@koendhoore/directus-extension-umami-analytics 1.0.0 → 1.0.1

package/dist/api.js

@@ -1 +1 @@
-const t=new Map;let e=null;function n(t,e){const n=t[e];if(!n)throw new Error(`Missing ${e}`);return n.replace(/\/$/,"")}function r(t,e){const n=Number(t);return Number.isFinite(n)?n:e}async function a(t,r){const a=n(t,"UMAMI_URL"),s=await async function(t){const r=t.UMAMI_TOKEN||t.UMAMI_API_KEY;if(r)return{headers:{Authorization:`Bearer ${r}`}};if(e&&e.expires>Date.now())return e.auth;const a=n(t,"UMAMI_URL"),s=n(t,"UMAMI_USERNAME"),o=n(t,"UMAMI_PASSWORD"),i=await fetch(`${a}/api/auth/login`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({username:s,password:o})});if(!i.ok){const t=await i.text();throw new Error(`Umami login failed: ${i.status} ${t}`)}const c=i.headers.get("set-cookie")||"";let u=null;try{u=await i.json()}catch{}const d=u?.token||u?.accessToken||u?.data?.token||u?.data?.accessToken,h=d?{headers:{Authorization:`Bearer ${d}`}}:{headers:c?{Cookie:c.split(";")[0]}:{}};return e={expires:Date.now()+33e5,auth:h},h}(t),o=await fetch(`${a}${r}`,{headers:{Accept:"application/json",...s.headers}});if(!o.ok){const t=await o.text();throw new Error(`Umami request failed: ${o.status} ${t}`)}return o.json()}function s(t,e,n,r,a=10){return`/api/websites/${t}/metrics?${new URLSearchParams({startAt:String(Math.round(n)),endAt:String(Math.round(r)),type:e,limit:String(a)}).toString()}`}const o=[],i=[{name:"umami-analytics",config:(e,n)=>{const o=n.env||process.env;e.get("/health",(t,e)=>{e.json({ok:!0,service:"umami-analytics"})}),e.get("/summary",async(e,n)=>{try{const i=String(e.query.websiteId||o.UMAMI_WEBSITE_ID||"");if(!i)return n.status(400).json({error:"Missing websiteId or UMAMI_WEBSITE_ID"});const{startAt:c,endAt:u,days:d}=function(t){const e=Date.now(),n=Math.max(1,Math.min(365,r(t.days,30))),a=r(t.endAt,e);return{startAt:r(t.startAt,a-24*n*60*60*1e3),endAt:a,days:n}}(e.query),h=`summary:${i}:${c}:${u}`,w=function(e){const n=t.get(e);return!n||n.expires<Date.now()?null:n.value}(h);if(w)return n.json(w);const A=new URLSearchParams({startAt:String(Math.round(c)),endAt:String(Math.round(u))}),[M,l,m,f]=await Promise.all([a(o,`/api/websites/${i}/stats?${A.toString()}`),a(o,s(i,"url",c,u,10)),a(o,s(i,"referrer",c,u,10)),a(o,s(i,"event",c,u,10)).catch(()=>[])]),g={websiteId:i,range:{startAt:c,endAt:u,days:d},stats:M,pages:l,referrers:m,events:f};!function(e,n,r=3e5){t.set(e,{expires:Date.now()+r,value:n})}(h,g),n.json(g)}catch(t){n.status(500).json({error:t.message||"Unknown error"})}})}}],c=[];export{i as endpoints,o as hooks,c as operations};
+import t from"node:crypto";const e=new Map;let r=null;function n(t,e){const r=t[e];if(!r)throw new Error(`Missing ${e}`);return r.replace(/\/+$/,"")}function a(t){return n(t,"UMAMI_URL").replace(/\/api\/?$/,"")}function s(t,e){const r=e.replace(/^\/api\/?/,"").replace(/^\/+/,"");return`${a(t)}/api/${r}`}function o(t,e){const r=Number(t);return Number.isFinite(r)?r:e}function i(t){return Buffer.from(t).toString("base64").replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function c(e,r){return function(e,r){const n=t.randomBytes(16),a=t.randomBytes(64),s=t.pbkdf2Sync(r,a,1e4,32,"sha512"),o=t.createCipheriv("aes-256-gcm",s,n),i=Buffer.concat([o.update(String(e),"utf8"),o.final()]),c=o.getAuthTag();return Buffer.concat([a,n,c,i]).toString("base64")}(function(e,r){const n=`${i(JSON.stringify({alg:"HS256",typ:"JWT"}))}.