feat: add privacy-safe production player pageviews

2026-09-30 02:58:33 +00:00
parent 2c93670aaf
commit 1693b20d58
5 changed files with 144 additions and 1 deletions
@@ -0,0 +1,38 @@
+# Production pageview privacy contract
+
+`static/privacy-pageview.js` loads the current Umami script only on HTTPS,
+exact hostname `player.nenasets.com`, default port, and known application document routes.
+It never loads on loopback, desktop protocol, DEV, previous, rollback, API,
+admin, download, or unknown routes. Website: `dc1b14a6-d1ba-4802-b895-553b3c81c677`.
+
+Automatic Umami tracking is disabled, including history and click hooks. One
+manual pageview is sent per loaded document. The before-send hook reconstructs
+a strict projection: website, hostname, static title `Alta Export Player`, static path
+`/`, empty referrer, validated ordinary browser screen/language. It drops
+identity, named/custom events, tags, arbitrary properties, user title, URL,
+query/fragment, filenames, upload contents, forms and application state.
+No application data is read. Both script requests and collection requests must
+have no Cookie, Authorization or Referer headers. Tracker credentials are omit.
+
+The only CSP additions are the exact script and endpoint paths:
+`https://umami.nenasets.com/script.js` in script-src and
+`https://umami.nenasets.com/api/send` in connect-src. Existing restrictions stay.
+No gateway/auth/deployment/registry configuration is changed by this commit.
+
+## Repeatable gates
+
+- `node --test tests/analytics.test.js`: hostname/path/protocol/port allowlist,
+  single pageview, automatic tracking off, reconstruction and identity/event denial.
+- `node scripts/check.js`: native utility/server checks plus analytics suite.
+- Root is the only native application document route. No synthetic media fixture
+  is provided; local acceptance exercised shell/layout controls, not footage playback.
+
+Built-image Chromium desktop/mobile acceptance and request evidence live outside
+this source checkout in the rollout project worker reports. The audited real
+tracker was served locally and its POSTs intercepted with a204 sink, not sent to
+production Umami. This does not prove organic ingestion. ONVIF acceptance uses
+unchanged documented real bundled catalogue records, independent local signing
+secrets and a test-only employee verifier; it does not prove a Google login.
+
+No push or deployment is part of this commit. Inspect CI and deployment bindings
+before publishing; the coordinator owns exact-image promotion and rollback.