Analytics: Ereignisse annehmen
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
ClaudeandClaude Sonnet 5.5 committed
1 parent
cd9aebe4b1
commit
3a48e6e677
6 files changed
+472
-4
No files matched your search
@@ -0,0 +1,251 @@
|
||||
import { test } from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import { openDb } from '../src/db.js';
|
||||
import { createPublicServer } from '../src/server.js';
|
||||
import { classifyUa } from '../src/ua.js';
|
||||
import { createSalt } from '../src/salt.js';
|
||||
|
||||
const KEY = 'abcdef0123456789abcd';
|
||||
const HOST = 'abc.project.webklar.com';
|
||||
const ORIGIN = `https://${HOST}`;
|
||||
const IP = '203.0.113.77';
|
||||
const UA = 'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) Mobile/15E148 Safari/604.1 GEHEIMERUA';
|
||||
|
||||
async function setup({ now = () => Date.UTC(2026, 9, 1, 10, 30, 45), geo = { lookup: () => 'DE' } } = {}) {
|
||||
const db = openDb(':memory:');
|
||||
db.prepare('INSERT INTO sites (siteKey, projectId, domains, active) VALUES (?,?,?,1)')
|
||||
.run(KEY, 'p1', JSON.stringify([HOST, 'www.kunde.de']));
|
||||
const server = createPublicServer({ config: {}, db, geo, now });
|
||||
await new Promise((r) => server.listen(0, '127.0.0.1', r));
|
||||
const base = `http://127.0.0.1:${server.address().port}`;
|
||||
const post = (ev, { origin = ORIGIN, ua = UA, ip = IP, referer, raw, type = 'text/plain' } = {}) => {
|
||||
const headers = { 'Content-Type': type, 'User-Agent': ua, 'X-Forwarded-For': `1.2.3.4, ${ip}` };
|
||||
if (origin) headers.Origin = origin;
|
||||
if (referer) headers.Referer = referer;
|
||||
return fetch(base + '/a/e', { method: 'POST', headers, body: raw ?? JSON.stringify(ev) });
|
||||
};
|
||||
const rows = () => db.prepare('SELECT * FROM events_raw ORDER BY id').all();
|
||||
return { db, post, rows, base, close: () => server.close() };
|
||||
}
|
||||
const pv = (o = {}) => ({ t: 'pv', site: KEY, path: '/', vp: 'd', ...o });
|
||||
|
||||
test('classifyUa: Bots, Geräte, leer', () => {
|
||||
assert.equal(classifyUa('').bot, true);
|
||||
assert.equal(classifyUa('Googlebot/2.1').bot, true);
|
||||
assert.equal(classifyUa('curl/8.0').bot, true);
|
||||
assert.equal(classifyUa('Mozilla/5.0 (Windows NT 10.0) Chrome/120').device, 'd');
|
||||
assert.equal(classifyUa('Mozilla/5.0 (iPhone; CPU) Mobile/15E').device, 'm');
|
||||
assert.equal(classifyUa('Mozilla/5.0 (Linux; Android 13; Pixel) Mobile Safari').device, 'm');
|
||||
assert.equal(classifyUa('Mozilla/5.0 (iPad; CPU OS 17)').device, 't');
|
||||
assert.equal(classifyUa('Mozilla/5.0 (Linux; Android 13; SM-T500) Safari').device, 't');
|
||||
assert.equal(classifyUa('Mozilla/5.0 (X11; Linux) Firefox/120').bot, false);
|
||||
});
|
||||
|
||||
test('Salz: stabil am Tag, wechselt um Mitternacht Berlin', () => {
|
||||
let t = Date.UTC(2026, 9, 1, 10, 0, 0);
|
||||
let n = 0;
|
||||
const s = createSalt({ now: () => t, random: () => Buffer.alloc(32, ++n) });
|
||||
const a = s.visitorId('s', '1.1.1.1', 'ua');
|
||||
assert.match(a, /^[0-9a-f]{16}$/);
|
||||
t = Date.UTC(2026, 9, 1, 21, 59, 0); // 23:59 Berlin (MESZ)
|
||||
