fix(stats): honor custom domains and stop misleading fallbacks

Review follow-ups: stats and export gain --domain and thread it through
ResolveAlias; a resolve 404 with --domain errors instead of silently
rendering a stranger's default-domain stats, and the convenience
fallback without --domain is announced on stderr. Password-protected
401s no longer trigger a pointless token refresh or a fake session
expiry, and the public-view notices now speak to ownership.

Author: Zingzy

internal/api/client.go

@@ -99,14 +99,24 @@ func (c *Client) request(ctx context.Context, method, path string, query url.Val
 	if err != nil {
 		return nil, err
 	}
-	if resp.StatusCode == http.StatusUnauthorized && creds != nil &&
-		creds.Mode == auth.ModeDevice && creds.RefreshToken != "" {
-		resp.Body.Close()
-		if creds, err = c.refreshTokens(ctx, creds); err != nil {
-			return nil, err
+	if resp.StatusCode == http.StatusUnauthorized {
+		// The public stats endpoint answers 401 for password-protected
+		// links. That is a property of the link, not of the session, so
+		// refreshing tokens can't help — and the CLI doesn't supply link
+		// passwords, so say so instead of blaming the login.
+		switch resp.Header.Get("X-Error-Code") {
+		case "password_required", "invalid_password":
+			resp.Body.Close()
+			return nil, errors.New("this link's stats are password protected")
 		}
-		if resp, err = c.send(ctx, method, path, query, body, creds); err != nil {
-			return nil, err
+		if creds != nil && creds.Mode == auth.ModeDevice && creds.RefreshToken != "" {
+			resp.Body.Close()
+			if creds, err = c.refreshTokens(ctx, creds); err != nil {
+				return nil, err
+			}
+			if resp, err = c.send(ctx, method, path, query, body, creds); err != nil {
+				return nil, err
+			}
 		}
 	}
 	return resp, nil

internal/api/client_test.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"sync/atomic"
 	"testing"
 
@@ -173,3 +174,39 @@ func TestClientHeaderKeptOnSameHostRedirect(t *testing.T) {
 		t.Fatalf("X-Spoo-Client after same-host redirect = %q, want cli/dev", gotClient)
 	}
 }
+
+// a password-protected link answers 401 too, but that's about the link,
+// not the session — no token refresh, and an honest error instead of
+// "session expired".
+func TestDo401PasswordRequiredSkipsRefresh(t *testing.T) {
+	var refreshCalls atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/auth/device/refresh" {
+			refreshCalls.Add(1)
+			w.Write([]byte(`{"access_token":"newAT","refresh_token":"newRT"}`))
+			return
+		}
+		w.Header().Set("X-Error-Code", "password_required")
+		w.WriteHeader(http.StatusUnauthorized)
+		w.Write([]byte(`{"error":"Password required","code":"password_required"}`))
+	}))
+	defer srv.Close()
+
+	store := newTestStore(t, &auth.Credentials{Mode: auth.ModeDevice, AccessToken: "goodAT", RefreshToken: "goodRT"})
+	c := New(srv.URL, store)
+	err := c.do(context.Background(), http.MethodGet, "/api/v1/public/stats/secret", nil, nil, nil)
+	if err == nil || !strings.Contains(err.Error(), "password protected") {
+		t.Fatalf("err = %v, want a password-protected explanation", err)
+	}
+	if refreshCalls.Load() != 0 {
+		t.Fatalf("refresh called %d times, want 0", refreshCalls.Load())
+	}
+	// the healthy session must survive untouched
+	got, loadErr := store.Load()
+	if loadErr != nil {
+		t.Fatal(loadErr)
+	}
+	if got.AccessToken != "goodAT" || got.RefreshToken != "goodRT" {
+		t.Fatalf("tokens rotated pointlessly: %+v", got)
+	}
+}

internal/api/urls.go

@@ -85,15 +85,19 @@ func (c *Client) ListURLs(ctx context.Context, opts ListURLsOptions) (*URLPage,
 
 // ResolveAlias looks up an owned link by alias via GET
 // /api/v1/urls/{domain}/{alias}, mainly to obtain its url id for the
-// per-link stats and export endpoints. The domain is the API base
-// URL's hostname, which covers spoo.me links. Unknown and foreign
-// aliases both answer 404 (no ownership oracle).
-func (c *Client) ResolveAlias(ctx context.Context, alias string) (*URLItem, error) {
-	base, err := url.Parse(c.base)
-	if err != nil {
-		return nil, err
+// per-link stats and export endpoints. An empty domain defaults to the
+// API base URL's hostname, which covers spoo.me links; pass one of the
+// user's custom domains to resolve links living there. Unknown and
+// foreign aliases both answer 404 (no ownership oracle).
+func (c *Client) ResolveAlias(ctx context.Context, alias, domain string) (*URLItem, error) {
+	if domain == "" {
+		base, err := url.Parse(c.base)
+		if err != nil {
+			return nil, err
+		}
+		domain = base.Hostname()
 	}
-	path := "/api/v1/urls/" + url.PathEscape(base.Hostname()) + "/" + url.PathEscape(alias)
+	path := "/api/v1/urls/" + url.PathEscape(domain) + "/" + url.PathEscape(alias)
 	var out URLItem
 	if err := c.do(ctx, http.MethodGet, path, nil, nil, &out); err != nil {
 		return nil, err

