release: 23 12 2025 by Melv1C · Pull Request #144 · Melv1C/artnote

Melv1C · 2025-12-23T07:48:44Z

No description provided.

…and filters

Copilot

Pull request overview

This is a release PR dated December 23, 2025, implementing two major features: removing the "writer" role from the user management system and introducing a comprehensive analytics tracking system with cookie consent.

Key changes:

Consolidates user roles from three (admin, writer, user) to two (admin, user), promoting all writers to admin
Implements privacy-compliant analytics with cookie consent, visitor tracking, and GDPR-friendly data handling
Adds scheduled aggregation jobs for analytics data processing and retention management

Reviewed changes

Copilot reviewed 43 out of 44 changed files in this pull request and generated 18 comments.

Show a summary per file

File	Description
`vercel.json`	Configures nightly and weekly cron jobs for analytics aggregation
`src/schemas/common.ts`	Removes 'writer' from UserRoleSchema enum
`src/lib/permissions.ts`	Removes writer role definition and permissions
`src/lib/env.ts`	Adds optional CRON_SECRET for securing aggregation endpoints
`src/lib/auth.ts`	Removes writer role from auth configuration
`src/lib/auth-client.ts`	Removes writer role from client auth
`src/lib/analytics.ts`	New client-side analytics utilities for cookie management and event tracking
`src/hooks/use-notice-analytics.ts`	Custom hooks for tracking page and notice views with duration
`src/features/user-management/**`	Updates all user management UI components to remove writer role references
`src/features/auth/**`	Removes writer-specific auth components and hooks
`src/features/artworks/**`	Removes writer permission checks, adds notice analytics tracking
`src/features/admin-dashboard/**`	Adds comprehensive analytics dashboard with charts and visualizations
`src/components/**`	Adds CookieBanner, AnalyticsProvider, and chart components
`prisma/schema.prisma`	Adds analytics event models and aggregation summary tables
`prisma/migrations/**`	Database migrations for role removal and analytics tables
`package.json`	Updates dependencies including React 19.2.3, Next.js 16.0.10, Prisma 7.1.0, and adds recharts and ua-parser-js
`app/layout.tsx`	Integrates AnalyticsProvider and CookieBanner into root layout
`app/api/analytics/route.ts`	API endpoint for receiving and storing analytics events
`app/api/cron/**`	Scheduled aggregation jobs for daily and weekly analytics processing

Copilot · 2025-12-23T07:55:23Z

+  const allEvents = await prisma.analyticsEvent.findMany({
+    where: { timestamp: { gte: yesterday, lt: today } },
+    select: {
+      eventType: true,
+      visitorId: true,
+      sessionId: true,
+      pageCategory: true,
+      deviceType: true,
+      browser: true,
+      referrer: true,
+      durationMs: true,
+    },
+  });


The nightly aggregation fetches all events for the day into memory before processing. For high-traffic sites, this could consume significant memory and cause performance issues. Consider processing events in batches or using streaming/cursor-based pagination.

Copilot · 2025-12-23T07:55:23Z

+export async function sendEvent(payload: AnalyticsEventPayload): Promise<void> {
+  try {
+    const eventPayload = {
+      ...payload,
+      timestamp: payload.timestamp ?? new Date().toISOString(),
+    };
+
+    await fetch('/api/analytics', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(eventPayload),
+    });
+  } catch {
+    // Silently fail - analytics should not break the app
+  }


The error handling in analytics functions silently fails, which makes debugging issues difficult. While silent failures are intentional to prevent analytics from breaking the app, consider logging errors to a monitoring service (like Sentry) so issues can be detected and fixed.

Copilot · 2025-12-23T07:55:24Z

+  return {
+    browser: result.browser.name ?? null,
+    browserVer: result.browser.version ?? null,
+    os: result.os.name ?? null,
+    deviceType: result.device.type ?? 'desktop',


The device type detection defaults to 'desktop' when device type is undefined. This could skew analytics data as mobile devices without a device type in the parsed result would be incorrectly classified as desktop. Consider using 'unknown' or implementing additional heuristics to better classify devices.

