domma-cms 0.15.0 → 0.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",
@@ -73,7 +73,7 @@
     "@fastify/rate-limit": "^10.3.0",
     "@fastify/static": "9.1.1",
     "bcryptjs": "^3.0.3",
-    "domma-js": "^0.23.0",
+    "domma-js": "^0.24.0",
     "dotenv": "^17.2.3",
     "fastify": "5.8.5",
     "gray-matter": "^4.0.3",

package/plugins/analytics/admin/templates/analytics.html

@@ -1,9 +1,60 @@
 <div class="view-header">
     <h1><span data-icon="chart-bar"></span> Analytics</h1>
-    <button id="reset-btn" class="btn btn-ghost btn-sm">Reset stats</button>
+    <div class="d-flex gap-2">
+        <button id="export-btn" class="btn btn-ghost btn-sm" type="button">
+            <span data-icon="download"></span> Export CSV
+        </button>
+        <button id="reset-btn" class="btn btn-ghost btn-sm">
+            <span data-icon="trash"></span> Reset stats
+        </button>
+    </div>
+</div>
+
+<div class="card mb-4">
+    <div class="card-body">
+        <div id="range-tabs" class="d-flex gap-2 flex-wrap">
+            <button class="btn btn-ghost btn-sm range-btn" data-range="today">Today</button>
+            <button class="btn btn-ghost btn-sm range-btn active" data-range="7d">Last 7 days</button>
+            <button class="btn btn-ghost btn-sm range-btn" data-range="30d">Last 30 days</button>
+            <button class="btn btn-ghost btn-sm range-btn" data-range="90d">Last 90 days</button>
+            <button class="btn btn-ghost btn-sm range-btn" data-range="all">All time</button>
+        </div>
+    </div>
+</div>
+
+<div class="grid grid-cols-3 gap-4 mb-4">
+    <div class="card">
+        <div class="card-body">
+            <div class="text-muted text-sm">Hits in range</div>
+            <div class="h2 mb-0" id="kpi-range">—</div>
+        </div>
+    </div>
+    <div class="card">
+        <div class="card-body">
+            <div class="text-muted text-sm">Unique pages</div>
+            <div class="h2 mb-0" id="kpi-pages">—</div>
+        </div>
+    </div>
+    <div class="card">
+        <div class="card-body">
+            <div class="text-muted text-sm">Lifetime hits</div>
+            <div class="h2 mb-0" id="kpi-lifetime">—</div>
+        </div>
+    </div>
+</div>
+
+<div class="card mb-4">
+    <div class="card-header"><strong>Hits over time</strong></div>
+    <div class="card-body">
+        <canvas id="trend-chart" height="90"></canvas>
+    </div>
 </div>
 
 <div class="card">
+    <div class="card-header d-flex justify-content-between align-items-center">
+        <strong>Top pages</strong>
+        <input id="filter-input" type="search" class="form-control form-control-sm" placeholder="Filter URL…" style="max-width: 240px;">
+    </div>
     <div class="card-body">
         <div id="analytics-table"></div>
     </div>

package/plugins/analytics/admin/views/analytics.js

@@ -1,51 +1,176 @@
 /**
  * Analytics Plugin — Admin View
- * Shows a sortable table of page hit counts.
- * Loaded dynamically from /plugins/ static path.
+ * KPI cards, trend chart (Chart.js via CDN), filterable top-pages table, CSV export.
  */
-export const analyticsView = {
-    templateUrl: '/plugins/example-analytics/admin/templates/analytics.html',
+const CHART_CDN = 'https://cdn.jsdelivr.net/npm/chart.js@4.4.1/dist/chart.umd.min.js';
 
-    async onMount($container) {
-        await loadStats($container);
+let chartInstance = null;
+let currentRange = '7d';
+let currentTop = [];
+let filterTerm = '';
 
