@iann29/rastro 0.10.9 → 0.11.0

package/src/component/leadgenToken.ts

@@ -0,0 +1,348 @@
+/*
+ * The control plane's word that Meta announced a lead: a short-lived RS256
+ * JWT signed with the federation issuer's key (the one the host already
+ * trusts for its dashboard connections), audience = the host's federation
+ * audience, bound to one Page and one leadgen id. A component has no
+ * `ctx.auth`, so the HTTP route checks it here against the issuer's published
+ * keys (`<issuer>/.well-known/openid-configuration` → `jwks_uri`). The token
+ * only says "go read this lead from Meta": the lead itself is always read
+ * from Meta with the Page's own token, so a replay at most repeats an
+ * idempotent read.
+ */
+
+import { META_LEADGEN_TOKEN } from "./constants.js";
+
+// The claim names, purpose, subject and lifetime come from
+// `META_LEADGEN_TOKEN` (constants.ts, contract §12.3): the control plane signs
+// with the same object.
+const CLAIMS = META_LEADGEN_TOKEN.claims;
+
+const CLOCK_SKEW_SECONDS = 60;
+const JWKS_TTL_MS = 5 * 60_000;
+const JWKS_REFRESH_MIN_MS = 60_000;
+const MAX_TOKEN = 8_192;
+const GRAPH_ID = /^\d{1,32}$/u;
+
+export class LeadgenTokenError extends Error {
+  /**
+   * `transient`: the token could not be checked because the issuer's keys
+   * could not be read right now (unreachable, 5xx, 429, not JSON). The route
+   * answers 503 then, which the control plane retries; any other refusal is a
+   * 401, which it does not.
+   */
+  constructor(
+    readonly reason: string,
+    readonly transient = false,
+  ) {
+    super(reason);
+    this.name = "LeadgenTokenError";
+  }
+}
+
+type Jwk = { kty?: unknown; kid?: unknown; n?: unknown; e?: unknown };
+type Fetch = typeof fetch;
+
+const jwksCache = new Map<
+  string,
+  { keys: Jwk[]; fetchedAt: number; refreshedAt: number }
+>();
+
+function base64UrlBytes(value: string): Uint8Array<ArrayBuffer> {
+  if (!/^[A-Za-z0-9_-]*$/u.test(value)) {
+    throw new LeadgenTokenError("token is not base64url");
+  }
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(padded + "=".repeat((4 - (padded.length % 4)) % 4));
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return bytes;
+}
+
+function jsonPart(value: string): Record<string, unknown> {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(new TextDecoder().decode(base64UrlBytes(value)));
+  } catch (error) {
+    if (error instanceof LeadgenTokenError) throw error;
+    throw new LeadgenTokenError("token part is not JSON");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new LeadgenTokenError("token part is not an object");
+  }
+  return parsed as Record<string, unknown>;
+}
+
+const trimSlash = (value: string) => value.replace(/\/+$/u, "");
+
+/**
+ * The production dashboard's federation issuer: what the leadgen route trusts
+ * when the host passes no `RASTRO_FEDERATION_ISSUER`, as a host's federation
+ * API does. The audience has no default: it is the host's own functions URL.
+ */
+export const DEFAULT_FEDERATION_ISSUER =
+  "https://site.api.amagerastro.com/federation";
+
+/**
+ * The issuer and audience the leadgen route checks forwards against, from the
+ * component's env. `audience` null means the route refuses every forward
+ * (`FEDERATION_NOT_CONFIGURED`), so a Page must not be linked or routed here.
+ */
+export function leadgenTrust(env: {
+  RASTRO_FEDERATION_ISSUER?: string;
+  RASTRO_FEDERATION_AUDIENCE?: string;
+}): { issuer: string; audience: string | null } {
+  return {
+    issuer:
+      trimSlash(env.RASTRO_FEDERATION_ISSUER?.trim() ?? "") ||
+      DEFAULT_FEDERATION_ISSUER,
+    audience: trimSlash(env.RASTRO_FEDERATION_AUDIENCE?.trim() ?? "") || null,
+  };
+}
+
+function sameOriginHttps(base: string, target: string): boolean {
+  try {
+    const from = new URL(base);
+    const to = new URL(target);
+    const local = to.hostname === "localhost" || to.hostname === "127.0.0.1";
+    return (
+      from.origin === to.origin &&
+      (to.protocol === "https:" || (to.protocol === "http:" && local))
+    );
+  } catch {
+    return false;
+  }
+}
+
+async function fetchJson(fetchImpl: Fetch, target: string): Promise<unknown> {
+  let response: Response;
+  try {
+    response = await fetchImpl(target, {
+      headers: { Accept: "application/json" },
+    });
+  } catch {
+    throw new LeadgenTokenError("the issuer is unreachable", true);
+  }
+  if (!response.ok) {
+    throw new LeadgenTokenError(
+      `the issuer answered ${response.status}`,
+      response.status >= 500 || response.status === 429,
+    );
+  }
+  try {
+    return await response.json();
+  } catch {
+    throw new LeadgenTokenError(
+      "the issuer answered something else than JSON",
+      true,
+    );
+  }
+}
+
+/**
+ * The issuer's signing keys, cached for five minutes; `fetched` says whether
+ * they were read from the issuer just now (a forced refresh within a minute
+ * of the last read answers from the cache).
