@huloglobal/vendure-plugin-visitor-analytics 0.18.2 → 0.18.4

package/dist/visitor-tracking.controller.js

@@ -13,6 +13,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VisitorTrackingController = void 0;
+exports.drained = drained;
 const common_1 = require("@nestjs/common");
 const vendure_licence_sdk_1 = require("@huloglobal/vendure-licence-sdk");
 const core_1 = require("@vendure/core");
@@ -64,6 +65,14 @@ function requireAdmin(ctx, res, perms = [core_1.Permission.ReadCustomer]) {
     }
     return true;
 }
+/** Back-pressure for streamed responses: resolves on 'drain' or when the client goes away. */
+function drained(res) {
+    return new Promise(resolve => {
+        const done = () => { res.off('drain', done); res.off('close', done); resolve(); };
+        res.once('drain', done);
+        res.once('close', done);
+    });
+}
 function clampInt(raw, fallback, min, max) {
     const n = parseInt(String(raw !== null && raw !== void 0 ? raw : fallback), 10);
     if (isNaN(n))
@@ -106,7 +115,8 @@ function parseChannelId(raw) {
 function channelWhere(channelId, alias) {
     if (channelId == null)
         return { sql: '', params: [] };
-    const col = alias ? `${alias}.channelId` : 'channelId';
+    // Backticked: `channelId` is a quoted camelCase column on Postgres.
+    const col = alias ? `${alias}.\`channelId\`` : '`channelId`';
     return { sql: `AND ${col} = ?`, params: [channelId] };
 }
 const proxy_headers_1 = require("./proxy-headers");
@@ -140,6 +150,9 @@ let VisitorTrackingController = class VisitorTrackingController {
         this.licenceStore = new vendure_licence_sdk_1.LicenceStore((sql, params) => (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(sql, params));
         /** Buy-from-admin auto-install client. */
         this.purchaseClaim = null;
+        // ------------------------------------------------------------------
+        /** userId → customerId, cached 10 min (bounded). Null when the request carries no session user. */
+        this.customerByUser = new Map();
     }
     onApplicationBootstrap() {
         void this.purchaseClaimClient().resume();
@@ -293,14 +306,18 @@ let VisitorTrackingController = class VisitorTrackingController {
         }
         return this.purchaseClaim;
     }
-    async track(body, req, res) {
+    /** CORS preflight for the beacon (a JSON `fetch` from another origin sends one). */
+    trackPreflight(req, res) {
+        this.applyCors(req, res);
+        res.setHeader('Access-Control-Max-Age', '600');
+        return res.status(204).end();
+    }
+    async track(ctx, body, req, res) {
         var _a;
         // Lenient CORS — analytics ingestion must work cross-origin from
         // both storefronts (and dev hosts) without complex config.
         this.applyCors(req, res);
         (0, vendure_licence_sdk_1.applySecurityHeaders)(res);
-        if (req.method === 'OPTIONS')
-            return res.status(204).end();
         if (this.rateLimited(req, res, 'track'))
             return;
         // Tier-gate: unlicensed installs are capped at 100 events / UTC day.
@@ -361,7 +378,10 @@ let VisitorTrackingController = class VisitorTrackingController {
             issuedSession = true;
         }
         const channelId = clampInt(body === null || body === void 0 ? void 0 : body.channelId, 1, 1, 2147483647);
-        const customerId = (body === null || body === void 0 ? void 0 : body.customerId) != null ? Number(body.customerId) || null : null;
+        // The customer comes from the Vendure session, never from the body: an
+        // anonymous beacon used to be able to file events under any customer id.
+        // The body value is honoured only when it matches the session's customer.
