splent-feature-analytics 0.2.0__py3-none-any.whl

splent_feature_analytics-0.2.0.dist-info/METADATA

@@ -0,0 +1,112 @@
+Metadata-Version: 2.4
+Name: splent_feature_analytics
+Version: 0.2.0
+License-Expression: LGPL-3.0-or-later
+Requires-Python: >=3.13
+Description-Content-Type: text/markdown
+License-File: COPYING
+License-File: COPYING.LESSER
+Requires-Dist: splent_framework>=1.30.0
+Dynamic: license-file
+
+# splent_feature_analytics
+
+Visit counts for a SPLENT product without cookies, so without a consent
+banner (decision D11): [Plausible](https://plausible.io) or
+[Matomo](https://matomo.org), cloud or self-hosted. Optional in the line
+and off by default: until the deployment gives the script and the site,
+nothing is loaded.
+
+## What a page gets
+
+The tag goes at the end of every page of both shells, in the
+`layout.scripts` slot, with the request's Content-Security-Policy nonce
+(`csp_nonce()`), so a policy that names the nonce allows it and no inline
+script is needed.
+
+- **plausible**: the provider's script, with the site's domain:
+  ```html
+  <script defer data-domain="uvlhub.io" src="https://plausible.io/js/script.js" nonce="…"></script>
+  ```
+  Plausible sets no cookie and keeps no query string but the campaign
+  tags.
+- **matomo**: this feature's own `assets/js/matomo.js`, which reads the
+  server and the site from its data attributes, tells Matomo to set no
+  cookie (`disableCookies`) and to record the page and the referrer
+  without their query strings, and then loads `matomo.js` from the Matomo
+  server with the same nonce. The tracker is `matomo.php` next to it.
+
+## What is never counted
+
+- **The excluded paths**, `ANALYTICS_EXCLUDED_PATHS`, and everything under
+  them, segment by segment (`/api` excludes `/api/v1/datasets`, not
+  `/apidocs`). By default: the administration, the account pages, signing
+  in, up and out, the reset and confirmation links, the developer pages,
+  the API, the ORCID and GitHub returns, and the acceptance of the legal
+  texts.
+- **The pages of a signed-in account**, unless `ANALYTICS_SIGNED_IN`:
+  their addresses are about the account.
+- **Every page that holds a token** (ID-14), whatever its path: a reset or
+  confirmation link, the page that shows a new API token, the return from
+  a provider. Those go through auth's `keep_token_private`, which sends
+  `Referrer-Policy: no-referrer`; a response that sends no Referer to
+  anybody has the tag taken out before it leaves. The page carries no
+  script of another site, and its address reaches no counter, even one
+  served from the site's own domain.
+
+## The Content-Security-Policy
+
+A product that sends one (`SPLENT_CONTENT_SECURITY_POLICY`) names the
+provider's host in `script-src` and `connect-src` (and `img-src` for
+Matomo's fallback), or uses the nonce with `'strict-dynamic'`. The feature
+says at start when the policy would block the script.
+
+With splent_feature_legal, the provider is listed in the privacy notice as
+a third party, with its host; no cookie is declared, since none is set.
+
+## Settings
+
+Each is a typed parameter in `[tool.splent.config_schema]`, so
+`product:validate` checks a product's value against it. The two of `deploy`
+bind are left to each deployment's `.env`; the rest are decided when the
+product is derived.
+
+| Variable | Type | Bind | Default | |
+|---|---|---|---|---|
+| `ANALYTICS_PROVIDER` | enum | derivation | `plausible` | `plausible` or `matomo` |
+| `ANALYTICS_SCRIPT_URL` | url | deploy | | Plausible's `script.js`, or the address of `matomo.js` on the Matomo server. Empty loads nothing |
+| `ANALYTICS_SITE_ID` | str | deploy | | The domain registered in Plausible, or the site's number in Matomo. Matches `[A-Za-z0-9.:_-]{1,253}` |
+| `ANALYTICS_EXCLUDED_PATHS` | list | derivation | the sensitive routes | Paths never counted, with everything under them. Each matches `/.*` |
+| `ANALYTICS_SIGNED_IN` | bool | derivation | `false` | Whether the pages of a signed-in account are counted |
+
+The default `ANALYTICS_EXCLUDED_PATHS` is `/admin`, `/account`, `/login`,
+`/logout`, `/signup`, `/reset`, `/confirmemail`, `/confirm_email_change`,
+`/confirm_user`, `/developer`, `/api`, `/orcid`, `/github` and
+`/legal/accept`. A product that sets it replaces the list, so it keeps these
+and adds its own.
+
+At start the feature refuses a Matomo site that is not a number, and in
+production a script over plain http, or a script without a site (or the
+reverse); elsewhere the last is a warning and nothing is loaded.
+
+## Enable it in a product
+
+1. Select `analytics`, an optional feature of `plataforma` in
+   openhubs_spl, and pin it. It requires no other feature.
+2. Choose the provider in the product's `[tool.splent.config]` if it is not
+   Plausible, and add any path of the product's own that must not be
+   counted to `ANALYTICS_EXCLUDED_PATHS`.
+3. In the deployment's `.env`:
+   ```
+   ANALYTICS_SCRIPT_URL=https://plausible.io/js/script.js
+   ANALYTICS_SITE_ID=uvlhub.io
+   ```
+
+## Develop
+
+```bash
+splent feature:test analytics --neutral
+splent feature:contract analytics --write
+```
+
+No test calls Plausible or Matomo: they check the tag the pages carry.

