Changeset e3a5aed in Klonkt for src/services

Timestamp:

06/30/2026 10:11:03 PM (2 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

d9c5eb8

Parents:

65a0697

Message:

feat(stats): let the admin exclude their own IP from statistics

Logged-in admins were already skipped, but an admin browsing logged out (incognito, another browser)
still inflated the numbers. Admin -> Statistics now shows your current IP with a one-click "Don't
count my visits" toggle, stored in a stats_exclude_ips app_setting and checked on every pageview
(recordPageview/recordPostView). Trust-proxy gives the real client IP; normalised for matching.

Co-Authored-By: Claude <noreply@…>

Location:

src/services

Files:

• StatsService.js (modified) (3 diffs)
• i18n.js (modified) (3 diffs)

src/services/StatsService.js

@@ -54 +54 @@
 }
 
+// The client IP (trust-proxy gives the real one), normalised: drop an IPv4-mapped-IPv6 prefix
+// and a trailing :port so it matches what the admin sees + stores.
+function clientIp(req) {
+  let ip = (req && (req.ip || (req.socket && req.socket.remoteAddress))) || '';
+  if (ip.startsWith('::ffff:')) ip = ip.slice(7);
+  if (/^\d{1,3}(\.\d{1,3}){3}:\d+$/.test(ip)) ip = ip.split(':')[0];
+  return ip;
+}
+export function currentIp(req) { return clientIp(req); }
+
+// Admin-configured IPs to skip — so an owner browsing logged-OUT (incognito, another browser)
+// doesn't inflate their own stats. Stored as a comma-separated app_setting.
+export function getExcludedIps() {
+  return (getSetting('stats_exclude_ips', '') || '').split(',').map((s) => s.trim()).filter(Boolean);
+}
+export function setExcludedIps(list) {
+  const clean = [...new Set((list || []).map((s) => String(s).trim()).filter(Boolean))].slice(0, 20);
+  setSetting('stats_exclude_ips', clean.join(','));
+}
+function isExcludedIp(req) {
+  try { const ip = clientIp(req); return !!ip && getExcludedIps().includes(ip); } catch { return false; }
+}
+
 // Lazy prepares — tables only exist after initializeDatabase(); this module is
 // imported before that call.
@@ -90 +113 @@
 
 export function recordPageview(siteId, req) {
-  if (!siteId || isOperator(req) || isBot(req)) return;
+  if (!siteId || isOperator(req) || isBot(req) || isExcludedIp(req)) return;
   try {
     const d = today();
@@ -100 +123 @@
 
 export function recordPostView(post, req) {
-  if (!post || !post.id || isOperator(req) || isBot(req)) return;
+  if (!post || !post.id || isOperator(req) || isBot(req) || isExcludedIp(req)) return;
   try {
     stmts().bumpPost.run(post.id);

src/services/i18n.js

@@ -356 +356 @@
     'astat.title': 'Statistieken',
     'astat.intro': 'Cookievrij gemeten — geen tracking-cookies, geen toestemmingsbanner. Bezoekers worden per dag geteld via een dagelijks roterende, anonieme hash (IP/browser worden niet bewaard). Je eigen beheerder-bezoeken en bekende bots/crawlers tellen niet mee.',
+    'astat.your_ip': 'Jouw IP', 'astat.ip_counted': 'wordt meegeteld.', 'astat.ip_not_counted': 'wordt NIET meegeteld.', 'astat.ip_exclude': 'Tel mijn bezoeken niet mee', 'astat.ip_count': 'Wel meetellen',
     'astat.visitor_days': 'Bezoeker-dagen ({n}d)',
     'astat.pageviews_days': 'Weergaven ({n}d)',
@@ -1274 +1275 @@
     'astat.title': 'Statistics',
     'astat.intro': 'Measured cookie-free — no tracking cookies, no consent banner. Visitors are counted per day via a daily-rotating, anonymous hash (IP/browser are not stored). Your own admin visits and known bots/crawlers are not counted.',
+    'astat.your_ip': 'Your IP', 'astat.ip_counted': 'is being counted.', 'astat.ip_not_counted': 'is NOT counted.', 'astat.ip_exclude': "Don't count my visits", 'astat.ip_count': 'Count my visits',
     'astat.visitor_days': 'Visitor-days ({n}d)',
     'astat.pageviews_days': 'Views ({n}d)',
@@ -2191 +2193 @@
     'astat.title': 'Statistiken',
     'astat.intro': 'Cookiefrei gemessen — keine Tracking-Cookies, kein Zustimmungsbanner. Besucher werden pro Tag über einen täglich rotierenden, anonymen Hash gezählt (IP/Browser werden nicht gespeichert). Deine eigenen Admin-Besuche und bekannte Bots/Crawler werden nicht mitgezählt.',
+    'astat.your_ip': 'Deine IP', 'astat.ip_counted': 'wird mitgezählt.', 'astat.ip_not_counted': 'wird NICHT mitgezählt.', 'astat.ip_exclude': 'Meine Besuche nicht zählen', 'astat.ip_count': 'Meine Besuche zählen',
     'astat.visitor_days': 'Besuchertage ({n}T)',
     'astat.pageviews_days': 'Aufrufe ({n}T)',