+        const customerId = await this.resolveCustomerId(ctx);
         const events = Array.isArray(body === null || body === void 0 ? void 0 : body.events) ? body.events.slice(0, 50) : [];
         const ip = realIp(req);
         // Prefer the upstream proxy's resolved country / region (Cloudflare,
@@ -405,30 +425,30 @@ let VisitorTrackingController = class VisitorTrackingController {
         const days = Math.min(Math.max(parseInt(String(req.query.days || '30'), 10) || 30, 1), 365);
         const channelId = parseChannelId(req.query.channelId);
         const w = channelWhere(channelId);
-        const rows = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT DATE(createdAt) AS day,
-                    COUNT(DISTINCT visitorId) AS visitors,
-                    COUNT(DISTINCT sessionId) AS sessions,
+        const rows = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT DATE(\`createdAt\`) AS day,
+                    COUNT(DISTINCT \`visitorId\`) AS visitors,
+                    COUNT(DISTINCT \`sessionId\`) AS sessions,
                     COUNT(*) AS events,
                     SUM(CASE WHEN type='pageview' THEN 1 ELSE 0 END) AS pageviews
              FROM visitor_event
-             WHERE createdAt >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
-             GROUP BY DATE(createdAt)
+             WHERE \`createdAt\` >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
+             GROUP BY DATE(\`createdAt\`)
              ORDER BY day`, [days, ...w.params]);
-        const [{ totalVisitors, totalSessions, totalPageviews, avgTimeMs }] = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT COUNT(DISTINCT visitorId) AS totalVisitors,
-                    COUNT(DISTINCT sessionId) AS totalSessions,
-                    SUM(CASE WHEN type='pageview' THEN 1 ELSE 0 END)      AS totalPageviews,
-                    AVG(CASE WHEN type='unload' AND timeOnPageMs > 0 THEN timeOnPageMs END) AS avgTimeMs
+        const [{ totalVisitors, totalSessions, totalPageviews, avgTimeMs }] = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT COUNT(DISTINCT \`visitorId\`) AS \`totalVisitors\`,
+                    COUNT(DISTINCT \`sessionId\`) AS \`totalSessions\`,
+                    SUM(CASE WHEN type='pageview' THEN 1 ELSE 0 END)      AS \`totalPageviews\`,
+                    AVG(CASE WHEN type='unload' AND \`timeOnPageMs\` > 0 THEN \`timeOnPageMs\` END) AS \`avgTimeMs\`
              FROM visitor_event
-             WHERE createdAt >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}`, [days, ...w.params]);
+             WHERE \`createdAt\` >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}`, [days, ...w.params]);
         // Previous period of identical length, immediately prior —
         // powers the KPI delta chips ("+12% vs previous 30 days").
-        const [prev] = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT COUNT(DISTINCT visitorId) AS totalVisitors,
-                    COUNT(DISTINCT sessionId) AS totalSessions,
-                    SUM(CASE WHEN type='pageview' THEN 1 ELSE 0 END)      AS totalPageviews,
-                    AVG(CASE WHEN type='unload' AND timeOnPageMs > 0 THEN timeOnPageMs END) AS avgTimeMs
+        const [prev] = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT COUNT(DISTINCT \`visitorId\`) AS \`totalVisitors\`,
+                    COUNT(DISTINCT \`sessionId\`) AS \`totalSessions\`,
+                    SUM(CASE WHEN type='pageview' THEN 1 ELSE 0 END)      AS \`totalPageviews\`,
+                    AVG(CASE WHEN type='unload' AND \`timeOnPageMs\` > 0 THEN \`timeOnPageMs\` END) AS \`avgTimeMs\`
              FROM visitor_event
-             WHERE createdAt >= DATE_SUB(NOW(), INTERVAL ? DAY)
-               AND createdAt <  DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}`, [days * 2, days, ...w.params]);
+             WHERE \`createdAt\` >= DATE_SUB(NOW(), INTERVAL ? DAY)
+               AND \`createdAt\` <  DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}`, [days * 2, days, ...w.params]);
         return res.json({
             days, channelId,
             totals: {
@@ -464,33 +484,33 @@ let VisitorTrackingController = class VisitorTrackingController {
         const channelId = parseChannelId(req.query.channelId);
         const w = channelWhere(channelId);
         const rows = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT source, medium, COALESCE(MAX(campaign), '') AS campaign,
-                    COUNT(DISTINCT visitorId) AS visitors,
-                    COUNT(DISTINCT sessionId) AS sessions,
-                    SUM(reached_product) AS productViewers,
-                    SUM(reached_checkout) AS checkoutReached
+                    COUNT(DISTINCT \`visitorId\`) AS visitors,
