Fix CodeRabbit findings from #149: no-cors events, proxy recipe paths

CHANGELOG.md

@@ -6,6 +6,11 @@ Supermetry is a self-hosted web analytics product: one Go binary and PostgreSQL,
 
 ## Unreleased
 
+### Fixed
+
+- The tracker sends events with `mode: "no-cors"`. Like the old beacons, it now follows a redirect that has no CORS headers (for example from a first-party proxy) instead of dropping the event.
+- The ad blocker proxy recipes in Settings → Installation use the instance's script directory. With a custom `SUPERMETRY_TRACKER_PATH`, the first-party snippet and the forwarded paths now match. The self-hosted note also mentions forwarding a changed `SUPERMETRY_EVENT_PATH`.
+
 ## v0.1.22 (2026-11-03)
 
 ### Changed

internal/tracker/tracker.js

@@ -41,11 +41,13 @@
     payload = JSON.stringify(payload);
     // fetch(keepalive) survives page exit like sendBeacon, but blockers file
     // it as a regular request instead of a "ping", which lists block
-    // wholesale. A string body keeps it a simple request: no preflight.
+    // wholesale. no-cors with a string body keeps it a simple request (no
+    // preflight) that follows redirects without CORS headers, as beacons do.
     fetch(endpoint, {
       method: "POST",
       body: payload,
-      keepalive: true
+      keepalive: true,
+      mode: "no-cors"
     }).catch(() => 0);
   }
 

internal/tracker/tracker_runtime_test.js

@@ -154,7 +154,7 @@ function loadTracker({full = false, dataset = {}, withExtensions = false, prelud
     // Events go out with fetch(keepalive), never sendBeacon: blockers file
     // beacons under the "ping" type, which filter lists block wholesale.
     fetch(_endpoint, options) {
-      if (!options || options.method !== "POST" || options.keepalive !== true || typeof options.body !== "string") {
+      if (!options || options.method !== "POST" || options.keepalive !== true || options.mode !== "no-cors" || typeof options.body !== "string") {
         throw new Error(`unexpected fetch options ${JSON.stringify(options)}`);
       }
       payloads.push(JSON.parse(options.body));

web/src/features/settings/installRecipes.test.ts

@@ -151,3 +151,23 @@ describe('first-party proxy recipes', () => {
     expect(firstPartySnippet(cloud)).toBe('<script defer src="/sm/js/abc123def456.js"></script>')
   })
 })
+
+describe('first-party proxy recipes with a custom tracker path', () => {
+  const custom = { publicId: 'abc123def456', scriptUrl: 'https://stats.example.org/a/abc123def456.js' }
+
+  it('uses the configured script directory in the snippet and every proxy', () => {
+    expect(firstPartySnippet(custom)).toBe('<script defer src="/sm/a/abc123def456.js"></script>')
+    const recipes = buildProxyRecipes(custom, { managed: false })
+    const code = (id: string) => recipes.find((recipe) => recipe.id === id)?.code ?? ''
+    expect(code('proxy-nginx')).toContain('^/sm/(a/|px/|api/public/|')
+    expect(code('proxy-caddy')).toContain('/sm/a/*')
+    expect(code('proxy-cloudflare')).toContain('"/sm/a/"')
+    for (const recipe of recipes) expect(recipe.code, recipe.id).not.toContain('/sm/js/')
+  })
+
+  it('tells self-hosters to forward a changed event path', () => {
+    for (const recipe of buildProxyRecipes(custom, { managed: false })) {
+      expect(recipe.note ?? '', recipe.id).toContain('SUPERMETRY_EVENT_PATH')
+    }
+  })
+})

web/src/features/settings/installRecipes.ts

@@ -318,17 +318,29 @@ When done, tell me which files you changed.`
 export const PROXY_PREFIX = '/sm'
 
 /** The snippet to use once the proxy is live: the script from the site's own domain. */
-export function firstPartySnippet({ publicId }: RecipeInput): string {
-  return `<script defer src="${PROXY_PREFIX}/js/${publicId}.js"></script>`
+/**
+ * The directory per-site scripts are served from, taken from the real script
+ * URL: "/js" by default, or the directory of SUPERMETRY_TRACKER_PATH.
+ */
+function scriptDir(scriptUrl: string): string {
+  const pathname = new URL(scriptUrl).pathname
+  const dir = pathname.slice(0, pathname.lastIndexOf('/'))
+  return dir || '/js'
 }
 