assert.equal(s.visitorId('s', '1.1.1.1', 'ua'), a);
|
||||
assert.notEqual(s.visitorId('s', '1.1.1.2', 'ua'), a);
|
||||
t = Date.UTC(2026, 9, 1, 22, 0, 1); // 00:00 Berlin
|
||||
assert.notEqual(s.visitorId('s', '1.1.1.1', 'ua'), a);
|
||||
assert.match(s.rateKey('s', '1.1.1.1'), /^[0-9a-f]{64}$/);
|
||||
assert.ok(!s.rateKey('s', '1.1.1.1').includes('1.1.1.1'));
|
||||
});
|
||||
|
||||
test('pv: gespeichert ohne visitor, mit Land und Gerät, Cookie-frei', async () => {
|
||||
const t = await setup();
|
||||
const res = await t.post(pv({ path: '/preise?x=1#a', ref: 'https://Google.com/search?q=1' }));
|
||||
assert.equal(res.status, 204);
|
||||
assert.equal(res.headers.get('set-cookie'), null);
|
||||
const [r] = t.rows();
|
||||
assert.equal(r.type, 'pv');
|
||||
assert.equal(r.site, KEY);
|
||||
assert.equal(r.path, '/preise');
|
||||
assert.equal(r.ref, 'google.com');
|
||||
assert.equal(r.vp, 'd');
|
||||
assert.equal(r.country, 'DE');
|
||||
assert.equal(r.device, 'm');
|
||||
assert.equal(r.visitor, null);
|
||||
assert.equal(res.headers.get('access-control-allow-origin'), ORIGIN);
|
||||
assert.equal(res.headers.get('access-control-allow-credentials'), null);
|
||||
t.close();
|
||||
});
|
||||
|
||||
test('pv: ref eigene Domain wird verworfen, ungültige Felder', async () => {
|
||||
const t = await setup();
|
||||
await t.post(pv({ ref: 'https://www.kunde.de/x' }));
|
||||
await t.post(pv({ ref: 'kein host!' }));
|
||||
assert.equal(t.rows()[0].ref, null);
|
||||
assert.equal(t.rows()[1].ref, null);
|
||||
await t.post(pv({ path: 'kein-slash' }));
|
||||
await t.post(pv({ path: '/' + 'a'.repeat(300) }));
|
||||
await t.post(pv({ path: '/a\u0001b' }));
|
||||
await t.post(pv({ vp: 'x' }));
|
||||
await t.post({ t: 'zz', site: KEY, path: '/', vp: 'd' });
|
||||
await t.post({ site: KEY, path: '/', vp: 'd' });
|
||||
await t.post(null, { raw: 'kein json' });
|
||||
await t.post(null, { raw: '[1]' });
|
||||
assert.equal(t.rows().length, 2);
|
||||
t.close();
|
||||
});
|
||||
|
||||
test('Antwort immer 204; 413 bei großem Body; 405 bei falscher Methode', async () => {
|
||||
const t = await setup();
|
||||
assert.equal((await t.post(null, { raw: 'kein json' })).status, 204);
|
||||
assert.equal((await t.post(pv({ pad: 'x'.repeat(5000) }))).status, 413);
|
||||
assert.equal(t.rows().length, 0);
|
||||
assert.equal((await fetch(t.base + '/a/e')).status, 405);
|
||||
assert.equal((await fetch(t.base + '/a/e', { method: 'PUT', body: '{}' })).status, 405);
|
||||
t.close();
|
||||
});
|
||||
|
||||
test('application/json wird ebenfalls angenommen; unbekannte Felder werden nicht gespeichert', async () => {
|
||||
const t = await setup();
|
||||
const res = await t.post(pv({ evil: 'GEHEIM', ip: '9.9.9.9' }), { type: 'application/json' });
|
||||
assert.equal(res.status, 204);
|
||||
assert.equal(t.rows().length, 1);
|
||||
assert.ok(!JSON.stringify(t.db.prepare('SELECT * FROM events_raw').all()).includes('GEHEIM'));
|
||||
t.close();
|
||||
});
|
||||
|
||||
test('Origin: fremd, fehlend, Referer-Fallback, inaktiv, unbekannte Site', async () => {
|
||||
const t = await setup();
|
||||