-        $container.find('#reset-btn').on('click', async () => {
-            const confirmed = await E.confirm('Reset all analytics data? This cannot be undone.');
-            if (!confirmed) return;
-            try {
-              await fetch('/api/plugins/example-analytics/stats', {
-                method: 'DELETE',
-                headers: {'Authorization': 'Bearer ' + (S.get('auth_token') || '')}
-              });
-                E.toast('Analytics reset.', { type: 'success' });
-                await loadStats($container);
-            } catch {
-                E.toast('Reset failed.', { type: 'error' });
-            }
-        });
+export const analyticsView = {
+    templateUrl: '/plugins/analytics/admin/templates/analytics.html',
 
+    async onMount($container) {
+        await ensureChartJs();
+        await refresh($container, currentRange);
+        wireRangeTabs($container);
+        wireExport($container);
+        wireReset($container);
+        wireFilter($container);
         Domma.icons.scan();
     }
 };
 
-async function loadStats($container) {
-    let stats = [];
+function authHeaders() {
+    return { 'Authorization': 'Bearer ' + (S.get('auth_token') || '') };
+}
+
+function ensureChartJs() {
+    if (window.Chart) return Promise.resolve();
+    return new Promise((resolve, reject) => {
+        const s = document.createElement('script');
+        s.src = CHART_CDN;
+        s.async = true;
+        s.onload = () => resolve();
+        s.onerror = () => reject(new Error('chart.js load failed'));
+        document.head.appendChild(s);
+    });
+}
+
+async function refresh($container, range) {
+    currentRange = range;
     try {
-      const res = await fetch('/api/plugins/example-analytics/stats', {
-        headers: {'Authorization': 'Bearer ' + (S.get('auth_token') || '')}
-      });
-      if (!res.ok) throw new Error(`HTTP ${res.status}`);
-        stats = await res.json();
-    } catch {
+        const [stats, series] = await Promise.all([
+            fetch('/api/plugins/analytics/stats?range=' + encodeURIComponent(range), { headers: authHeaders() })
+                .then((r) => r.json()),
+            fetch('/api/plugins/analytics/series?range=' + encodeURIComponent(range === 'all' ? '30d' : range), { headers: authHeaders() })
+                .then((r) => r.json())
+        ]);
+
+        $container.find('#kpi-range').text(stats.total.toLocaleString());
+        $container.find('#kpi-pages').text(stats.uniquePages.toLocaleString());
+        $container.find('#kpi-lifetime').text(stats.lifetimeTotal.toLocaleString());
+
+        currentTop = stats.top || [];
+        renderTable($container);
+        renderChart($container, series.series || []);
+        updateExportLink($container);
+    } catch (err) {
         E.toast('Could not load analytics data.', { type: 'error' });
     }
+}
+
+function renderTable($container) {
+    const filtered = filterTerm
+        ? currentTop.filter((row) => row.url.toLowerCase().includes(filterTerm))
+        : currentTop;
 