${i(JSON.stringify(e))}`;return`${n}.${i(t.createHmac("sha256",r).update(n).digest())}`}(e,r),r)}function u(e){const r=e.UMAMI_USER_ID||e.UMAMI_API_CLIENT_USER_ID,n=e.UMAMI_APP_SECRET||e.UMAMI_API_CLIENT_SECRET;if(!r||!n)return null;return{headers:{Authorization:`Bearer ${c({userId:r},function(...e){return t.createHash("sha512").update(e.join("")).digest("hex")}(n))}`}}}async function d(t){const e=t.UMAMI_API_KEY;if(e)return{headers:{"x-umami-api-key":e}};const a=t.UMAMI_TOKEN;if(a)return{headers:{Authorization:`Bearer ${a}`}};const o=u(t);return o||async function(t){if(r&&r.expires>Date.now())return r.auth;const e=n(t,"UMAMI_USERNAME"),a=n(t,"UMAMI_PASSWORD"),o=await fetch(s(t,"/auth/login"),{method:"POST",headers:{"Content-Type":"application/json",Accept:"application/json"},body:JSON.stringify({username:e,password:a})}),i=await o.text();if(!o.ok)throw new Error(`Umami login failed: ${o.status} ${i}`);let c=null;try{c=i?JSON.parse(i):null}catch{}const u=c?.token||c?.accessToken||c?.data?.token||c?.data?.accessToken,d=o.headers.get("set-cookie")||"",f=u?{headers:{Authorization:`Bearer ${u}`}}:{headers:d?{Cookie:d.split(";")[0]}:{}};return r={expires:Date.now()+33e5,auth:f},f}(t)}async function f(t,e){const r=await d(t),n=await fetch(s(t,e),{headers:{Accept:"application/json",...r.headers}}),a=await n.text();if(!n.ok)throw new Error(`Umami request failed: ${n.status} ${a}`);return a?JSON.parse(a):null}function h(t,e,r,n,a=10){return`/websites/${t}/metrics?${new URLSearchParams({startAt:String(Math.round(r)),endAt:String(Math.round(n)),type:e,limit:String(a)}).toString()}`}const p=[],M=[{name:"umami-analytics",config:(t,r)=>{const n=r.env||process.env;t.get("/health",(t,e)=>{e.json({ok:!0,service:"umami-analytics"})}),t.get("/debug",async(t,e)=>{try{const t=n.UMAMI_API_KEY?"api-key":n.UMAMI_TOKEN?"bearer-token":n.UMAMI_USER_ID||n.UMAMI_API_CLIENT_USER_ID?"api-client":"username-password",r=await f(n,"/me").catch(t=>({error:t.message}));e.json({ok:!0,authMode:t,umamiUrl:a(n),websiteId:n.UMAMI_WEBSITE_ID,me:r})}catch(t){e.status(500).json({error:t.message||"Unknown error"})}}),t.get("/summary",async(t,r)=>{try{const a=String(t.query.websiteId||n.UMAMI_WEBSITE_ID||"");if(!a)return r.status(400).json({error:"Missing websiteId or UMAMI_WEBSITE_ID"});const{startAt:s,endAt:i,days:c}=function(t){const e=Date.now(),r=Math.max(1,Math.min(365,o(t.days,30))),n=o(t.endAt,e);return{startAt:o(t.startAt,n-24*r*60*60*1e3),endAt:n,days:r}}(t.query),u=`summary:${a}:${s}:${i}`,d=function(t){const r=e.get(t);return!r||r.expires<Date.now()?null:r.value}(u);if(d)return r.json(d);const p=new URLSearchParams({startAt:String(Math.round(s)),endAt:String(Math.round(i))}),[M,l,A,m]=await Promise.all([f(n,`/websites/${a}/stats?${p.toString()}`),f(n,h(a,"url",s,i,10)),f(n,h(a,"referrer",s,i,10)),f(n,h(a,"event",s,i,10)).catch(()=>[])]),g={websiteId:a,range:{startAt:s,endAt:i,days:c},stats:M,pages:l,referrers:A,events:m};!function(t,r,n=3e5){e.set(t,{expires:Date.now()+n,value:r})}(u,g),r.json(g)}catch(t){r.status(500).json({error:t.message||"Unknown error"})}})}}],l=[];export{M as endpoints,p as hooks,l as operations};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@koendhoore/directus-extension-umami-analytics",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Directus bundle: secure Umami proxy endpoint + native Insights analytics panel.",
   "type": "module",
   "license": "MIT",