+ */
+async function issuerKeys(
+  issuer: string,
+  fetchImpl: Fetch,
+  now: number,
+  refresh: boolean,
+): Promise<{ keys: Jwk[]; fetched: boolean }> {
+  const cached = jwksCache.get(issuer);
+  if (
+    cached &&
+    now - cached.fetchedAt < JWKS_TTL_MS &&
+    !(refresh && now - cached.refreshedAt >= JWKS_REFRESH_MIN_MS)
+  ) {
+    return { keys: cached.keys, fetched: false };
+  }
+  const discovery = await fetchJson(
+    fetchImpl,
+    `${issuer}/.well-known/openid-configuration`,
+  );
+  const jwksUri =
+    discovery &&
+    typeof discovery === "object" &&
+    typeof (discovery as { jwks_uri?: unknown }).jwks_uri === "string"
+      ? (discovery as { jwks_uri: string }).jwks_uri
+      : `${issuer}/jwks.json`;
+  if (!sameOriginHttps(issuer, jwksUri)) {
+    throw new LeadgenTokenError("the issuer's jwks_uri is not its own");
+  }
+  const jwks = await fetchJson(fetchImpl, jwksUri);
+  const keys =
+    jwks &&
+    typeof jwks === "object" &&
+    Array.isArray((jwks as { keys?: unknown }).keys)
+      ? ((jwks as { keys: unknown[] }).keys.filter(
+          (key) => key && typeof key === "object",
+        ) as Jwk[])
+      : [];
+  jwksCache.set(issuer, { keys, fetchedAt: now, refreshedAt: now });
+  return { keys, fetched: true };
+}
+
+/** For tests: forget the cached keys. */
+export function clearLeadgenKeyCache(): void {
+  jwksCache.clear();
+}
+
+export interface LeadgenTokenClaims {
+  connectionId: string;
+  organizationId: string;
+  version: number;
+  pageId: string;
+  leadgenId: string;
+}
+
+/**
+ * Checks a forwarding token: RS256 under one of the issuer's keys, the
+ * issuer and audience the host trusts, alive and short-lived, for the
+ * leadgen purpose, and bound to exactly this Page and leadgen id. Throws a
+ * `LeadgenTokenError` (no secret in its reason) when anything is off.
+ */
+export async function verifyLeadgenToken(
+  token: string,
+  expected: {
+    issuer: string;
+    audience: string;
+    pageId: string;
+    leadgenId: string;
+  },
+  options: { now?: number; fetch?: Fetch } = {},
+): Promise<LeadgenTokenClaims> {
+  const now = options.now ?? Date.now();
+  const fetchImpl = options.fetch ?? ((...args) => fetch(...args));
+  const issuer = trimSlash(expected.issuer.trim());
+  const audience = trimSlash(expected.audience.trim());
+  if (!issuer || !audience) {
+    throw new LeadgenTokenError("the host has no federation issuer");
+  }
+  if (token.length > MAX_TOKEN) throw new LeadgenTokenError("token too long");
+  const parts = token.split(".");
+  if (parts.length !== 3) throw new LeadgenTokenError("token is not a JWT");
+  const [headerPart, payloadPart, signaturePart] = parts as [
+    string,
+    string,
+    string,
+  ];
+  const header = jsonPart(headerPart);
+  if (header.alg !== "RS256") {
+    throw new LeadgenTokenError("token is not RS256");
+  }
+  const claims = jsonPart(payloadPart);
+
+  // The cheap checks first: a token for something else costs no key fetch.
