47 lines
3.0 KiB
Markdown
47 lines
3.0 KiB
Markdown
# Production pageview privacy contract
|
|
|
|
`static/privacy-pageview.js` loads the current Umami script only on HTTPS,
|
|
exact hostname `player.nenasets.com`, default port, and known application document routes.
|
|
It never loads on loopback, desktop protocol, DEV, previous, rollback, API,
|
|
admin, download, or unknown routes. Website: `dc1b14a6-d1ba-4802-b895-553b3c81c677`.
|
|
|
|
Automatic Umami tracking is disabled, including history and click hooks. One
|
|
manual pageview is sent per loaded document. The before-send hook reconstructs
|
|
a strict projection: website, hostname, static title `Alta Export Player`, static path
|
|
`/`, empty referrer, validated ordinary browser screen/language. It drops
|
|
identity, unknown/custom events, tags, arbitrary properties, user title, URL,
|
|
query/fragment, filenames, upload contents, forms and application state.
|
|
Only fixed download controls emit fixed event names/properties: `#releaseAction` → `download_desktop_app` (`tool: alta-export-player`, `format: desktop`). Native desktop/update modes are excluded.
|
|
These are click intents, not successful-download reports. A capture listener does
|
|
not read the link URL or filename, cancel navigation, or await analytics. Unknown events and
|
|
caller-provided event data are discarded; whitelisted event data is reconstructed.
|
|
|
|
The hook is installed before creating/loading the external script, auto tracking
|
|
is disabled, and an unavailable bootstrap produces no tracker GET/POST. The script
|
|
uses anonymous CORS and no-referrer; collection fetch credentials are omit.
|
|
No application data is read. Both script requests and collection requests must
|
|
have no Cookie, Authorization or Referer headers. Tracker credentials are omit.
|
|
|
|
The only CSP additions are the exact script and endpoint paths:
|
|
`https://umami.nenasets.com/script.js` in script-src and
|
|
`https://umami.nenasets.com/api/send` in connect-src. Existing restrictions stay.
|
|
No gateway/auth/deployment/registry configuration is changed by this commit.
|
|
|
|
## Repeatable gates
|
|
|
|
- `node --test tests/analytics.test.js`: hostname/path/protocol/port allowlist,
|
|
single pageview, automatic tracking off, reconstruction and identity/event denial.
|
|
- `node scripts/check.js`: native utility/server checks plus analytics suite.
|
|
- Root is the only native application document route. No synthetic media fixture
|
|
is provided; local acceptance exercised shell/layout controls, not footage playback.
|
|
|
|
Built-image Chromium desktop/mobile acceptance and request evidence live outside
|
|
this source checkout in the rollout project worker reports. The audited real
|
|
tracker was served locally and its POSTs intercepted with a204 sink, not sent to
|
|
production Umami. This does not prove organic ingestion. ONVIF acceptance uses
|
|
unchanged documented real bundled catalogue records, independent local signing
|
|
secrets and a test-only employee verifier; it does not prove a Google login.
|
|
|
|
No push or deployment is part of this commit. Inspect CI and deployment bindings
|
|
before publishing; the coordinator owns exact-image promotion and rollback.
|