package/src/umami-analytics-endpoint/index.ts

@@ -1,8 +1,9 @@
+import crypto from 'node:crypto';
+
 type Env = Record<string, string | undefined>;
 
 type UmamiAuth = {
   headers: Record<string, string>;
-  cookie?: string;
 };
 
 const FIVE_MINUTES = 5 * 60 * 1000;
@@ -12,7 +13,17 @@ let authCache: { expires: number; auth: UmamiAuth } | null = null;
 function required(env: Env, key: string): string {
   const value = env[key];
   if (!value) throw new Error(`Missing ${key}`);
-  return value.replace(/\/$/, '');
+  return value.replace(/\/+$/, '');
+}
+
+function cleanBaseUrl(env: Env): string {
+  // Accept both https://analytics.example.com and https://analytics.example.com/api
+  return required(env, 'UMAMI_URL').replace(/\/api\/?$/, '');
+}
+
+function apiUrl(env: Env, path: string): string {
+  const cleanPath = path.replace(/^\/api\/?/, '').replace(/^\/+/, '');
+  return `${cleanBaseUrl(env)}/api/${cleanPath}`;
 }
 
 function numberParam(value: unknown, fallback: number) {
@@ -38,36 +49,78 @@ function setCached(key: string, value: unknown, ttlMs = FIVE_MINUTES) {
   cache.set(key, { expires: Date.now() + ttlMs, value });
 }
 
-async function getAuth(env: Env): Promise<UmamiAuth> {
-  const token = env.UMAMI_TOKEN || env.UMAMI_API_KEY;
-  if (token) return { headers: { Authorization: `Bearer ${token}` } };
+function base64url(input: Buffer | string) {
+  return Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+}
+
+function hash(...args: string[]) {
+  return crypto.createHash('sha512').update(args.join('')).digest('hex');
+}
 
+function createJwt(payload: Record<string, unknown>, secret: string) {
+  const header = { alg: 'HS256', typ: 'JWT' };
+  const encodedHeader = base64url(JSON.stringify(header));
+  const encodedPayload = base64url(JSON.stringify(payload));
+  const data = `${encodedHeader}.${encodedPayload}`;
+  const signature = crypto.createHmac('sha256', secret).update(data).digest();
+  return `${data}.${base64url(signature)}`;
+}
+
+function encryptAesGcm(value: string, secret: string) {
+  const iv = crypto.randomBytes(16);
+  const salt = crypto.randomBytes(64);
+  const key = crypto.pbkdf2Sync(secret, salt, 10000, 32, 'sha512');
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+  const encrypted = Buffer.concat([cipher.update(String(value), 'utf8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return Buffer.concat([salt, iv, tag, encrypted]).toString('base64');
+}
+
+function createSecureToken(payload: Record<string, unknown>, secret: string) {
+  return encryptAesGcm(createJwt(payload, secret), secret);
+}
+
+function getApiClientAuth(env: Env): UmamiAuth | null {
+  const userId = env.UMAMI_USER_ID || env.UMAMI_API_CLIENT_USER_ID;
+  const appSecret = env.UMAMI_APP_SECRET || env.UMAMI_API_CLIENT_SECRET;
+
+  if (!userId || !appSecret) return null;
+
+  // This matches @umami/api-client: secret is sha512(APP_SECRET), then createSecureToken({ userId }, secret)
+  const secret = hash(appSecret);
+  const token = createSecureToken({ userId }, secret);
+
+  return { headers: { Authorization: `Bearer ${token}` } };
+}
+
+async function getUsernamePasswordAuth(env: Env): Promise<UmamiAuth> {
   if (authCache && authCache.expires > Date.now()) return authCache.auth;
 
-  const baseUrl = required(env, 'UMAMI_URL');
   const username = required(env, 'UMAMI_USERNAME');
   const password = required(env, 'UMAMI_PASSWORD');
 
-  const response = await fetch(`${baseUrl}/api/auth/login`, {
+  const response = await fetch(apiUrl(env, '/auth/login'), {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
     body: JSON.stringify({ username, password }),
   });
 
