fix: contain anonymous analytics ingestion

Author: richiemcilroy

apps/web/__tests__/unit/product-analytics-browser-token.test.ts

@@ -4,6 +4,7 @@ import {
 	PRODUCT_ANALYTICS_BROWSER_TOKEN_COOKIE,
 	PRODUCT_ANALYTICS_BROWSER_TOKEN_TTL_SECONDS,
 	readProductAnalyticsBrowserToken,
+	readProductAnalyticsBrowserTokenClaims,
 	verifyProductAnalyticsBrowserToken,
 } from "@/lib/analytics/browser-token";
 
@@ -12,8 +13,15 @@ const now = Date.parse("2026-07-12T12:00:00.000Z");
 
 describe("product analytics browser token", () => {
 	it("accepts an untampered token inside its bounded lifetime", () => {
-		const token = createProductAnalyticsBrowserToken(secret, now, "nonce");
+		const token = createProductAnalyticsBrowserToken(
+			secret,
+			"anonymous-1",
+			now,
+		);
 		expect(verifyProductAnalyticsBrowserToken(token, secret, now)).toBe(true);
+		expect(readProductAnalyticsBrowserTokenClaims(token, secret, now)).toEqual({
+			anonymousId: "anonymous-1",
+		});
 		expect(
 			verifyProductAnalyticsBrowserToken(
 				token,
@@ -24,7 +32,11 @@ describe("product analytics browser token", () => {
 	});
 
 	it("rejects expired, future, tampered, and malformed tokens", () => {
-		const token = createProductAnalyticsBrowserToken(secret, now, "nonce");
+		const token = createProductAnalyticsBrowserToken(
+			secret,
+			"anonymous-1",
+			now,
+		);
 		expect(
 			verifyProductAnalyticsBrowserToken(
 				token,
@@ -34,7 +46,7 @@ describe("product analytics browser token", () => {
 		).toBe(false);
 		expect(
 			verifyProductAnalyticsBrowserToken(
-				createProductAnalyticsBrowserToken(secret, now + 61_000, "nonce"),
+				createProductAnalyticsBrowserToken(secret, "anonymous-1", now + 61_000),
 				secret,
 				now,
 			),
@@ -48,7 +60,11 @@ describe("product analytics browser token", () => {
 	});
 
 	it("reads only the analytics token cookie", () => {
-		const token = createProductAnalyticsBrowserToken(secret, now, "nonce");
+		const token = createProductAnalyticsBrowserToken(
+			secret,
+			"anonymous-1",
+			now,
+		);
 		expect(
 			readProductAnalyticsBrowserToken(
 				`other=value; ${PRODUCT_ANALYTICS_BROWSER_TOKEN_COOKIE}=${token}`,

apps/web/__tests__/unit/product-analytics-queue.test.ts

@@ -5,6 +5,7 @@ import {
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import {
 	createProductEventId,
+	getOrCreateBrowserAnonymousId,
 	getOrCreateStorageId,
 	ProductAnalyticsQueue,
 	type ProductAnalyticsTransport,
@@ -232,6 +233,17 @@ describe("browser analytics identity", () => {
 		expect(storage.setItem).toHaveBeenCalledWith("key", "new-id");
 	});
 
+	it("uses the server-issued cookie identity", () => {
+		const storage = { getItem: vi.fn(() => "stale-id"), setItem: vi.fn() };
+		expect(
+			getOrCreateBrowserAnonymousId(storage, "signed-id", () => "new-id"),
+		).toBe("signed-id");
+		expect(storage.setItem).toHaveBeenCalledWith(
+			"cap_analytics_anonymous_id_v1",
+			"signed-id",
+		);
+	});
+
 	it("falls back when storage is unavailable", () => {
 		const storage = {
 			getItem: vi.fn(() => {

