@iann29/rastro 0.6.0 → 0.7.0

package/src/component/sanitize.ts

@@ -82,6 +82,36 @@ const NUMERIC_SEGMENT = /^\d+$/;
 const UUID_SEGMENT =
   /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const HEX_SEGMENT = /^[0-9a-f]{16,}$/i;
+const ROUTE_PARAMETER = /^:[A-Za-z][A-Za-z0-9_]*$/;
+
+/** Ordered, full-path patterns; no regex or wildcard execution from settings. */
+export function validateRoutePatterns(patterns: readonly string[]): string[] {
+  if (patterns.length > 32)
+    throw new Error("At most 32 route patterns are allowed");
+  return [
+    ...new Set(
+      patterns.map((value) => {
+        const pattern = value.trim().replace(/\/$/, "");
+        const segments = pattern.slice(1).split("/");
+        if (
+          !pattern.startsWith("/") ||
+          pattern.length > 256 ||
+          /[\s?#*\\]/.test(pattern) ||
+          !segments.some((segment) => ROUTE_PARAMETER.test(segment)) ||
+          segments.some(
+            (segment) =>
+              !segment ||
+              segment === "." ||
+              segment === ".." ||
+              (segment.includes(":") && !ROUTE_PARAMETER.test(segment)),
+          )
+        )
+          throw new Error("Use full route patterns such as /pedido/:codigo");
+        return pattern;
+      }),
+    ),
+  ];
+}
 
 /**
  * Collapses the identifiers that unmistakably vary per record — numbers,
@@ -91,10 +121,25 @@ const HEX_SEGMENT = /^[0-9a-f]{16,}$/i;
  * spellings serve the same page. Only the map uses this; every other report
  * keeps the sanitized path exactly as the tracker sent it.
  */
-export function normalizeRoute(path: string): string {
+export function normalizeRoute(
+  path: string,
+  patterns: readonly string[] = [],
+): string {
   const trimmed =
     path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
   const segments = trimmed.split("/");
+  for (const pattern of patterns) {
+    const parts = pattern.split("/");
+    if (
+      parts.length === segments.length &&
+      parts.every(
+        (part, index) =>
+          part === segments[index] ||
+          (ROUTE_PARAMETER.test(part) && Boolean(segments[index])),
+      )
+    )
+      return pattern;
+  }
   for (let index = 1; index < segments.length; index += 1) {
     const segment = segments[index] ?? "";
     if (

package/src/component/sites.ts

@@ -12,6 +12,7 @@ import {
   sanitizeCurrency,
   sanitizeOpaqueId,
   validateTimezone,
+  validateRoutePatterns,
 } from "./sanitize.js";
 import { siteFieldsValidator } from "./validators.js";
 