     T.create('#analytics-table', {
-        data: stats,
+        data: filtered,
         columns: [
-          {key: 'url', title: 'Page URL', render: (val) => `<code>${val}</code>`},
-          {key: 'hits', title: 'Page views'}
+            { key: 'url', title: 'Page URL', render: (val) => `<code>${val}</code>` },
+            { key: 'hits', title: 'Page views' }
         ],
-        emptyMessage: 'No page views recorded yet.'
+        emptyMessage: filterTerm ? 'No pages match that filter.' : 'No page views recorded yet.'
+    });
+}
+
+function renderChart($container, series) {
+    const canvas = $container.find('#trend-chart').get(0);
+    if (!canvas || !window.Chart) return;
+    if (chartInstance) {
+        chartInstance.destroy();
+        chartInstance = null;
+    }
+    chartInstance = new window.Chart(canvas, {
+        type: 'line',
+        data: {
+            labels: series.map((p) => p.date),
+            datasets: [{
+                label: 'Hits',
+                data: series.map((p) => p.hits),
+                borderColor: 'rgba(99, 102, 241, 1)',
+                backgroundColor: 'rgba(99, 102, 241, 0.15)',
+                fill: true,
+                tension: 0.3,
+                borderWidth: 2,
+                pointRadius: 2
+            }]
+        },
+        options: {
+            responsive: true,
+            maintainAspectRatio: false,
+            plugins: { legend: { display: false } },
+            scales: {
+                y: { beginAtZero: true, ticks: { precision: 0 } },
+                x: { ticks: { maxRotation: 0, autoSkip: true, maxTicksLimit: 10 } }
+            }
+        }
+    });
+}
+
+function wireRangeTabs($container) {
+    $container.find('.range-btn').on('click', function () {
+        const btn = $(this);
+        $container.find('.range-btn').removeClass('active');
+        btn.addClass('active');
+        refresh($container, btn.attr('data-range'));
+    });
+}
+
+function wireExport($container) {
+    $container.find('#export-btn').on('click', async () => {
+        try {
+            const res = await fetch('/api/plugins/analytics/export.csv?range=' + encodeURIComponent(currentRange), {
+                headers: authHeaders()
+            });
+            if (!res.ok) throw new Error('export failed');
+            const blob = await res.blob();
+            const cd = res.headers.get('Content-Disposition') || '';
+            const match = cd.match(/filename="?([^"]+)"?/);
+            const filename = match ? match[1] : 'analytics.csv';
+            const url = URL.createObjectURL(blob);
+            const a = document.createElement('a');
+            a.href = url;
+            a.download = filename;
+            document.body.appendChild(a);
+            a.click();
+            a.remove();
+            URL.revokeObjectURL(url);
+        } catch {
+            E.toast('Export failed.', { type: 'error' });
+        }
+    });
+}
+
+function updateExportLink() {
+    // no-op; export button uses fetch+blob to preserve Bearer auth
+}
+
+function wireReset($container) {
+    $container.find('#reset-btn').on('click', async () => {
+        const confirmed = await E.confirm('Reset all analytics data? This cannot be undone.');
+        if (!confirmed) return;
+        try {
+            const res = await fetch('/api/plugins/analytics/stats', {
+                method: 'DELETE',
+                headers: authHeaders()
+            });
+            if (!res.ok) throw new Error('reset failed');
+            E.toast('Analytics reset.', { type: 'success' });
+            await refresh($container, currentRange);
+        } catch {
+            E.toast('Reset failed.', { type: 'error' });
+        }
+    });
+}
+
+function wireFilter($container) {
+    const input = $container.find('#filter-input');
+    input.on('input', () => {
+        filterTerm = (input.val() || '').toString().toLowerCase().trim();
+        renderTable($container);
     });
 }

package/plugins/analytics/config.js

@@ -1,6 +1,14 @@
 /**
- * Example Analytics Plugin — Default Configuration
+ * Analytics Plugin — Default Configuration
+ *
+ * excludeAdmin   strip /admin pageviews before recording
+ * excludePaths   array of path prefixes to ignore (e.g. ['/api', '/healthz'])
+ * honourDnt      respect navigator.doNotTrack on the client
+ * sessionDedup   only record one hit per URL per browser session
  */
 export default {
-    excludeAdmin: true
+    excludeAdmin: true,
+    excludePaths: ['/api'],
+    honourDnt: true,
+    sessionDedup: true
 };

package/plugins/analytics/plugin.js

@@ -1,58 +1,247 @@
 /**
  * Analytics Plugin — Server
- * Tracks page hits in a JSON file alongside the plugin.
- * Endpoints:
- *   POST   /api/plugins/analytics/hit    - public: record a hit { url }
- *   GET    /api/plugins/analytics/stats  - admin: return all hit counts
- *   DELETE /api/plugins/analytics/stats  - admin: reset all stats
+ * Tracks page hits with per-day buckets so we can chart trends and
+ * filter by time range.
+ *
+ * Storage:
+ *   lifetime.json  { "/url": totalHits }
+ *   daily.json     { "YYYY-MM-DD": { "/url": hits } }
+ *
+ * Endpoints (mounted at /api/plugins/analytics):
+ *   POST   /hit            public  record a hit { url, dnt }
+ *   GET    /stats          admin   summary + top pages (?range=today|7d|30d|90d|all|custom&from=&to=)
+ *   GET    /series         admin   per-day totals series (?days=N or ?from=&to=)
+ *   GET    /export.csv     admin   CSV export of top pages for the active range
+ *   DELETE /stats          admin   reset all stats
  */
 import fs from 'fs/promises';
 import path from 'path';
 import {fileURLToPath} from 'url';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const STATS_FILE = path.join(__dirname, 'stats.json');
+const LIFETIME_FILE = path.join(__dirname, 'lifetime.json');
+const DAILY_FILE = path.join(__dirname, 'daily.json');
+const LEGACY_FILE = path.join(__dirname, 'stats.json');
 