assert.equal((await t.post(pv(), { origin: 'https://evil.example' })).headers.get('access-control-allow-origin'), null);
|
||||
await t.post(pv(), { origin: null });
|
||||
assert.equal(t.rows().length, 0);
|
||||
await t.post(pv(), { origin: null, referer: `${ORIGIN}/seite` });
|
||||
assert.equal(t.rows().length, 1);
|
||||
await t.post(pv(), { origin: 'https://www.kunde.de' });
|
||||
assert.equal(t.rows().length, 2);
|
||||
await t.post(pv({ site: 'zzzzzzzzzzzzzzzzzzzz' }));
|
||||
assert.equal(t.rows().length, 2);
|
||||
t.db.prepare('UPDATE sites SET active = 0').run();
|
||||
await t.post(pv());
|
||||
assert.equal(t.rows().length, 2);
|
||||
t.close();
|
||||
});
|
||||
|
||||
test('Bot und leerer User-Agent: nichts gespeichert', async () => {
|
||||
const t = await setup();
|
||||
await t.post(pv(), { ua: 'Googlebot/2.1' });
|
||||
await t.post(pv(), { ua: '' });
|
||||
assert.equal(t.rows().length, 0);
|
||||
t.close();
|
||||
});
|
||||
|
||||
test('bn: nur site, ts (Stunde), type, kind', async () => {
|
||||
const t = await setup();
|
||||
await t.post({ t: 'bn', site: KEY, a: 'shown', path: '/x', vp: 'm', visitor: 'v' });
|
||||
await t.post({ t: 'bn', site: KEY, a: 'accept' });
|
||||
await t.post({ t: 'bn', site: KEY, a: 'foo' });
|
||||
const rows = t.rows();
|
||||
assert.equal(rows.length, 2);
|
||||
for (const r of rows) {
|
||||
assert.equal(r.type, 'bn');
|
||||
for (const f of ['path', 'vp', 'country', 'device', 'visitor', 'ref', 'sec', 'scroll', 'host']) assert.equal(r[f], null, f);
|
||||
assert.equal(r.ts, Date.UTC(2026, 9, 1, 10, 0, 0));
|
||||
}
|
||||
assert.deepEqual(rows.map((r) => r.kind), ['shown', 'accept']);
|
||||
t.close();
|
||||
});
|
||||
|
||||
test('en: sec/scroll begrenzt, mit visitor', async () => {
|
||||
const t = await setup();
|
||||
await t.post({ t: 'en', site: KEY, path: '/a?b', vp: 't', sec: 99999, scroll: 250 });
|
||||
await t.post({ t: 'en', site: KEY, path: '/a', vp: 't', sec: 12.7, scroll: -5 });
|
||||
await t.post({ t: 'en', site: KEY, path: '/a', vp: 't', sec: 'x', scroll: 1 });
|
||||
const rows = t.rows();
|
||||
assert.equal(rows.length, 2);
|
||||
assert.match(rows[0].visitor, /^[0-9a-f]{16}$/);
|
||||
assert.equal(rows[0].path, '/a');
|
||||
assert.equal(rows[0].sec, 3600);
|
||||
assert.equal(rows[0].scroll, 100);
|
||||
assert.equal(rows[1].sec, 12);
|
||||
assert.equal(rows[1].scroll, 0);
|
||||
t.close();
|
||||
});
|
||||
|
||||
test('ck: in clicks, geklemmt, ohne visitor', async () => {
|
||||
const t = await setup();
|
||||
await t.post({ t: 'ck', site: KEY, path: '/a#h', vp: 'd', x: 0.123456, y: 1.7, sel: 'div>a'.repeat(100) });
|
||||
await t.post({ t: 'ck', site: KEY, path: '/a', vp: 'd', x: 'n', y: 0.5 });
|
||||
assert.equal(t.rows().length, 0);
|
||||
const c = t.db.prepare('SELECT * FROM clicks').all();
|
||||
assert.equal(c.length, 1);
|
||||
assert.equal(c[0].path, '/a');
|
||||
assert.equal(c[0].x, 0.123);
|
||||
assert.equal(c[0].y, 1);
|
||||
assert.equal(c[0].sel.length, 200);
|
||||
assert.deepEqual(Object.keys(c[0]).sort(), ['id', 'path', 'sel', 'site', 'ts', 'vp', 'x', 'y']);
|
||||
t.close();
|
||||
});
|
||||
|
||||