@@ -29,6 +30,7 @@ export const create = mutation({
     timezone: v.optional(v.string()),
     currency: v.optional(v.string()),
     cookieless: v.optional(v.boolean()),
+    routePatterns: v.optional(v.array(v.string())),
   },
   returns: v.id("sites"),
   handler: async (ctx, args) => {
@@ -41,6 +43,7 @@ export const create = mutation({
     let timezone: string | undefined;
     let networkId: string | undefined;
     let currency: string;
+    let routePatterns: string[];
     try {
       domains = normalizeDomains(args.domains);
       timezone = validateTimezone(args.timezone);
@@ -48,6 +51,7 @@ export const create = mutation({
         ? sanitizeOpaqueId(args.networkId, "networkId")
         : undefined;
       currency = sanitizeCurrency(args.currency ?? "USD");
+      routePatterns = validateRoutePatterns(args.routePatterns ?? []);
     } catch (error) {
       fail(
         "INVALID_SITE",
@@ -69,7 +73,10 @@ export const create = mutation({
         existing.networkId !== networkId ||
         existing.timezone !== timezone ||
         (existing.currency ?? "USD") !== currency ||
-        existing.cookieless !== cookieless
+        existing.cookieless !== cookieless ||
+        (args.routePatterns !== undefined &&
+          JSON.stringify(existing.routePatterns ?? []) !==
+            JSON.stringify(routePatterns))
       ) {
         fail(
           "CONFLICT",
@@ -99,6 +106,7 @@ export const create = mutation({
       timezone,
       currency,
       cookieless,
+      routePatterns,
       createdAt: now,
       updatedAt: now,
     });
@@ -116,6 +124,7 @@ export const update = mutation({
     timezone: v.optional(v.union(v.string(), v.null())),
     currency: v.optional(v.string()),
     cookieless: v.optional(v.boolean()),
+    routePatterns: v.optional(v.array(v.string())),
   },
   returns: v.null(),
   handler: async (ctx, args) => {
@@ -129,6 +138,7 @@ export const update = mutation({
       timezone?: string | undefined;
       currency?: string;
       cookieless?: boolean;
+      routePatterns?: string[];
       updatedAt: number;
     } = { updatedAt: Date.now() };
     if (args.name !== undefined) {
@@ -161,6 +171,9 @@ export const update = mutation({
       if (args.currency !== undefined) {
         patch.currency = sanitizeCurrency(args.currency);
       }
+      if (args.routePatterns !== undefined) {
+        patch.routePatterns = validateRoutePatterns(args.routePatterns);
+      }
     } catch (error) {
       fail(
         "INVALID_SITE",

package/src/component/validators.ts

@@ -161,6 +161,7 @@ export const siteFieldsValidator = v.object({
   timezone: v.optional(v.string()),
   currency: v.optional(v.string()),
   cookieless: v.boolean(),
+  routePatterns: v.optional(v.array(v.string())),
   createdAt: v.number(),
   updatedAt: v.number(),
 });

