tacilytics 2.2.0 → 2.3.0

package/README.md

@@ -273,9 +273,11 @@ Out of the box the dashboard opens with one shared passphrase (`WEB_PASSWORD`).
 | Role | Can |
 |---|---|
 | **Owner** | everything, including the team |
-| **Admin** | add/remove sites, share links, funnels |
+| **Admin** | add/remove sites, share links, funnels — optionally limited to **specific sites** |
 | **Viewer** | read only — optionally limited to **specific sites** |
 
+**Hosting several customers on one instance** (2.3): give each customer an **admin limited to their sites**. The operator adds their sites; a domain that already belongs to someone else is refused (409) instead of being shared. Pause a site with `PATCH /api/sites/:id {"paused": true}` (server key or an unlimited owner/admin): it collects nothing until resumed, the data stays. `GET /api/v1/usage?month=YYYY-MM` lists page views per site for volume checks (operator only). The operator's `DIGEST_WEBHOOK_URL` is never used for alerts of limited accounts; set `DIGEST_WEBHOOK_URL=off` on a shared instance so the daily digest does not list customer domains. `DASHBOARD_EXTRA_SCRIPT=/path.js` adds one same-origin script to the dashboard (e.g. a billing banner served by your own proxy). Paused sites are left out of alerts and the weekly report. Site-limited accounts cannot add or delete sites (the operator does both, sites are what is billed and paused). **Domains are first come, first served:** if a customer gets 409 for a domain they own, the operator resolves it with an owner account (move the site to the right account in Settings → Team); domain verification is planned.
+
 Everyone can turn on, **optionally**:
 
 - **Passkeys** (Face ID, Touch ID, Windows Hello, security keys). A passkey replaces password *and* code and cannot be phished.
@@ -303,6 +305,7 @@ The server-wide `API_KEY` from `.env` keeps owner rights for agents and the CLI
 | `API_KEY` | — | Bearer key for the API / CLI |
 | `DB_PATH` | `./data/analytics.db` | SQLite path |
 | `DIGEST_WEBHOOK_URL` | — | Daily digest + default alert target (Discord/Slack-compatible). `off` disables it |
+| `DASHBOARD_EXTRA_SCRIPT` | — | One same-origin script added to the dashboard page (hosting banner). Only a plain path like `/cloud/ui.js`; URLs, `//` and `..` are ignored |
 | `WATCH_MIN_VISITORS` | `10` | Spike/drop alerts stay silent below this many visitors per hour |
 | `SMTP_URL` / `REPORT_FROM` | — | Mail server + sender for the weekly report |
 | `REPORT_HOUR_UTC` | `6` | Monday hour (UTC) the weekly report goes out; it covers the last 7 full days in each site's time zone |

package/auth.js

@@ -660,7 +660,7 @@ function setupAuth({ app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp, site
     const b = req.body || {};
     const role = cleanRole(b.role);
     if (!role) return res.status(400).json({ error: 'Role must be owner, admin or viewer' });
-    const sites = role === 'viewer' ? cleanSites(b.sites) : null;
+    const sites = role !== 'owner' ? cleanSites(b.sites) : null; // admins and viewers can be limited to sites
     if (sites === undefined) return res.status(400).json({ error: 'sites must be a list of site ids or null' });
     if (Array.isArray(sites) && !sites.length) return res.status(400).json({ error: 'Pick at least one site' });
     const token = randToken();
@@ -682,7 +682,7 @@ function setupAuth({ app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp, site
     const role = b.role === undefined ? u.role : cleanRole(b.role);
     if (!role) return res.status(400).json({ error: 'Role must be owner, admin or viewer' });
     if (u.role === 'owner' && role !== 'owner' && q.ownerCount.get().n <= 1) return res.status(400).json({ error: 'There must be at least one owner' });
-    let sites = role === 'viewer' ? (b.sites === undefined ? (u.sites ? JSON.parse(u.sites) : null) : cleanSites(b.sites)) : null;
+    let sites = role !== 'owner' ? (b.sites === undefined ? (u.sites ? JSON.parse(u.sites) : null) : cleanSites(b.sites)) : null;
     if (sites === undefined) return res.status(400).json({ error: 'sites must be a list of site ids or null' });
     if (Array.isArray(sites) && !sites.length) return res.status(400).json({ error: 'Pick at least one site' });
     db.prepare('UPDATE users SET role = ?, sites = ? WHERE id = ?').run(role, sites ? JSON.stringify(sites) : null, u.id);
@@ -761,7 +761,20 @@ function setupAuth({ app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp, site
     res.json({ ok: true, username: who });
   });
 
