@koendhoore/directus-extension-umami-analytics 1.0.0 → 1.0.2

package/dist/api.js

@@ -1 +1 @@
-const t=new Map;let e=null;function n(t,e){const n=t[e];if(!n)throw new Error(`Missing ${e}`);return n.replace(/\/$/,"")}function r(t,e){const n=Number(t);return Number.isFinite(n)?n:e}async function a(t,r){const a=n(t,"UMAMI_URL"),s=await async function(t){const r=t.UMAMI_TOKEN||t.UMAMI_API_KEY;if(r)return{headers:{Authorization:`Bearer ${r}`}};if(e&&e.expires>Date.now())return e.auth;const a=n(t,"UMAMI_URL"),s=n(t,"UMAMI_USERNAME"),o=n(t,"UMAMI_PASSWORD"),i=await fetch(`${a}/api/auth/login`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({username:s,password:o})});if(!i.ok){const t=await i.text();throw new Error(`Umami login failed: ${i.status} ${t}`)}const c=i.headers.get("set-cookie")||"";let u=null;try{u=await i.json()}catch{}const d=u?.token||u?.accessToken||u?.data?.token||u?.data?.accessToken,h=d?{headers:{Authorization:`Bearer ${d}`}}:{headers:c?{Cookie:c.split(";")[0]}:{}};return e={expires:Date.now()+33e5,auth:h},h}(t),o=await fetch(`${a}${r}`,{headers:{Accept:"application/json",...s.headers}});if(!o.ok){const t=await o.text();throw new Error(`Umami request failed: ${o.status} ${t}`)}return o.json()}function s(t,e,n,r,a=10){return`/api/websites/${t}/metrics?${new URLSearchParams({startAt:String(Math.round(n)),endAt:String(Math.round(r)),type:e,limit:String(a)}).toString()}`}const o=[],i=[{name:"umami-analytics",config:(e,n)=>{const o=n.env||process.env;e.get("/health",(t,e)=>{e.json({ok:!0,service:"umami-analytics"})}),e.get("/summary",async(e,n)=>{try{const i=String(e.query.websiteId||o.UMAMI_WEBSITE_ID||"");if(!i)return n.status(400).json({error:"Missing websiteId or UMAMI_WEBSITE_ID"});const{startAt:c,endAt:u,days:d}=function(t){const e=Date.now(),n=Math.max(1,Math.min(365,r(t.days,30))),a=r(t.endAt,e);return{startAt:r(t.startAt,a-24*n*60*60*1e3),endAt:a,days:n}}(e.query),h=`summary:${i}:${c}:${u}`,w=function(e){const n=t.get(e);return!n||n.expires<Date.now()?null:n.value}(h);if(w)return n.json(w);const A=new URLSearchParams({startAt:String(Math.round(c)),endAt:String(Math.round(u))}),[M,l,m,f]=await Promise.all([a(o,`/api/websites/${i}/stats?${A.toString()}`),a(o,s(i,"url",c,u,10)),a(o,s(i,"referrer",c,u,10)),a(o,s(i,"event",c,u,10)).catch(()=>[])]),g={websiteId:i,range:{startAt:c,endAt:u,days:d},stats:M,pages:l,referrers:m,events:f};!function(e,n,r=3e5){t.set(e,{expires:Date.now()+r,value:n})}(h,g),n.json(g)}catch(t){n.status(500).json({error:t.message||"Unknown error"})}})}}],c=[];export{i as endpoints,o as hooks,c as operations};
+import t from"node:crypto";function e(t,e){const r=e.replace(/^\/api\/?/,"").replace(/^\/+/,"");return`${n(t)}/api/${r}`}function r(t){return Buffer.from(t).toString("base64").replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function n(t){return c(t,"UMAMI_URL").replace(/\/api\/?$/,"")}function a(e,n){return function(e,r){const n=t.randomBytes(16),a=t.randomBytes(64),s=t.pbkdf2Sync(r,a,1e4,32,"sha512"),o=t.createCipheriv("aes-256-gcm",s,n),i=Buffer.concat([o.update(String(e),"utf8"),o.final()]),c=o.getAuthTag();return Buffer.concat([a,n,c,i]).toString("base64")}(function(e,n){const a=`${r(JSON.stringify({alg:"HS256",typ:"JWT"}))}.${r(JSON.stringify(e))}`;return`${a}.