+                    COUNT(DISTINCT \`sessionId\`) AS sessions,
+                    SUM(reached_product) AS \`productViewers\`,
+                    SUM(reached_checkout) AS \`checkoutReached\`
              FROM (
-                 SELECT visitorId, sessionId,
-                        COALESCE(utmSource, referrerDomain, '(direct)') AS source,
-                        COALESCE(utmMedium, IF(referrerDomain IS NOT NULL, 'referral', 'none')) AS medium,
-                        utmCampaign AS campaign,
+                 SELECT \`visitorId\`, \`sessionId\`,
+                        COALESCE(\`utmSource\`, \`referrerDomain\`, '(direct)') AS source,
+                        COALESCE(\`utmMedium\`, IF(\`referrerDomain\` IS NOT NULL, 'referral', 'none')) AS medium,
+                        \`utmCampaign\` AS campaign,
                         MAX(CASE WHEN url LIKE '/products/%' AND type='pageview' THEN 1 ELSE 0 END) AS reached_product,
                         MAX(CASE WHEN (url LIKE '%/checkout%' OR url LIKE '%cart%') AND type='pageview' THEN 1 ELSE 0 END) AS reached_checkout
                  FROM visitor_event
-                 WHERE createdAt >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
-                   GROUP BY visitorId, sessionId,
-                          COALESCE(utmSource, referrerDomain, '(direct)'),
-                          COALESCE(utmMedium, IF(referrerDomain IS NOT NULL, 'referral', 'none')),
-                          utmCampaign
+                 WHERE \`createdAt\` >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
+                   GROUP BY \`visitorId\`, \`sessionId\`,
+                          COALESCE(\`utmSource\`, \`referrerDomain\`, '(direct)'),
+                          COALESCE(\`utmMedium\`, IF(\`referrerDomain\` IS NOT NULL, 'referral', 'none')),
+                          \`utmCampaign\`
              ) by_session
              GROUP BY source, medium
              ORDER BY visitors DESC
              LIMIT ? OFFSET ?`, [days, ...w.params, take, skip]);
         const [{ total }] = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT COUNT(*) AS total FROM (
                 SELECT DISTINCT
-                    COALESCE(utmSource, referrerDomain, '(direct)') AS source,
-                    COALESCE(utmMedium, IF(referrerDomain IS NOT NULL, 'referral', 'none')) AS medium
+                    COALESCE(\`utmSource\`, \`referrerDomain\`, '(direct)') AS source,
+                    COALESCE(\`utmMedium\`, IF(\`referrerDomain\` IS NOT NULL, 'referral', 'none')) AS medium
                 FROM visitor_event
-                WHERE createdAt >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
+                WHERE \`createdAt\` >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
                    ) sources`, [days, ...w.params]);
         return res.json({
             sources: rows.map((r) => ({
@@ -517,16 +537,16 @@ let VisitorTrackingController = class VisitorTrackingController {
         const rows = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT url,
                     MAX(title)               AS title,
                     COUNT(*)                 AS views,
-                    COUNT(DISTINCT visitorId) AS uniqueVisitors,
-                    AVG(NULLIF(timeOnPageMs, 0)) AS avgTimeMs
+                    COUNT(DISTINCT \`visitorId\`) AS \`uniqueVisitors\`,
+                    AVG(NULLIF(\`timeOnPageMs\`, 0)) AS \`avgTimeMs\`
              FROM visitor_event
-             WHERE createdAt >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
+             WHERE \`createdAt\` >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
                    AND type IN ('pageview', 'unload')
              GROUP BY url
              ORDER BY views DESC
              LIMIT ? OFFSET ?`, [days, ...w.params, take, skip]);
         const [{ total }] = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT COUNT(DISTINCT url) AS total FROM visitor_event
-             WHERE createdAt >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
+             WHERE \`createdAt\` >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
                    AND type IN ('pageview', 'unload')`, [days, ...w.params]);
         return res.json({
             pages: rows.map((r) => ({
@@ -553,8 +573,8 @@ let VisitorTrackingController = class VisitorTrackingController {
         ];
         const result = [];
         for (const s of stages) {
-            const [{ n }] = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT COUNT(DISTINCT visitorId) AS n FROM visitor_event
-                 WHERE createdAt >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
+            const [{ n }] = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT COUNT(DISTINCT \`visitorId\`) AS n FROM visitor_event