-  return { auth, requireRole, siteAllowed, principal, audit };
+  /** a site created by a site-limited account becomes part of that account's list */
+  function grantSite(req, siteId) {
+    const p = req.principal;
+    if (!p || p.sites == null || !p.user) return;
+    const u = q.userById.get(p.user.id);
+    if (!u || u.sites == null) return;
+    const list = JSON.parse(u.sites);
+    if (!list.includes(siteId)) list.push(siteId);
+    db.prepare('UPDATE users SET sites = ? WHERE id = ?').run(JSON.stringify(list), u.id);
+    p.sites = list;
+  }
+  /** limited = can only see some sites (cloud customers, viewers with a site list) */
+  const isLimited = (req) => !!(req.principal && req.principal.sites != null);
+  return { auth, requireRole, siteAllowed, principal, audit, grantSite, isLimited };
 }
 
 // ── offline admin (CLI on the server, for lock-outs) ─────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tacilytics",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Privacy-first, cookieless analytics for websites and apps. Self-hosted: one Node process, one SQLite file.",
   "main": "server.js",
   "type": "commonjs",

package/public/account.js

@@ -163,7 +163,7 @@
 
   // ── settings ──
   var ROLE_LABEL = { owner: 'Owner', admin: 'Admin', viewer: 'Viewer' };
-  var ROLE_HELP = { owner: 'everything, including the team', admin: 'sites, share links and funnels', viewer: 'read only' };
+  var ROLE_HELP = { owner: 'everything, including the team', admin: 'sites, share links and funnels (all or picked sites)', viewer: 'read only' };
   var me = null;
   function setErr(t) { $('setErr').textContent = t || ''; }
   // footer version: only after sign-in (from /api/me), links to the release tag; strict format check so
@@ -183,6 +183,7 @@
       $('meName').textContent = m.username || 'Settings';
       showVersion(m.version);
       document.body.classList.toggle('role-viewer', m.role === 'viewer');
+      document.body.classList.toggle('site-limited', !!(m.sites && m.role !== 'owner')); // the operator adds their sites
     }).catch(function () {});
   }
   function openSettings(tab) {
@@ -418,15 +419,15 @@
         var self = me && me.id === u.id;
         return '<div class="set-row team-row" data-uid="' + u.id + '">' +
           '<span><strong data-no-i18n>' + esc(u.username) + '</strong>' + (self ? ' <span class="muted small">(you)</span>' : '') +
-          '<br><span class="muted small">' + (u.role === 'viewer' ? siteNames(u.sites) + ' · ' : '') + (u.totp ? '2FA on' : 'no 2FA') + (u.passkeys ? ' · ' + u.passkeys + ' passkey' + (u.passkeys > 1 ? 's' : '') : '') + ' · last sign-in ' + date(u.last_login) + '</span></span>' +
+          '<br><span class="muted small">' + (u.role !== 'owner' ? siteNames(u.sites) + ' · ' : '') + (u.totp ? '2FA on' : 'no 2FA') + (u.passkeys ? ' · ' + u.passkeys + ' passkey' + (u.passkeys > 1 ? 's' : '') : '') + ' · last sign-in ' + date(u.last_login) + '</span></span>' +
           '<select data-role>' + ['owner', 'admin', 'viewer'].map(function (r) { return '<option value="' + r + '"' + (r === u.role ? ' selected' : '') + '>' + ROLE_LABEL[r] + '</option>'; }).join('') + '</select>' +
-          '<span class="row-actions">' + (u.role === 'viewer' ? '<button class="btn ghost mini" data-sites>Sites</button>' : '') +
+          '<span class="row-actions">' + (u.role !== 'owner' ? '<button class="btn ghost mini" data-sites>Sites</button>' : '') +
           (!self ? '<button class="btn ghost mini" data-resetlink title="One-time link to set a new password (24 h)">Password link</button>' : '') +
           (u.totp && !self ? '<button class="btn ghost mini" data-reset2fa>Reset 2FA</button>' : '') +
           (!self ? '<button class="btn ghost danger mini" data-remove>Remove</button>' : '') + '</span></div>';
       }).join('');
       var invites = t.invites.map(function (i) {
-        return '<div class="set-row"><span>' + ico('i-user-plus') + ROLE_LABEL[i.role] + (i.role === 'viewer' ? ' · ' + esc(siteNames(i.sites)) : '') + '</span><span class="muted small">expires ' + date(i.expires) + '</span><button class="btn ghost danger mini" data-delinv="' + i.id + '">Revoke</button></div>';
+        return '<div class="set-row"><span>' + ico('i-user-plus') + ROLE_LABEL[i.role] + (i.role !== 'owner' ? ' · ' + esc(siteNames(i.sites)) : '') + '</span><span class="muted small">expires ' + date(i.expires) + '</span><button class="btn ghost danger mini" data-delinv="' + i.id + '">Revoke</button></div>';
       }).join('');
       el.innerHTML =
         '<div class="set-card"><h3>' + ico('i-users') + 'Members</h3>' + rows + '</div>' +
@@ -436,11 +437,11 @@
         '<div id="invSites">' + sitePicker('invPick', null) + '</div>' +
         '<div id="invOut"></div>' + (invites ? '<h4 class="muted small" style="margin-top:12px">Open invites</h4>' + invites : '') + '</div>';
 
