Harden Space analytics attribution and privacy

hf-shell-app.js

@@ -1275,6 +1275,28 @@
         "hfviewer_actor",
       ];
       const TRACKING_ACTOR_LABEL_QUERY_KEY = "tracking_actor_label";
+      const SENSITIVE_ANALYTICS_QUERY_KEYS = new Set([
+        "__sign",
+        "access_token",
+        "auth_token",
+        "code",
+        "id_token",
+        "state",
+        "token",
+      ]);
+      const HFVIEWER_PRODUCT_CONTEXT = (() => {
+        const configured =
+          window.HFVIEWER_PRODUCT_CONTEXT &&
+          typeof window.HFVIEWER_PRODUCT_CONTEXT === "object"
+            ? window.HFVIEWER_PRODUCT_CONTEXT
+            : {};
+        const text = (value, maxLength = 120) => `${value || ""}`.trim().slice(0, maxLength);
+        return Object.freeze({
+          product_surface: text(configured.product_surface) || "website",
+          space_repo: text(configured.space_repo),
+          space_revision: text(configured.space_revision),
+        });
+      })();
       const HFVIEWER_INTERNAL_TRACKING_STORAGE_KEY = "hfviewer:internalTracking:v1";
       const HFVIEWER_INTERNAL_TRACKING_COOKIE_NAME = "hfviewer_internal";
       const HFVIEWER_INTERNAL_ANALYTICS_EMAILS = new Set([
@@ -6729,6 +6751,7 @@
         TRACKING_ACTOR_QUERY_KEYS.forEach((key) => url.searchParams.delete(key));
         url.searchParams.delete(TRACKING_ACTOR_LABEL_QUERY_KEY);
         url.searchParams.delete("codex_ts");
+        SENSITIVE_ANALYTICS_QUERY_KEYS.forEach((key) => url.searchParams.delete(key));
         return url;
       }
 
@@ -6749,6 +6772,56 @@
         }
       }
 
+      const POSTHOG_URL_PROPERTY_KEYS = new Set([
+        "$current_url",
+        "$initial_current_url",
+        "$initial_referrer",
+        "$referrer",
+        "client_referrer_url",
+        "first_touch_landing_url",
+        "first_touch_referrer_url",
+        "href",
+        "page_location",
+      ]);
+      const POSTHOG_PATH_PROPERTY_KEYS = new Set([
+        "$pathname",
+        "first_touch_landing_path",
+        "outer_page_path",
+        "page_path",
+      ]);
+
+      function sanitizePostHogAutomaticUrlProperties(event) {
+        const containers = [
+          event?.properties,
+          event?.properties?.$set,
+          event?.properties?.$set_once,
+        ];
+        containers.forEach((container) => {
+          if (!container || typeof container !== "object") {
+            return;
+          }
+          POSTHOG_URL_PROPERTY_KEYS.forEach((key) => {
+            if (typeof container[key] === "string") {
+              container[key] = sanitizedAnalyticsUrl(container[key]);
+            }
+          });
+          POSTHOG_PATH_PROPERTY_KEYS.forEach((key) => {
+            if (typeof container[key] !== "string") {
+              return;
+            }
+            try {
+              const url = stripInternalTrackingParams(
+                new URL(container[key], window.location.origin)
+              );
+              container[key] = `${url.pathname}${url.search}`;
+            } catch {
+              // Preserve malformed values rather than breaking analytics.
+            }
+          });
+        });
+        return event;
+      }
+
       const HFVIEWER_FIRST_TOUCH_ATTRIBUTION_KEY = "hfviewer:firstTouchAttribution:v1";
       const HFVIEWER_ATTRIBUTION_VISIT_ID_KEY = "hfviewer:attributionVisitId:v1";
       const ATTRIBUTION_QUERY_KEYS = [
@@ -6765,6 +6838,8 @@
         "ttclid",
         "li_fat_id",
         "mcp_token",
+        "space_journey_id",
+        "space_interaction",
       ];
       let cachedAttributionPayload = null;
 