+                 WHERE \`createdAt\` >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
                    AND type='pageview' AND (${s.where})`, [days, ...w.params]);
             result.push({ key: s.key, label: s.label, visitors: Number(n) || 0 });
         }
@@ -574,10 +594,10 @@ let VisitorTrackingController = class VisitorTrackingController {
                     MAX(title) AS title,
                     COUNT(*)   AS exits
              FROM (
-                 SELECT sessionId, url, title, createdAt,
-                        ROW_NUMBER() OVER (PARTITION BY sessionId ORDER BY createdAt DESC) AS rn
+                 SELECT \`sessionId\`, url, title, \`createdAt\`,
+                        ROW_NUMBER() OVER (PARTITION BY \`sessionId\` ORDER BY \`createdAt\` DESC) AS rn
                  FROM visitor_event
-                 WHERE createdAt >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
+                 WHERE \`createdAt\` >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
                    AND type='pageview'
              ) last_pages
              WHERE rn = 1
@@ -585,10 +605,10 @@ let VisitorTrackingController = class VisitorTrackingController {
              ORDER BY exits DESC
              LIMIT ? OFFSET ?`, [days, ...w.params, take, skip]);
         const [{ total }] = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT COUNT(DISTINCT url) AS total FROM (
-                SELECT sessionId, url,
-                       ROW_NUMBER() OVER (PARTITION BY sessionId ORDER BY createdAt DESC) AS rn
+                SELECT \`sessionId\`, url,
+                       ROW_NUMBER() OVER (PARTITION BY \`sessionId\` ORDER BY \`createdAt\` DESC) AS rn
                 FROM visitor_event
-                WHERE createdAt >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
+                WHERE \`createdAt\` >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
                    AND type='pageview'
              ) lp WHERE rn = 1`, [days, ...w.params]);
         return res.json({
@@ -611,16 +631,16 @@ let VisitorTrackingController = class VisitorTrackingController {
         const w = channelWhere(channelId);
         const rows = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT type,
                     COUNT(*) AS count,
-                    COUNT(DISTINCT visitorId) AS uniqueVisitors,
-                    COUNT(DISTINCT sessionId) AS sessions
+                    COUNT(DISTINCT \`visitorId\`) AS \`uniqueVisitors\`,
+                    COUNT(DISTINCT \`sessionId\`) AS sessions
              FROM visitor_event
-             WHERE createdAt >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
+             WHERE \`createdAt\` >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
                    AND type NOT IN ('pageview', 'unload')
              GROUP BY type
              ORDER BY count DESC
              LIMIT ? OFFSET ?`, [days, ...w.params, take, skip]);
         const [{ total }] = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT COUNT(DISTINCT type) AS total FROM visitor_event
-             WHERE createdAt >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
+             WHERE \`createdAt\` >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
                    AND type NOT IN ('pageview', 'unload')`, [days, ...w.params]);
         return res.json({
             events: rows.map((r) => ({
@@ -672,9 +692,9 @@ let VisitorTrackingController = class VisitorTrackingController {
         const days = clampInt(req.query.days, 30, 1, 365);
         const channelId = parseChannelId(req.query.channelId);
         const w = channelWhere(channelId);
-        const grouped = (col) => (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT ${col} AS label, COUNT(DISTINCT visitorId) AS visitors
+        const grouped = (col) => (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT ${col} AS label, COUNT(DISTINCT \`visitorId\`) AS visitors
              FROM visitor_event
-             WHERE createdAt >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
+             WHERE \`createdAt\` >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
                AND ${col} IS NOT NULL AND ${col} <> ''
              GROUP BY ${col}
              ORDER BY visitors DESC
@@ -706,18 +726,28 @@ let VisitorTrackingController = class VisitorTrackingController {
         res.setHeader('Connection', 'keep-alive');
         res.setHeader('X-Accel-Buffering', 'no'); // disable nginx buffering
         (_a = res.flushHeaders) === null || _a === void 0 ? void 0 : _a.call(res);
+        // One query in flight at a time: a slow tick used to pile up behind
+        // itself every 5 s. A `: keepalive` comment every 15 s keeps proxies
+        // from closing an idle stream between data frames.
