Mattsson
a5c10e441a
* chore(analytics): configure posthog session replay masking Move session replay from the mask-everything default to pattern-based masking in lib/analytics/replay-masking.ts: currency-shaped text, person-/organisationsnummer (rendered and typed) and password inputs are masked; other interface text and typed input is recorded for debugging. data-ph-mask keeps force-masking tagged PII and data-ph-unmask is still honored for chrome. Privacy policy, RoPA and decision log updated to match. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(analytics): address review comments on replay masking PR Bump the privacy policy's visible last-updated date to 2026-08-06 and add the conventional vi.clearAllMocks() beforeEach to the replay-masking tests. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
98 lines
4.5 KiB
TypeScript
98 lines
4.5 KiB
TypeScript
import posthog from 'posthog-js'
|
|
import { isAnalyticsEnabled, warnIfAnalyticsMisconfigured } from '@/lib/analytics/enabled'
|
|
import { purgeLegacyAnalyticsStorage } from '@/lib/analytics/purge-legacy-storage'
|
|
import { replayMaskInput, replayMaskText } from '@/lib/analytics/replay-masking'
|
|
|
|
// Clear anything Recapt left on the device. Runs unconditionally, BEFORE the
|
|
// analytics gate: a browser carrying `__recapt_record_engine` must get cleaned
|
|
// up even on a build where PostHog itself is switched off.
|
|
purgeLegacyAnalyticsStorage()
|
|
|
|
/**
|
|
* Hostnames that get the X-POSTHOG-DISTINCT-ID / X-POSTHOG-SESSION-ID headers,
|
|
* which is what lets a server error captured in instrumentation.ts link back
|
|
* to this user's session replay.
|
|
*
|
|
* Deliberately our own origin only. Listing a Supabase or third-party host
|
|
* here would leak PostHog identifiers to them. PostHog matches on hostname
|
|
* alone, so no protocol and no port ('localhost', never 'localhost:3000').
|
|
*/
|
|
function tracingHosts(): string[] {
|
|
const hosts = ['localhost', '127.0.0.1']
|
|
const appUrl = process.env.NEXT_PUBLIC_APP_URL
|
|
if (appUrl) {
|
|
try {
|
|
hosts.push(new URL(appUrl).hostname)
|
|
} catch {
|
|
// Malformed NEXT_PUBLIC_APP_URL: skip rather than break init.
|
|
}
|
|
}
|
|
return hosts
|
|
}
|
|
|
|
/**
|
|
* Client-side PostHog initialisation.
|
|
*
|
|
* This file is the ONLY place posthog.init() is called. Next.js 15.3+ runs
|
|
* `instrumentation-client` before hydration, which is what PostHog's own
|
|
* Next.js guidance requires; deliberately NOT combined with a
|
|
* <PostHogProvider> wrapper, which their example calls out as a mistake.
|
|
*
|
|
* Three choices here are deliberate and worth not "fixing":
|
|
*
|
|
* 1. `api_host: '/rl'` routes every request through the same-origin rewrite
|
|
* in next.config.ts. That keeps PostHog first-party, so the strict CSP
|
|
* needs no third-party hosts at all (`connect-src 'self'` already covers
|
|
* it) and ad blockers have nothing to match on. The path must stay in the
|
|
* proxy.ts matcher exclusion or middleware bounces it to /login.
|
|
*
|
|
* 2. `persistence: 'memory'` stores nothing on the device. That is what lets
|
|
* us run analytics without a cookie-consent banner. The cost is that an
|
|
* anonymous visitor's identity does not survive a hard reload; everything
|
|
* post-login is unaffected because AnalyticsIdentify re-identifies on
|
|
* every dashboard load. Note that surveys still write their own
|
|
* `seenSurvey_*` flags straight to localStorage, bypassing this setting:
|
|
* that is functional UI state ("don't ask again"), not tracking.
|
|
*
|
|
* 3. Pattern-based replay masking (founder-approved 2026-08-06, supersedes
|
|
* the 2026-07-27 mask-everything default that made replays wall-to-wall
|
|
* asterisks). Replays exist so support can see WHERE a user gets stuck
|
|
* and WHAT they typed while getting there; what stays unreadable is the
|
|
* content of their books. `lib/analytics/replay-masking.ts` masks
|
|
* currency-shaped text (every amount renders through `formatCurrency()`,
|
|
* so one pattern covers all surfaces including future code), person-/
|
|
* organisationsnummer (for an enskild firma the orgnr IS the owner's
|
|
* personnummer) in both text and typed input, and password inputs.
|
|
* Everything else, typed input included, is visible in the replay.
|
|
*
|
|
* `data-ph-mask` force-masks a subtree (deliberate PII spots: danger-zone
|
|
* labels, user-defined dimension names, nav count bubbles) and
|
|
* `data-ph-unmask` exempts one from pattern masking; the NEAREST tagged
|
|
* ancestor wins, and mask wins when both land on the same element.
|
|
*
|
|
* rrweb only calls `maskInputFn` on inputs flagged by `maskInputOptions`,
|
|
* so `maskAllInputs: true` stays set to flag every input and the function
|
|
* decides per value. posthog-js force-merges `password: true` into
|
|
* `maskInputOptions` on top of that.
|
|
*/
|
|
if (warnIfAnalyticsMisconfigured() && isAnalyticsEnabled()) {
|
|
posthog.init(process.env.NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN!, {
|
|
api_host: '/rl',
|
|
ui_host: 'https://eu.posthog.com',
|
|
defaults: '2026-05-30',
|
|
// Only create person profiles for users we actually identify: logged-out
|
|
// visitors stay anonymous and cheap.
|
|
person_profiles: 'identified_only',
|
|
persistence: 'memory',
|
|
capture_exceptions: true,
|
|
tracing_headers: tracingHosts(),
|
|
session_recording: {
|
|
maskAllInputs: true,
|
|
maskInputFn: replayMaskInput,
|
|
maskTextSelector: '*',
|
|
maskTextFn: replayMaskText,
|
|
},
|
|
debug: process.env.NODE_ENV === 'development',
|
|
})
|
|
}
|