@iann29/rastro 0.1.0-alpha.5 → 0.1.0-alpha.7

package/src/component/http.ts

@@ -19,18 +19,23 @@ import {
   resolveGeoIp,
 } from "./geo.js";
 import { isPlainRecord } from "./guards.js";
-import { sanitizeEvent } from "./sanitize.js";
+import { alignClock, sanitizeEvent } from "./sanitize.js";
 import { deriveVisitorKey, randomSecret } from "./identity.js";
 import { classifyClient, isKnownBot } from "./useragent.js";
 import type { TrackerEvent } from "./validators.js";
 import {
   TRACKER_GZIP_BASE64,
   TRACKER_GZIP_BYTES,
+  VITALS_GZIP_BASE64,
+  VITALS_GZIP_BYTES,
 } from "../tracker/generated.js";
 
 const TRACKER_GZIP = Uint8Array.from(atob(TRACKER_GZIP_BASE64), (character) =>
   character.charCodeAt(0),
 );
+const VITALS_GZIP = Uint8Array.from(atob(VITALS_GZIP_BASE64), (character) =>
+  character.charCodeAt(0),
+);
 
 const http = httpRouter();
 
@@ -57,7 +62,7 @@ http.route({
       );
     }
 
-    let payload: { siteId: string; events: TrackerEvent[] };
+    let payload: { siteId: string; events: TrackerEvent[]; sentAt?: number };
     try {
       const bytes = await readLimitedBody(request, MAX_BATCH_BYTES);
       const parsed: unknown = JSON.parse(new TextDecoder().decode(bytes));
@@ -82,6 +87,12 @@ http.route({
         headers,
       );
     }
+    // The sender's clock says when its events happened, but a clock minutes
+    // off would keep the visitor out of the live view and file the traffic
+    // under another hour. The batch also says when it was sent, and that offset
+    // re-anchors every event here, before the transaction and the geo
+    // enrichment read them, so both see the same timestamps.
+    const events = alignClock(payload.events, payload.sentAt, Date.now());
 
     const trustProxy = env.RASTRO_TRUST_PROXY === "true";
     const metadata = await readRequestMetadata(ctx);
@@ -94,14 +105,14 @@ http.route({
     // counter shape the tracker expects and names the reason in a header.
     if (isKnownBot(userAgent)) {
       return json(
-        { accepted: 0, duplicates: 0, rejected: payload.events.length },
+        { accepted: 0, duplicates: 0, rejected: events.length },
         200,
         { ...headers, "X-Rastro-Rejected": "bot" },
       );
     }
     // Anonymous batches (visitorId === sessionId) get a salted daily key so
     // repeat visits count once; the IP itself stops here.
-    const anonymous = payload.events.some(
+    const anonymous = events.some(
       (event) => event.visitorId === event.sessionId,
     );
     const visitorKey =
@@ -124,7 +135,7 @@ http.route({
       const result = await ctx.runMutation(api.ingest.ingestBatch, {
         siteId: payload.siteId as Id<"sites">,
         origin,
-        events: payload.events,
+        events,
         context,
       });
       if (
@@ -133,18 +144,15 @@ http.route({
         geoIpStatus(env.RASTRO_GEOIP_PROVIDER, env.RASTRO_GEOIP_TOKEN) ===
           "ready"
       ) {
-        const events = enrichmentCandidateEvents(payload.events);
-        if (events) {
+        const candidates = enrichmentCandidateEvents(events);
+        if (candidates) {
           let stage: GeoIpFailureStage = "claim";
           try {
-            const claim = await ctx.runMutation(
-              internal.geo.claimEnrichment,
-              {
-                siteId: payload.siteId as Id<"sites">,
-                events,
-                dailyLimit: geoIpDailyLimit(env.RASTRO_GEOIP_DAILY_LIMIT),
-              },
-            );
+            const claim = await ctx.runMutation(internal.geo.claimEnrichment, {
+              siteId: payload.siteId as Id<"sites">,
+              events: candidates,
+              dailyLimit: geoIpDailyLimit(env.RASTRO_GEOIP_DAILY_LIMIT),
+            });
             if (claim.sessionIds.length > 0) {
               stage = "resolve";
               const providerGeo = await resolveGeoIp(
@@ -161,19 +169,11 @@ http.route({
                   context: providerGeo,
                 });
               } else {
-                logGeoIpFailure(
-                  requestId,
-                  stage,
-                  env.RASTRO_GEOIP_PROVIDER!,
-                );
+                logGeoIpFailure(requestId, stage, env.RASTRO_GEOIP_PROVIDER!);
               }
             }
           } catch {
-            logGeoIpFailure(
-              requestId,
-              stage,
-              env.RASTRO_GEOIP_PROVIDER!,
-            );
+            logGeoIpFailure(requestId, stage, env.RASTRO_GEOIP_PROVIDER!);
           }
         }
       }
@@ -193,9 +193,7 @@ http.route({
           status === 429
             ? {
                 ...headers,
-                "Retry-After": String(
-                  Math.ceil(RATE_LIMIT_WINDOW_MS / 1_000),
-                ),
+                "Retry-After": String(Math.ceil(RATE_LIMIT_WINDOW_MS / 1_000)),
               }
             : headers,
         );
@@ -245,6 +243,24 @@ http.route({
   }),
 });
 
