cursor-usage-tracker 1.15.0 → 1.17.0

package/README.md

@@ -193,7 +193,6 @@ DASHBOARD_URL=http://localhost:3000
 
 # Optional
 CRON_SECRET=your_secret_here                  # protects the cron endpoint
-DASHBOARD_PASSWORD=your_password              # optional basic auth for the dashboard
 
 # Email alerts via Resend (optional)
 RESEND_API_KEY=re_xxxxxxxxxxxx
@@ -277,13 +276,24 @@ volumes:
 
 </details>
 
-### Cloud platforms
+### Fly.io (recommended free option)
 
-Any platform that supports Docker + persistent volumes works. Tested with:
+```bash
+fly launch --copy-config          # creates the app from fly.toml
+fly volumes create tracker_data --region ams --size 1
+fly secrets set CURSOR_ADMIN_API_KEY=your_key CRON_SECRET=your_secret
+fly deploy
+# Dashboard at https://your-app.fly.dev
+```
+
+Set up hourly collection by adding `DASHBOARD_URL` and `CRON_SECRET` as [GitHub Actions secrets](https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions) — the included `.github/workflows/cron.yml` workflow triggers `/api/cron` every hour.
+
+### Other cloud platforms
+
+Any platform that supports Docker + persistent volumes works:
 
 - **[Render](https://render.com)** — use the deploy button above, or `render.yaml` in this repo
 - **[Railway](https://railway.app)** — create a project from this repo, attach a volume at `/app/data`
-- **[Fly.io](https://fly.io)** — deploy with `fly launch`, create a volume for `/app/data`
 
 > **Note:** Vercel is not supported — SQLite requires a persistent filesystem that Vercel's serverless functions don't provide.
 
@@ -365,6 +375,44 @@ The import uses HiBob's `Group` and `Team` columns (falling back to `Department`
 
 ---
 
+## Authentication
+
+Authentication is **fully optional**. When no auth environment variables are set, the dashboard is open (the default behavior). Setting `AUTH_SECRET` enables Google OAuth sign-in.
+
+### Setup
+
+1. Create a [Google OAuth app](https://console.cloud.google.com/apis/credentials) with redirect URI:
+   - Local: `http://localhost:3000/api/auth/callback/google`
+   - Production: `https://your-domain.com/api/auth/callback/google`
+
+2. Add to your `.env`:
+
+```bash
+AUTH_SECRET=$(openssl rand -base64 32)       # encryption key for sessions
+AUTH_GOOGLE_ID=your-client-id.apps.google... # Google OAuth client ID
+AUTH_GOOGLE_SECRET=GOCSPX-...               # Google OAuth client secret
+AUTH_TRUST_HOST=true                         # required behind a reverse proxy
+AUTH_URL=https://your-domain.com             # public URL (auto-detected locally)
+```
+
+3. Optionally restrict access by domain or specific emails:
+
+```bash
+AUTH_ALLOWED_DOMAIN=yourcompany.com          # only @yourcompany.com emails
+AUTH_ALLOWED_EMAILS=admin@example.com,cto@example.com  # or specific emails
+```
+
+When both are set, either match grants access. When neither is set, any Google account can sign in.
+
+### How It Works
+
+- Sessions use encrypted JWT cookies — no database tables needed
+- The `/api/cron` endpoint is excluded from auth (it uses its own `CRON_SECRET`)
+- Sign-in page appears automatically when auth is enabled
+- User avatar and sign-out menu appear in the nav bar
+
+---
+
 ## API Endpoints
 
 | Endpoint              | Method  | Description                                         |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cursor-usage-tracker",
-  "version": "1.15.0",
+  "version": "1.17.0",
   "description": "Open-source Cursor IDE usage monitoring, anomaly detection, and alerting for enterprise teams",
   "homepage": "https://github.com/ofershap/cursor-usage-tracker#readme",
   "type": "module",
@@ -15,8 +15,8 @@
     "lint": "eslint . && prettier --check .",
     "format": "prettier --write .",
     "prepare": "husky",
-    "collect": "tsx src/lib/cli/collect.ts",
-    "detect": "tsx src/lib/cli/detect.ts",
+    "collect": "npx tsx --env-file=.env src/lib/cli/collect.ts",
+    "detect": "npx tsx --env-file=.env src/lib/cli/detect.ts",
     "generate:mock": "tsx scripts/generate-mock-db.ts",
     "dev:mock": "DATABASE_PATH=data/mock.db next dev"
   },
@@ -73,6 +73,7 @@
     "@tailwindcss/postcss": "^4.1.18",
     "better-sqlite3": "^12.6.2",
     "next": "^16.1.6",
+    "next-auth": "^5.0.0-beta.30",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
     "recharts": "^3.7.0",