Analyse: Messdienst: Ping ohne Einwilligung, Zeitstempel auf Stunde, Pfade ohne Kennungen

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

analytics/test/stats.test.js

@@ -204,3 +204,34 @@ test('scheduleNightly: früh feuernder Timer läuft nicht vorzeitig und nie dopp
   s.stop();
   assert.equal(pending.length, 0);
 });
+
+test('T2: pv ohne Einwilligung + cx: pv_total 1, pv_ref nur {google.com:1}; cx zählt nie pv_total', () => {
+  const { db, ev } = mk();
+  const t = NOW - D;
+  ev({ ts: t, type: 'pv', path: '/', vp: null, ref: null, country: 'DE', device: 'd' });
+  ev({ ts: t, type: 'cx', vp: 'd', ref: 'google.com' });
+  ev({ ts: t, type: 'cx', vp: 'd', ref: null });
+  ev({ ts: t, type: 'pv', path: '/', vp: 'd', ref: null, country: 'DE', device: 'd' });
+  runNightly(db, { now: NOW });
+  const d = '2026-10-09';
+  assert.equal(get(db, d, 'pv_total'), 2);
+  assert.equal(get(db, d, 'pv_ref', 'google.com'), 1);
+  assert.equal(get(db, d, 'pv_ref', ''), 2); // pv mit vp und cx ohne ref
+  const refs = db.prepare("SELECT key FROM daily WHERE site=? AND dim='pv_ref' ORDER BY key").all(KEY).map((r) => r.key);
+  assert.deepEqual(refs, ['', 'google.com']);
+});
+
+test('T2: Stats-Endpunkt refs live und aus daily, nie doppelt', async () => {
+  const { db, ev } = mk();
+  ev({ ts: NOW - D, type: 'pv', path: '/', vp: null, country: 'DE', device: 'd' });
+  ev({ ts: NOW - D, type: 'cx', vp: 'd', ref: 'google.com' });
+  const a = await admin(db);
+  const live = await (await a.get(`/a/admin/stats/${KEY}?range=7`)).json();
+  assert.equal(live.totals.pv, 1);
+  assert.deepEqual(live.refs, [{ key: 'google.com', count: 1 }]);
+  runNightly(db, { now: NOW });
+  const agg = await (await a.get(`/a/admin/stats/${KEY}?range=7`)).json();
+  assert.equal(agg.totals.pv, 1);
+  assert.deepEqual(agg.refs, [{ key: 'google.com', count: 1 }]);
+  a.close();
+});