-      $('invRole').onchange = function () { $('invSites').classList.toggle('hide', this.value !== 'viewer'); };
+      $('invRole').onchange = function () { $('invSites').classList.toggle('hide', this.value === 'owner'); };
       $('invCreate').onclick = function () {
         setErr('');
         var role = $('invRole').value;
-        call('POST', '/api/team/invites', { role: role, sites: role === 'viewer' ? pickedSites('invPick') : null }).then(function (r) {
+        call('POST', '/api/team/invites', { role: role, sites: role !== 'owner' ? pickedSites('invPick') : null }).then(function (r) {
           var url = location.origin + r.url;
           $('invOut').innerHTML = '<div class="snippet" id="invUrl">' + esc(url) + '</div><button class="btn ghost" id="invCopy">Copy link</button>';
           $('invCopy').onclick = function () { navigator.clipboard.writeText(url); $('invCopy').textContent = 'Copied ✓'; };

package/public/i18n.js

@@ -142,7 +142,7 @@
     'For scripts, agents and the CLI (': 'Für Skripte, Agents und die CLI (',
     '). A key acts as you, sees only your sites, and cannot touch the team or your security settings. Read-only unless you untick it.': '). Ein Key handelt als du, sieht nur deine Seiten und kann weder das Team noch deine Sicherheitseinstellungen ändern. Nur lesen, außer du nimmst den Haken raus.',
     'Signed in as': 'Angemeldet als',
-    'Viewer — read only': 'Viewer: nur lesen', 'Admin — sites, share links and funnels': 'Admin: Seiten, Share-Links und Funnels', 'Owner — everything, including the team': 'Owner: alles, auch das Team',
+    'Viewer — read only': 'Viewer: nur lesen', 'Admin — sites, share links and funnels (all or picked sites)': 'Admin: Seiten, Share-Links und Funnels (alle oder ausgewählte Seiten)', 'Owner — everything, including the team': 'Owner: alles, auch das Team',
     'In Plausible:': 'In Plausible:', 'Site settings → Imports & Exports → Export data': 'Website-Einstellungen → Imports & Exports → Export data',
     '. Upload the ZIP you get (or the CSV files in it).': '. Lade das ZIP hoch (oder die CSV-Dateien darin).',
     'In Google Analytics 4: open a report (e.g.': 'In Google Analytics 4: Öffne einen Bericht (z. B.', 'Pages and screens': 'Seiten und Bildschirme', 'Traffic acquisition': 'Akquisition von Zugriffen',