+  const seconds = Math.floor(now / 1000);
+  const aud = claims.aud;
+  const audiences = (Array.isArray(aud) ? aud : [aud]).map((value) =>
+    typeof value === "string" ? trimSlash(value) : "",
+  );
+  const exp = claims.exp;
+  const iat = claims.iat;
+  if (typeof claims.iss !== "string" || trimSlash(claims.iss) !== issuer) {
+    throw new LeadgenTokenError("token issuer is not trusted");
+  }
+  if (!audiences.includes(audience)) {
+    throw new LeadgenTokenError("token audience is not this host");
+  }
+  if (typeof exp !== "number" || exp + CLOCK_SKEW_SECONDS < seconds) {
+    throw new LeadgenTokenError("token expired");
+  }
+  if (
+    typeof iat !== "number" ||
+    iat - CLOCK_SKEW_SECONDS > seconds ||
+    exp - iat > META_LEADGEN_TOKEN.maxLifetimeSeconds
+  ) {
+    throw new LeadgenTokenError("token lifetime is not a forwarding one");
+  }
+  if (
+    claims[CLAIMS.purpose] !== META_LEADGEN_TOKEN.purpose ||
+    claims.sub !== META_LEADGEN_TOKEN.subject
+  ) {
+    throw new LeadgenTokenError("token is not for a leadgen");
+  }
+  const organizationId = claims[CLAIMS.organizationId];
+  const version = claims[CLAIMS.version];
+  if (
+    typeof organizationId !== "string" ||
+    organizationId.length === 0 ||
+    organizationId.length > 128 ||
+    typeof version !== "number" ||
+    !Number.isSafeInteger(version) ||
+    version < 0
+  ) {
+    throw new LeadgenTokenError("token names no organization");
+  }
+  const connectionId = claims[CLAIMS.connectionId];
+  if (
+    typeof connectionId !== "string" ||
+    connectionId.length === 0 ||
+    connectionId.length > 128
+  ) {
+    throw new LeadgenTokenError("token names no connection");
+  }
+  if (
+    claims[CLAIMS.pageId] !== expected.pageId ||
+    claims[CLAIMS.leadgenId] !== expected.leadgenId ||
+    !GRAPH_ID.test(expected.pageId) ||
+    !GRAPH_ID.test(expected.leadgenId)
+  ) {
+    throw new LeadgenTokenError("token is for another lead");
+  }
+
+  const kid = typeof header.kid === "string" ? header.kid : null;
+  const pick = (keys: Jwk[]) =>
+    keys.filter(
+      (key) =>
+        key.kty === "RSA" &&
+        typeof key.n === "string" &&
+        typeof key.e === "string" &&
+        (kid === null || key.kid === undefined || key.kid === kid),
+    );
+  let candidates = pick((await issuerKeys(issuer, fetchImpl, now, false)).keys);
+  if (candidates.length === 0) {
+    // A rotated key: read the issuer again (at most once a minute).
+    const again = await issuerKeys(issuer, fetchImpl, now, true);
+    candidates = pick(again.keys);
+    if (candidates.length === 0) {
+      // Keys read a moment ago may predate the rotation: transient (503,
+      // retried) until the issuer has been read again.
+      throw new LeadgenTokenError(
+        again.fetched
+          ? "no issuer key matches the token"
+          : "no issuer key matches the token yet",
+        !again.fetched,
+      );
+    }
+  }
+  const data = new TextEncoder().encode(`${headerPart}.${payloadPart}`);
+  const signature = base64UrlBytes(signaturePart);
+  for (const jwk of candidates) {
+    let key: CryptoKey;
+    try {
+      key = await crypto.subtle.importKey(
+        "jwk",
+        { kty: "RSA", n: jwk.n as string, e: jwk.e as string, ext: true },
+        { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+        false,
+        ["verify"],
+      );
+    } catch {
+      continue;
+    }
+    if (await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key, signature, data)) {
+      return {
+        connectionId,
+        organizationId,
+        version,
+        pageId: expected.pageId,
+        leadgenId: expected.leadgenId,
+      };
+    }
+  }
+  throw new LeadgenTokenError("token signature is invalid");
+}

package/src/component/leads.ts

@@ -19,6 +19,7 @@ import {
   MAX_SITE_AD_ACCOUNTS,
   MAX_AD_SPEND_ROWS,
   MAX_SPEND_SUM_ROWS,
+  PAID_LEADS_ORIGIN,
 } from "./constants.js";
 import { fail } from "./errors.js";
 import {
@@ -32,6 +33,7 @@ import {
   parseMetaUserData,
   removeLeadConversions,
 } from "./metaCapi.js";
+import { forgetFormLead, formLeadDetail } from "./leadFormStore.js";
 import { cleanString, isValidMoney, sanitizeOpaqueId } from "./sanitize.js";
 import {
   leadAdRowValidator,
@@ -71,6 +73,20 @@ const MAX_NAME = 200;
 export const AD_ORIGIN = "ctwa_ad";
 /** The bucket for a lead the channel gave no entry point for. */
 export const NO_ORIGIN = "none";
+/**
+ * A Meta instant form's leads (since 0.11.0): `lead_form` when an ad brought
+ * them, so they count as paid next to `ctwa_ad`; `lead_form_organic` when the
+ * form was filled without an ad.