+        let inFlight = false;
+        let closed = false;
         const tick = async () => {
+            if (inFlight || closed)
+                return;
+            inFlight = true;
             try {
-                const rows = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT visitorId,
+                const rows = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT \`visitorId\`,
                             MAX(url) AS url,
                             MAX(country) AS country,
-                            TIMESTAMPDIFF(SECOND, MAX(createdAt), NOW()) AS secondsAgo
+                            TIMESTAMPDIFF(SECOND, MAX(\`createdAt\`), NOW()) AS \`secondsAgo\`
                      FROM visitor_event
-                     WHERE createdAt >= DATE_SUB(NOW(), INTERVAL 5 MINUTE) ${w.sql}
+                     WHERE \`createdAt\` >= DATE_SUB(NOW(), INTERVAL 5 MINUTE) ${w.sql}
                        AND type = 'pageview'
-                     GROUP BY visitorId
-                     ORDER BY MAX(createdAt) DESC
+                     GROUP BY \`visitorId\`
+                     ORDER BY MAX(\`createdAt\`) DESC
                      LIMIT 20`, [...w.params]);
+                if (closed)
+                    return;
                 const payload = {
                     ts: new Date().toISOString(),
                     activeCount: rows.length,
@@ -735,12 +765,18 @@ let VisitorTrackingController = class VisitorTrackingController {
                 // tick will retry. SSE clients reconnect automatically
                 // if the connection drops.
             }
+            finally {
+                inFlight = false;
+            }
         };
         // Fire immediately, then every 5s. Stop when the client disconnects.
         await tick();
         const interval = setInterval(() => { tick().catch(() => undefined); }, 5000);
-        req.on('close', () => clearInterval(interval));
-        req.on('end', () => clearInterval(interval));
+        const keepalive = setInterval(() => { if (!closed)
+            res.write(': keepalive\n\n'); }, 15000);
+        const stop = () => { closed = true; clearInterval(interval); clearInterval(keepalive); };
+        req.on('close', stop);
+        req.on('end', stop);
     }
     /** Journey timeline for one visitor — every event in order. */
     async journey(ctx, visitorId, res) {
@@ -763,11 +799,11 @@ let VisitorTrackingController = class VisitorTrackingController {
         const skip = clampInt(req.query.skip, 0, 0, 1000000);
         const channelId = parseChannelId(req.query.channelId);
         const w = channelWhere(channelId);
-        const rows = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT visitorId,
-                    MAX(customerId)            AS customerId,
-                    MIN(createdAt)             AS firstSeenAt,
-                    MAX(createdAt)             AS lastSeenAt,
-                    COUNT(DISTINCT sessionId)  AS sessions,
+        const rows = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT \`visitorId\`,
+                    MAX(\`customerId\`)            AS \`customerId\`,
+                    MIN(\`createdAt\`)             AS \`firstSeenAt\`,
+                    MAX(\`createdAt\`)             AS \`lastSeenAt\`,
+                    COUNT(DISTINCT \`sessionId\`)  AS sessions,
                     SUM(CASE WHEN type='pageview' THEN 1 ELSE 0 END)       AS pageviews,
                     MAX(country)               AS country,
                     MAX(city)                  AS city,
@@ -775,12 +811,12 @@ let VisitorTrackingController = class VisitorTrackingController {
                     MAX(os)                    AS os,
                     MAX(device)                AS device
              FROM visitor_event
-             WHERE createdAt >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
-                   GROUP BY visitorId
-             ORDER BY MAX(createdAt) DESC
+             WHERE \`createdAt\` >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
+                   GROUP BY \`visitorId\`
+             ORDER BY MAX(\`createdAt\`) DESC
              LIMIT ? OFFSET ?`, [days, ...w.params, take, skip]);
-        const [{ total }] = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT COUNT(DISTINCT visitorId) AS total
-             FROM visitor_event WHERE createdAt >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
+        const [{ total }] = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT COUNT(DISTINCT \`visitorId\`) AS total
+             FROM visitor_event WHERE \`createdAt\` >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
                    `, [days, ...w.params]);
         return res.json({
             visitors: rows.map((r) => ({
@@ -808,49 +844,49 @@ let VisitorTrackingController = class VisitorTrackingController {
             return;
         const visitorId = String(visitorIdRaw).slice(0, 64);
         // One row with the latest non-null value of every column.