@@ -6903,6 +6978,7 @@
           page_title: document.title,
           page_path: sanitizedAnalyticsPagePath(),
           page_location: sanitizedAnalyticsUrl(),
+          ...HFVIEWER_PRODUCT_CONTEXT,
           ...params,
           ...(tracking
             ? {
@@ -7197,6 +7273,23 @@
             hfviewer_hf_name: identity.name || undefined,
             hfviewer_last_identified_source: source || "hf_oauth_session",
           });
+        } else if (identity.hfUsername && !internalMatch && !shouldSuppressPostHogForInternalTracking()) {
+          void loadPostHogClient().then((client) => {
+            try {
+              const distinctId = `hf:${identity.hfUsername}`;
+              const personProperties = {
+                hfviewer_authenticated: true,
+                hfviewer_auth_provider: "hugging_face",
+                hfviewer_hf_username: identity.hfUsername,
+                hfviewer_hf_name: identity.name || undefined,
+                hfviewer_last_identified_source: source || "hf_oauth_session",
+              };
+              client?.identify?.(distinctId, personProperties);
+              latestPostHogIdentity = { email: "", personProperties };
+            } catch {
+              // Analytics identity is best-effort only.
+            }
+          });
         }
         trackPendingHfOauthReturnFromSession(payload, source);
         return internalMatch;
@@ -7368,6 +7461,9 @@
           ads_allowed: hasAdsConsent,
           allowed_all: Boolean(consent?.allowed),
         };
+        if (hasAnalyticsConsent) {
+          flushPendingExternalHfAnalyticsIdentity();
+        }
         const categories = consent?.categories || {};
         const categoryEntries = Object.entries(categories)
           .filter(([, value]) => typeof value === "boolean")
@@ -7511,7 +7607,7 @@
                 }
               } catch {}
             }
-            return event;
+            return sanitizePostHogAutomaticUrlProperties(event);
           },
           disable_session_recording:
             disableMobileSessionRecording || Boolean(internalAutomationLabel),
@@ -7533,6 +7629,7 @@
           window.posthog.register?.({
             hfviewer_surface: "top_level_shell",
             is_visualizer_frame: false,
+            ...HFVIEWER_PRODUCT_CONTEXT,
             anonymous_persistence_scope: latestAnalyticsConsentState.analytics_allowed
               ? "durable_consented"
               : "session_tab",
@@ -7886,6 +7983,36 @@
       // and property sanitizer as the rest of the first-party shell.
       window.hfviewerTrackPostHogEvent = trackPostHogEvent;
 
+      let pendingExternalHfAnalyticsIdentity = null;
+
+      function identifyExternalHfAnalyticsIdentity(payload, source = "external_hf_oauth") {
+        if (!payload || payload.authenticated === false) {
+          return false;
+        }
+        if (!latestAnalyticsConsentState.analytics_allowed) {
+          pendingExternalHfAnalyticsIdentity = { payload, source };
+          return false;
+        }
+        pendingExternalHfAnalyticsIdentity = null;
+        identifyHfViewerPostHogUserFromSession(payload, source);
+        return true;
+      }
+
+      function flushPendingExternalHfAnalyticsIdentity() {
+        if (!pendingExternalHfAnalyticsIdentity) {
+          return false;
+        }
+        const pending = pendingExternalHfAnalyticsIdentity;
+        return identifyExternalHfAnalyticsIdentity(pending.payload, pending.source);
+      }
+
+      window.hfviewerAnalyticsBridge = Object.freeze({
+        capture: trackPostHogEvent,
+        hasAnalyticsConsent: () => latestAnalyticsConsentState.analytics_allowed === true,
+        identifyHfSession: identifyExternalHfAnalyticsIdentity,
+        productContext: () => ({ ...HFVIEWER_PRODUCT_CONTEXT }),
+      });
+
       function identifyPostHogUserByEmail(email, personProperties = {}) {
         const normalizedEmail = normalizeAnalyticsEmail(email);
         if (!normalizedEmail || shouldSuppressPostHogForInternalTracking()) {
@@ -58606,4 +58733,4 @@ ${shouldInstallBridge ? `<script>${bridgeScript}</scr${"ipt"}>` : ""}
         scheduleCommunityShowcasePermalinkScroll();
       });
       syncLandingModelCardButton();
-    
+    