${r(t.createHmac("sha256",n).update(a).digest())}`}(e,n),n)}function s(e){const r=e.UMAMI_USER_ID||e.UMAMI_API_CLIENT_USER_ID,n=e.UMAMI_APP_SECRET||e.UMAMI_API_CLIENT_SECRET;if(!r||!n)return null;return{headers:{Authorization:`Bearer ${a({userId:r},function(...e){return t.createHash("sha512").update(e.join("")).digest("hex")}(n))}`}}}async function o(t){const r=t.UMAMI_API_KEY;if(r)return{headers:{"x-umami-api-key":r}};const n=t.UMAMI_TOKEN;if(n)return{headers:{Authorization:`Bearer ${n}`}};const a=s(t);return a||async function(t){if(M&&M.expires>Date.now())return M.auth;const r=c(t,"UMAMI_USERNAME"),n=c(t,"UMAMI_PASSWORD"),a=await fetch(e(t,"/auth/login"),{method:"POST",headers:{"Content-Type":"application/json",Accept:"application/json"},body:JSON.stringify({username:r,password:n})}),s=await a.text();if(!a.ok)throw new Error(`Umami login failed: ${a.status} ${s}`);let o=null;try{o=s?JSON.parse(s):null}catch{}const i=o?.token||o?.accessToken||o?.data?.token||o?.data?.accessToken,u=a.headers.get("set-cookie")||"",d=i?{headers:{Authorization:`Bearer ${i}`}}:{headers:u?{Cookie:u.split(";")[0]}:{}};return M={expires:Date.now()+33e5,auth:d},d}(t)}function i(t,e){const r=Number(t);return Number.isFinite(r)?r:e}function c(t,e){const r=t[e];if(!r)throw new Error(`Missing ${e}`);return r.replace(/\/+$/,"")}async function u(t,r){const n=await o(t),a=await fetch(e(t,r),{headers:{Accept:"application/json",...n.headers}}),s=await a.text();if(!a.ok)throw new Error(`Umami request failed: ${a.status} ${s}`);return s?JSON.parse(s):null}const d=3e5,f=new Map;let M=null;const m=[],p=[{name:"umami-analytics",config:(t,e)=>{const r=e.env||process.env;t.get("/health",(t,e)=>{e.json({ok:!0,service:"umami-analytics"})}),t.get("/debug",async(t,e)=>{try{const t=r.UMAMI_API_KEY?"api-key":r.UMAMI_TOKEN?"bearer-token":r.UMAMI_USER_ID||r.UMAMI_API_CLIENT_USER_ID?"api-client":"username-password",a=await u(r,"/me").catch(t=>({error:t.message}));e.json({ok:!0,authMode:t,umamiUrl:n(r),websiteId:r.UMAMI_WEBSITE_ID,me:a})}catch(t){e.status(500).json({error:t.message||"Unknown error"})}}),t.get("/summary",async(t,e)=>{try{const n=String(t.query.websiteId||r.UMAMI_WEBSITE_ID||"");if(!n)return e.status(400).json({error:"Missing websiteId or UMAMI_WEBSITE_ID"});const{startAt:a,endAt:s,days:o}=function(t){const e=Date.now(),r=Math.max(1,Math.min(365,i(t.days,30))),n=i(t.endAt,e);return{startAt:i(t.startAt,n-24*r*60*60*1e3),endAt:n,days:r}}(t.query),c=`summary:${n}:${a}:${s}`,M=function(t){const e=f.get(t);return!e||e.expires<Date.now()?null:e.value}(c);if(M)return e.json(M);const m=r.UMAMI_TIMEZONE||"Europe/Brussels",p=new URLSearchParams({startAt:String(Math.round(a)),endAt:String(Math.round(s)),unit:"day",timezone:m}),h=(t,e=10)=>new URLSearchParams({startAt:String(Math.round(a)),endAt:String(Math.round(s)),type:t,limit:String(e),timezone:m}),[l,A,g,I]=await Promise.all([u(r,`/websites/${n}/stats?${p.toString()}`),u(r,`/websites/${n}/metrics?${h("url").toString()}`),u(r,`/websites/${n}/metrics?${h("referrer").toString()}`),u(r,`/websites/${n}/metrics?${h("event").toString()}`).catch(()=>[])]),S={websiteId:n,range:{startAt:a,endAt:s,days:o},stats:l,pages:A,referrers:g,events:I};!function(t,e,r=d){f.set(t,{expires:Date.now()+r,value:e})}(c,S),e.json(S)}catch(t){e.status(500).json({error:t.message||"Unknown error"})}})}}],h=[];export{p as endpoints,m as hooks,h as operations};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@koendhoore/directus-extension-umami-analytics",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Directus bundle: secure Umami proxy endpoint + native Insights analytics panel.",
   "type": "module",
   "license": "MIT",

