Merge feature/accurate-analytics: self-view/click exclusion + unique reach

Owner's own views/clicks no longer counted (resolved via the shared session
secret on both the api and redirect binaries). New salted-hashed visitor_hash
on click_events powers a unique 'reach' metric shown alongside clicks. Migration
0006; redirect now needs SHOPLIT_SESSION_SECRET (added to compose).

Author: mayur-tolexo

cmd/shoplit-api/main.go

@@ -116,7 +116,7 @@ func run() error {
 
 	// Public, unauthenticated read endpoints
 	r.Route("/api/public", func(r chi.Router) {
-		publicapi.RegisterRoutes(r, svc)
+		publicapi.RegisterRoutes(r, svc, sm)
 		r.Post("/feedback", fb.Handler())
 	})
 

cmd/shoplit-redirect/main.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 
+	"github.com/mayur-tolexo/shoplit/internal/auth"
 	"github.com/mayur-tolexo/shoplit/internal/config"
 	"github.com/mayur-tolexo/shoplit/internal/db"
 	sqlcgen "github.com/mayur-tolexo/shoplit/internal/db/sqlc"
@@ -56,7 +57,8 @@ func run() error {
 	defer rc.Close()
 
 	q := sqlcgen.New(pool)
-	svc := redirect.NewService(q)
+	sm := auth.NewSessionManager(cfg.SessionSecret).WithSecure(cfg.CookieSecure)
+	svc := redirect.NewService(q, sm, cfg.SessionSecret)
 
 	r := chi.NewRouter()
 	r.Use(middleware.RequestID, middleware.Recoverer)

deploy/compose.prod.yaml

@@ -104,6 +104,8 @@ services:
       SHOPLIT_DB_DSN: postgres://shoplit:${POSTGRES_PASSWORD}@postgres:5432/shoplit?sslmode=disable
       SHOPLIT_DB_DSN_READONLY: postgres://shoplit:${POSTGRES_PASSWORD}@postgres:5432/shoplit?sslmode=disable
       SHOPLIT_REDIS_URL: redis://redis:6379/0
+      SHOPLIT_SESSION_SECRET: ${SHOPLIT_SESSION_SECRET}
+      SHOPLIT_COOKIE_SECURE: "true"
 
   shoplit-web:
     build:

internal/analytics/visitor.go

@@ -0,0 +1,18 @@
+// Package analytics holds shared analytics helpers (visitor identity, etc.).
+package analytics
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+)
+
+// VisitorHash returns a short, salted, one-way hash of a visitor IP. The raw IP
+// is never stored — only this hash, so distinct visitors can be counted
+// (reach) without retaining PII. Empty ip → empty hash (not counted).
+func VisitorHash(ip, salt string) string {
+	if ip == "" {
+		return ""
+	}
+	sum := sha256.Sum256([]byte(salt + "|" + ip))
+	return hex.EncodeToString(sum[:])[:16]
+}

internal/analytics/visitor_test.go

@@ -0,0 +1,27 @@
+package analytics_test
+
+import (
+	"testing"
+
+	"github.com/mayur-tolexo/shoplit/internal/analytics"
+)
+
+func TestVisitorHash(t *testing.T) {
+	a := analytics.VisitorHash("1.2.3.4", "salt")
+	b := analytics.VisitorHash("1.2.3.4", "salt")
+	if a == "" || a != b {
+		t.Fatalf("hash must be deterministic and non-empty: %q %q", a, b)
+	}
+	if len(a) != 16 {
+		t.Fatalf("want 16 hex chars, got %d", len(a))
+	}
+	if analytics.VisitorHash("1.2.3.4", "other") == a {
+		t.Fatalf("different salt must give a different hash")
+	}
+	if analytics.VisitorHash("5.6.7.8", "salt") == a {
+		t.Fatalf("different ip must give a different hash")
+	}
+	if analytics.VisitorHash("", "salt") != "" {
+		t.Fatalf("empty ip must hash to empty string")
+	}
+}