apps/web/__tests__/unit/product-analytics-request.test.ts

@@ -1,16 +1,20 @@
-import { PRODUCT_ANALYTICS_LIMITS } from "@cap/analytics";
+import {
+	PRODUCT_ANALYTICS_LIMITS,
+	type ProductEventInput,
+} from "@cap/analytics";
 import { describe, expect, it } from "vitest";
 import {
 	getProductAnalyticsRateLimitKey,
+	hasExpectedBrowserAnalyticsMetadata,
+	isAllowedAnonymousBrowserProductEvent,
 	isAuthenticatedAnalyticsRequestCandidate,
-	isTrustedAnalyticsRequest,
 	normalizeGeoHeader,
 	normalizeProductEventBatch,
 	ProductAnalyticsRateLimiter,
 } from "@/lib/analytics/request";
 
 const allowedOrigins = ["https://cap.so", "tauri://localhost"];
-const event = {
+const event: ProductEventInput = {
 	eventId: "event-1",
 	eventName: "page_view",
 	occurredAt: "2026-07-12T12:00:00.000Z",
@@ -20,7 +24,7 @@ const event = {
 };
 const now = Date.parse("2026-07-12T12:00:01.000Z");
 
-describe("isTrustedAnalyticsRequest", () => {
+describe("hasExpectedBrowserAnalyticsMetadata", () => {
 	it.each([
 		[
 			"same-origin browser",
@@ -31,25 +35,30 @@ describe("isTrustedAnalyticsRequest", () => {
 			{ origin: "https://cap.so", secFetchSite: "same-site" },
 		],
 	])("accepts %s", (_label, headers) => {
-		expect(isTrustedAnalyticsRequest(headers, allowedOrigins)).toBe(true);
+		expect(hasExpectedBrowserAnalyticsMetadata(headers, allowedOrigins)).toBe(
+			true,
+		);
 	});
 
 	it("rejects cross-site browser requests", () => {
 		expect(
-			isTrustedAnalyticsRequest(
+			hasExpectedBrowserAnalyticsMetadata(
 				{ origin: "https://attacker.example", secFetchSite: "cross-site" },
 				allowedOrigins,
 			),
 		).toBe(false);
 	});
 
 	it("rejects requests without browser metadata", () => {
-		expect(isTrustedAnalyticsRequest({}, allowedOrigins)).toBe(false);
+		expect(hasExpectedBrowserAnalyticsMetadata({}, allowedOrigins)).toBe(false);
 		expect(
-			isTrustedAnalyticsRequest({ origin: "https://cap.so" }, allowedOrigins),
+			hasExpectedBrowserAnalyticsMetadata(
+				{ origin: "https://cap.so" },
+				allowedOrigins,
+			),
 		).toBe(false);
 		expect(
-			isTrustedAnalyticsRequest(
+			hasExpectedBrowserAnalyticsMetadata(
 				{ origin: "https://cap.so", secFetchSite: "none" },
 				allowedOrigins,
 			),
@@ -67,6 +76,11 @@ describe("isTrustedAnalyticsRequest", () => {
 				authorization: "Bearer invalid",
 			}),
 		).toBe(false);
+		expect(
+			isAuthenticatedAnalyticsRequestCandidate({
+				authorization: `Bearer ${"a".repeat(36)} extra`,
+			}),
+		).toBe(false);
 		expect(
 			isAuthenticatedAnalyticsRequestCandidate({
 				authorization: `Bearer ${"a".repeat(36)}`,
@@ -75,9 +89,33 @@ describe("isTrustedAnalyticsRequest", () => {
 		).toBe(true);
 	});
 
