Changeset e3a5aed in Klonkt

Timestamp:

06/30/2026 10:11:03 PM (2 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

d9c5eb8

Parents:

65a0697

Message:

feat(stats): let the admin exclude their own IP from statistics

Logged-in admins were already skipped, but an admin browsing logged out (incognito, another browser)
still inflated the numbers. Admin -> Statistics now shows your current IP with a one-click "Don't
count my visits" toggle, stored in a stats_exclude_ips app_setting and checked on every pageview
(recordPageview/recordPostView). Trust-proxy gives the real client IP; normalised for matching.

Co-Authored-By: Claude <noreply@…>

Location:

src

Files:

• routes/admin-stats.js (modified) (3 diffs)
• services/StatsService.js (modified) (3 diffs)
• services/i18n.js (modified) (3 diffs)
• views/pages/admin-stats.ejs (modified) (1 diff)

src/routes/admin-stats.js

@@ -14 +14 @@
 import { requireGod } from '../middleware/auth.js';
 import { premiumUnlocked } from '../services/PatreonService.js';
-import { getStats } from '../services/StatsService.js';
+import { getStats, currentIp, getExcludedIps, setExcludedIps } from '../services/StatsService.js';
 
 const router = express.Router();
@@ -32 +32 @@
   }
   const days = [7, 14, 30, 90].includes(parseInt(req.query.days, 10)) ? parseInt(req.query.days, 10) : 14;
+  const myIp = currentIp(req);
   renderPage(req, res, 'pages/admin-stats', {
     pageTitleKey: 'admin.t_stats',
@@ -37 +38 @@
     stats: getStats(days),
     linkClicks,
+    myIp,
+    ipExcluded: !!myIp && getExcludedIps().includes(myIp),
   });
 });
 
+// Toggle whether the admin's current IP is counted in statistics.
+router.post('/exclude-ip', requireGod, (req, res) => {
+  const ip = currentIp(req);
+  if (ip) {
+    const list = getExcludedIps();
+    const i = list.indexOf(ip);
+    if (i >= 0) list.splice(i, 1); else list.push(ip);
+    setExcludedIps(list);
+  }
+  res.redirect('/admin/stats');
+});
+
 export default router;

src/services/StatsService.js

@@ -54 +54 @@
 }
 
+// The client IP (trust-proxy gives the real one), normalised: drop an IPv4-mapped-IPv6 prefix
+// and a trailing :port so it matches what the admin sees + stores.
+function clientIp(req) {
+  let ip = (req && (req.ip || (req.socket && req.socket.remoteAddress))) || '';
+  if (ip.startsWith('::ffff:')) ip = ip.slice(7);
+  if (/^\d{1,3}(\.\d{1,3}){3}:\d+$/.test(ip)) ip = ip.split(':')[0];
+  return ip;
+}
+export function currentIp(req) { return clientIp(req); }
+
+// Admin-configured IPs to skip — so an owner browsing logged-OUT (incognito, another browser)
+// doesn't inflate their own stats. Stored as a comma-separated app_setting.
+export function getExcludedIps() {
+  return (getSetting('stats_exclude_ips', '') || '').split(',').map((s) => s.trim()).filter(Boolean);
+}
+export function setExcludedIps(list) {
+  const clean = [...new Set((list || []).map((s) => String(s).trim()).filter(Boolean))].slice(0, 20);
+  setSetting('stats_exclude_ips', clean.join(','));
+}
+function isExcludedIp(req) {
+  try { const ip = clientIp(req); return !!ip && getExcludedIps().includes(ip); } catch { return false; }
+}
+
 // Lazy prepares — tables only exist after initializeDatabase(); this module is
 // imported before that call.
@@ -90 +113 @@
 
 export function recordPageview(siteId, req) {
-  if (!siteId || isOperator(req) || isBot(req)) return;
+  if (!siteId || isOperator(req) || isBot(req) || isExcludedIp(req)) return;
   try {
     const d = today();
@@ -100 +123 @@
 
