From 03ba1fd8fef71ca9549884073d1a72bdc6ff79dd Mon Sep 17 00:00:00 2001 From: Caleb Burke Date: Fri, 4 Sep 2026 20:41:40 -0700 Subject: [PATCH 1/4] :bug: Record Matomo analytics in production. Why? The Matomo integration was already present but never recorded: the production build shipped with an empty tracker host, and the app's Content Security Policy blocked the external tracker script and beacons. Default the production tracker host to https://analytics.gov.yk.ca (still overridable via VITE_MATOMO_HOST) and allowlist it in the script-src and connect-src CSP directives. Non-production environments stay disabled. See https://yg-hpw.atlassian.net/browse/TK-34 --- api/src/app.ts | 6 +++--- api/src/config.ts | 6 ++++++ web/src/config.ts | 9 +++++++-- 3 files changed, 16 insertions(+), 5 deletions(-) diff --git a/api/src/app.ts b/api/src/app.ts index fffd14f2..d7dd2b4d 100644 --- a/api/src/app.ts +++ b/api/src/app.ts @@ -4,7 +4,7 @@ import path from "path" import helmet from "helmet" import formData from "express-form-data" -import { AUTH0_DOMAIN, FRONTEND_URL } from "@/config" +import { AUTH0_DOMAIN, FRONTEND_URL, MATOMO_TRACKER_HOST } from "@/config" import { betterFormDataBodyParserMiddleware, requestLoggerMiddleware } from "@/middlewares" import router from "@/router" import enhancedQsDecoder from "@/utils/enhanced-qs-decoder" @@ -26,11 +26,11 @@ app.use( "frame-ancestors": ["'self'"], "img-src": ["'self'", "data:", "https:"], "object-src": ["'none'"], - "script-src": ["'self'", "'unsafe-eval'"], + "script-src": ["'self'", "'unsafe-eval'", MATOMO_TRACKER_HOST], "script-src-attr": ["'none'"], "style-src": ["'self'", "https:", "'unsafe-inline'"], "worker-src": ["'self'", "blob:"], - "connect-src": ["'self'", FRONTEND_URL, AUTH0_DOMAIN], + "connect-src": ["'self'", FRONTEND_URL, AUTH0_DOMAIN, MATOMO_TRACKER_HOST], }, }) ) diff --git a/api/src/config.ts b/api/src/config.ts index 4b14e9bf..5c58d47f 100644 --- a/api/src/config.ts +++ b/api/src/config.ts @@ -41,6 +41,12 @@ export const FRONTEND_URL = process.env.FRONTEND_URL || "" export const APPLICATION_NAME = process.env.VITE_APPLICATION_NAME || "" export const RUN_SCHEDULER = process.env.RUN_SCHEDULER || "false" +// Matomo analytics tracker host; used to allowlist the tracker in the CSP. Defaults to the +// Yukon Government analytics host and can be overridden with VITE_MATOMO_HOST. See TK-34. +export const MATOMO_TRACKER_HOST = stripTrailingSlash( + process.env.VITE_MATOMO_HOST || "https://analytics.gov.yk.ca" +) + // ==================== // Authentication & Authorization // ==================== diff --git a/web/src/config.ts b/web/src/config.ts index cfaaf8b1..e3853799 100644 --- a/web/src/config.ts +++ b/web/src/config.ts @@ -3,8 +3,13 @@ import { stripTrailingSlash } from "@/utils/strip-trailing-slash" export const ENVIRONMENT = import.meta.env.MODE const DEVELOPMENT_API_BASE_URL = import.meta.env.VITE_API_BASE_URL || "http://localhost:3000" -/** Matomo tracking is disabled unless the host is configured for the environment. */ +/** + * Matomo tracking is disabled unless the host is configured for the environment. + * Production defaults to the Yukon Government analytics host; VITE_MATOMO_HOST overrides it. + * See TK-34. + */ const MATOMO_HOST = import.meta.env.VITE_MATOMO_HOST || "" +const PRODUCTION_MATOMO_HOST = import.meta.env.VITE_MATOMO_HOST || "https://analytics.gov.yk.ca" const MATOMO_SITE_ID = 115 const prodConfig = { @@ -13,7 +18,7 @@ const prodConfig = { audience: "generic-production", apiBaseUrl: "", applicationName: "Traditional Knowledge Vault", - matomoHost: MATOMO_HOST, + matomoHost: PRODUCTION_MATOMO_HOST, matomoSiteId: MATOMO_SITE_ID, } From