+	it("allows only bounded top-of-funnel web events without an actor", () => {
+		expect(isAllowedAnonymousBrowserProductEvent(event, "anonymous-1")).toBe(
+			true,
+		);
+		expect(
+			isAllowedAnonymousBrowserProductEvent(
+				{ ...event, eventName: "recording_started" },
+				"anonymous-1",
+			),
+		).toBe(false);
+		expect(
+			isAllowedAnonymousBrowserProductEvent(
+				{ ...event, anonymousId: "attacker-chosen" },
+				"anonymous-1",
+			),
+		).toBe(false);
+		expect(
+			isAllowedAnonymousBrowserProductEvent(
+				{ ...event, platform: "desktop" },
+				"anonymous-1",
+			),
+		).toBe(false);
+	});
+
 	it("rejects oversized declared bodies", () => {
 		expect(
-			isTrustedAnalyticsRequest(
+			hasExpectedBrowserAnalyticsMetadata(
 				{ contentLength: String(PRODUCT_ANALYTICS_LIMITS.requestBytes + 1) },
 				allowedOrigins,
 			),
@@ -87,9 +125,9 @@ describe("isTrustedAnalyticsRequest", () => {
 	it.each(["invalid", "-1", "1.5"])(
 		"rejects malformed content length %s",
 		(contentLength) => {
-			expect(isTrustedAnalyticsRequest({ contentLength }, allowedOrigins)).toBe(
-				false,
-			);
+			expect(
+				hasExpectedBrowserAnalyticsMetadata({ contentLength }, allowedOrigins),
+			).toBe(false);
 		},
 	);
 });

apps/web/app/api/events/route.ts

@@ -19,12 +19,13 @@ import {
 import { Effect, Layer, Schema } from "effect";
 import {
 	readProductAnalyticsBrowserToken,
-	verifyProductAnalyticsBrowserToken,
+	readProductAnalyticsBrowserTokenClaims,
 } from "@/lib/analytics/browser-token";
 import {
 	getProductAnalyticsRateLimitKey,
+	hasExpectedBrowserAnalyticsMetadata,
+	isAllowedAnonymousBrowserProductEvent,
 	isAuthenticatedAnalyticsRequestCandidate,
-	isTrustedAnalyticsRequest,
 	normalizeGeoHeader,
 	normalizeProductEventBatch,
 	ProductAnalyticsRateLimiter,
@@ -88,14 +89,17 @@ const ApiLive = HttpApiBuilder.api(Api).pipe(
 							origin: headers.origin,
 							secFetchSite: headers["sec-fetch-site"],
 						};
-						const isBrowserRequest =
-							isTrustedAnalyticsRequest(requestMetadata, allowedOrigins) &&
-							verifyProductAnalyticsBrowserToken(
+						const browserClaims =
+							hasExpectedBrowserAnalyticsMetadata(
+								requestMetadata,
+								allowedOrigins,
+							) &&
+							readProductAnalyticsBrowserTokenClaims(
 								readProductAnalyticsBrowserToken(headers.cookie),
 								serverEnv().NEXTAUTH_SECRET,
 							);
 						if (
-							!isBrowserRequest &&
+							!browserClaims &&
 							!isAuthenticatedAnalyticsRequestCandidate(requestMetadata)
 						) {
 							return yield* Effect.fail(new HttpApiError.BadRequest());
@@ -126,7 +130,16 @@ const ApiLive = HttpApiBuilder.api(Api).pipe(
 						}
 
 						const actor = yield* resolveProductAnalyticsActor;
-						if (!isBrowserRequest && !actor) {
+						if (
+							!actor &&
+							(!browserClaims ||
+								!events.every((event) =>
+									isAllowedAnonymousBrowserProductEvent(
+										event,
+										browserClaims.anonymousId,
+									),
+								))
+						) {
 							return yield* Effect.fail(new HttpApiError.BadRequest());
 						}
 						const rows = createProductEventRows(events, {