-const trustedProxiesNote = 'Self-hosted: add this server\'s address to SUPERMETRY_TRUSTED_PROXIES on your Supermetry server, so it reads the visitor address from X-Forwarded-For instead of counting every visitor as your proxy.'
+export function firstPartySnippet({ publicId, scriptUrl }: RecipeInput): string {
+  return `<script defer src="${PROXY_PREFIX}${scriptDir(scriptUrl)}/${publicId}.js"></script>`
+}
+
+const trustedProxiesNote = 'Self-hosted: add this server\'s address to SUPERMETRY_TRUSTED_PROXIES on your Supermetry server, so it reads the visitor address from X-Forwarded-For instead of counting every visitor as your proxy. If you changed SUPERMETRY_EVENT_PATH, forward that path under /sm too.'
 const proxyKeyNote = 'Keep the proxy key on the server only (config file, environment or secret store). Never put it in HTML or client code.'
 
 export function buildProxyRecipes(input: RecipeInput, { managed }: { managed: boolean }): Recipe[] {
   const host = trackerHost(input.scriptUrl)
   const hostname = new URL(host).host
   const p = PROXY_PREFIX
+  // Script directory without its leading slash, as a path segment ("js/").
+  const scripts = `${scriptDir(input.scriptUrl).slice(1)}/`
   const note = managed ? proxyKeyNote : trustedProxiesNote
 
   const nginxKey = managed ? `    proxy_set_header X-Supermetry-Proxy-Key $sm_key;
@@ -338,7 +350,7 @@ export function buildProxyRecipes(input: RecipeInput, { managed }: { managed: bo
 set $sm_key "smpk_REPLACE_WITH_YOUR_KEY";
 
 ` : ''}# Forward only the tracking paths, never the whole app.
-location ~ ^${p}/(js/|px/|api/public/|replay\\.js$|api/replay/) {
+location ~ ^${p}/(${scripts}|px/|api/public/|replay\\.js$|api/replay/) {
     rewrite ^${p}/(.*)$ /$1 break;
     proxy_pass ${host};
     proxy_ssl_server_name on;
@@ -352,7 +364,7 @@ ${nginxKey}    proxy_set_header X-Forwarded-For $remote_addr;
 			header_up X-Supermetry-Client-IP {client_ip}
 ` : ''
   const caddy = `your-site.example {
-	@supermetry path ${p}/js/* ${p}/px/* ${p}/api/public/* ${p}/replay.js ${p}/api/replay/*
+	@supermetry path ${p}/${scripts}* ${p}/px/* ${p}/api/public/* ${p}/replay.js ${p}/api/replay/*
 	handle @supermetry {
 		uri strip_prefix ${p}
 		reverse_proxy ${host} {
@@ -372,7 +384,7 @@ if (visitor) {
 if (visitor) headers.set('X-Forwarded-For', visitor)`
   const worker = `// Route: your-site.example${p}/*${managed ? `
 // Secret: wrangler secret put SUPERMETRY_PROXY_KEY` : ''}
-const prefixes = [${['js/', 'px/', 'api/public/', 'api/replay/'].map((path) => q(`${p}/${path}`)).join(', ')}]
+const prefixes = [${[scripts, 'px/', 'api/public/', 'api/replay/'].map((path) => q(`${p}/${path}`)).join(', ')}]
 const files = [${q(`${p}/replay.js`)}]
 
 export default {

web/src/lib/tracker-full.test.ts

@@ -47,8 +47,8 @@ function load(attributes = '', body = '', withObservers = false, navigationRespo
   })
   Object.defineProperty(dom.window, 'fetch', {
     configurable: true,
-    value: (_url: string, init: { method?: string; body: string; keepalive?: boolean }) => {
-      if (init.method !== 'POST' || init.keepalive !== true) throw new Error(`unexpected fetch ${JSON.stringify(init)}`)
+    value: (_url: string, init: { method?: string; body: string; keepalive?: boolean; mode?: string }) => {
+      if (init.method !== 'POST' || init.keepalive !== true || init.mode !== 'no-cors') throw new Error(`unexpected fetch ${JSON.stringify(init)}`)
       payloads.push(JSON.parse(init.body) as EventPayload)
       return Promise.resolve({})
     },