+ */
+export const LEAD_FORM_ORIGIN = "lead_form";
+export const LEAD_FORM_ORGANIC_ORIGIN = "lead_form_organic";
+/** The origins spend buys: what `bySite[].paid` counts. */
+const PAID_ORIGINS: ReadonlySet<string> = new Set([
+  AD_ORIGIN,
+  LEAD_FORM_ORIGIN,
+]);
+/** `leads.daily`'s `origin` for every paid origin together. */
+const PAID_SCOPE = PAID_LEADS_ORIGIN;
 
 type LeadAd = Infer<typeof leadAdValidator>;
 type Counters = {
@@ -149,6 +165,9 @@ function sanitizeEntryPoint(value: string | undefined): string | undefined {
 }
 
 function originKeyFor(entryPoint: string | undefined, ad: LeadAd | undefined) {
+  if (entryPoint === LEAD_FORM_ORIGIN) {
+    return ad?.adId ? LEAD_FORM_ORIGIN : LEAD_FORM_ORGANIC_ORIGIN;
+  }
   if (ad || entryPoint === AD_ORIGIN) return AD_ORIGIN;
   return entryPoint ?? NO_ORIGIN;
 }
@@ -156,7 +175,7 @@ function originKeyFor(entryPoint: string | undefined, ad: LeadAd | undefined) {
 async function bumpRollup(
   ctx: MutationCtx,
   lead: Pick<Doc<"leads">, "siteId" | "dayStart">,
-  dimension: "origin" | "ad",
+  dimension: "origin" | "ad" | "form",
   key: string,
   delta: Counters,
 ) {
@@ -194,11 +213,12 @@ async function bumpRollup(
 /** Applies one lead's change to every rollup row it is counted in. */
 async function bumpLead(
   ctx: MutationCtx,
-  lead: Pick<Doc<"leads">, "siteId" | "dayStart" | "originKey" | "ad">,
+  lead: Pick<Doc<"leads">, "siteId" | "dayStart" | "originKey" | "ad" | "form">,
   delta: Counters,
 ) {
   await bumpRollup(ctx, lead, "origin", lead.originKey, delta);
   if (lead.ad?.adId) await bumpRollup(ctx, lead, "ad", lead.ad.adId, delta);
+  if (lead.form) await bumpRollup(ctx, lead, "form", lead.form.formId, delta);
 }
 
 async function findLead(ctx: QueryCtx, siteId: Id<"sites">, leadKey: string) {
@@ -236,86 +256,108 @@ export const record = mutation({
     meta: v.optional(v.any()),
   },
   returns: v.object({ leadId: v.id("leads"), created: v.boolean() }),
-  handler: async (ctx, args) => {
-    const site = await ctx.db.get("sites", args.siteId);
-    if (!site) fail("NOT_FOUND", "site not found");
-    const now = Date.now();
-    const leadKey = opaque(args.leadKey, "leadKey");
-    const meta = parseMetaUserData(args.meta) ?? undefined;
-    const label = optionalText(args.label, MAX_LABEL);
-    const visitorId =
-      args.visitorId === undefined
-        ? undefined
-        : opaque(args.visitorId, "visitorId");
-    const existing = await findLead(ctx, args.siteId, leadKey);
-    if (existing) {
-      const patch: Partial<Doc<"leads">> = {};
-      if (label && label !== existing.label) patch.label = label;
-      if (visitorId && !existing.visitorId) patch.visitorId = visitorId;
-      // The column is where the lead is now, so a later call may move it.