package/public/style.css

@@ -451,6 +451,7 @@ select option { background: #0c1a1d; color: var(--text); }
 #login .btn.ghost .ico, #settingsBtn .ico { margin-right: 6px; }
 /* viewers: hide everything that would only answer with 403 */
 body.role-viewer #addSiteBtn, body.role-viewer #shareBtn, body.role-viewer #addFunnelBtn { display: none !important; }
+body.site-limited #addSiteBtn { display: none !important; }
 @media (max-width: 560px) { #meName { display: none; } .team-row { flex-wrap: wrap; } }
 a.btn, a.btn:hover { text-decoration: none; display: inline-flex; align-items: center; gap: 6px; color: var(--text); }
 .swatch.ann { width: 9px; height: 9px; transform: rotate(45deg); border-radius: 1px; background: var(--accent-2, #ff7a5c); }

package/server.js

@@ -143,6 +143,8 @@ db.exec(`
 const norm = (d) => String(d || '').toLowerCase().replace(/^www\./, '').replace(/\/.*$/, '').trim();
 // per-site time zone (Fabian): only query boundaries move, stored days stay UTC (Tyto). Old installs → 'UTC'.
 if (!db.prepare('PRAGMA table_info(sites)').all().some((c) => c.name === 'timezone')) db.exec("ALTER TABLE sites ADD COLUMN timezone TEXT NOT NULL DEFAULT 'UTC'");
+// paused sites collect nothing (hosting: trial over / subscription ended). Only an unlimited admin or owner can pause.
+if (!db.prepare('PRAGMA table_info(sites)').all().some((c) => c.name === 'paused')) db.exec('ALTER TABLE sites ADD COLUMN paused INTEGER NOT NULL DEFAULT 0');
 const getSiteByDomain = db.prepare('SELECT * FROM sites WHERE domain = ?');
 const insSite = db.prepare("INSERT OR IGNORE INTO sites (domain, name, created, timezone) VALUES (?, ?, ?, COALESCE(?, 'UTC'))");
 const allSites = db.prepare('SELECT * FROM sites ORDER BY domain');
@@ -317,7 +319,7 @@ function collect(req, res) {
   const domain = norm(b.d || b.domain);
   if (!domain) return res.status(204).end();
   const site = getSiteByDomain.get(domain);
-  if (!site) return res.status(202).end(); // unknown site → silently ignore
+  if (!site || site.paused) return res.status(202).end(); // unknown or paused site → silently ignore
   const platform = appPlatform(b);
   // apps: the HTTP client's user agent says nothing about the device, so OS/device come from the beacon.
   // A bot-looking UA is still dropped, so the bot filter cannot be bypassed by just adding `pf`.
@@ -386,7 +388,7 @@ app.get('/api/collect', collect);
 