 export function recordPostView(post, req) {
-  if (!post || !post.id || isOperator(req) || isBot(req)) return;
+  if (!post || !post.id || isOperator(req) || isBot(req) || isExcludedIp(req)) return;
   try {
     stmts().bumpPost.run(post.id);

src/services/i18n.js

@@ -356 +356 @@
     'astat.title': 'Statistieken',
     'astat.intro': 'Cookievrij gemeten — geen tracking-cookies, geen toestemmingsbanner. Bezoekers worden per dag geteld via een dagelijks roterende, anonieme hash (IP/browser worden niet bewaard). Je eigen beheerder-bezoeken en bekende bots/crawlers tellen niet mee.',
+    'astat.your_ip': 'Jouw IP', 'astat.ip_counted': 'wordt meegeteld.', 'astat.ip_not_counted': 'wordt NIET meegeteld.', 'astat.ip_exclude': 'Tel mijn bezoeken niet mee', 'astat.ip_count': 'Wel meetellen',
     'astat.visitor_days': 'Bezoeker-dagen ({n}d)',
     'astat.pageviews_days': 'Weergaven ({n}d)',
@@ -1274 +1275 @@
     'astat.title': 'Statistics',
     'astat.intro': 'Measured cookie-free — no tracking cookies, no consent banner. Visitors are counted per day via a daily-rotating, anonymous hash (IP/browser are not stored). Your own admin visits and known bots/crawlers are not counted.',
+    'astat.your_ip': 'Your IP', 'astat.ip_counted': 'is being counted.', 'astat.ip_not_counted': 'is NOT counted.', 'astat.ip_exclude': "Don't count my visits", 'astat.ip_count': 'Count my visits',
     'astat.visitor_days': 'Visitor-days ({n}d)',
     'astat.pageviews_days': 'Views ({n}d)',
@@ -2191 +2193 @@
     'astat.title': 'Statistiken',
     'astat.intro': 'Cookiefrei gemessen — keine Tracking-Cookies, kein Zustimmungsbanner. Besucher werden pro Tag über einen täglich rotierenden, anonymen Hash gezählt (IP/Browser werden nicht gespeichert). Deine eigenen Admin-Besuche und bekannte Bots/Crawler werden nicht mitgezählt.',
+    'astat.your_ip': 'Deine IP', 'astat.ip_counted': 'wird mitgezählt.', 'astat.ip_not_counted': 'wird NICHT mitgezählt.', 'astat.ip_exclude': 'Meine Besuche nicht zählen', 'astat.ip_count': 'Meine Besuche zählen',
     'astat.visitor_days': 'Besuchertage ({n}T)',
     'astat.pageviews_days': 'Aufrufe ({n}T)',

src/views/pages/admin-stats.ejs

@@ -3 +3 @@
   <h1><%= t('astat.title') %></h1>
   <p class="stats-note"><%= t('astat.intro') %></p>
+
+  <% if (typeof myIp !== 'undefined' && myIp) { %>
+  <form method="post" action="/admin/stats/exclude-ip" class="stats-note" style="margin:.2rem 0 1.2rem;display:flex;align-items:center;gap:.6rem;flex-wrap:wrap;">
+    <span><%= t('astat.your_ip') %> <code><%= myIp %></code> —
+      <% if (ipExcluded) { %><strong><%= t('astat.ip_not_counted') %></strong><% } else { %><%= t('astat.ip_counted') %><% } %></span>
+    <button type="submit" class="btn" style="padding:3px 10px;font-size:.85rem;"><%= ipExcluded ? t('astat.ip_count') : t('astat.ip_exclude') %></button>
+  </form>
+  <% } %>
 
   <% var s = stats; var _max = Math.max(1, ...s.series.map(function(d){ return d.pageviews; })); %>