-      const moved = await enterColumn(
-        ctx,
-        existing,
-        args.column,
-        eventTime(args.occurredAt, now),
-        meta,
-      );
-      if (moved) Object.assign(patch, moved);
-      if (Object.keys(patch).length > 0) {
-        await ctx.db.patch("leads", existing._id, { ...patch, updatedAt: now });
-      }
-      return { leadId: existing._id, created: false };
-    }
-    const entryPoint = sanitizeEntryPoint(args.entryPoint);
-    const ad = sanitizeAd(args.ad);
-    const firstAt = eventTime(args.occurredAt, now);
-    const lead = {
-      siteId: args.siteId,
-      leadKey,
-      channel: args.channel,
-      ...(entryPoint ? { entryPoint } : {}),
-      originKey: originKeyFor(entryPoint, ad),
-      ...(ad ? { ad } : {}),
-      ...(label ? { label } : {}),
-      ...(visitorId ? { visitorId } : {}),
-      stage: "lead" as const,
-      revenueCents: 0,
-      firstAt,
-      dayStart: Math.floor(firstAt / DAY_MS) * DAY_MS,
-      stageAt: firstAt,
-      updatedAt: now,
-    };
-    const leadId = await ctx.db.insert("leads", lead);
-    const placed = await enterColumn(
+  handler: async (ctx, args) => await recordLeadCore(ctx, args),
+});
+
+/**
+ * `record`'s body, shared with the Lead Ads ingestion (metaLeads.ts), which
+ * also files the lead under its instant form (`form`).
+ */
+export async function recordLeadCore(
+  ctx: MutationCtx,
+  args: {
+    siteId: Id<"sites">;
+    leadKey: string;
+    channel: Doc<"leads">["channel"];
+    entryPoint?: string | undefined;
+    ad?: LeadAd | undefined;
+    label?: string | undefined;
+    visitorId?: string | undefined;
+    column?: string | undefined;
+    occurredAt: number;
+    meta?: unknown;
+    form?: { formId: string; pageId: string } | undefined;
+  },
+): Promise<{ leadId: Id<"leads">; created: boolean }> {
+  const site = await ctx.db.get("sites", args.siteId);
+  if (!site) fail("NOT_FOUND", "site not found");
+  const now = Date.now();
+  const leadKey = opaque(args.leadKey, "leadKey");
+  const meta = parseMetaUserData(args.meta) ?? undefined;
+  const label = optionalText(args.label, MAX_LABEL);
+  const visitorId =
+    args.visitorId === undefined
+      ? undefined
+      : opaque(args.visitorId, "visitorId");
+  const existing = await findLead(ctx, args.siteId, leadKey);
+  if (existing) {
+    const patch: Partial<Doc<"leads">> = {};
+    if (label && label !== existing.label) patch.label = label;
+    if (visitorId && !existing.visitorId) patch.visitorId = visitorId;
+    // The column is where the lead is now, so a later call may move it.
+    const moved = await enterColumn(
       ctx,
-      { _id: leadId, siteId: args.siteId, column: undefined },
+      existing,
       args.column,
-      firstAt,
+      eventTime(args.occurredAt, now),
       meta,
     );
-    if (placed) await ctx.db.patch("leads", leadId, placed);
-    await ctx.db.insert("leadEvents", {
-      siteId: args.siteId,
-      leadId,
-      eventId: `created:${leadKey}`,
-      type: "created",
-      at: firstAt,
-    });
-    await bumpLead(ctx, lead, {
-      leads: 1,
-      qualified: 0,
-      won: 0,
-      revenueCents: 0,
-    });
-    await enqueueNewLead(ctx, {
-      siteId: args.siteId,
-      leadId,
-      eventTime: firstAt,
-      meta,
-    });
-    return { leadId, created: true };
-  },
-});
+    if (moved) Object.assign(patch, moved);
+    if (Object.keys(patch).length > 0) {
+      await ctx.db.patch("leads", existing._id, { ...patch, updatedAt: now });
+    }
+    return { leadId: existing._id, created: false };
+  }
+  const entryPoint = sanitizeEntryPoint(args.entryPoint);
+  const ad = sanitizeAd(args.ad);
+  const firstAt = eventTime(args.occurredAt, now);
+  const lead = {
+    siteId: args.siteId,
+    leadKey,
+    channel: args.channel,
+    ...(entryPoint ? { entryPoint } : {}),
+    originKey: originKeyFor(entryPoint, ad),
+    ...(ad ? { ad } : {}),
+    ...(label ? { label } : {}),
+    ...(visitorId ? { visitorId } : {}),
