2,
+    [TREND_BUCKET.DAY]: 92,
+    [TREND_BUCKET.WEEK]: 731,
+};
+
+/** Rows per breakdown returned by the admin analysis; the rest is "other". */
+const ANALYSIS_TOP_N = 10;
+
+/** Bounds of the admin analysis beyond the breakdowns. */
+const ANALYSIS = {
+    /**
+     * A visit ends after this long without a page view, the common 30-minute
+     * convention. Visits are read from the rotating visitor hash, so they
+     * never link a visitor across days.
+     */
+    VISIT_GAP_SECONDS: 30 * 60,
+    /** Page-to-page steps listed in the page flow. */
+    TRANSITIONS_TOP_N: 15,
+    /** The time-of-day heatmap reads at most the last year of the range. */
+    HEATMAP_MAX_DAYS: 365,
+    /** Most recent custom events whose properties are tallied. */
+    EVENT_PROPERTIES_SAMPLE: 5000,
+    /** Property values listed across all custom events. */
+    EVENT_PROPERTIES_TOP_N: 30,
+    /** "Right now" means the last few minutes; the live chart covers half an hour. */
+    REALTIME_VISITOR_MINUTES: 5,
+    REALTIME_CHART_MINUTES: 30,
+};
+
+/** Which rows an admin listing returns. */
+const VIEW_STATUS = {
+    ACTIVE: 'active',
+    DELETED: 'deleted',
+    ALL: 'all',
+};
+
+/** Filter on whether an admin has edited a row's content. */
+const MODIFIED_FILTER = {
+    ANY: 'any',
+    MODIFIED: 'modified',
+    UNMODIFIED: 'unmodified',
+};
+
+const SORT_ORDER = {
+    ASC: 'asc',
+    DESC: 'desc',
+};
+
+/**
+ * Columns an admin listing may be sorted by, mapped from the API name to the
+ * column. Sorting interpolates the column, so only these values can reach SQL.
+ */
+const ADMIN_SORT_COLUMNS = {
+    timestamp: 'timestamp',
+    page: 'page_path',
+    country: 'country',
+    deviceSize: 'devicesize',
+    eventType: 'event_type',
+    source: 'source_type',
+    browser: 'browser',
+    os: 'os',
+    title: 'page_title',
+    hostname: 'hostname',
+    referrer: 'referrer_domain',
+    campaign: 'utm_campaign',
+    language: 'language',
+    engagedMs: 'engaged_ms',
+    modifiedAt: 'admin_modified_at',
+    deletedAt: 'deleted_at',
+};
+
+/**
+ * Content fields an admin may edit, mapped from the API name to the column.
+ *
+ * Deliberately excludes everything that records who or when: the masked IP,
+ * visitor hash, timestamp, country, and every User-Agent-derived field. An
+ * edit can correct what was viewed, never fabricate who viewed it or when.
+ * `referrerDomain` and `sourceType` are not editable directly; they are
+ * re-derived whenever `referrer` changes, so they can never disagree with it.
+ */
+const EDITABLE_FIELDS = {
+    pagePath: 'page_path',
+    pageTitle: 'page_title',
+    referrer: 'referrer',
+    deviceSize: 'devicesize',
+    eventType: 'event_type',
+    eventData: 'event_data',
+};
+
+/** Every entry in the admin operation log is one of these. */
+const ADMIN_ACTION = {
+    LOGIN_SUCCEEDED: 'login_succeeded',
+    LOGIN_FAILED: 'login_failed',
+    LOGOUT: 'logout',
+    VIEWS_EDITED: 'views_edited',
+    NOTE_SET: 'note_set',
+    NOTE_CLEARED: 'note_cleared',
+    VIEWS_DELETED: 'views_deleted',
+    VIEWS_RESTORED: 'views_restored',
+    VIEWS_PURGED: 'views_purged',
+    TRASH_AUTO_PURGED: 'trash_auto_purged',
+    VIEW_LOG_PRUNED: 'view_log_pruned',
+    /** The password entered again to allow a permanent erasure. */
+    PASSWORD_CONFIRMED: 'password_confirmed',
+};
+
+/**
+ * Machine-readable error codes returned by the admin API. The UI maps each one
+ * to a translated message, so no server-side English reaches the screen.
+ */
+const ADMIN_ERROR_CODE = {
+    UNAUTHENTICATED: 'UNAUTHENTICATED',
+    INVALID_PASSWORD: 'INVALID_PASSWORD',
+    TOO_MANY_ATTEMPTS: 'TOO_MANY_ATTEMPTS',
+    RATE_LIMITED: 'RATE_LIMITED',
+    CSRF_REJECTED: 'CSRF_REJECTED',
+    /** The action needs the password entered again (POST /reauth), then a retry. */
+    REAUTH_REQUIRED: 'REAUTH_REQUIRED',
+    VALIDATION_FAILED: 'VALIDATION_FAILED',
+    NOT_FOUND: 'NOT_FOUND',
+    SERVER_ERROR: 'SERVER_ERROR',
+};
+
+/** Which tracking endpoint a request came through. */
+const VIEW_LOG_SOURCE = {
+    REGISTER_VIEW: 'registerView',
+    EVENT: 'event',
+    /** Time on page and scroll depth for a view already recorded. */
+    ENGAGE: 'engage',
+};
+
+/** Service-owned tables. All carry the reserved `_` prefix. */
+const ADMIN_LOG_TABLE = '_admin_log';
+const ADMIN_SESSIONS_TABLE = '_admin_sessions';
+const VIEW_LOG_TABLE = '_view_log';
+/** Tracking requests that were not stored, counted per minute. */
+const TRACKING_REJECTIONS_TABLE = '_tracking_rejections';
+
+/** The tracking pipeline's own bounds. */
+const TRACKING = {
+    /** Longest visible time one page view may report. */
+    MAX_ENGAGED_MS: 6 * 60 * 60 * 1000,
+    /** Engagement is only accepted for a view recorded this recently. */
+    ENGAGE_WINDOW_HOURS: 24,
+    /** A beacon is a few dozen bytes; this bounds what is even parsed. */
+    ENGAGE_BODY_BYTES: 1024,
+    /** How often counted rejections are written to the database. */
+    REJECTION_FLUSH_MS: 15_000,
+    /**
+     * Distinct rejection keys kept with their app, detail, and hostname, per
+     * minute and per hour, however often the counts are written. Beyond these,
+     * a request is still counted, by minute, endpoint, and reason alone, so a
+     * flood of made-up values cannot grow memory or the table: at most a few
+     * thousand rows an hour, whatever arrives.
+     */
+    REJECTION_MAX_KEYS_PER_MINUTE: 100,
+    REJECTION_MAX_KEYS_PER_HOUR: 1000,
+    /** Rejections are only ever stored as per-minute counts. */
+    REJECTION_BUCKET_MS: 60 * 1000,
+};
+
+/** What happened to one tracking request, as the tracking log reports it. */
+const TRACKING_OUTCOME = {
+    /** Stored, and the first view of the page by this visitor in the window. */
+    RECORDED: 'recorded',
+    /** Stored, but the same visitor viewed it again within the window. */
+    REPEAT: 'repeat',
+    /** A crawler, preview fetcher, or headless browser; counted, not stored. */
+    BOT: 'bot',
+    /** Refused; the reason says why. */
+    REJECTED: 'rejected',
+};
+
+/** Why a tracking request was not stored. */
+const REJECTION_REASON = {
+    BOT: 'bot',
+    UNKNOWN_APP: 'unknown_app',
+    ORIGIN_NOT_ALLOWED: 'origin_not_allowed',
+    INVALID_REQUEST: 'invalid_request',
+    INVALID_IP: 'invalid_ip',
+    RATE_LIMITED: 'rate_limited',
+    /** Engagement for a view that does not exist, is trashed, or is too old. */
+    UNKNOWN_VIEW: 'unknown_view',
+    SERVER_ERROR: 'server_error',
+};
+
+/** Canonical UUID text form, any version. Admin row IDs are validated with it. */
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
 /** Recognised event types. `pageview` is the only one the server itself emits. */
 const EVENT_TYPE = {
     PAGEVIEW: 'pageview',
@@ -139,6 +445,8 @@ const SOURCE_TYPE = {
     EMAIL: 'email',
     CAMPAIGN: 'campaign',
     REFERRAL: 'referral',
+    /** From another page of the same site: a click within it, not a way in. */
+    INTERNAL: 'internal',
     UNKNOWN: 'unknown',
 };
 