+  const text = await response.text();
+
   if (!response.ok) {
-    const text = await response.text();
     throw new Error(`Umami login failed: ${response.status} ${text}`);
   }
 
-  const setCookie = response.headers.get('set-cookie') || '';
   let json: any = null;
   try {
-    json = await response.json();
+    json = text ? JSON.parse(text) : null;
   } catch {
-    // Some Umami versions rely on cookies only.
+    // ignore
   }
 
   const bearer = json?.token || json?.accessToken || json?.data?.token || json?.data?.accessToken;
+  const setCookie = response.headers.get('set-cookie') || '';
+
   const auth: UmamiAuth = bearer
     ? { headers: { Authorization: `Bearer ${bearer}` } }
     : { headers: setCookie ? { Cookie: setCookie.split(';')[0] } : {} };
@@ -76,22 +129,35 @@ async function getAuth(env: Env): Promise<UmamiAuth> {
   return auth;
 }
 
+async function getAuth(env: Env): Promise<UmamiAuth> {
+  const apiKey = env.UMAMI_API_KEY;
+  if (apiKey) return { headers: { 'x-umami-api-key': apiKey } };
+
+  const token = env.UMAMI_TOKEN;
+  if (token) return { headers: { Authorization: `Bearer ${token}` } };
+
+  const apiClientAuth = getApiClientAuth(env);
+  if (apiClientAuth) return apiClientAuth;
+
+  return getUsernamePasswordAuth(env);
+}
+
 async function umamiGet(env: Env, path: string) {
-  const baseUrl = required(env, 'UMAMI_URL');
   const auth = await getAuth(env);
-  const response = await fetch(`${baseUrl}${path}`, {
+  const response = await fetch(apiUrl(env, path), {
     headers: {
       Accept: 'application/json',
       ...auth.headers,
     },
   });
 
+  const text = await response.text();
+
   if (!response.ok) {
-    const text = await response.text();
     throw new Error(`Umami request failed: ${response.status} ${text}`);
   }
 
-  return response.json();
+  return text ? JSON.parse(text) : null;
 }
 
 function metricPath(websiteId: string, type: string, startAt: number, endAt: number, limit = 10) {
@@ -101,7 +167,7 @@ function metricPath(websiteId: string, type: string, startAt: number, endAt: num
     type,
     limit: String(limit),
   });
-  return `/api/websites/${websiteId}/metrics?${params.toString()}`;
+  return `/websites/${websiteId}/metrics?${params.toString()}`;
 }
 
 export default (router: any, context: any) => {
@@ -111,6 +177,30 @@ export default (router: any, context: any) => {
     res.json({ ok: true, service: 'umami-analytics' });
   });
 
+  router.get('/debug', async (_req: any, res: any) => {
+    try {
+      const authMode = env.UMAMI_API_KEY
+        ? 'api-key'
+        : env.UMAMI_TOKEN
+          ? 'bearer-token'
+          : env.UMAMI_USER_ID || env.UMAMI_API_CLIENT_USER_ID
+            ? 'api-client'
+            : 'username-password';
+
+      const me = await umamiGet(env, '/me').catch((error: any) => ({ error: error.message }));
+
+      res.json({
+        ok: true,
+        authMode,
+        umamiUrl: cleanBaseUrl(env),
+        websiteId: env.UMAMI_WEBSITE_ID,
+        me,
+      });
+    } catch (error: any) {
+      res.status(500).json({ error: error.message || 'Unknown error' });
+    }
+  });
+
   router.get('/summary', async (req: any, res: any) => {
     try {
       const websiteId = String(req.query.websiteId || env.UMAMI_WEBSITE_ID || '');
@@ -123,7 +213,7 @@ export default (router: any, context: any) => {
 
       const params = new URLSearchParams({ startAt: String(Math.round(startAt)), endAt: String(Math.round(endAt)) });
       const [stats, pages, referrers, events] = await Promise.all([
-        umamiGet(env, `/api/websites/${websiteId}/stats?${params.toString()}`),
+        umamiGet(env, `/websites/${websiteId}/stats?${params.toString()}`),
         umamiGet(env, metricPath(websiteId, 'url', startAt, endAt, 10)),
         umamiGet(env, metricPath(websiteId, 'referrer', startAt, endAt, 10)),
         umamiGet(env, metricPath(websiteId, 'event', startAt, endAt, 10)).catch(() => []),