-async function readStats() {
+async function readJson(file, fallback) {
     try {
-        return JSON.parse(await fs.readFile(STATS_FILE, 'utf8'));
+        return JSON.parse(await fs.readFile(file, 'utf8'));
     } catch {
-        return {};
+        return fallback;
     }
 }
 
-async function writeStats(stats) {
-    await fs.writeFile(STATS_FILE, JSON.stringify(stats, null, 2) + '\n', 'utf8');
+async function writeJson(file, data) {
+    const tmp = file + '.tmp';
+    await fs.writeFile(tmp, JSON.stringify(data, null, 2) + '\n', 'utf8');
+    await fs.rename(tmp, file);
+}
+
+/**
+ * One-shot migration from the legacy flat stats.json.
+ * Preserves existing totals as lifetime numbers; daily history starts empty.
+ */
+async function migrateLegacy() {
+    try {
+        await fs.access(LIFETIME_FILE);
+        return; // already migrated
+    } catch {
+        // fall through
+    }
+    const legacy = await readJson(LEGACY_FILE, null);
+    if (legacy && typeof legacy === 'object') {
+        await writeJson(LIFETIME_FILE, legacy);
+        await writeJson(DAILY_FILE, {});
+        // keep stats.json on disk as a backup; the next reset will wipe it
+    } else {
+        await writeJson(LIFETIME_FILE, {});
+        await writeJson(DAILY_FILE, {});
+    }
+}
+
+function todayKey(date = new Date()) {
+    return date.toISOString().slice(0, 10);
+}
+
+function rangeToDates(range, from, to) {
+    const today = new Date();
+    today.setUTCHours(0, 0, 0, 0);
+    const end = to ? new Date(to + 'T00:00:00Z') : today;
+    let start;
+    switch (range) {
+        case 'today':
+            start = today;
+            break;
+        case '7d':
+            start = new Date(today);
+            start.setUTCDate(start.getUTCDate() - 6);
+            break;
+        case '30d':
+            start = new Date(today);
+            start.setUTCDate(start.getUTCDate() - 29);
+            break;
+        case '90d':
+            start = new Date(today);
+            start.setUTCDate(start.getUTCDate() - 89);
+            break;
+        case 'custom':
+            start = from ? new Date(from + 'T00:00:00Z') : today;
+            break;
+        case 'all':
+        default:
+            return null; // all-time → use lifetime aggregate
+    }
+    return { start, end };
+}
+
+function aggregateDaily(daily, start, end) {
+    const totals = {};
+    let total = 0;
+    const startMs = start.getTime();
+    const endMs = end.getTime();
+    for (const [day, urls] of Object.entries(daily)) {
+        const dayMs = new Date(day + 'T00:00:00Z').getTime();
+        if (dayMs < startMs || dayMs > endMs) continue;
+        for (const [url, hits] of Object.entries(urls)) {
+            totals[url] = (totals[url] || 0) + hits;
+            total += hits;
+        }
+    }
+    return { totals, total };
+}
+
+function buildSeries(daily, start, end) {
+    const series = [];
+    const cursor = new Date(start);
+    while (cursor.getTime() <= end.getTime()) {
+        const key = todayKey(cursor);
+        const day = daily[key] || {};
+        const hits = Object.values(day).reduce((acc, n) => acc + n, 0);
+        series.push({ date: key, hits });
+        cursor.setUTCDate(cursor.getUTCDate() + 1);
+    }
+    return series;
+}
+
+function escapeCsvCell(value) {
+    const str = String(value ?? '');
+    if (/[",\n\r]/.test(str)) {
+        return '"' + str.replace(/"/g, '""') + '"';
+    }
+    return str;
 }
 
 export default async function analyticsPlugin(fastify, options) {
-  const {authenticate, requireAdmin} = options.auth;
+    const { authenticate, requireAdmin } = options.auth;
+    const settings = options.settings || {};
+
+    await migrateLegacy();
 