test('ct: kind und host', async () => {
|
||||
const t = await setup();
|
||||
await t.post({ t: 'ct', site: KEY, path: '/k', kind: 'tel', host: 'ignored.de' });
|
||||
await t.post({ t: 'ct', site: KEY, path: '/k', kind: 'out', host: 'Instagram.COM' });
|
||||
await t.post({ t: 'ct', site: KEY, path: '/k', kind: 'out' });
|
||||
await t.post({ t: 'ct', site: KEY, path: '/k', kind: 'sms' });
|
||||
const rows = t.rows();
|
||||
assert.equal(rows.length, 2);
|
||||
assert.equal(rows[0].kind, 'tel');
|
||||
assert.equal(rows[0].host, null);
|
||||
assert.equal(rows[1].host, 'instagram.com');
|
||||
assert.match(rows[1].visitor, /^[0-9a-f]{16}$/);
|
||||
t.close();
|
||||
});
|
||||
|
||||
test('Mengenlimit: 121. Ereignis verworfen, neue Minute frei', async () => {
|
||||
let now = Date.UTC(2026, 9, 1, 10, 30, 0);
|
||||
const t = await setup({ now: () => now });
|
||||
for (let i = 0; i < 125; i++) await t.post(pv());
|
||||
assert.equal(t.rows().length, 120);
|
||||
await t.post(pv(), { ip: '198.51.100.9' });
|
||||
assert.equal(t.rows().length, 121);
|
||||
now += 61000;
|
||||
await t.post(pv());
|
||||
assert.equal(t.rows().length, 122);
|
||||
t.close();
|
||||
});
|
||||
|
||||
test('Land: nur 2 Großbuchstaben, sonst leer', async () => {
|
||||
const t = await setup({ geo: { lookup: () => 'xyz' } });
|
||||
await t.post(pv());
|
||||
assert.equal(t.rows()[0].country, '');
|
||||
t.close();
|
||||
const u = await setup({ geo: { lookup: () => 'at' } });
|
||||
await u.post(pv());
|
||||
assert.equal(u.rows()[0].country, 'AT');
|
||||
u.close();
|
||||
});
|
||||
|
||||
test('CORS-Preflight nur für erlaubte Origin', async () => {
|
||||
const t = await setup();
|
||||
const ok = await fetch(t.base + '/a/e', { method: 'OPTIONS', headers: { Origin: ORIGIN, 'Access-Control-Request-Method': 'POST' } });
|
||||
assert.equal(ok.status, 204);
|
||||
assert.equal(ok.headers.get('access-control-allow-origin'), ORIGIN);
|
||||
assert.equal(ok.headers.get('access-control-allow-credentials'), null);
|
||||
const bad = await fetch(t.base + '/a/e', { method: 'OPTIONS', headers: { Origin: 'https://evil.example' } });
|
||||
assert.equal(bad.status, 204);
|
||||
assert.equal(bad.headers.get('access-control-allow-origin'), null);
|
||||
t.close();
|
||||
});
|
||||
|
||||
test('Datenschutz: weder IP noch User-Agent irgendwo in der Datenbank', async () => {
|
||||
const t = await setup();
|
||||
await t.post(pv({ ref: 'https://google.com' }));
|
||||
await t.post({ t: 'bn', site: KEY, a: 'accept' });
|
||||
await t.post({ t: 'en', site: KEY, path: '/a', vp: 'd', sec: 5, scroll: 50 });
|
||||
await t.post({ t: 'ck', site: KEY, path: '/a', vp: 'd', x: 0.5, y: 0.5, sel: 'a' });
|
||||
await t.post({ t: 'ct', site: KEY, path: '/a', kind: 'mail' });
|
||||
let dump = '';
|
||||
for (const { name } of t.db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all()) {
|
||||
dump += JSON.stringify(t.db.prepare(`SELECT * FROM ${name}`).all());
|
||||
}
|
||||
for (const needle of [IP, '1.2.3.4', 'GEHEIMERUA', 'Mozilla', 'iPhone']) assert.ok(!dump.includes(needle), needle);
|
||||
t.close();
|
||||
});
|
||||
Reference in new issue
Block a user