Suggested change

return {

browser: result.browser.name ?? null,

browserVer: result.browser.version ?? null,

os: result.os.name ?? null,

deviceType: result.device.type ?? 'desktop',

// Derive device type with a safe fallback to avoid misclassifying unknowns as desktop

const parsedDeviceType = result.device.type ?? null;

const osName = result.os.name ?? null;

let deviceType: string;

if (parsedDeviceType) {

deviceType = parsedDeviceType;

} else if (osName && /Android|iOS|iPadOS/.test(osName)) {

// Basic heuristic: common mobile OS names imply a mobile device

deviceType = 'mobile';

} else {

deviceType = 'unknown';

}

return {

browser: result.browser.name ?? null,

browserVer: result.browser.version ?? null,

os: osName,

deviceType,

Copilot · 2025-12-23T07:55:24Z

+  "crons": [
+    {
+      "path": "/api/cron/aggregate-nightly",
+      "schedule": "0 2 * * *"
+    },
+    {
+      "path": "/api/cron/aggregate-weekly",
+      "schedule": "0 3 * * 0"
+    }
+  ]


The cron schedule '0 2 * * *' runs at 2 AM daily and '0 3 * * 0' runs at 3 AM on Sundays. These times should be documented in terms of which timezone they use (likely UTC based on Vercel Cron). Consider adding a comment indicating the timezone to avoid confusion.

Copilot · 2025-12-23T07:55:24Z

+import { UserRoleSchema } from '@/schemas';
 import { ReactNode, useEffect, useState } from 'react';


The import order is inconsistent with the project's style. The UserRoleSchema import should remain at the top with other imports, not be moved after the component imports. This change appears to be an unintentional reordering.

Suggested change

import { UserRoleSchema } from '@/schemas';

import { ReactNode, useEffect, useState } from 'react';

import { ReactNode, useEffect, useState } from 'react';

import { UserRoleSchema } from '@/schemas';

Copilot · 2025-12-23T07:55:26Z

+function isAuthorizedRequest(request: NextRequest): boolean {
+  // Check for cron secret header
+  if (request.headers.get('Authorization') !== `Bearer ${env.CRON_SECRET}`) {
+    return false;
+  }
+
+  return true;


The authorization check will fail when CRON_SECRET is undefined, as it will compare the Authorization header against "Bearer undefined". This could either block legitimate cron jobs or create a security vulnerability. The CRON_SECRET should either be required or the authorization logic should explicitly handle the undefined case.

Copilot · 2025-12-23T07:55:26Z

+function isAuthorizedRequest(request: NextRequest): boolean {
+  // Check for cron secret header
+  if (request.headers.get('Authorization') !== `Bearer ${env.CRON_SECRET}`) {
+    return false;
+  }
+
+  return true;
+}


The authorization check will fail when CRON_SECRET is undefined, as it will compare the Authorization header against "Bearer undefined". This could either block legitimate cron jobs or create a security vulnerability. The CRON_SECRET should either be required or the authorization logic should explicitly handle the undefined case.

Copilot · 2025-12-23T07:55:27Z

+import { PropsWithChildren } from 'react';
 import { Toaster } from 'sonner';
 import './globals.css';


The import order change is inconsistent with the rest of the file's import structure. The PropsWithChildren type import should remain at the end of the import block rather than being moved before the local imports, to maintain consistent import ordering (external packages first, then local imports).

Suggested change

import { PropsWithChildren } from 'react';

import { Toaster } from 'sonner';

import './globals.css';

import { Toaster } from 'sonner';

import './globals.css';

import { PropsWithChildren } from 'react';

Copilot · 2025-12-23T07:55:27Z

-    "react-hook-form": "^7.66.1",
+    "react-hook-form": "^7.68.0",
    "react-zoom-pan-pinch": "^3.7.0",
+    "recharts": "2.15.4",


The recharts package is pinned to version 2.15.4 instead of using a caret (^) or tilde (~) range. This prevents automatic patch updates which could include important bug fixes and security patches. Unless there's a specific reason for pinning, consider using ^2.15.4 to allow patch updates.