splent_feature_analytics-0.2.0.dist-info/RECORD

@@ -0,0 +1,14 @@
+splent_feature_analytics-0.2.0.dist-info/licenses/COPYING,sha256=jOtLnuWt7d5Hsx6XXB2QxzrSe2sWWh3NgMfFRetluQM,35147
+splent_feature_analytics-0.2.0.dist-info/licenses/COPYING.LESSER,sha256=2n6rt7r999OuXp8iOqW9we7ORaxWncIbOwN1ILRGR2g,7651
+splent_io/splent_feature_analytics/__init__.py,sha256=w-6mJVR2qFPSlHZ_jXfe7NFkShYShLbXtypgB-XOrJk,990
+splent_io/splent_feature_analytics/config.py,sha256=2JzcrPU14Oz0d2M1xfOj5IU-IF1lFcbzSC2xe-HG0cA,448
+splent_io/splent_feature_analytics/hooks.py,sha256=MQRbD9RB3mJRS8X5YNiFSJRUWC-SqYZFosXn_-Zy45g,394
+splent_io/splent_feature_analytics/tracking.py,sha256=riKtZFRTBLPY7e_Q6KAGNcC4TNJILp7PL3XrrhHtdyA,9336
+splent_io/splent_feature_analytics/assets/js/matomo.js,sha256=W4vDd9-vD5lC18vXT9bpG5V2RKcJ0BxomnD7qLwH35U,1563
+splent_io/splent_feature_analytics/translations/messages.pot,sha256=hevR6VcU_tO95rjjqT4de-htqGJeNrxTS7diRnW0MBo,1277
+splent_io/splent_feature_analytics/translations/es/LC_MESSAGES/messages.mo,sha256=mUdD0Nl73T2wUWZ2ty2ejkecSGAeFzZIh3W4Ij0AQWo,1095
+splent_io/splent_feature_analytics/translations/es/LC_MESSAGES/messages.po,sha256=uh3vPirV9AfaQN5jmVspM6FxP0vdxkyNap0LzE3FBVo,1613
+splent_feature_analytics-0.2.0.dist-info/METADATA,sha256=JVHp_a0mQkt9xadFrxRE1J2hmF4iKlLU6bHX18SNqw4,5000
+splent_feature_analytics-0.2.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+splent_feature_analytics-0.2.0.dist-info/top_level.txt,sha256=nksrfdr_edPhGPUsCqz08kyNRLBkNc2sInZYzmbZ4TA,10
+splent_feature_analytics-0.2.0.dist-info/RECORD,,

splent_feature_analytics-0.2.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+