2.3 KiB
Production pageview privacy contract
static/privacy-pageview.js loads the current Umami script only on HTTPS,
exact hostname player.nenasets.com, default port, and known application document routes.
It never loads on loopback, desktop protocol, DEV, previous, rollback, API,
admin, download, or unknown routes. Website: dc1b14a6-d1ba-4802-b895-553b3c81c677.
Automatic Umami tracking is disabled, including history and click hooks. One
manual pageview is sent per loaded document. The before-send hook reconstructs
a strict projection: website, hostname, static title Alta Export Player, static path
/, empty referrer, validated ordinary browser screen/language. It drops
identity, named/custom events, tags, arbitrary properties, user title, URL,
query/fragment, filenames, upload contents, forms and application state.
No application data is read. Both script requests and collection requests must
have no Cookie, Authorization or Referer headers. Tracker credentials are omit.
The only CSP additions are the exact script and endpoint paths:
https://umami.nenasets.com/script.js in script-src and
https://umami.nenasets.com/api/send in connect-src. Existing restrictions stay.
No gateway/auth/deployment/registry configuration is changed by this commit.
Repeatable gates
node --test tests/analytics.test.js: hostname/path/protocol/port allowlist, single pageview, automatic tracking off, reconstruction and identity/event denial.node scripts/check.js: native utility/server checks plus analytics suite.- Root is the only native application document route. No synthetic media fixture is provided; local acceptance exercised shell/layout controls, not footage playback.
Built-image Chromium desktop/mobile acceptance and request evidence live outside this source checkout in the rollout project worker reports. The audited real tracker was served locally and its POSTs intercepted with a204 sink, not sent to production Umami. This does not prove organic ingestion. ONVIF acceptance uses unchanged documented real bundled catalogue records, independent local signing secrets and a test-only employee verifier; it does not prove a Google login.
No push or deployment is part of this commit. Inspect CI and deployment bindings before publishing; the coordinator owns exact-image promotion and rollback.