internal/api/urls_test.go

@@ -46,7 +46,7 @@ func TestResolveAliasUsesAPIHostAndEscapes(t *testing.T) {
 	defer srv.Close()
 
 	c := New(srv.URL, newTestStore(t, nil))
-	u, err := c.ResolveAlias(context.Background(), "🚀")
+	u, err := c.ResolveAlias(context.Background(), "🚀", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -68,12 +68,31 @@ func TestResolveAliasNotFound(t *testing.T) {
 	defer srv.Close()
 
 	c := New(srv.URL, newTestStore(t, nil))
-	_, err := c.ResolveAlias(context.Background(), "nope")
+	_, err := c.ResolveAlias(context.Background(), "nope", "")
 	if !IsNotFound(err) {
 		t.Fatalf("err = %v, want IsNotFound", err)
 	}
 }
 
+// a custom domain replaces the API host in the resolve path, so links
+// on the user's own domains resolve to their real url ids.
+func TestResolveAliasCustomDomain(t *testing.T) {
+	var gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.EscapedPath()
+		w.Write([]byte(`{"id":"65f0abc123","alias":"promo","long_url":"https://x.com","status":"ACTIVE"}`))
+	}))
+	defer srv.Close()
+
+	c := New(srv.URL, newTestStore(t, nil))
+	if _, err := c.ResolveAlias(context.Background(), "promo", "links.example.com"); err != nil {
+		t.Fatal(err)
+	}
+	if gotPath != "/api/v1/urls/links.example.com/promo" {
+		t.Fatalf("path = %q, want the custom domain in the path", gotPath)
+	}
+}
+
 func TestUpdateURLSendsPatch(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodPatch || r.URL.Path != "/api/v1/urls/abc123" {

internal/cmd/export.go

@@ -13,7 +13,7 @@ import (
 )
 
 func newExportCmd() *cobra.Command {
-	var format, output, from, to string
+	var format, output, from, to, domain string
 	cmd := &cobra.Command{
 		Use:   "export [short-code]",
 		Short: "Export click analytics to a file",
@@ -46,9 +46,13 @@ workbook with one sheet per dimension.`,
 			var name string
 			var data []byte
 			if len(args) == 1 {
-				u, err := d.client.ResolveAlias(cmd.Context(), args[0])
+				u, err := d.client.ResolveAlias(cmd.Context(), args[0], domain)
 				if api.IsNotFound(err) {
-					return fmt.Errorf("%s is not one of your links — export covers only links you own", args[0])
+					where := args[0]
+					if domain != "" {
+						where += " on " + domain
+					}
+					return fmt.Errorf("%s is not one of your links — export covers only links you own", where)
 				}
 				if err != nil {
 					return err
@@ -79,6 +83,8 @@ workbook with one sheet per dimension.`,
 	cmd.Flags().StringVarP(&output, "output", "o", "", "output file (default: server-suggested name; - for stdout)")
 	cmd.Flags().StringVar(&from, "from", "", "start date (ISO 8601)")
 	cmd.Flags().StringVar(&to, "to", "", "end date (ISO 8601)")
+	cmd.Flags().StringVar(&domain, "domain", "", "the link is on one of your custom domains")
 	fixed(cmd, "format", "json", "csv", "xlsx", "xml")
+	flagComp(cmd, "domain", completeDomain)
 	return cmd
 }

internal/cmd/export_test.go

@@ -94,3 +94,31 @@ func TestExportForeignCodeErrors(t *testing.T) {
 		t.Fatalf("err = %v, want an ownership explanation", err)
 	}
 }
+
+// --domain must reach the resolve path, replacing the API host.
+func TestExportDomainFlagResolvesOnThatDomain(t *testing.T) {
+	var paths []string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		paths = append(paths, r.URL.Path)
+		if strings.HasPrefix(r.URL.Path, "/api/v1/urls/") {
+			w.Write([]byte(`{"id":"65f0abc123","alias":"promo","long_url":"https://x.com","status":"ACTIVE"}`))
+			return
+		}
+		w.Write([]byte(`{"export":"ok"}`))
+	}))
+	defer srv.Close()
+	pointDepsAtLoggedIn(t, srv.URL)
+
+	root := NewRootCmd()
+	var out bytes.Buffer
+	root.SetOut(&out)
+	root.SetErr(&out)
+	root.SetArgs([]string{"export", "promo", "--domain", "links.example.com", "-o", "-"})
+	if err := root.Execute(); err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"/api/v1/urls/links.example.com/promo", "/api/v1/export/links/65f0abc123"}
+	if len(paths) != 2 || paths[0] != want[0] || paths[1] != want[1] {
+		t.Fatalf("paths = %v, want %v", paths, want)
+	}
+}