package/src/umami-analytics-endpoint/index.ts

@@ -1,31 +1,18 @@
+import crypto from "node:crypto";
+
 type Env = Record<string, string | undefined>;
 
 type UmamiAuth = {
   headers: Record<string, string>;
-  cookie?: string;
 };
 
-const FIVE_MINUTES = 5 * 60 * 1000;
-const cache = new Map<string, { expires: number; value: unknown }>();
-let authCache: { expires: number; auth: UmamiAuth } | null = null;
-
-function required(env: Env, key: string): string {
-  const value = env[key];
-  if (!value) throw new Error(`Missing ${key}`);
-  return value.replace(/\/$/, '');
-}
-
-function numberParam(value: unknown, fallback: number) {
-  const parsed = Number(value);
-  return Number.isFinite(parsed) ? parsed : fallback;
+function apiUrl(env: Env, path: string): string {
+  const cleanPath = path.replace(/^\/api\/?/, '').replace(/^\/+/, '');
+  return `${cleanBaseUrl(env)}/api/${cleanPath}`;
 }
 
-function getRange(query: Record<string, unknown>) {
-  const now = Date.now();
-  const days = Math.max(1, Math.min(365, numberParam(query.days, 30)));
-  const endAt = numberParam(query.endAt, now);
-  const startAt = numberParam(query.startAt, endAt - days * 24 * 60 * 60 * 1000);
-  return { startAt, endAt, days };
+function base64url(input: Buffer | string) {
+  return Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
 }
 
 function cached<T>(key: string): T | null {
@@ -34,40 +21,96 @@ function cached<T>(key: string): T | null {
   return hit.value as T;
 }
 
-function setCached(key: string, value: unknown, ttlMs = FIVE_MINUTES) {
-  cache.set(key, { expires: Date.now() + ttlMs, value });
+function cleanBaseUrl(env: Env): string {
+  // Accept both https://analytics.example.com and https://analytics.example.com/api
+  return required(env, 'UMAMI_URL').replace(/\/api\/?$/, '');
+}
+
+function createJwt(payload: Record<string, unknown>, secret: string) {
+  const header = { alg: 'HS256', typ: 'JWT' };
+  const encodedHeader = base64url(JSON.stringify(header));
+  const encodedPayload = base64url(JSON.stringify(payload));
+  const data = `${encodedHeader}.${encodedPayload}`;
+  const signature = crypto.createHmac('sha256', secret).update(data).digest();
+  return `${data}.${base64url(signature)}`;
+}
+
+function createSecureToken(payload: Record<string, unknown>, secret: string) {
+  return encryptAesGcm(createJwt(payload, secret), secret);
+}
+
+function encryptAesGcm(value: string, secret: string) {
+  const iv = crypto.randomBytes(16);
+  const salt = crypto.randomBytes(64);
+  const key = crypto.pbkdf2Sync(secret, salt, 10000, 32, 'sha512');
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+  const encrypted = Buffer.concat([cipher.update(String(value), 'utf8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return Buffer.concat([salt, iv, tag, encrypted]).toString('base64');
+}
+
+function getApiClientAuth(env: Env): UmamiAuth | null {
+  const userId = env.UMAMI_USER_ID || env.UMAMI_API_CLIENT_USER_ID;
+  const appSecret = env.UMAMI_APP_SECRET || env.UMAMI_API_CLIENT_SECRET;
+
+  if (!userId || !appSecret) return null;
+
+  // This matches @umami/api-client: secret is sha512(APP_SECRET), then createSecureToken({ userId }, secret)
+  const secret = hash(appSecret);
+  const token = createSecureToken({ userId }, secret);
+
+  return { headers: { Authorization: `Bearer ${token}` } };
 }
 
 async function getAuth(env: Env): Promise<UmamiAuth> {
-  const token = env.UMAMI_TOKEN || env.UMAMI_API_KEY;
+  const apiKey = env.UMAMI_API_KEY;
+  if (apiKey) return { headers: { 'x-umami-api-key': apiKey } };
+
+  const token = env.UMAMI_TOKEN;
   if (token) return { headers: { Authorization: `Bearer ${token}` } };
 