-        const [latest] = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT visitorId,
-                    MAX(customerId)         AS customerId,
-                    MIN(createdAt)          AS firstSeenAt,
-                    MAX(createdAt)          AS lastSeenAt,
-                    COUNT(DISTINCT sessionId) AS totalSessions,
-                    SUM(CASE WHEN type='pageview' THEN 1 ELSE 0 END)    AS totalPageviews,
-                    SUM(CASE WHEN type='unload' THEN 1 ELSE 0 END)      AS totalUnloads,
-                    SUM(CASE WHEN type='event' THEN 1 ELSE 0 END)       AS totalEvents,
-                    SUM(timeOnPageMs)       AS totalTimeMs,
+        const [latest] = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT \`visitorId\`,
+                    MAX(\`customerId\`)         AS \`customerId\`,
+                    MIN(\`createdAt\`)          AS \`firstSeenAt\`,
+                    MAX(\`createdAt\`)          AS \`lastSeenAt\`,
+                    COUNT(DISTINCT \`sessionId\`) AS \`totalSessions\`,
+                    SUM(CASE WHEN type='pageview' THEN 1 ELSE 0 END)    AS \`totalPageviews\`,
+                    SUM(CASE WHEN type='unload' THEN 1 ELSE 0 END)      AS \`totalUnloads\`,
+                    SUM(CASE WHEN type='event' THEN 1 ELSE 0 END)       AS \`totalEvents\`,
+                    SUM(\`timeOnPageMs\`)       AS \`totalTimeMs\`,
                     MAX(ip)                 AS ip,
-                    MAX(ipHash)             AS ipHash,
-                    MAX(userAgent)          AS userAgent,
+                    MAX(\`ipHash\`)             AS \`ipHash\`,
+                    MAX(\`userAgent\`)          AS \`userAgent\`,
                     MAX(browser)            AS browser,
-                    MAX(browserVersion)     AS browserVersion,
+                    MAX(\`browserVersion\`)     AS \`browserVersion\`,
                     MAX(os)                 AS os,
-                    MAX(osVersion)          AS osVersion,
+                    MAX(\`osVersion\`)          AS \`osVersion\`,
                     MAX(device)             AS device,
-                    MAX(acceptLanguage)     AS acceptLanguage,
+                    MAX(\`acceptLanguage\`)     AS \`acceptLanguage\`,
                     MAX(country)            AS country,
                     MAX(region)             AS region,
                     MAX(city)               AS city,
                     MAX(timezone)           AS timezone,
-                    MAX(channelId)          AS channelId
+                    MAX(\`channelId\`)          AS \`channelId\`
              FROM visitor_event
-             WHERE visitorId = ?
-             GROUP BY visitorId`, [visitorId]);
+             WHERE \`visitorId\` = ?
+             GROUP BY \`visitorId\``, [visitorId]);
         if (!latest)
             return res.status(404).json({ error: 'visitor not found' });
-        const sessions = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT sessionId,
-                    MIN(createdAt) AS startedAt,
-                    MAX(createdAt) AS endedAt,
+        const sessions = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT \`sessionId\`,
+                    MIN(\`createdAt\`) AS \`startedAt\`,
+                    MAX(\`createdAt\`) AS \`endedAt\`,
                     COUNT(*)       AS events,
                     SUM(CASE WHEN type='pageview' THEN 1 ELSE 0 END) AS pageviews,
-                    SUM(timeOnPageMs)    AS timeMs,
-                    MIN(CASE WHEN type='pageview' THEN url END) AS entryUrl
+                    SUM(\`timeOnPageMs\`)    AS \`timeMs\`,
+                    MIN(CASE WHEN type='pageview' THEN url END) AS \`entryUrl\`
              FROM visitor_event
-             WHERE visitorId = ?
-             GROUP BY sessionId
-             ORDER BY MIN(createdAt) DESC
+             WHERE \`visitorId\` = ?