internal/cmd/helpers.go

@@ -2,13 +2,23 @@ package cmd
 
 import (
 	"io"
+	"net/url"
 	"strings"
 	"time"
 
 	"github.com/charmbracelet/colorprofile"
 	"github.com/spf13/cobra"
 )
 
+// apiHost is the hostname of the configured API base — the system
+// default domain that short links live on unless --domain says otherwise.
+func apiHost(base string) string {
+	if u, err := url.Parse(base); err == nil && u.Hostname() != "" {
+		return u.Hostname()
+	}
+	return base
+}
+
 // timeNow is a seam for tests that need deterministic expiry math.
 var timeNow = time.Now
 

internal/cmd/stats.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"time"
 
 	tea "charm.land/bubbletea/v2"
@@ -16,16 +17,24 @@ import (
 )
 
 // resolveTarget maps a short code and login state onto a stats surface.
-// Logged in with a code, the alias resolves to an owned link's url id;
-// a 404 means the link isn't yours (or doesn't exist), so it falls back
-// to the public endpoint, which answers for anyone's public link.
-func resolveTarget(ctx context.Context, client *api.Client, code string, loggedIn bool) (stats.Target, error) {
+// Logged in with a code, the alias resolves to an owned link's url id on
+// the given domain (empty means the system default). On a 404 with
+// --domain set there is nowhere to fall back to — the public endpoint
+// serves only default-domain links — so it errors instead of silently
+// showing a different link's stats. Without --domain the code may still
+// be someone else's public default-domain link, so it falls back to the
+// public endpoint, announcing the switch on errOut.
+func resolveTarget(ctx context.Context, client *api.Client, code, domain, defaultDomain string, loggedIn bool, errOut io.Writer) (stats.Target, error) {
 	switch {
 	case code == "":
 		return stats.Target{Kind: stats.KindAccount}, nil
 	case loggedIn:
-		u, err := client.ResolveAlias(ctx, code)
+		u, err := client.ResolveAlias(ctx, code, domain)
 		if api.IsNotFound(err) {
+			if domain != "" {
+				return stats.Target{}, fmt.Errorf("%s on %s is not one of your links — public stats cover only %s links", code, domain, defaultDomain)
+			}
+			fmt.Fprintf(errOut, "note: %s isn't one of your links — showing public stats for %s/%s\n", code, defaultDomain, code)
 			return stats.Target{Kind: stats.KindPublicLink, Alias: code}, nil
 		}
 		if err != nil {
@@ -38,7 +47,7 @@ func resolveTarget(ctx context.Context, client *api.Client, code string, loggedI
 }
 
 func newStatsCmd() *cobra.Command {
-	var from, to, tz string
+	var from, to, tz, domain string
 	var plain bool
 	cmd := &cobra.Command{
 		Use:   "stats [short-code]",
@@ -75,7 +84,11 @@ With a short code, shows that link — public stats work without login.`,
 			if !loggedIn && code == "" {
 				return fmt.Errorf("not logged in — pass a short code for public stats, or run `spoo auth login`")
 			}
-			target, err := resolveTarget(cmd.Context(), d.client, code, loggedIn)
+			defaultDomain := apiHost(d.cfg.APIBase)
+			if domain != "" && !loggedIn {
+				return fmt.Errorf("--domain requires login — public stats cover only %s links", defaultDomain)
+			}
+			target, err := resolveTarget(cmd.Context(), d.client, code, domain, defaultDomain, loggedIn, cmd.ErrOrStderr())
 			if err != nil {
 				return err
 			}
@@ -132,5 +145,7 @@ With a short code, shows that link — public stats work without login.`,
 	cmd.Flags().StringVar(&to, "to", "", "end date, ISO 8601 (static report; default: now)")
 	cmd.Flags().StringVar(&tz, "tz", "", "IANA timezone for time buckets (default UTC)")
 	cmd.Flags().BoolVar(&plain, "plain", false, "print the static report instead of the dashboard")
+	cmd.Flags().StringVar(&domain, "domain", "", "the link is on one of your custom domains")
+	flagComp(cmd, "domain", completeDomain)
 	return cmd
 }