crawlproof stats: who arrived and from where, from the CLI - #239
Merged
Conversation
The dashboard's stats route is session-authed, so a CLI holding an API token could read ads and slots but nothing about traffic — and "did that post do anything" is the question a terminal is best placed to answer. GET /api/tracker/v1/stats?site&range&who serves the same panels the dashboard renders, with the bearer auth the ads API already uses. The project is resolved by hostname, id or name and always scoped by owner_id, so a token cannot read a site it does not own by guessing an id. `crawlproof stats [site]` prints sources, referrers and top pages. Defaults are the last day and humans only, because over a month with bots counted a launch is invisible inside the crawler traffic. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GX6xEcjGFxcvcMCFLhQng
ThreatCrush Security Scan39 finding(s) HIGH/CRITICAL: 2 | MEDIUM: 28 | LOW: 9
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The dashboard's stats route is session-authed (
requireProjectAccess), so a CLI holding an API token could create ads and slots but could not read a single number about traffic. "Did that post do anything" is exactly the question a terminal is best placed to answer, and it was the one thing the CLI could not.What
GET /api/tracker/v1/stats?site=&range=&who=serves the same panels the dashboard renders (series, sources, referrers, pages), behind the bearer auth/api/ads/v1/*already uses.lib/tracker/apiStats.tsresolves the project by hostname, id or name, always scoped byowner_id, so a token cannot read a site it does not own by guessing an id. With one project the name can be left out.crawlproof stats [site] [--range] [--who] [--json]prints sources, referrers and top pages. Defaults to the last day and humans only, because over a month with bots counted a launch is invisible inside the crawler traffic. An empty window says so and names the likeliest cause rather than printing zeroes.Verified
🤖 Generated with Claude Code
https://claude.ai/code/session_013GX6xEcjGFxcvcMCFLhQng