+  const apiClientAuth = getApiClientAuth(env);
+  if (apiClientAuth) return apiClientAuth;
+
+  return getUsernamePasswordAuth(env);
+}
+
+function getRange(query: Record<string, unknown>) {
+  const now = Date.now();
+  const days = Math.max(1, Math.min(365, numberParam(query.days, 30)));
+  const endAt = numberParam(query.endAt, now);
+  const startAt = numberParam(query.startAt, endAt - days * 24 * 60 * 60 * 1000);
+  return { startAt, endAt, days };
+}
+
+async function getUsernamePasswordAuth(env: Env): Promise<UmamiAuth> {
   if (authCache && authCache.expires > Date.now()) return authCache.auth;
 
-  const baseUrl = required(env, 'UMAMI_URL');
   const username = required(env, 'UMAMI_USERNAME');
   const password = required(env, 'UMAMI_PASSWORD');
 
-  const response = await fetch(`${baseUrl}/api/auth/login`, {
+  const response = await fetch(apiUrl(env, '/auth/login'), {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
     body: JSON.stringify({ username, password }),
   });
 
+  const text = await response.text();
+
   if (!response.ok) {
-    const text = await response.text();
     throw new Error(`Umami login failed: ${response.status} ${text}`);
   }
 
-  const setCookie = response.headers.get('set-cookie') || '';
   let json: any = null;
   try {
-    json = await response.json();
+    json = text ? JSON.parse(text) : null;
   } catch {
-    // Some Umami versions rely on cookies only.
+    // ignore
   }
 
   const bearer = json?.token || json?.accessToken || json?.data?.token || json?.data?.accessToken;
+  const setCookie = response.headers.get('set-cookie') || '';
+
   const auth: UmamiAuth = bearer
     ? { headers: { Authorization: `Bearer ${bearer}` } }
     : { headers: setCookie ? { Cookie: setCookie.split(';')[0] } : {} };
@@ -76,33 +119,56 @@ async function getAuth(env: Env): Promise<UmamiAuth> {
   return auth;
 }
 
+function hash(...args: string[]) {
+  return crypto.createHash('sha512').update(args.join('')).digest('hex');
+}
+
+function metricPath(websiteId: string, type: string, startAt: number, endAt: number, limit = 10) {
+  const params = new URLSearchParams({
+    startAt: String(Math.round(startAt)),
+    endAt: String(Math.round(endAt)),
+    type,
+    limit: String(limit),
+  });
+  return `/websites/${websiteId}/metrics?${params.toString()}`;
+}
+
+function numberParam(value: unknown, fallback: number) {
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : fallback;
+}
+
+function required(env: Env, key: string): string {
+  const value = env[key];
+  if (!value) throw new Error(`Missing ${key}`);
+  return value.replace(/\/+$/, '');
+}
+
+function setCached(key: string, value: unknown, ttlMs = FIVE_MINUTES) {
+  cache.set(key, { expires: Date.now() + ttlMs, value });
+}
+
 async function umamiGet(env: Env, path: string) {
-  const baseUrl = required(env, 'UMAMI_URL');
   const auth = await getAuth(env);
-  const response = await fetch(`${baseUrl}${path}`, {
+  const response = await fetch(apiUrl(env, path), {
     headers: {
       Accept: 'application/json',
       ...auth.headers,
     },
   });
 
+  const text = await response.text();
+
   if (!response.ok) {
-    const text = await response.text();
     throw new Error(`Umami request failed: ${response.status} ${text}`);
   }
 
-  return response.json();
+  return text ? JSON.parse(text) : null;
 }
 
-function metricPath(websiteId: string, type: string, startAt: number, endAt: number, limit = 10) {
-  const params = new URLSearchParams({
-    startAt: String(Math.round(startAt)),
-    endAt: String(Math.round(endAt)),
-    type,
-    limit: String(limit),
-  });
-  return `/api/websites/${websiteId}/metrics?${params.toString()}`;
-}
+const FIVE_MINUTES = 5 * 60 * 1000;
+const cache = new Map<string, { expires: number; value: unknown }>();
+let authCache: { expires: number; auth: UmamiAuth } | null = null;
 
 export default (router: any, context: any) => {
   const env: Env = context.env || process.env;
@@ -111,29 +177,110 @@ export default (router: any, context: any) => {
     res.json({ ok: true, service: 'umami-analytics' });
   });
 
