Release: codebar analytics on the feedback page

.env.example

@@ -47,3 +47,5 @@ OH_DEAR_HEALTH_CHECK_PATH=/oh-dear-health-check-results
 NIGHTWATCH_API_TOKEN=
 NIGHTWATCH_APPLICATION_ID=
 NIGHTWATCH_ENVIRONMENT_ID=
+
+CODEBAR_ANALYTICS_URL=https://analytics.codebar.ch

app/Http/Controllers/FeedbackPageController.php

@@ -15,7 +15,7 @@
  * Page of one feedback entry behind a signed link (feedback:link, share link):
  * screenshot with the sender's message, technical details in a second tab.
  * The only HTML the API serves: one nonce'd inline script (tabs, copy
- * buttons), nothing loaded from other hosts.
+ * buttons) and, in production, the nonce'd codebar analytics tracker.
  */
 final class FeedbackPageController
 {
@@ -32,6 +32,7 @@ public function __invoke(Request $request, FeedbackEntry $entry): Response
         $environment = self::environment($entry);
         $console = self::rows($entry->console_log, ['type', 'message', 'source', 'line', 'column', 'stack']);
         $network = self::rows($entry->network_log, ['method', 'url', 'status', 'duration']);
+        $analyticsUrl = self::analyticsUrl();
         $customData = $entry->custom_data === null || $entry->custom_data === [] ? null : (string) json_encode($entry->custom_data, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
 
         return response()->view('feedback.show', [
@@ -51,14 +52,24 @@ public function __invoke(Request $request, FeedbackEntry $entry): Response
             'statusUrl' => $request->boolean('manage') ? FeedbackLink::status($entry, $expires, is_string($by) ? $by : null) : null,
             'expires' => $expires,
             'nonce' => $nonce,
+            'analyticsScript' => $analyticsUrl === null ? null : $analyticsUrl.'/js/script.js',
         ])->withHeaders([
-            'Content-Security-Policy' => "default-src 'none'; img-src 'self'; style-src 'nonce-{$nonce}'; script-src 'nonce-{$nonce}'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'",
+            'Content-Security-Policy' => "default-src 'none'; img-src 'self'; style-src 'nonce-{$nonce}'; script-src 'nonce-{$nonce}'; ".($analyticsUrl === null ? '' : "connect-src {$analyticsUrl}; ")."base-uri 'none'; form-action 'self'; frame-ancestors 'none'",
             'Cache-Control' => 'private, no-store',
             'Referrer-Policy' => 'no-referrer',
             'X-Content-Type-Options' => 'nosniff',
         ]);
     }
 
+    /** Origin of codebar analytics when the tracker runs in this environment. */
+    private static function analyticsUrl(): ?string
+    {
+        $url = config('default.codebar_analytics.url');
+        $environments = (array) config('default.codebar_analytics.environments', []);
+
+        return is_string($url) && $url !== '' && app()->environment($environments) ? rtrim($url, '/') : null;
+    }
+
     /** @return array<string, string> label => value, only what is known */
     private static function environment(FeedbackEntry $entry): array
     {

config/default.php

@@ -17,4 +17,13 @@
         'environment_id' => env('NIGHTWATCH_ENVIRONMENT_ID'),
     ],
 
+    /*
+     * codebar analytics (analytics.codebar.ch) on the feedback page, production only.
+     * The tracker sends the page URL; analytics drops the query string (the link signature).
+     */
+    'codebar_analytics' => [
+        'url' => env('CODEBAR_ANALYTICS_URL'),
+        'environments' => ['production'],
+    ],
+
 ];

resources/views/feedback/show.blade.php

@@ -385,5 +385,8 @@
         });
     })();
 </script>
+@if ($analyticsScript)
+<script src="{{ $analyticsScript }}" nonce="{{ $nonce }}" crossorigin="anonymous" defer></script>
+@endif
 </body>
 </html>

tests/Feature/FeedbackLinkTest.php

@@ -138,6 +138,25 @@ function entryWithShot(FeedbackProject $project, array $attributes = []): Feedba
         ->assertDontSee('Download');
 });
 
+it('loads the nonced codebar analytics tracker in production only', function (): void {
+    config(['default.codebar_analytics.url' => 'https://analytics.codebar.ch/']);
+    $entry = entryWithShot($this->project);
+    $url = feedbackLink($entry->id)['url'];
+
+    $local = test()->get($url, NAVIGATE)->assertOk();
+    expect((string) $local->headers->get('Content-Security-Policy'))->not->toContain('connect-src')
+        ->and((string) $local->getContent())->not->toContain('analytics.codebar.ch');
+
+    app()['env'] = 'production';
+    $response = test()->get($url, NAVIGATE)->assertOk();
+    $csp = (string) $response->headers->get('Content-Security-Policy');
+    preg_match("/'nonce-([^']+)'/", $csp, $nonce);
+
+    expect($csp)->toContain('connect-src https://analytics.codebar.ch;')->toContain("default-src 'none'")
+        ->and((string) $response->getContent())->toContain('<script src="https://analytics.codebar.ch/js/script.js" nonce="'.$nonce[1].'" crossorigin="anonymous" defer></script>')
+        ->and(substr_count((string) $response->getContent(), '<script'))->toBe(2);
+});
+
 it('escapes everything the browser sent', function (): void {
     $entry = FeedbackEntry::factory()->for($this->project, 'project')->create([
         'message' => '<script>alert(1)</script>',