 // ── auth: accounts, team, optional 2FA + passkeys (auth.js) ───────────────────
 const { setupAuth } = require('./auth');
-const { auth, requireRole, siteAllowed, audit } = setupAuth({
+const { auth, requireRole, siteAllowed, audit, grantSite, isLimited } = setupAuth({
   app, db, WEB_PASSWORD, API_KEY, rateLimited, clientIp,
   allSiteIds: () => db.prepare('SELECT id FROM sites').all().map((r) => r.id),
 });
@@ -411,6 +413,9 @@ function newToken() { return crypto.randomBytes(24).toString('hex'); }
 // ── sites management ─────────────────────────────────────────────────────────
 const sitesListHandler = (req, res) => res.json(allSites.all().filter((st) => siteAllowed(req, st.id)));
 const sitesCreateHandler = (req, res) => {
+  // a site-limited account (a hosting customer) never creates sites itself: the operator does, because sites are what
+  // is billed and paused. Otherwise a paused customer could add a fresh, unpaused site and move the snippet (Kiro, 2.3.0).
+  if (isLimited(req)) return res.status(403).json({ error: 'Your role does not allow this' });
   const rawDomain = norm(req.body && req.body.domain);
   let domain = rawDomain;
   let displayName = rawDomain; // keep Unicode original for a readable display name (e.g. ernährungs-plan.de)
@@ -423,7 +428,17 @@ const sitesCreateHandler = (req, res) => {
   const rawTz = req.body && req.body.timezone;
   const timezone = rawTz == null || rawTz === '' ? null : TZ.validTz(String(rawTz));
   if (rawTz != null && rawTz !== '' && !timezone) return res.status(400).json({ error: 'Unknown time zone' });
-  insSite.run(domain, (req.body && req.body.name) || displayName, Date.now(), timezone);
+  const existing = getSiteByDomain.get(domain);
+  if (existing) {
+    // an account limited to some sites must never get a foreign site back (or added to its list) by naming its domain
+    if (!siteAllowed(req, existing.id)) return res.status(409).json({ error: 'This domain is already registered' });
+    return res.json(existing);
+  }
+  const info = insSite.run(domain, (req.body && req.body.name) || displayName, Date.now(), timezone);
+  // defensive: if INSERT OR IGNORE did nothing (e.g. a second process sharing the DB won the domain), lastInsertRowid is
+  // stale and must never be granted. Not reachable over HTTP in one process (the handler is synchronous), so no test.
+  if (!info.changes) return res.status(409).json({ error: 'This domain is already registered' });
+  grantSite(req, Number(info.lastInsertRowid));
   audit(res, 'site.add', domain);
   res.json(getSiteByDomain.get(domain));
 };
@@ -435,15 +450,27 @@ app.patch('/api/sites/:id', adminOnly, (req, res) => {
   if (!siteAllowed(req, id)) return res.status(403).json(NO_SITE);
   const site = db.prepare('SELECT * FROM sites WHERE id = ?').get(id);
   if (!site) return res.status(404).json({ error: 'Unknown site' });
-  const timezone = TZ.validTz(String((req.body && req.body.timezone) || ''));
-  if (!timezone) return res.status(400).json({ error: 'Unknown time zone' });
-  db.prepare('UPDATE sites SET timezone = ? WHERE id = ?').run(timezone, id);