-  router.get('/summary', async (req: any, res: any) => {
+  router.get('/debug', async (_req: any, res: any) => {
     try {
-      const websiteId = String(req.query.websiteId || env.UMAMI_WEBSITE_ID || '');
-      if (!websiteId) return res.status(400).json({ error: 'Missing websiteId or UMAMI_WEBSITE_ID' });
-
-      const { startAt, endAt, days } = getRange(req.query);
-      const key = `summary:${websiteId}:${startAt}:${endAt}`;
-      const hit = cached(key);
-      if (hit) return res.json(hit);
-
-      const params = new URLSearchParams({ startAt: String(Math.round(startAt)), endAt: String(Math.round(endAt)) });
-      const [stats, pages, referrers, events] = await Promise.all([
-        umamiGet(env, `/api/websites/${websiteId}/stats?${params.toString()}`),
-        umamiGet(env, metricPath(websiteId, 'url', startAt, endAt, 10)),
-        umamiGet(env, metricPath(websiteId, 'referrer', startAt, endAt, 10)),
-        umamiGet(env, metricPath(websiteId, 'event', startAt, endAt, 10)).catch(() => []),
-      ]);
-
-      const payload = { websiteId, range: { startAt, endAt, days }, stats, pages, referrers, events };
-      setCached(key, payload);
-      res.json(payload);
+      const authMode = env.UMAMI_API_KEY
+        ? 'api-key'
+        : env.UMAMI_TOKEN
+          ? 'bearer-token'
+          : env.UMAMI_USER_ID || env.UMAMI_API_CLIENT_USER_ID
+            ? 'api-client'
+            : 'username-password';
+
+      const me = await umamiGet(env, '/me').catch((error: any) => ({ error: error.message }));
+
+      res.json({
+        ok: true,
+        authMode,
+        umamiUrl: cleanBaseUrl(env),
+        websiteId: env.UMAMI_WEBSITE_ID,
+        me,
+      });
     } catch (error: any) {
       res.status(500).json({ error: error.message || 'Unknown error' });
     }
   });
+
+  router.get('/summary', async (req: any, res: any) => {
+  try {
+    const websiteId = String(req.query.websiteId || env.UMAMI_WEBSITE_ID || '');
+
+    if (!websiteId) {
+      return res.status(400).json({
+        error: 'Missing websiteId or UMAMI_WEBSITE_ID',
+      });
+    }
+
+    const { startAt, endAt, days } = getRange(req.query);
+
+    const key = `summary:${websiteId}:${startAt}:${endAt}`;
+
+    const hit = cached(key);
+
+    if (hit) {
+      return res.json(hit);
+    }
+
+    const timezone = env.UMAMI_TIMEZONE || 'Europe/Brussels';
+
+    const statsParams = new URLSearchParams({
+      startAt: String(Math.round(startAt)),
+      endAt: String(Math.round(endAt)),
+      unit: 'day',
+      timezone,
+    });
+
+    const metricsParams = (type: string, limit = 10) =>
+      new URLSearchParams({
+        startAt: String(Math.round(startAt)),
+        endAt: String(Math.round(endAt)),
+        type,
+        limit: String(limit),
+        timezone,
+      });
+
+    const [stats, pages, referrers, events] = await Promise.all([
+      umamiGet(
+        env,
+        `/websites/${websiteId}/stats?${statsParams.toString()}`
+      ),
+
+      umamiGet(
+        env,
+        `/websites/${websiteId}/metrics?${metricsParams('url').toString()}`
+      ),
+
+      umamiGet(
+        env,
+        `/websites/${websiteId}/metrics?${metricsParams('referrer').toString()}`
+      ),
+
+      umamiGet(
+        env,
+        `/websites/${websiteId}/metrics?${metricsParams('event').toString()}`
+      ).catch(() => []),
+    ]);
+
+    const payload = {
+      websiteId,
+      range: {
+        startAt,
+        endAt,
+        days,
+      },
+      stats,
+      pages,
+      referrers,
+      events,
+    };
+
+    setCached(key, payload);
+
+    res.json(payload);
+  } catch (error: any) {
+    res.status(500).json({
+      error: error.message || 'Unknown error',
+    });
+  }
+});
 };