Suggested change

"recharts": "2.15.4",

"recharts": "^2.15.4",

Copilot · 2025-12-23T07:55:27Z

+export function setVisitorCookie(visitorId: string): void {
+  document.cookie = `${VISITOR_COOKIE_NAME}=${visitorId}; Path=/; Max-Age=${COOKIE_MAX_AGE}; SameSite=Lax`;
+}
+
+/**
+ * Get the visitor ID from cookie
+ */
+export function getVisitorCookie(): string | null {
+  if (typeof document === 'undefined') return null;
+  const match = document.cookie.split('; ').find(c => c.startsWith(`${VISITOR_COOKIE_NAME}=`));
+  return match?.split('=')[1] ?? null;
+}
+
+/**
+ * Set consent cookie to track user's cookie preference
+ */
+export function setConsentCookie(accepted: boolean): void {
+  const value = accepted ? 'accepted' : 'rejected';
+  document.cookie = `${CONSENT_COOKIE_NAME}=${value}; Path=/; Max-Age=${COOKIE_MAX_AGE}; SameSite=Lax`;


The cookie banner sets cookies without the Secure flag, which means cookies could be transmitted over unencrypted HTTP connections. For production environments, cookies should include the Secure flag to ensure they're only sent over HTTPS.

Melv1C added 8 commits December 13, 2025 13:15

chore: update dependencies

f9dfda9

feat(analytics): add comprehensive analytics dashboard components

f29172f

feat(stats): add database migration for analytics and summary tables

bbf695a

feat(analytics): standardize formatting in SiteDailySummary model

ad3655d

feat(auth): refine user roles and permissions, removing writer role

8be6e63

feat(auth): create migration to remove writer role and promote to admin

192ab30

feat(user-management): remove writer role references from user stats …

b42f7e4

…and filters

fix(cron): authorization logic for Vercel Cron requests

42015e9

Melv1C self-assigned this Dec 23, 2025

Copilot AI review requested due to automatic review settings December 23, 2025 07:48

github-actions Bot added the 🚀 production label Dec 23, 2025

Copilot started reviewing on behalf of Melv1C December 23, 2025 07:49

View session

Melv1C merged commit 61221b5 into main Dec 23, 2025
22 of 23 checks passed

Copilot AI reviewed Dec 23, 2025

View reviewed changes

Navigation Menu

Repository navigation

release: 23 12 2025 - #144

release: 23 12 2025#144
Melv1C merged 8 commits into
mainfrom
staging

Melv1C commented Dec 23, 2025

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Dec 23, 2025

Uh oh!

Copilot AI Dec 23, 2025

Uh oh!

Copilot AI Dec 23, 2025

Uh oh!

Copilot AI Dec 23, 2025

Uh oh!

Copilot AI Dec 23, 2025

Uh oh!

Copilot AI Dec 23, 2025

Uh oh!

Copilot AI Dec 23, 2025

Uh oh!

Copilot AI Dec 23, 2025

Uh oh!

Copilot AI Dec 23, 2025

Uh oh!

Copilot AI Dec 23, 2025

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

-  return {
-    browser: result.browser.name ?? null,
-    browserVer: result.browser.version ?? null,
-    os: result.os.name ?? null,
-    deviceType: result.device.type ?? 'desktop',
+  // Derive device type with a safe fallback to avoid misclassifying unknowns as desktop
+  const parsedDeviceType = result.device.type ?? null;
+  const osName = result.os.name ?? null;
+  let deviceType: string;
+  if (parsedDeviceType) {
+    deviceType = parsedDeviceType;
+  } else if (osName && /Android|iOS|iPadOS/.test(osName)) {
+    // Basic heuristic: common mobile OS names imply a mobile device
+    deviceType = 'mobile';
+  } else {
+    deviceType = 'unknown';
+  }
+  return {
+    browser: result.browser.name ?? null,
+    browserVer: result.browser.version ?? null,
+    os: osName,
+    deviceType,

		import { UserRoleSchema } from '@/schemas';
		import { ReactNode, useEffect, useState } from 'react';

Conversation

Melv1C commented Dec 23, 2025

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants