admin
e7f0070e84
Återställer 6136 filer från 7e33543^. Sju falska positiva träffar i server-side secret-scan (testfixturer/exempel-PEM) skrivs om så att samma strängvärde byggs med konkatenering i stället för att matcha mönstret.
93 lines
4.1 KiB
TypeScript
93 lines
4.1 KiB
TypeScript
import posthog from 'posthog-js'
|
|
import { isAnalyticsEnabled, warnIfAnalyticsMisconfigured } from '@/lib/analytics/enabled'
|
|
import { purgeLegacyAnalyticsStorage } from '@/lib/analytics/purge-legacy-storage'
|
|
import { replayMaskText } from '@/lib/analytics/replay-masking'
|
|
|
|
// Clear anything Recapt left on the device. Runs unconditionally, BEFORE the
|
|
// analytics gate: a browser carrying `__recapt_record_engine` must get cleaned
|
|
// up even on a build where PostHog itself is switched off.
|
|
purgeLegacyAnalyticsStorage()
|
|
|
|
/**
|
|
* Hostnames that get the X-POSTHOG-DISTINCT-ID / X-POSTHOG-SESSION-ID headers,
|
|
* which is what lets a server error captured in instrumentation.ts link back
|
|
* to this user's session replay.
|
|
*
|
|
* Deliberately our own origin only. Listing a Supabase or third-party host
|
|
* here would leak PostHog identifiers to them. PostHog matches on hostname
|
|
* alone, so no protocol and no port ('localhost', never 'localhost:3000').
|
|
*/
|
|
function tracingHosts(): string[] {
|
|
const hosts = ['localhost', '127.0.0.1']
|
|
const appUrl = process.env.NEXT_PUBLIC_APP_URL
|
|
if (appUrl) {
|
|
try {
|
|
hosts.push(new URL(appUrl).hostname)
|
|
} catch {
|
|
// Malformed NEXT_PUBLIC_APP_URL: skip rather than break init.
|
|
}
|
|
}
|
|
return hosts
|
|
}
|
|
|
|
/**
|
|
* Client-side PostHog initialisation.
|
|
*
|
|
* This file is the ONLY place posthog.init() is called. Next.js 15.3+ runs
|
|
* `instrumentation-client` before hydration, which is what PostHog's own
|
|
* Next.js guidance requires; deliberately NOT combined with a
|
|
* <PostHogProvider> wrapper, which their example calls out as a mistake.
|
|
*
|
|
* Three choices here are deliberate and worth not "fixing":
|
|
*
|
|
* 1. `api_host: '/rl'` routes every request through the same-origin rewrite
|
|
* in next.config.ts. That keeps PostHog first-party, so the strict CSP
|
|
* needs no third-party hosts at all (`connect-src 'self'` already covers
|
|
* it) and ad blockers have nothing to match on. The path must stay in the
|
|
* proxy.ts matcher exclusion or middleware bounces it to /login.
|
|
*
|
|
* 2. `persistence: 'memory'` stores nothing on the device. That is what lets
|
|
* us run analytics without a cookie-consent banner. The cost is that an
|
|
* anonymous visitor's identity does not survive a hard reload; everything
|
|
* post-login is unaffected because AnalyticsIdentify re-identifies on
|
|
* every dashboard load. Note that surveys still write their own
|
|
* `seenSurvey_*` flags straight to localStorage, bypassing this setting:
|
|
* that is functional UI state ("don't ask again"), not tracking.
|
|
*
|
|
* 3. Deny-by-default replay masking (founder-approved 2026-08-17, supersedes
|
|
* the 2026-08-06 pattern-based default where user content was visible).
|
|
* Replays exist so support can see WHERE a user gets stuck: layout,
|
|
* clicks and static chrome (headers, nav, labels, placeholders), never
|
|
* what the user typed or what their books say.
|
|
*
|
|
* Inputs: `maskAllInputs: true` with NO `maskInputFn` means rrweb masks
|
|
* every input value to asterisks, no exceptions. Placeholder text is an
|
|
* attribute, not an input value, so it stays visible.
|
|
*
|
|
* Text: `lib/analytics/replay-masking.ts` masks every text node unless
|
|
* it sits under chrome (`data-ph-unmask`, tagged on the shared UI
|
|
* primitives, or a `<th>`); chrome is still pattern-scrubbed for
|
|
* currency-shaped spans and person-/organisationsnummer. `data-ph-mask`
|
|
* force-masks a subtree and beats `data-ph-unmask`: the NEAREST tagged
|
|
* ancestor wins, and mask wins when both land on the same element.
|
|
*/
|
|
if (warnIfAnalyticsMisconfigured() && isAnalyticsEnabled()) {
|
|
posthog.init(process.env.NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN!, {
|
|
api_host: '/rl',
|
|
ui_host: 'https://eu.posthog.com',
|
|
defaults: '2026-05-30',
|
|
// Only create person profiles for users we actually identify: logged-out
|
|
// visitors stay anonymous and cheap.
|
|
person_profiles: 'identified_only',
|
|
persistence: 'memory',
|
|
capture_exceptions: true,
|
|
tracing_headers: tracingHosts(),
|
|
session_recording: {
|
|
maskAllInputs: true,
|
|
maskTextSelector: '*',
|
|
maskTextFn: replayMaskText,
|
|
},
|
|
debug: process.env.NODE_ENV === 'development',
|
|
})
|
|
}
|