+http.route({
+  path: "/vitals.js",
+  method: "GET",
+  handler: httpAction(async () => {
+    return new Response(VITALS_GZIP, {
+      status: 200,
+      headers: {
+        "Content-Type": "text/javascript; charset=utf-8",
+        "Content-Encoding": "gzip",
+        "Content-Length": String(VITALS_GZIP_BYTES),
+        "Cache-Control": "public, max-age=300, stale-while-revalidate=86400",
+        "Access-Control-Allow-Origin": "*",
+        Vary: "Accept-Encoding",
+      },
+    });
+  }),
+});
+
 http.route({
   path: "/health",
   method: "GET",
@@ -271,14 +287,17 @@ http.route({
           trustedProxy: trustProxy,
           proxyRequestTrusted,
           edgeHeadersAvailable:
-            proxyRequestTrusted && Object.keys(geoFromHeaders(request)).length > 0,
+            proxyRequestTrusted &&
+            Object.keys(geoFromHeaders(request)).length > 0,
         },
         features: {
           botDetection: "userAgent",
           uniqueVisitors:
-            clientIp.ip && (metadata.userAgent ?? request.headers.get("user-agent"))
+            clientIp.ip &&
+            (metadata.userAgent ?? request.headers.get("user-agent"))
               ? "dailyHash"
               : "session",
+          webVitals: "optIn",
         },
       },
       200,
@@ -293,6 +312,7 @@ http.route({
 function parsePayload(value: unknown): {
   siteId: string;
   events: TrackerEvent[];
+  sentAt?: number;
 } {
   if (
     !isPlainRecord(value) ||
@@ -301,7 +321,12 @@ function parsePayload(value: unknown): {
   ) {
     throw new Error("body must contain siteId and events");
   }
-  return { siteId: value.siteId, events: value.events.map(parseEvent) };
+  const sentAt = optionalNumber(value.sentAt, "sentAt");
+  return {
+    siteId: value.siteId,
+    events: value.events.map(parseEvent),
+    ...(sentAt === undefined ? {} : { sentAt }),
+  };
 }
 
 class PayloadTooLargeError extends Error {}
@@ -342,7 +367,8 @@ function parseEvent(value: unknown): TrackerEvent {
     type !== "custom" &&
     type !== "conversion" &&
     type !== "heartbeat" &&
-    type !== "outbound"
+    type !== "outbound" &&
+    type !== "vital"
   ) {
     throw new Error("event type is invalid");
   }
@@ -387,6 +413,9 @@ function parseEvent(value: unknown): TrackerEvent {
     ...(optionalString(value.affiliateSlug, "affiliateSlug") !== undefined
       ? { affiliateSlug: optionalString(value.affiliateSlug, "affiliateSlug") }
       : {}),
+    ...(optionalNumber(value.value, "value") !== undefined
+      ? { value: optionalNumber(value.value, "value") }
+      : {}),
   };
 }
 
@@ -480,9 +509,7 @@ function geoFromHeaders(request: Request): {
   return {
     ...(country ? { country } : {}),
     ...(city ? { city } : {}),
-    ...(validCoordinates(latitude, longitude)
-      ? { latitude, longitude }
-      : {}),
+    ...(validCoordinates(latitude, longitude) ? { latitude, longitude } : {}),
   };
 }
 
@@ -497,12 +524,14 @@ function validCoordinates(
   latitude: number | undefined,
   longitude: number | undefined,
 ): latitude is number {
-  return latitude !== undefined &&
+  return (
+    latitude !== undefined &&
     longitude !== undefined &&
     latitude >= -90 &&
     latitude <= 90 &&
     longitude >= -180 &&
-    longitude <= 180;
+    longitude <= 180
+  );
 }
 
 function firstHeader(request: Request, names: string[]): string | undefined {
@@ -532,13 +561,15 @@ function decodeHeader(value: string | undefined): string | undefined {
 type GeoIpFailureStage = "claim" | "resolve" | "apply";
 
 function logInternalHttpError(requestId: string): void {
-  console.error(JSON.stringify({
-    level: "error",
-    event: "rastro.http.internal_error",
-    requestId,
-    route: "/events",
-    method: "POST",
-  }));
+  console.error(
+    JSON.stringify({
+      level: "error",
+      event: "rastro.http.internal_error",
+      requestId,
+      route: "/events",
+      method: "POST",
+    }),
+  );
 }
 
 function logGeoIpFailure(
@@ -546,21 +577,26 @@ function logGeoIpFailure(
   stage: GeoIpFailureStage,
   provider: "ipinfo" | "ipwhois",
 ): void {
-  console.warn(JSON.stringify({
-    level: "warn",
-    event: "rastro.geoip.failure",
-    requestId,
-    route: "/events",
-    stage,
-    provider,
-  }));
+  console.warn(
+    JSON.stringify({
+      level: "warn",
+      event: "rastro.geoip.failure",
+      requestId,
+      route: "/events",
+      stage,
+      provider,
+    }),
+  );
 }
 
 function requestIdHeaders(requestId: string): Record<string, string> {
   return { "X-Request-ID": requestId };
 }
 
-function corsHeaders(origin: string, requestId?: string): Record<string, string> {
+function corsHeaders(
+  origin: string,
+  requestId?: string,
+): Record<string, string> {
   return {
     "Access-Control-Allow-Origin": origin,
     "Access-Control-Allow-Methods": "POST, OPTIONS",
@@ -585,7 +621,10 @@ let cachedVisitorSecret: string | undefined;
 
 /** The per-deployment salt behind anonymous visitor keys, created on first use. */
 async function visitorSecret(ctx: {
-  runQuery: (reference: typeof internal.identity.secret, args: Record<string, never>) => Promise<string | null>;
+  runQuery: (
+    reference: typeof internal.identity.secret,
+    args: Record<string, never>,
+  ) => Promise<string | null>;
   runMutation: (
     reference: typeof internal.identity.ensureSecret,
     args: { candidate: string },