internal/carts/handlers.go

@@ -64,8 +64,8 @@ func listCarts(svc *Service) http.HandlerFunc {
 		owner, _ := svc.GetUser(r.Context(), uid)
 		for _, c := range list {
 			items, _ := svc.ListCartItems(r.Context(), c.ID)
-			v, cl := svc.CartStats7d(r.Context(), c.ID)
-			out = append(out, MarshalCart(c, owner, items, int(v), int(cl)))
+			v, cl, rc := svc.CartStats7d(r.Context(), c.ID)
+			out = append(out, MarshalCart(c, owner, items, int(v), int(cl), int(rc)))
 		}
 		writeJSON(w, http.StatusOK, out)
 	}
@@ -87,7 +87,7 @@ func createCart(svc *Service) http.HandlerFunc {
 			return
 		}
 		owner, _ := svc.GetUser(r.Context(), uid)
-		writeJSON(w, http.StatusCreated, MarshalCart(cart, owner, nil, 0, 0))
+		writeJSON(w, http.StatusCreated, MarshalCart(cart, owner, nil, 0, 0, 0))
 	}
 }
 
@@ -113,8 +113,8 @@ func getCart(svc *Service) http.HandlerFunc {
 			return
 		}
 		owner, _ := svc.GetUser(r.Context(), uid)
-		v, cl := svc.CartStats7d(r.Context(), cart.ID)
-		writeJSON(w, http.StatusOK, MarshalCart(cart, owner, items, int(v), int(cl)))
+		v, cl, rc := svc.CartStats7d(r.Context(), cart.ID)
+		writeJSON(w, http.StatusOK, MarshalCart(cart, owner, items, int(v), int(cl), int(rc)))
 	}
 }
 
@@ -149,7 +149,7 @@ func updateCart(svc *Service) http.HandlerFunc {
 			return
 		}
 		owner, _ := svc.GetUser(r.Context(), uid)
-		writeJSON(w, http.StatusOK, MarshalCart(cart, owner, nil, 0, 0))
+		writeJSON(w, http.StatusOK, MarshalCart(cart, owner, nil, 0, 0, 0))
 	}
 }
 

internal/carts/marshal.go

@@ -22,6 +22,7 @@ type CartJSON struct {
 	Products         []ProductJSON `json:"products"`
 	ViewsLast7d      int           `json:"viewsLast7d"`
 	ClicksLast7d     int           `json:"clicksLast7d"`
+	ReachLast7d      int           `json:"reachLast7d"`
 	CreatedAt        string        `json:"createdAt"`
 	UpdatedAt        string        `json:"updatedAt"`
 }
@@ -57,9 +58,9 @@ func MarshalUser(u sqlcgen.User) UserJSON {
 }
 
 // MarshalCart converts a sqlc Cart, its owner, and item rows into CartJSON.
-// viewsLast7d/clicksLast7d are the analytics counts (0 where not needed, e.g.
+// viewsLast7d/clicksLast7d/reachLast7d are the analytics counts (0 where not needed, e.g.
 // the public page that doesn't display them).
-func MarshalCart(c sqlcgen.Cart, owner sqlcgen.User, items []sqlcgen.ListCartItemsRow, viewsLast7d, clicksLast7d int) CartJSON {
+func MarshalCart(c sqlcgen.Cart, owner sqlcgen.User, items []sqlcgen.ListCartItemsRow, viewsLast7d, clicksLast7d, reachLast7d int) CartJSON {
 	out := CartJSON{
 		ID:               intStr(c.ID),
 		Slug:             c.Slug,
@@ -72,6 +73,7 @@ func MarshalCart(c sqlcgen.Cart, owner sqlcgen.User, items []sqlcgen.ListCartIte
 		AccentHex:        "#B5532A",
 		ViewsLast7d:      viewsLast7d,
 		ClicksLast7d:     clicksLast7d,
+		ReachLast7d:      reachLast7d,
 		CreatedAt:        c.CreatedAt.Time.Format(time.RFC3339),
 		UpdatedAt:        c.UpdatedAt.Time.Format(time.RFC3339),
 	}

internal/carts/service.go

@@ -60,12 +60,14 @@ func (s *Service) ListMyCarts(ctx context.Context, userID int64) ([]sqlcgen.Cart
 	return s.q.ListCartsByUser(ctx, userID)
 }
 