e554991c676a86ae5ace519263038cd3f0818328 Mon Sep 17 00:00:00 2001 From: Caleb Burke Date: Fri, 4 Sep 2026 21:06:06 -0700 Subject: [PATCH 2/4] Keep config vars simple --- api/src/config.ts | 6 +----- web/src/config.ts | 8 +------- 2 files changed, 2 insertions(+), 12 deletions(-) diff --git a/api/src/config.ts b/api/src/config.ts index 5c58d47f..6e900dd3 100644 --- a/api/src/config.ts +++ b/api/src/config.ts @@ -41,11 +41,7 @@ export const FRONTEND_URL = process.env.FRONTEND_URL || "" export const APPLICATION_NAME = process.env.VITE_APPLICATION_NAME || "" export const RUN_SCHEDULER = process.env.RUN_SCHEDULER || "false" -// Matomo analytics tracker host; used to allowlist the tracker in the CSP. Defaults to the -// Yukon Government analytics host and can be overridden with VITE_MATOMO_HOST. See TK-34. -export const MATOMO_TRACKER_HOST = stripTrailingSlash( - process.env.VITE_MATOMO_HOST || "https://analytics.gov.yk.ca" -) +export const MATOMO_TRACKER_HOST = stripTrailingSlash(process.env.VITE_MATOMO_HOST || "") // ==================== // Authentication & Authorization diff --git a/web/src/config.ts b/web/src/config.ts index e3853799..95b19ee9 100644 --- a/web/src/config.ts +++ b/web/src/config.ts @@ -3,13 +3,7 @@ import { stripTrailingSlash } from "@/utils/strip-trailing-slash" export const ENVIRONMENT = import.meta.env.MODE const DEVELOPMENT_API_BASE_URL = import.meta.env.VITE_API_BASE_URL || "http://localhost:3000" -/** - * Matomo tracking is disabled unless the host is configured for the environment. - * Production defaults to the Yukon Government analytics host; VITE_MATOMO_HOST overrides it. - * See TK-34. - */ const MATOMO_HOST = import.meta.env.VITE_MATOMO_HOST || "" -const PRODUCTION_MATOMO_HOST = import.meta.env.VITE_MATOMO_HOST || "https://analytics.gov.yk.ca" const MATOMO_SITE_ID = 115 const prodConfig = { @@ -18,7 +12,7 @@ const prodConfig = { audience: "generic-production", apiBaseUrl: "", applicationName: "Traditional Knowledge Vault", - matomoHost: PRODUCTION_MATOMO_HOST, + matomoHost: MATOMO_HOST, matomoSiteId: MATOMO_SITE_ID, } From 41e7b01e2adf2ef45c6ade1e7be3250c569bdb0e Mon Sep 17 00:00:00 2001 From: Caleb Burke Date: Fri, 4 Sep 2026 21:07:03 -0700 Subject: [PATCH 3/4] Adding back in comment --- web/src/config.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/web/src/config.ts b/web/src/config.ts index 95b19ee9..08695023 100644 --- a/web/src/config.ts +++ b/web/src/config.ts @@ -3,6 +3,8 @@ import { stripTrailingSlash } from "@/utils/strip-trailing-slash" export const ENVIRONMENT = import.meta.env.MODE const DEVELOPMENT_API_BASE_URL = import.meta.env.VITE_API_BASE_URL || "http://localhost:3000" +/** Matomo tracking is disabled unless the host is configured +for the environment. */ const MATOMO_HOST = import.meta.env.VITE_MATOMO_HOST || "" const MATOMO_SITE_ID = 115 From 0190532fc816c8e05e2ab2d86c99fb9eb0743c41 Mon Sep 17 00:00:00 2001 From: Caleb Burke Date: Fri, 4 Sep 2026 21:07:31 -0700 Subject: [PATCH 4/4] Adding back in comment (formatted) --- web/src/config.ts | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/web/src/config.ts b/web/src/config.ts index 08695023..cfaaf8b1 100644 --- a/web/src/config.ts +++ b/web/src/config.ts @@ -3,8 +3,7 @@ import { stripTrailingSlash } from "@/utils/strip-trailing-slash" export const ENVIRONMENT = import.meta.env.MODE const DEVELOPMENT_API_BASE_URL = import.meta.env.VITE_API_BASE_URL || "http://localhost:3000" -/** Matomo tracking is disabled unless the host is configured -for the environment. */ +/** Matomo tracking is disabled unless the host is configured for the environment. */ const MATOMO_HOST = import.meta.env.VITE_MATOMO_HOST || "" const MATOMO_SITE_ID = 115