From 1f7b288a2169634517b99a1c356cf55d42c54a3b Mon Sep 17 00:00:00 2001 From: john Date: Thu, 16 Jul 2026 21:09:20 +0800 Subject: [PATCH] fix(analytics): keep readable owner labels server-side --- mindspace-analytics.mjs | 5 ++++- mindspace-analytics.test.mjs | 4 +++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/mindspace-analytics.mjs b/mindspace-analytics.mjs index a619d31..f3839e4 100644 --- a/mindspace-analytics.mjs +++ b/mindspace-analytics.mjs @@ -95,7 +95,10 @@ export function injectMindSpaceAnalytics(html, { if (source.includes(ANALYTICS_MARKER)) return source; const owner = pseudonymizeAnalyticsId(ownerId, config.idSecret); if (!owner) return source; - const metadata = { owner_id: owner, owner_segment: String(ownerSegment || 'unknown'), owner_label: resolveAnalyticsOwnerLabel({ displayName: ownerLabel }), page_id: String(pageId || ''), publication_id: String(publicationId || ''), channel }; + // Public page source must not contain a readable account name. The stable + // pseudonym and coarse plan segment are sufficient for page analytics; + // readable labels are reserved for server-originated events only. + const metadata = { owner_id: owner, owner_segment: String(ownerSegment || 'unknown'), page_id: String(pageId || ''), publication_id: String(publicationId || ''), channel }; const attrs = [ ANALYTICS_MARKER, `data-website-id="${config.websiteId.replaceAll('"', '"')}"`, diff --git a/mindspace-analytics.test.mjs b/mindspace-analytics.test.mjs index 5cc7b00..c3d874b 100644 --- a/mindspace-analytics.test.mjs +++ b/mindspace-analytics.test.mjs @@ -49,6 +49,7 @@ test('injects one local same-origin tracker with page dimensions', () => { const html = 'Demo

Demo

'; const out = injectMindSpaceAnalytics(html, { ownerId: 'user-123', + ownerLabel: '张三', pageId: 'page-1', publicationId: 'pub-1', config: { @@ -65,7 +66,8 @@ test('injects one local same-origin tracker with page dimensions', () => { assert.match(out, /data-auto-track="false"/); assert.match(out, /page_id/); assert.match(out, /owner_segment/); - assert.match(out, /owner_label/); + assert.doesNotMatch(out, /owner_label/); + assert.doesNotMatch(out, /张三/); assert.match(out, /page_click/); assert.match(out, /page_form_submit/); assert.match(out, /page_scroll_/);