Return early if detectBot in track/open

apps/web/app/(ee)/api/track/open/route.ts

@@ -29,6 +29,7 @@ export const POST = withAxiom(async (req) => {
     const identityHash = await getIdentityHash(req);
 
     if (!deepLinkUrl) {
+      // Probabilistic IP-based tracking
       if (ip) {
         // if ip address is present, check if there's a cached click
         console.log(`Checking cache for ${ip}:${dubDomain}:*`);
@@ -105,9 +106,16 @@ export const POST = withAxiom(async (req) => {
       });
     }
 
+    const linkData = {
+      id: cachedLink.id,
+      domain,
+      key,
+      url: cachedLink.url,
+    };
+
     // if there's no cached clickId, track the click event
     if (!cachedClickId) {
-      await recordClick({
+      const clickData = await recordClick({
         req,
         clickId,
         workspaceId: cachedLink.projectId,
@@ -121,16 +129,22 @@ export const POST = withAxiom(async (req) => {
         shouldCacheClickId: true,
         trigger: "deeplink",
       });
+
+      // return early with clickId = null if no click data was recorded (bot detected)
+      if (!clickData) {
+        return NextResponse.json(
+          trackOpenResponseSchema.parse({
+            clickId: null,
+            link: linkData,
+          }),
+          { headers: COMMON_CORS_HEADERS },
+        );
+      }
     }
 
     const response = trackOpenResponseSchema.parse({
       clickId,
-      link: {
-        id: cachedLink.id,
-        domain,
-        key,
-        url: cachedLink.url,
-      },
+      link: linkData,
     });
 
     return NextResponse.json(response, { headers: COMMON_CORS_HEADERS });

apps/web/lib/zod/schemas/opens.ts

@@ -30,7 +30,7 @@ export const trackOpenResponseSchema = z.object({
     .string()
     .nullable()
     .describe(
-      "The click ID of the associated open event (or the prior click that led the user to the app store for probabilistic tracking). This will be `null` if the open event was not associated with a link (e.g. a direct download from the app store). Learn more: https://d.to/ddl",
+      "The click ID of the associated open event (or the prior click that led the user to the app store for probabilistic tracking). This will be `null` if the open event was not associated with a deep link (e.g. a direct download from the app store), or if the open event was performed by a bot (no click recorded). Learn more: https://d.to/ddl",
     ),
   link: z
     .object({