-  // Record a page hit — called by the client-side injection script (public)
     fastify.post('/hit', async (request, reply) => {
-        const { url } = request.body || {};
+        const { url, dnt } = request.body || {};
         if (!url || typeof url !== 'string') {
             return reply.status(400).send({ error: 'url is required' });
         }
+        if (dnt === true || dnt === '1') {
+            return { ok: true, ignored: 'dnt' };
+        }
+
+        const normalised = url.split('?')[0].split('#')[0].replace(/\/+$/, '') || '/';
+        if (settings.excludeAdmin && normalised.startsWith('/admin')) {
+            return { ok: true, ignored: 'admin' };
+        }
+        if (Array.isArray(settings.excludePaths)) {
+            for (const prefix of settings.excludePaths) {
+                if (typeof prefix === 'string' && prefix && normalised.startsWith(prefix)) {
+                    return { ok: true, ignored: 'excluded' };
+                }
+            }
+        }
 
-        const normalised = url.split('?')[0].replace(/\/$/, '') || '/';
-        const stats = await readStats();
-        stats[normalised] = (stats[normalised] || 0) + 1;
-        await writeStats(stats);
+        const today = todayKey();
+        const [lifetime, daily] = await Promise.all([
+            readJson(LIFETIME_FILE, {}),
+            readJson(DAILY_FILE, {})
+        ]);
+        lifetime[normalised] = (lifetime[normalised] || 0) + 1;
+        if (!daily[today]) daily[today] = {};
+        daily[today][normalised] = (daily[today][normalised] || 0) + 1;
+        await Promise.all([writeJson(LIFETIME_FILE, lifetime), writeJson(DAILY_FILE, daily)]);
         return { ok: true };
     });
 
-  // Return all stats — admin only
-  fastify.get('/stats', {preHandler: [authenticate, requireAdmin]}, async () => {
-        const stats = await readStats();
-        return Object.entries(stats)
+    fastify.get('/stats', { preHandler: [authenticate, requireAdmin] }, async (request) => {
+        const { range = '30d', from, to } = request.query || {};
+        const dates = rangeToDates(range, from, to);
+        const [lifetime, daily] = await Promise.all([
+            readJson(LIFETIME_FILE, {}),
+            readJson(DAILY_FILE, {})
+        ]);
+
+        let totals;
+        let total;
+        if (!dates) {
+            totals = lifetime;
+            total = Object.values(lifetime).reduce((acc, n) => acc + n, 0);
+        } else {
+            const agg = aggregateDaily(daily, dates.start, dates.end);
+            totals = agg.totals;
+            total = agg.total;
+        }
+
+        const top = Object.entries(totals)
+            .map(([url, hits]) => ({ url, hits }))
+            .sort((a, b) => b.hits - a.hits);
+
+        const lifetimeTotal = Object.values(lifetime).reduce((acc, n) => acc + n, 0);
+        return {
+            range,
+            from: dates ? todayKey(dates.start) : null,
+            to: dates ? todayKey(dates.end) : null,
+            total,
+            lifetimeTotal,
+            uniquePages: top.length,
+            top
+        };
+    });
+
+    fastify.get('/series', { preHandler: [authenticate, requireAdmin] }, async (request) => {
+        const { range = '30d', from, to } = request.query || {};
+        const dates = rangeToDates(range === 'all' ? '30d' : range, from, to);
+        const daily = await readJson(DAILY_FILE, {});
+        return { series: buildSeries(daily, dates.start, dates.end) };
+    });
+
+    fastify.get('/export.csv', { preHandler: [authenticate, requireAdmin] }, async (request, reply) => {
+        const { range = '30d', from, to } = request.query || {};
+        const dates = rangeToDates(range, from, to);
+        const [lifetime, daily] = await Promise.all([
+            readJson(LIFETIME_FILE, {}),
+            readJson(DAILY_FILE, {})
+        ]);
+        const totals = dates ? aggregateDaily(daily, dates.start, dates.end).totals : lifetime;
+        const rows = Object.entries(totals)
             .map(([url, hits]) => ({ url, hits }))
             .sort((a, b) => b.hits - a.hits);
+
+        const lines = ['url,hits'];
+        for (const row of rows) {
+            lines.push(`${escapeCsvCell(row.url)},${row.hits}`);
+        }
+        const filename = `analytics-${range}-${new Date().toISOString().slice(0, 10)}.csv`;
+        reply
+            .header('Content-Type', 'text/csv; charset=utf-8')
+            .header('Content-Disposition', `attachment; filename="${filename}"`);
+        return lines.join('\n') + '\n';
     });
 