@@ -171,7 +479,7 @@ const SCOPE_ALL = '*';
  * identifiers cannot be bound as parameters. Until now app IDs only ever came
  * from trusted local config; they can now arrive over HTTP from the admin API,
  * so the character set is restricted to what is unambiguously safe as an
- * identifier. This is the gate — not a nicety.
+ * identifier. This is the gate, not a nicety.
  *
  * Letters, digits, underscore, and hyphen only. A backtick is the sole
  * character that can terminate a quoted identifier, and none of these can;
@@ -180,7 +488,7 @@ const SCOPE_ALL = '*';
  */
 const APP_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
 
-/** Reserved prefix for the service's own tables (`_migrations`, `_apps`). */
+/** Reserved prefix for the service's own tables (`_migrations`, `_apps`, logs). */
 const RESERVED_TABLE_PREFIX = '_';
 
 /** Internal registry of dynamically provisioned apps. */
@@ -213,6 +521,29 @@ module.exports = {
     DATABASE,
     SERVER,
     PRIVACY,
+    ADMIN,
+    VIEW_STATUS,
+    ADMIN_RANGE,
+    ADMIN_RANGE_DAYS,
+    TREND_BUCKET,
+    TREND_BUCKET_MAX_DAYS,
+    ANALYSIS_TOP_N,
+    ANALYSIS,
+    MODIFIED_FILTER,
+    SORT_ORDER,
+    ADMIN_SORT_COLUMNS,
+    EDITABLE_FIELDS,
+    ADMIN_ACTION,
+    ADMIN_ERROR_CODE,
+    VIEW_LOG_SOURCE,
+    ADMIN_LOG_TABLE,
+    ADMIN_SESSIONS_TABLE,
+    VIEW_LOG_TABLE,
+    TRACKING_REJECTIONS_TABLE,
+    TRACKING,
+    TRACKING_OUTCOME,
+    REJECTION_REASON,
+    UUID_PATTERN,
     EVENT_TYPE,
     TREND_PERIOD,
     TREND_PERIODS,