-  if (timezone !== site.timezone) audit(res, 'site.timezone', site.domain + ': ' + site.timezone + ' → ' + timezone);
+  const b = req.body || {};
+  if (b.paused !== undefined) {
+    // pausing is the operator's switch (hosting: trial or subscription ended), never the customer's
+    if (isLimited(req)) return res.status(403).json({ error: 'Your role does not allow this' });
+    const paused = b.paused ? 1 : 0;
+    db.prepare('UPDATE sites SET paused = ? WHERE id = ?').run(paused, id);
+    if (paused !== site.paused) audit(res, paused ? 'site.pause' : 'site.resume', site.domain);
+  }
+  if (b.timezone !== undefined || b.paused === undefined) {
+    const timezone = TZ.validTz(String(b.timezone || ''));
+    if (!timezone) return res.status(400).json({ error: 'Unknown time zone' });
+    db.prepare('UPDATE sites SET timezone = ? WHERE id = ?').run(timezone, id);
+    if (timezone !== site.timezone) audit(res, 'site.timezone', site.domain + ': ' + site.timezone + ' → ' + timezone);
+  }
   res.json(db.prepare('SELECT * FROM sites WHERE id = ?').get(id));
 });
 app.delete('/api/sites/:id', adminOnly, (req, res) => {
   const id = Number(req.params.id);
   if (!siteAllowed(req, id)) return res.status(403).json(NO_SITE);
+  // hard delete frees the domain and resets usage: only the operator (unlimited admin/owner) may do it (Tyto/Kiro, 2.3.0)
+  if (isLimited(req)) return res.status(403).json({ error: 'Your role does not allow this' });
   const gone = db.prepare('SELECT domain FROM sites WHERE id = ?').get(id);
   audit(res, 'site.remove', gone ? gone.domain : '#' + id);
   db.prepare('DELETE FROM events WHERE site_id = ?').run(id);
@@ -464,10 +491,20 @@ app.get('/api/v1', (_req, res) => res.json({
     'POST /api/v1/sites': 'add a site { domain }',
     'GET /api/v1/stats?site=&period=': 'aggregated stats (period: today|7d|30d|90d|12mo, or from=YYYY-MM-DD&to=YYYY-MM-DD)',
     'GET /api/v1/realtime?site=': 'online count, last-30-min pulse + recent events',
+    'GET /api/v1/usage?month=YYYY-MM': 'page views per site in a calendar month (UTC), owner / server key only',
   },
   filters: 'add any of country,source,page,browser,os,device,lang,medium,campaign,goal to /stats to segment',
 }));
 app.get('/api/v1/sites', auth, sitesListHandler);
+// page views per site in one calendar month (UTC), for hosting volume checks. Operator only:
+// owners or the server API key with access to all sites, never a site-limited account.
+app.get('/api/v1/usage', requireRole('owner'), (req, res) => {
+  if (isLimited(req)) return res.status(403).json({ error: 'Your role does not allow this' });
+  const m = String(req.query.month || new Date().toISOString().slice(0, 7));
+  if (!/^\d{4}-(0[1-9]|1[0-2])$/.test(m)) return res.status(400).json({ error: 'month must be YYYY-MM' });
+  const from = Date.UTC(+m.slice(0, 4), +m.slice(5, 7) - 1, 1), to = Date.UTC(+m.slice(0, 4), +m.slice(5, 7), 1);
+  res.json(db.prepare('SELECT s.id site_id, s.domain, COUNT(e.id) pageviews FROM sites s LEFT JOIN events e ON e.site_id = s.id AND e.ts >= ? AND e.ts < ? AND e.name IS NULL GROUP BY s.id ORDER BY s.id').all(from, to));
+});
 app.post('/api/v1/sites', adminOnly, sitesCreateHandler);
 