apps/web/app/utils/product-analytics.ts

@@ -222,6 +222,19 @@ export function getOrCreateStorageId(
 	return created;
 }
 
+export function getOrCreateBrowserAnonymousId(
+	storage: Pick<Storage, "getItem" | "setItem"> | undefined,
+	cookieId: string | undefined,
+	createId: () => string,
+) {
+	if (!cookieId)
+		return getOrCreateStorageId(storage, ANONYMOUS_ID_KEY, createId);
+	try {
+		storage?.setItem(ANONYMOUS_ID_KEY, cookieId);
+	} catch {}
+	return cookieId;
+}
+
 export function createProductEventId(
 	randomUUID: (() => string) | null = getRandomUUID() ?? null,
 	now = Date.now(),
@@ -278,10 +291,12 @@ function getBrowserQueue() {
 
 function getAnonymousId() {
 	if (!anonymousId) {
-		anonymousId = getOrCreateStorageId(
-			getBrowserStorage("localStorage"),
-			ANONYMOUS_ID_KEY,
-			() => createProductEventId(),
+		const storage = getBrowserStorage("localStorage");
+		const cookieId = Cookies.get(PRODUCT_ANALYTICS_ANONYMOUS_ID_COOKIE);
+		anonymousId = getOrCreateBrowserAnonymousId(
+			storage,
+			cookieId,
+			createProductEventId,
 		);
 		persistAnonymousIdCookie(anonymousId);
 	}

apps/web/lib/analytics/browser-token.ts

@@ -2,38 +2,55 @@ import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 
 export const PRODUCT_ANALYTICS_BROWSER_TOKEN_COOKIE =
 	"cap_analytics_browser_token";
-export const PRODUCT_ANALYTICS_BROWSER_TOKEN_TTL_SECONDS = 24 * 60 * 60;
+export const PRODUCT_ANALYTICS_BROWSER_TOKEN_TTL_SECONDS = 60 * 60;
+
+export function createProductAnalyticsAnonymousId() {
+	return randomBytes(16).toString("base64url");
+}
 
 export function createProductAnalyticsBrowserToken(
 	secret: string,
+	anonymousId = createProductAnalyticsAnonymousId(),
 	now = Date.now(),
-	nonce = randomBytes(16).toString("base64url"),
 ) {
-	const payload = `v1.${Math.floor(now / 1000)}.${nonce}`;
+	const payload = `v1.${Math.floor(now / 1000)}.${anonymousId}`;
 	return `${payload}.${sign(payload, secret)}`;
 }
 
-export function verifyProductAnalyticsBrowserToken(
+export function readProductAnalyticsBrowserTokenClaims(
 	token: string | undefined,
 	secret: string,
 	now = Date.now(),
 ) {
-	if (!token) return false;
+	if (!token) return undefined;
 	const parts = token.split(".");
-	if (parts.length !== 4 || parts[0] !== "v1") return false;
+	if (parts.length !== 4 || parts[0] !== "v1") return undefined;
 	const issuedAt = Number(parts[1]);
-	if (!Number.isSafeInteger(issuedAt)) return false;
+	if (!Number.isSafeInteger(issuedAt)) return undefined;
+	const anonymousId = parts[2];
+	if (!anonymousId || anonymousId.length > 128) return undefined;
 	const nowSeconds = Math.floor(now / 1000);
 	if (
 		issuedAt > nowSeconds + 60 ||
 		nowSeconds - issuedAt > PRODUCT_ANALYTICS_BROWSER_TOKEN_TTL_SECONDS
 	) {
-		return false;
+		return undefined;
 	}
 	const payload = parts.slice(0, 3).join(".");
 	const expected = Buffer.from(sign(payload, secret));
 	const actual = Buffer.from(parts[3] ?? "");
-	return expected.length === actual.length && timingSafeEqual(expected, actual);
+	if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) {
+		return undefined;
+	}
+	return { anonymousId };
+}
+
+export function verifyProductAnalyticsBrowserToken(
+	token: string | undefined,
+	secret: string,
+	now = Date.now(),
+) {
+	return Boolean(readProductAnalyticsBrowserTokenClaims(token, secret, now));
 }
 
 export function readProductAnalyticsBrowserToken(cookieHeader?: string) {