package/src/tracker/generated.ts

@@ -1,5 +1,5 @@
 // Generated by scripts/build-tracker.mjs. Do not edit.
-export const RASTRO_VERSION = "0.6.0";
+export const RASTRO_VERSION = "0.7.0";
 export const TRACKER_SOURCE = "(()=>{const t=document.currentScript,e=t?.dataset.site,i=t?.dataset.endpoint||t?.src&&new URL(\"events\",t.src).href;if(!e||!i)return;const n=()=>crypto.randomUUID?.()||Math.random()+\"\",r=new URLSearchParams(location.search),s=r.get(\"ref\")?.slice(0,64);let o;for(const t of[\"source\",\"medium\",\"campaign\",\"term\",\"content\"]){const e=r.get(\"utm_\"+t)?.slice(0,64);e&&((o??={})[\"utm_\"+t]=e)}const a=\"gclid gbraid wbraid msclkid ttclid twclid li_fat_id ScCid rdt_cid dclid epik srsltid mc_cid mc_eid _hsenc igsh igshid fbclid\".split(\" \").filter(t=>r.has(t)).slice(0,8);let c,d,l,h,f=t.dataset.visitor||\"\",p=Boolean(f);try{f||=localStorage._rv||=n()}catch{}try{d=sessionStorage,l=d._r,c=d._ri==f&&d._rt,h=s||d._a,h&&(d._a=h),o||=d._u&&JSON.parse(d._u),o&&(d._u=JSON.stringify(o))}catch{h=s}let v,g=0;const u=[];let m=document.referrer.split(\"/\",3).join(\"/\")||void 0;const _=t=>{const n=u.splice(0,50);if(!n.length)return;const r=()=>new Blob([JSON.stringify({siteId:e,events:n,sentAt:Date.now()})]);let s=r();for(;s.size>64e3&&n.length>1;)u.unshift(n.pop()),s=r();t&&navigator.sendBeacon(i,s)||fetch(i,{method:\"POST\",body:s,keepalive:1}).catch(()=>{}),u.length&&_(t)},y=(t,e,i)=>{const r=Date.now(),s=r-c;c=r,s<18e5||(l=n(),\"pageview\"!=t&&(S=\"\",w()));try{d._r=l,d._ri=f,d._rt=r}catch{}u.push({eventId:`${l}.${r.toString(36)}.${g}`,sessionId:l,visitorId:f||l,type:t,name:e,path:location.pathname.slice(0,256),referrer:m,timestamp:r,sequence:g++,affiliateSlug:h,...i}),clearTimeout(v),v=setTimeout(_,1200)};let S;const w=()=>{const t=location.pathname;t!=S&&(S=t,y(\"pageview\",void 0,{properties:o,clid:a.length?a:void 0}))};window.rastro=(e,i,r)=>{if(\"context\"==e)return{sessionId:l,visitorId:f||l,identified:p};if(\"identify\"==e||\"reset\"==e){if(\"identify\"==e&&(!i||i.length>128||!/^[A-Za-z0-9][A-Za-z0-9_.:-]*$/.test(i)))return;if(\"identify\"==e&&i==f)return;_();const r=\"reset\"==e||p;if(p=\"identify\"==e,f=\"identify\"==e?i:n(),t.dataset.visitor=\"identify\"==e?f:\"\",r){h=void 0,o=void 0,m=void 0,a.length=0;try{\"reset\"==e&&(localStorage._rv=f),d._a=\"\",d._u=\"\"}catch{}}c=0,g=0,S=\"\",w()}\"event\"==e&&y(\"custom\",`${i||\"event\"}`.slice(0,80),r&&JSON.stringify(r).length>2e4?void 0:{properties:r})},document.addEventListener(\"click\",t=>{const e=t.target?.closest(\"a,button,[data-rastro-event]\");if(!e)return;const i=e.dataset.rastroEvent,n=e.href,r=n&&new URL(n),s=/^https?:$/.test(r?.protocol),o=s&&r.origin!=location.origin;y(i?\"custom\":o?