+    ...(args.form ? { form: args.form } : {}),
+    stage: "lead" as const,
+    revenueCents: 0,
+    firstAt,
+    dayStart: Math.floor(firstAt / DAY_MS) * DAY_MS,
+    stageAt: firstAt,
+    updatedAt: now,
+  };
+  const leadId = await ctx.db.insert("leads", lead);
+  const placed = await enterColumn(
+    ctx,
+    { _id: leadId, siteId: args.siteId, column: undefined },
+    args.column,
+    firstAt,
+    meta,
+  );
+  if (placed) await ctx.db.patch("leads", leadId, placed);
+  await ctx.db.insert("leadEvents", {
+    siteId: args.siteId,
+    leadId,
+    eventId: `created:${leadKey}`,
+    type: "created",
+    at: firstAt,
+  });
+  await bumpLead(ctx, lead, {
+    leads: 1,
+    qualified: 0,
+    won: 0,
+    revenueCents: 0,
+  });
+  await enqueueNewLead(ctx, {
+    siteId: args.siteId,
+    leadId,
+    eventTime: firstAt,
+    meta,
+  });
+  return { leadId, created: true };
+}
 
 /**
  * Moves a lead through the host's pipeline, idempotent by `eventId`. A lead the
@@ -488,6 +530,7 @@ export const remove = mutation({
       revenueCents: lead.stage === "won" ? -lead.revenueCents : 0,
     });
     await forgetLeadColumns(ctx, lead);
+    await forgetFormLead(ctx, lead._id);
     await ctx.db.delete("leads", lead._id);
     return { removed: true };
   },
@@ -835,7 +878,7 @@ export const report = query({
       )) {
         add(totals, row);
         add(siteCounters, row);
-        if (row.key === AD_ORIGIN) add(paidCounters, row);
+        if (PAID_ORIGINS.has(row.key)) add(paidCounters, row);
         const counters = origins.get(row.key) ?? zero();
         add(counters, row);
         origins.set(row.key, counters);
@@ -1080,8 +1123,9 @@ export const report = query({
 /**
  * The lead funnel per cohort day, for sparklines and the sales × spend chart:
  * every UTC day in the range, empty days included. With `adId`, only that
- * ad's leads; with `origin`, only that origin's (`ctwa_ad` for the leads the
- * ads bought). Spend is the day's Meta spend for the same scope, null where
+ * ad's leads; with `origin`, only that origin's (`ctwa_ad` for the
+ * click-to-WhatsApp ads, `paid` for every lead an ad bought: `ctwa_ad` and
+ * `lead_form`). Spend is the day's Meta spend for the same scope, null where
  * no synced ad account covers it, for an organic origin, or when the sites'
  * accounts bill in more than one currency.
  */
@@ -1112,7 +1156,14 @@ export const daily = query({
     }
     const adId =
       args.adId === undefined ? undefined : opaque(args.adId, "adId");
+    const paidScope = args.origin === PAID_SCOPE;
     const key = adId ?? args.origin;
+    const keep = (rowKey: string) =>
+      key === undefined ||
+      (paidScope ? PAID_ORIGINS.has(rowKey) : rowKey === key);
+    // Spend buys the ad leads: an organic origin has none to show.
+    const spendScope =
+      args.origin === undefined || args.origin === AD_ORIGIN || paidScope;
     const days = new Map<number, Counters>();
     for (let day = first; day <= lastDay; day += DAY_MS) days.set(day, zero());
     const budget = { rows: MAX_LEAD_REPORT_ROWS };
@@ -1132,12 +1183,11 @@ export const daily = query({
         first,
         last,
       )) {
-        if (key !== undefined && row.key !== key) continue;
+        if (!keep(row.key)) continue;
         const counters = days.get(row.dayStart);
         if (counters) add(counters, row);
       }
-      // Spend buys the ad leads: an organic origin has none to show.
-      if (args.origin !== undefined && args.origin !== AD_ORIGIN) continue;
+      if (!spendScope) continue;
       const sources = await spendSources(ctx, siteId);
       if (sources.accounts.size === 0) continue;
       let rows: Array<{
@@ -1313,6 +1363,8 @@ export const journey = query({
           }
         : null,
       visitorId: lead.visitorId ?? null,
+      // Since 0.11.0: the instant form's answers, origin and path.
+      ...(lead.form ? { form: await formLeadDetail(ctx, lead) } : {}),
       events: events.map((event) => ({
         type: event.type,
         at: event.at,