fix: allow paths for analytics url

Author: majkshkurti

apps/core/src/core/schemas/organization_analytics.py

@@ -39,13 +39,15 @@ def _must_be_https_and_clean(cls, v: AnyHttpUrl) -> AnyHttpUrl:
         # would either fail (mixed content) or downgrade privacy.
         if v.scheme != "https":
             raise ValueError("Matomo URL must use https://")
-        # No query / fragment. Path other than "/" is suspicious — the JS
-        # snippet appends "matomo.php" / "matomo.js" to the base.
+        # No query / fragment — the JS snippet appends "matomo.php" /
+        # "matomo.js" to the base. A path is fine (self-hosted Matomo often
+        # lives under one, e.g. https://host.de/matomo/); normalize it to a
+        # trailing slash so the append yields ".../matomo/matomo.js".
         if v.query or v.fragment:
             raise ValueError("Matomo URL must not contain a query or fragment")
         path = v.path or "/"
-        if path not in ("", "/"):
-            raise ValueError("Matomo URL must point at the instance root")
+        if not path.endswith("/"):
+            return AnyHttpUrl(f"{v}/")
         return v
 
 

apps/core/tests/unit/schemas/test_organization_analytics_schemas.py

@@ -48,6 +48,34 @@ def test_create_rejects_http_url() -> None:
         OrganizationAnalyticsCreate.model_validate(payload)
 
 
+def test_create_accepts_subdirectory_url() -> None:
+    """Self-hosted Matomo often lives under a path, e.g. host.de/matomo/."""
+    payload = _valid_payload()
+    payload["config"]["url"] = "https://analytics.example.org/matomo/"
+    parsed = OrganizationAnalyticsCreate.model_validate(payload)
+    assert str(parsed.config.url) == "https://analytics.example.org/matomo/"
+
+
+def test_create_normalizes_missing_trailing_slash() -> None:
+    """The tracker appends matomo.php/matomo.js to the base, so the stored
+    URL must end with a slash."""
+    payload = _valid_payload()
+    payload["config"]["url"] = "https://analytics.example.org/matomo"
+    parsed = OrganizationAnalyticsCreate.model_validate(payload)
+    assert str(parsed.config.url) == "https://analytics.example.org/matomo/"
+
+
+def test_create_still_rejects_query_and_fragment() -> None:
+    for bad in (
+        "https://analytics.example.org/matomo/?x=1",
+        "https://analytics.example.org/matomo/#frag",
+    ):
+        payload = _valid_payload()
+        payload["config"]["url"] = bad
+        with pytest.raises(ValidationError):
+            OrganizationAnalyticsCreate.model_validate(payload)
+
+
 def test_read_defaults_usage_count_to_zero() -> None:
     read = OrganizationAnalyticsRead.model_validate(
         {

apps/web/components/analytics/MatomoTracker.tsx

@@ -6,9 +6,9 @@ import Script from "next/script";
  * Injects the customer's Matomo tracker on a public dashboard.
  *
  * Defence-in-depth on the URL/site_id: the backend already validates
- * https-only, no path, and numeric site IDs. We re-validate here at the
- * trust boundary so a malformed or hostile JSONB row from the DB can't
- * end up in a <script> tag.
+ * https-only, no query/fragment, and numeric site IDs. We re-validate here
+ * at the trust boundary so a malformed or hostile JSONB row from the DB
+ * can't end up in a <script> tag.
  *
  * Sends:
  *   - setDocumentTitle(projectName)        — readable in Matomo's UI
@@ -34,8 +34,10 @@ function isSafeMatomoUrl(u: string): boolean {
   try {
     const parsed = new URL(u);
     if (parsed.protocol !== "https:") return false;
-    if (parsed.search || parsed.hash) return false;
-    return parsed.pathname === "/" || parsed.pathname === "";
+    // A pathname is allowed — self-hosted Matomo often lives under one
+    // (e.g. https://host.de/matomo/); the base is normalized to a trailing
+    // slash before matomo.php/matomo.js are appended.
+    return !parsed.search && !parsed.hash;
   } catch {
     return false;
   }

apps/web/lib/validations/__tests__/organizationAnalytics.test.ts

@@ -33,6 +33,28 @@ describe("organizationAnalyticsCreateSchema", () => {
     ).toThrow();
   });
 
+  it("accepts a subdirectory url and normalizes the trailing slash", () => {
+    const parsed = organizationAnalyticsCreateSchema.parse({
+      ...validCreate,
+      config: { ...validCreate.config, url: "https://analytics.example.org/matomo" },
+    });
+    expect(parsed.config.url).toBe("https://analytics.example.org/matomo/");
+  });
+
+  it("still rejects urls with query or fragment", () => {
+    for (const bad of [
+      "https://analytics.example.org/matomo/?x=1",
+      "https://analytics.example.org/matomo/#frag",
+    ]) {
+      expect(() =>
+        organizationAnalyticsCreateSchema.parse({
+          ...validCreate,
+          config: { ...validCreate.config, url: bad },
+        })
+      ).toThrow();
+    }
+  });
+
   it("rejects http urls", () => {
     expect(() =>
       organizationAnalyticsCreateSchema.parse({

apps/web/lib/validations/organizationAnalytics.ts

@@ -14,11 +14,15 @@ export const matomoConfigSchema = z.object({
     .refine((v) => {
       try {
         const u = new URL(v);
-        return (u.pathname === "" || u.pathname === "/") && !u.search && !u.hash;
+        return !u.search && !u.hash;
       } catch {
         return false;
       }
-    }, "Must point at the Matomo root (no path, query, or fragment)"),
+    }, "Must not contain a query or fragment")
+    // A path is fine (self-hosted Matomo often lives under one, e.g.
+    // https://host.de/matomo/); the tracker appends matomo.php/matomo.js,
+    // so normalize to a trailing slash.
+    .transform((v) => (v.endsWith("/") ? v : `${v}/`)),
   site_id: z
     .string()
     .min(1)