\"outbound\":\"click\",i,{target:(e.dataset.rastroLabel||e.innerText||e.tagName).slice(0,64),href:s?((o?r.origin:\"\")+r.pathname).slice(0,256):void 0})},1);for(const t of[\"pushState\",\"replaceState\"]){const e=history[t];history[t]=(...t)=>{e.apply(history,t),w()}}addEventListener(\"popstate\",w);let b=0;const I=()=>{y(\"heartbeat\"),_()},L=()=>{b&&(clearInterval(b),b=0,y(\"leave\"),_(1))},E=()=>{document.hidden?L():b||(I(),b=setInterval(I,2e4))};addEventListener(\"pagehide\",L),addEventListener(\"pageshow\",E),document.addEventListener(\"visibilitychange\",E),b=setInterval(I,2e4),w(),E()})();";
 export const TRACKER_GZIP_BASE64 = "H4sIAAAAAAACA31W23LbOBL9FRmVYgHrNiI7l8pSi6gmO3nwludSq+RlXR4FIpsiNhTAAZrSaET++xRIUYrt1LyQALqBbjTOOQDnQr0/ZM4GmpDKXdZs0JLMGu/R0iLzpiZARXOZa9IBSQZDCObbEbR57YyltqW5DD5LEou7yef/3nGGW7QUGFAcF7L0WMxMwS+wbS+M8EiNt7MhulUxlczva3LSa5u7zefPtz/OJRdt+5Om8jjIxSVj4NUxxgK1z8pftdebwCuXaTLOytCPCgjKyzUSZx4LJuYyVCZDPoW3r8WsQpq4WeE8P25/4op7FlzjM2TANpibZsOAZXpTa7O2DBih70ecJbTEHsSxcjiGaWizZJf0JBImCeduPleHTtyPPg8KRTdM14qts8rkk/XKa5NPdsNvE7Lqq8knRL2Rdv2vMstC09Lkk0X2b5NPfE7LzOSTvLdibb5Ogg8VxQWy3rLJlmjyybIMaLOJWYey/5h8UqziJCZDXRnibMKELExF6Dmp916WOnAS4rSXd0PRMsihghIKRScMbE0w5HzbMga1+uBchdryQszI7w9F26p4NNWCnNdrlEu/bVtluegyTVl56KJXrgKGYJw9ekGlcrn0kPU/o1SRJLFFUKrQtrlcaiiThMeGKgW4to2eTZL8Z/HLz7LWPmA0NgLc4Nao3hLIG7s2xZ47MWZQqtDFvW1hraZHRDbq/qHf8OZMDI8Feo9+LNlLBq+E/L8zNrZF226dySfjCktFJ3ZZ1fST+kq+mYqeB1ZWaNdUPqaC76kQAf6hcit+/yTrQ6TgbZ4iDPRKLQS09AOlP2pCad2Oi048DIcVlOeiR/ksyGD+xPdvX+OrJBkjv7+eiUY2NpSmIG5l7WoueuJwMaMksXpr1pqclwFt/gF15iw3EETbFkhZyQ0cNkily1P26y+LTwxWLt+nAb4i1royW0yvOyH7KvNebDoBzTF4kiw5iQ72ihMgmLMWeXXeS0zmKptlykP41/U7fNO2vIroAVbrNW4N7tiFoiThC8UY7LgQA+4iWlQFA3yK/k/Kj5hrZN2Ekh/6It7m6ZcXh6qTLw5eklv0xeav3oo4su6+wBGbt3lawRHst3latG0FtK8xJbB6gylCralMT0IUe9Fw4tDNm7cCRhSlGyCzwUB6U6ceAv7eoM0wXV9egi4KUxlNuKiadVqClNJ0ArIKtf9kNuga4lsBWxWQxv4Srm+mU9H1J784ommnHmn8s9RmdKEWffEI9vxcUhigDIfauxo9GQypgygYqT6e31yng1MnRDfbGZu7nfQ6kHeKIxjwMbIp+CCZfxBTCo9YP/xNRU2OlkxhME/rLhKFHUf2cYG2ZR4DDosdnlqThF+YtjUnfN+8a9uLl7/d/3D1P3315/Tqnw/n5lKmVw//ePFSEgbiRoiRiM9XjQI0WpdcnKh6zqVt6zivVo9mQvG4PzdphO4z6XziVaTxlhOHUh2PwY2NzdgYT0FNe7SfE0kS/lRuVSGgF0rGoFdCxkYedJmaRtWDkT3dcG0PK+05y5pAbsPgy4uDadujsftyvhamAvxRdc8q5cV4Ajf4ej6knH6LJd+JDk7CqvP8Y1z4zgRCi56zrDLZVwZnBUVFkrRfI81lVrkQj4xpWDVEzsJ9rOfVAL6rPscHNogsPlZXo/BU+8G9DwxWYf9AiW+L8xPGRvl5+VtJVId5OiLFz2XtHbnMVQKcCknipfNmbezFmWDDwGzPzXysYermzDW0co3NWTpu0cBh2FfKn6Z2p1dYtS1KYy36T/gHxQ7p9c96g+LbVwbE3NMwjy+NMZmUMXHpT0wXj1ToRN0OrsWzd1DUxgVpik8hj3WlMxy63zx6ShPI+f09PczOTcWllBR5j1LXdbXnRxuQ6NHVPT/q2tVhiLUbbq3V6RK+HdRrz1mJ2tMKNTEBSy46uBtMqyThvSreWkK/1RVfCVipaRSzCvUWe/9rITr4OMw4ga40eY52fsdFumpbfsvjxIB0WukWbvB11Lbv5KzXWJocGdwJ+L45lG7H4KP4O5RH9q9MZWifldqusff/XhKxdvAx3uxczP4CGKXLCLcLAAA=";
 export const TRACKER_RAW_BYTES = 2999;