-// CartStats7d returns the cart's view and click counts over the last 7 days.
+// CartStats7d returns the cart's view, click, and reach counts over the last 7 days.
 // Best-effort: any read error yields 0 rather than failing the request.
-func (s *Service) CartStats7d(ctx context.Context, cartID int64) (views, clicks int64) {
+func (s *Service) CartStats7d(ctx context.Context, cartID int64) (views, clicks, reach int64) {
 	views, _ = s.q.CartViews7d(ctx, cartID)
-	clicks, _ = s.q.CartClicks7d(ctx, pgtype.Int8{Int64: cartID, Valid: true})
-	return views, clicks
+	cid := pgtype.Int8{Int64: cartID, Valid: true}
+	clicks, _ = s.q.CartClicks7d(ctx, cid)
+	reach, _ = s.q.CartReach7d(ctx, cid)
+	return views, clicks, reach
 }
 
 // ListMyCoverImages returns the distinct cover image URLs the user has used
@@ -101,8 +103,9 @@ func (s *Service) GetCart(ctx context.Context, userID, cartID int64) (sqlcgen.Ca
 }
 
 // GetPublicCart resolves a public cart by slug, returning the cart, its items,
-// and the owning user. It also bumps the view counter in the background.
-func (s *Service) GetPublicCart(ctx context.Context, slug string) (sqlcgen.Cart, []sqlcgen.ListCartItemsRow, sqlcgen.User, error) {
+// and the owning user. It also bumps the view counter in the background,
+// unless the viewer is the cart owner (to avoid counting self-views).
+func (s *Service) GetPublicCart(ctx context.Context, slug string, viewerUserID int64) (sqlcgen.Cart, []sqlcgen.ListCartItemsRow, sqlcgen.User, error) {
 	cart, err := s.q.GetCartBySlug(ctx, slug)
 	if err != nil {
 		return sqlcgen.Cart{}, nil, sqlcgen.User{}, err
@@ -115,10 +118,13 @@ func (s *Service) GetPublicCart(ctx context.Context, slug string) (sqlcgen.Cart,
 	if err != nil {
 		return sqlcgen.Cart{}, nil, sqlcgen.User{}, err
 	}
-	// Fire-and-forget view bump (best effort).
-	go func() {
-		_ = s.q.BumpCartViewsDaily(context.Background(), cart.ID)
-	}()
+	// Fire-and-forget view bump (best effort) — but never count the owner's
+	// own views of their own cart.
+	if viewerUserID != cart.UserID {
+		go func() {
+			_ = s.q.BumpCartViewsDaily(context.Background(), cart.ID)
+		}()
+	}
 	return cart, items, user, nil
 }
 

internal/carts/service_test.go

@@ -94,7 +94,7 @@ func TestService_GetPublicCart(t *testing.T) {
 	ctx := context.Background()
 	cart, _ := svc.CreateCart(ctx, uid, "Public Cart")
 
-	gotCart, items, user, err := svc.GetPublicCart(ctx, cart.Slug)
+	gotCart, items, user, err := svc.GetPublicCart(ctx, cart.Slug, 0)
 	require.NoError(t, err)
 	assert.Equal(t, cart.ID, gotCart.ID)
 	assert.Empty(t, items)

internal/db/migrations/0006_click_visitor_hash.down.sql

@@ -0,0 +1,2 @@
+DROP INDEX IF EXISTS click_events_link_visitor;
+ALTER TABLE click_events DROP COLUMN IF EXISTS visitor_hash;