+             GROUP BY \`sessionId\`
+             ORDER BY MIN(\`createdAt\`) DESC
              LIMIT 50`, [visitorId]);
         let customer = null;
         if (latest.customerId) {
-            const [c] = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT id, firstName, lastName, emailAddress
+            const [c] = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT id, \`firstName\`, \`lastName\`, \`emailAddress\`
                  FROM customer WHERE id = ? LIMIT 1`, [Number(latest.customerId)]);
             customer = c || null;
         }
@@ -894,19 +930,42 @@ let VisitorTrackingController = class VisitorTrackingController {
             })),
         });
     }
-    // ------------------------------------------------------------------
+    async resolveCustomerId(ctx) {
+        var _a;
+        const userId = ctx === null || ctx === void 0 ? void 0 : ctx.activeUserId;
+        if (!userId)
+            return null;
+        const key = String(userId);
+        const now = Date.now();
+        const hit = this.customerByUser.get(key);
+        if (hit && hit.exp > now)
+            return hit.id;
+        let id = null;
+        try {
+            const rows = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT id FROM customer WHERE \`userId\` = ? AND \`deletedAt\` IS NULL LIMIT 1`, [userId]);
+            id = ((_a = rows === null || rows === void 0 ? void 0 : rows[0]) === null || _a === void 0 ? void 0 : _a.id) != null ? Number(rows[0].id) || null : null;
+        }
+        catch {
+            id = null;
+        }
+        if (this.customerByUser.size > 5000)
+            this.customerByUser.clear();
+        this.customerByUser.set(key, { id, exp: now + 10 * 60000 });
+        return id;
+    }
     applyCors(req, res) {
         const origin = String(req.headers.origin || '');
         const allowList = (0, plugin_1.getOptions)().corsAllowedOrigins || [];
-        // When an allowlist is configured we reflect only matching
-        // origins; otherwise we reflect any (legacy behaviour, looser).
-        let allow = origin || '*';
-        if (allowList.length) {
-            allow = allowList.includes(origin) ? origin : 'null';
-        }
-        res.setHeader('Access-Control-Allow-Origin', allow);
+        // When an allowlist is configured we reflect only matching origins;
+        // otherwise we reflect any (legacy behaviour, looser). A disallowed
+        // origin gets NO Allow-Origin header — `null` is itself a valid
+        // origin value (sandboxed iframes, file://) and would let it through.
         res.setHeader('Vary', 'Origin');
-        res.setHeader('Access-Control-Allow-Credentials', 'true');
+        if (allowList.length && !allowList.includes(origin))
+            return;
+        res.setHeader('Access-Control-Allow-Origin', origin || '*');
+        if (origin)
+            res.setHeader('Access-Control-Allow-Credentials', 'true');
         res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
         res.setHeader('Access-Control-Allow-Headers', 'content-type');
     }
@@ -1027,15 +1086,15 @@ let VisitorTrackingController = class VisitorTrackingController {
             return;
         const days = Math.min(Math.max(parseInt(String(req.query.days || '30'), 10) || 30, 1), 365);
         const channelId = parseInt(String(req.query.channelId || '1'), 10) || 1;
-        const rows = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT g.id, g.name, g.urlPattern, g.valueMinor, g.enabled,
-                    COUNT(DISTINCT v.visitorId) AS uniqueVisitors,
+        const rows = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT g.id, g.name, g.\`urlPattern\`, g.\`valueMinor\`, g.enabled,
+                    COUNT(DISTINCT v.\`visitorId\`) AS \`uniqueVisitors\`,
                     COUNT(v.id) AS completions
              FROM conversion_goal g
              LEFT JOIN visitor_event v
-                ON v.goalId = g.id
-               AND v.createdAt >= DATE_SUB(NOW(), INTERVAL ? DAY)
-               AND v.isBot = 0
-             WHERE g.channelId = ?
+                ON v.\`goalId\` = g.id
+               AND v.\`createdAt\` >= DATE_SUB(NOW(), INTERVAL ? DAY)
+               AND v.\`isBot\` = FALSE
+             WHERE g.\`channelId\` = ?
