feat(mindspace): add opt-in local analytics

2026-07-16 21:06:28 +08:00
parent 6e460336f7
commit 320945a485
9 changed files with 412 additions and 6 deletions
@@ -64,3 +64,35 @@ test('updateMindSpaceConfig persists a positive integer limit', async () => {
  assert.equal(config.publicPageLimit, 15);
  assert.equal(calls.some(({ sql }) => sql.includes('ON DUPLICATE KEY UPDATE')), true);
 });
+
+test('analytics settings encrypt the id secret and only reveal it on internal loads', async () => {
+  const rows = new Map();
+  const pool = {
+    async query(sql, params = []) {
+      if (sql.includes('FROM mindspace_config')) {
+        return [[...rows].map(([key, value]) => ({ key, value }))];
+      }
+      if (sql.includes('ON DUPLICATE KEY UPDATE')) rows.set(params[0], params[1]);
+      return [[]];
+    },
+  };
+  const env = { TKMIND_SERVER__SECRET_KEY: 'test-server-secret' };
+
+  const publicConfig = await updateMindSpaceConfig(pool, {
+    analytics: {
+      enabled: true,
+      websiteId: 'website-1',
+      analyticsUrl: 'http://127.0.0.1:3200',
+      domains: 'localhost',
+      idSecret: 'analytics-secret',
+    },
+  }, { env });
+
+  assert.equal(publicConfig.analytics.enabled, true);
+  assert.equal(publicConfig.analytics.idSecretConfigured, true);
+  assert.equal('idSecret' in publicConfig.analytics, false);
+  assert.doesNotMatch(rows.get('analytics_id_secret'), /analytics-secret/);
+
+  const internalConfig = await loadMindSpaceConfig(pool, { env, includeAnalyticsSecret: true });
+  assert.equal(internalConfig.analytics.idSecret, 'analytics-secret');
+});