 // ── stats ────────────────────────────────────────────────────────────────────
@@ -983,6 +1020,16 @@ app.get('/api/funnels/:id/stats', authOrShare, (req, res) => {
 });
 
 // ── static dashboard ─────────────────────────────────────────────────────────
+// Hosting (e.g. Tacilytics Cloud): DASHBOARD_EXTRA_SCRIPT="/cloud/ui.js" adds one same-origin script to the
+// dashboard page (trial/billing banner). Only a plain local path is accepted, never a URL to another host.
+const EXTRA_SCRIPT = /^\/[A-Za-z0-9._\/-]{1,120}$/.test(process.env.DASHBOARD_EXTRA_SCRIPT || '') && !/\.\.|\/\//.test(process.env.DASHBOARD_EXTRA_SCRIPT) ? process.env.DASHBOARD_EXTRA_SCRIPT : '';
+const INDEX_HTML = path.join(__dirname, 'public', 'index.html');
+function sendIndex(_req, res) {
+  if (!EXTRA_SCRIPT) return res.sendFile(INDEX_HTML);
+  const html = fs.readFileSync(INDEX_HTML, 'utf8').replace('</body>', `<script src="${EXTRA_SCRIPT}" defer></script>\n</body>`);
+  res.type('html').set('Cache-Control', 'no-cache').send(html);
+}
+app.get(['/', '/index.html'], sendIndex);
 app.use(express.static(path.join(__dirname, 'public')));
 // ── visitor journeys: session-based path transitions for a sankey flow ───────────
 // A "session" = one visitor's pageviews with < 30 min between them.
@@ -1093,7 +1140,7 @@ app.get('/api/alerts', auth, (req, res) => {
   const site = getSiteByDomain.get(norm(req.query.site));
   if (!site) return res.status(404).json({ error: 'Unknown site' });
   if (!siteOk(req, site)) return res.status(403).json(NO_SITE);
-  res.json({ fallbackWebhook: !!DIGEST_WEBHOOK_URL, alerts: db.prepare('SELECT * FROM alerts WHERE site_id = ? ORDER BY id').all(site.id).map((a) => publicAlert(a, site.domain)) });
+  res.json({ fallbackWebhook: !!DIGEST_WEBHOOK_URL && !isLimited(req), alerts: db.prepare('SELECT * FROM alerts WHERE site_id = ? ORDER BY id').all(site.id).map((a) => publicAlert(a, site.domain)) });
 });
 app.post('/api/alerts', adminOnly, async (req, res) => {
   const b = req.body || {};
@@ -1118,7 +1165,10 @@ app.post('/api/alerts', adminOnly, async (req, res) => {
     if (prob) return res.status(400).json({ error: prob });
     if (!(await webhookResolvesPublic(b.webhook, webhookLookup))) return res.status(400).json({ error: 'Webhook must point to a public address' });
     webhook = String(b.webhook);
-  } else if (!DIGEST_WEBHOOK_URL) return res.status(400).json({ error: 'Add a webhook URL (no default DIGEST_WEBHOOK_URL is set)' });
+  } else if (!DIGEST_WEBHOOK_URL || isLimited(req)) {
+    // the operator's webhook is for the operator: an account limited to some sites must bring its own
+    return res.status(400).json({ error: 'Add a webhook URL' + (DIGEST_WEBHOOK_URL ? '' : ' (no default DIGEST_WEBHOOK_URL is set)') });
+  }
   if (db.prepare('SELECT COUNT(*) n FROM alerts WHERE site_id = ?').get(site.id).n >= 20) return res.status(400).json({ error: 'At most 20 alerts per site' });
   const info = db.prepare('INSERT INTO alerts (site_id, kind, goal, threshold, window_hours, webhook, created) VALUES (?, ?, ?, ?, ?, ?, ?)')
     .run(site.id, b.kind, goal, threshold, windowHours, webhook, Date.now());
@@ -1173,7 +1223,7 @@ const validEmail = (e) => /^[^\s@<>",;]{1,64}@[^\s@<>",;]{1,190}\.[A-Za-z]{2,}$/
 const { createReport, REPORT_LANGS } = require('./report');
 const reporter = createReport(db);
 function buildReport(user, now) {
-  const sites = allSites.all().filter((st) => !user.sites || JSON.parse(user.sites).includes(st.id));
+  const sites = allSites.all().filter((st) => !st.paused && (!user.sites || JSON.parse(user.sites).includes(st.id)));
   return reporter.build(user, sites, now, { publicUrl: PUBLIC_URL, lang: REPORT_LANGS.includes(user.report_lang) ? user.report_lang : 'en' });
 }
 async function sendReport(user, now = Date.now()) {
@@ -1303,6 +1353,7 @@ const COOLDOWN = { spike: 6 * 3600e3, drop: 6 * 3600e3 };
 async function alertTick(now = Date.now()) {
   const fired = [];
   for (const site of allSites.all()) {
+    if (site.paused) continue; // a paused site collects nothing: a 'drop' alert would only announce the pause (Tyto, 2.3.0)
     const rules = db.prepare('SELECT * FROM alerts WHERE site_id = ? AND enabled = 1').all(site.id);
     const hasOwn = db.prepare('SELECT COUNT(*) n FROM alerts WHERE site_id = ?').get(site.id).n > 0;
     let verdict = null;
@@ -1353,6 +1404,6 @@ if (process.env.TACILYTICS_TEST_HOOKS === '1') {
 // unknown API paths are a 404 in JSON — never the SPA page. A client that asks an older/newer server for a
 // route it doesn't have must get an error it can show, not HTML it would try to read as data (Kiro, 2.2.0).
 app.all(/^\/(api|auth)(\/|$)/, (_req, res) => res.status(404).json({ error: 'Not found' }));
-app.get('*', (_req, res) => res.sendFile(path.join(__dirname, 'public', 'index.html')));
+app.get('*', sendIndex);
 
 app.listen(PORT, '127.0.0.1', () => console.log(`Tacilytics on http://127.0.0.1:${PORT}${RETENTION_DAYS ? ` · retention ${RETENTION_DAYS}d` : ''}${DIGEST_WEBHOOK_URL ? ` · digest ${DIGEST_HOUR_UTC}:00 UTC` : ''}`));