              GROUP BY g.id`, [days, channelId]);
         return res.json({ days, channelId, goals: rows.map((r) => ({
                 ...r,
@@ -1052,14 +1111,6 @@ let VisitorTrackingController = class VisitorTrackingController {
         const days = Math.min(Math.max(parseInt(String(req.query.days || '7'), 10) || 7, 1), 90);
         const channelId = parseChannelId(req.query.channelId);
         const w = channelWhere(channelId);
-        const rows = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT createdAt, visitorId, sessionId, customerId, channelId,
-                    type, url, title, referrerDomain,
-                    country, region, city, browser, os, device,
-                    isBot, goalId, utmSource, utmMedium, utmCampaign
-             FROM visitor_event
-             WHERE createdAt >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
-                   ORDER BY createdAt DESC
-             LIMIT 200000`, [days, ...w.params]);
         res.setHeader('Content-Type', 'text/csv; charset=utf-8');
         res.setHeader('Content-Disposition', `attachment; filename="visitors-${new Date().toISOString().slice(0, 10)}.csv"`);
         const esc = (v) => {
@@ -1072,15 +1123,40 @@ let VisitorTrackingController = class VisitorTrackingController {
             return /[",\n]/.test(s) ? `"${s}"` : s;
         };
         res.write('createdAt,visitorId,sessionId,customerId,channelId,type,url,title,referrerDomain,country,region,city,browser,os,device,isBot,goalId,utmSource,utmMedium,utmCampaign\n');
-        for (const r of rows) {
-            res.write([
-                esc(r.createdAt instanceof Date ? r.createdAt.toISOString() : r.createdAt),
-                esc(r.visitorId), esc(r.sessionId), esc(r.customerId), esc(r.channelId),
-                esc(r.type), esc(r.url), esc(r.title), esc(r.referrerDomain),
-                esc(r.country), esc(r.region), esc(r.city), esc(r.browser), esc(r.os), esc(r.device),
-                esc(r.isBot), esc(r.goalId),
-                esc(r.utmSource), esc(r.utmMedium), esc(r.utmCampaign),
-            ].join(',') + '\n');
+        // Streamed in id-ordered chunks: the export used to materialise up to
+        // 200 000 rows before writing the first byte.
+        const CHUNK = 5000;
+        const MAX_ROWS = 200000;
+        let lastId = 0;
+        let written = 0;
+        while (written < MAX_ROWS) {
+            const rows = await (0, vendure_licence_sdk_1.adapterFor)(this.connection.rawConnection).query(`SELECT id, \`createdAt\`, \`visitorId\`, \`sessionId\`, \`customerId\`, \`channelId\`,
+                        type, url, title, \`referrerDomain\`,
+                        country, region, city, browser, os, device,
+                        \`isBot\`, \`goalId\`, \`utmSource\`, \`utmMedium\`, \`utmCampaign\`
+                 FROM visitor_event
+                 WHERE id > ? AND \`createdAt\` >= DATE_SUB(NOW(), INTERVAL ? DAY) ${w.sql}
+                 ORDER BY id
+                 LIMIT ?`, [lastId, days, ...w.params, Math.min(CHUNK, MAX_ROWS - written)]);
+            if (!rows.length)
+                break;
+            let out = '';
+            for (const r of rows) {
+                out += [
+                    esc(r.createdAt instanceof Date ? r.createdAt.toISOString() : r.createdAt),
+                    esc(r.visitorId), esc(r.sessionId), esc(r.customerId), esc(r.channelId),
+                    esc(r.type), esc(r.url), esc(r.title), esc(r.referrerDomain),
+                    esc(r.country), esc(r.region), esc(r.city), esc(r.browser), esc(r.os), esc(r.device),
+                    esc(r.isBot === true ? 1 : r.isBot === false ? 0 : r.isBot), esc(r.goalId),
+                    esc(r.utmSource), esc(r.utmMedium), esc(r.utmCampaign),
+                ].join(',') + '\n';
+            }
+            lastId = Number(rows[rows.length - 1].id);
+            written += rows.length;
+            if (!res.write(out))
+                await drained(res);
+            if (res.destroyed || res.writableEnded)
+                return;
         }
         return res.end();
     }
@@ -1146,13 +1222,22 @@ __decorate([
     __metadata("design:paramtypes", [core_1.RequestContext, Object]),
     __metadata("design:returntype", Promise)
 ], VisitorTrackingController.prototype, "licencePortalLink", null);
+__decorate([
+    (0, common_1.Options)('track'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", void 0)
+], VisitorTrackingController.prototype, "trackPreflight", null);
 __decorate([
     (0, common_1.Post)('track'),
-    __param(0, (0, common_1.Body)()),
-    __param(1, (0, common_1.Req)()),
-    __param(2, (0, common_1.Res)()),
+    __param(0, (0, core_1.Ctx)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Req)()),
+    __param(3, (0, common_1.Res)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, Object, Object]),
+    __metadata("design:paramtypes", [core_1.RequestContext, Object, Object, Object]),
     __metadata("design:returntype", Promise)
 ], VisitorTrackingController.prototype, "track", null);
 __decorate([