-  // Reset stats — admin only
-  fastify.delete('/stats', {preHandler: [authenticate, requireAdmin]}, async () => {
-        await writeStats({});
+    fastify.delete('/stats', { preHandler: [authenticate, requireAdmin] }, async () => {
+        await Promise.all([writeJson(LIFETIME_FILE, {}), writeJson(DAILY_FILE, {})]);
+        try {
+            await fs.unlink(LEGACY_FILE);
+        } catch {
+            // ignore
+        }
         return { ok: true };
     });
 }

package/plugins/analytics/plugin.json

@@ -1,10 +1,10 @@
 {
   "name": "analytics",
   "displayName": "Analytics",
-  "version": "1.0.0",
-  "description": "Basic page view analytics. Tracks hits per page using a simple JSON store.",
+  "version": "2.0.0",
+  "description": "Page view analytics with daily trends, time-range filtering, top-pages table and CSV export. Honours Do-Not-Track and dedups per session.",
   "author": "Darryl Waterhouse",
-  "date": "2026-03-01",
+  "date": "2026-05-04",
   "icon": "chart-bar",
   "admin": {
     "sidebar": [
@@ -25,7 +25,7 @@
     ],
     "views": {
       "plugin-analytics": {
-        "entry": "analytics/admin/views/analytics.js?v=80339cdc",
+        "entry": "analytics/admin/views/analytics.js?v=2c26480d",
         "exportName": "analyticsView"
       }
     }
@@ -37,7 +37,11 @@
   "scaffold": {
     "reset": [
       {
-        "path": "stats.json",
+        "path": "lifetime.json",
+        "content": "{}"
+      },
+      {
+        "path": "daily.json",
         "content": "{}"
       }
     ]

package/plugins/analytics/public/inject-body.html

@@ -1,13 +1,31 @@
-<!-- analytics: page view tracker -->
+<!-- analytics: page view tracker (DNT-aware, session-deduped) -->
 <script>
 (function () {
+    if (typeof fetch !== 'function') return;
+
+    var dnt = navigator.doNotTrack === '1'
+        || window.doNotTrack === '1'
+        || navigator.msDoNotTrack === '1';
+    if (dnt) return;
+
     var url = window.location.pathname;
-    if (typeof fetch === 'function') {
-        fetch('/api/plugins/analytics/hit', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ url: url })
-        }).catch(function () { /* silent fail */ });
+
+    try {
+        var key = 'dm_analytics_seen';
+        var seen = sessionStorage.getItem(key);
+        var list = seen ? seen.split('|') : [];
+        if (list.indexOf(url) !== -1) return;
+        list.push(url);
+        sessionStorage.setItem(key, list.join('|'));
+    } catch (e) {
+        // sessionStorage unavailable (e.g. private mode) — record anyway
     }
+
+    fetch('/api/plugins/analytics/hit', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        keepalive: true,
+        body: JSON.stringify({ url: url })
+    }).catch(function () { /* silent */ });
 })();
 </script>