index.html

@@ -184,7 +184,53 @@
         }
       }
     </script>
-  <script>window.dataLayer=window.dataLayer||[];window.gtag=function(){};window.VIEWMYMODEL_HF_API_BASE="https://hfviewer.com/api";try{var u=new URL(window.location.href);var m=u.searchParams.get('model');if(m){window.__SX_DEEP_MODEL=m;u.searchParams.delete('model');window.history.replaceState(null,'',u.toString());}}catch(e){}</script>
+  <script>
+    window.dataLayer = window.dataLayer || [];
+    window.gtag = function () {};
+    window.VIEWMYMODEL_HF_API_BASE = "https://hfviewer.com/api";
+    window.HFVIEWER_PRODUCT_CONTEXT = Object.freeze({
+      product_surface: "hf_space",
+      space_repo: "embedl/hfviewer",
+      space_revision: "hf-space-2e4848474064",
+    });
+    try {
+      var initialUrl = new URL(window.location.href);
+      var initialModel = initialUrl.searchParams.get("model");
+      if (initialModel) {
+        window.__SX_DEEP_MODEL = initialModel;
+        initialUrl.searchParams.delete("model");
+        window.history.replaceState(null, "", initialUrl.toString());
+      }
+      var signedAccess = initialUrl.searchParams.get("__sign") || "";
+      var signedPayloadPart = signedAccess.split(".")[1] || "";
+      if (signedPayloadPart) {
+        signedPayloadPart = signedPayloadPart.replace(/-/g, "+").replace(/_/g, "/");
+        while (signedPayloadPart.length % 4) signedPayloadPart += "=";
+        var signedPayload = JSON.parse(atob(signedPayloadPart));
+        var signedUsername = String(signedPayload?.onBehalfOf?.user || "")
+          .trim()
+          .replace(/^@+/, "")
+          .toLowerCase();
+        if (signedUsername === "hannesvonessen") {
+          window.localStorage?.setItem(
+            "hfviewer:internalTracking:v1",
+            JSON.stringify({
+              tracking_actor: "internal",
+              tracking_actor_label: "allowlisted_hf_username:hannesvonessen",
+              hfviewer_internal: true,
+              hfviewer_staff: true,
+              hfviewer_internal_reason: "allowlisted_hf_username",
+              hf_username: signedUsername,
+              source: "hf_space_signed_access",
+              set_at: new Date().toISOString(),
+            })
+          );
+        }
+      }
+    } catch (error) {
+      // Space access hints and cosmetic deep links are best effort only.
+    }
+  </script>
 <style>
 /* --- injected by build_space_landing.py: sections stripped for the HF space --- */
 header.nav,
@@ -10102,7 +10148,6 @@ body.sx-viewer-open { overflow: hidden; }
 <script>
 (function () {
   var SITE = "https://hfviewer.com";
-  var UTM = "utm_source=hf_space&utm_medium=referral&utm_campaign=space-explorer";
   var SITE_SECTIONS = ["models", "glossary", "timeline", "blog", "family", "compare", "model-card-embed", "share", "api", "assets", "visualizer", "next"];
   var MODEL_RE = /^\/([\w.-]+)\/([\w.-]+)\/?$/;
   var overlay = document.getElementById("sx-viewer-overlay");
@@ -10111,17 +10156,64 @@ body.sx-viewer-open { overflow: hidden; }
   var back = document.getElementById("sx-back");
   var openFull = document.getElementById("sx-open");
   var currentPath = null;
+  var currentEmbedJourneyId = null;
 
-  function siteUrl(path) {
-    return SITE + path + (path.indexOf("?") >= 0 ? "&" : "?") + UTM;
+  function createJourneyId() {
+    try {
+      if (window.crypto && typeof window.crypto.randomUUID === "function") {
+        return window.crypto.randomUUID();
+      }
+    } catch (error) { /* fall through */ }
+    return "space-" + Date.now().toString(36) + "-" + Math.random().toString(36).slice(2, 10);
+  }
+
+  function trackSpaceEvent(eventName, properties) {
+    try {
+      window.hfviewerAnalyticsBridge?.capture?.(eventName, Object.assign({
+        product_surface: "hf_space",
+        space_repo: "embedl/hfviewer",
+        space_revision: "hf-space-2e4848474064",
+      }, properties || {}));
+    } catch (error) { /* analytics must never break navigation */ }
+  }
+
+  function siteUrl(path, interaction, journeyId) {
+    var url = new URL(path || "/", SITE);
+    url.searchParams.set("utm_source", "hf_space");
+    url.searchParams.set("utm_medium", "referral");
+    url.searchParams.set("utm_campaign", "space-explorer");
+    url.searchParams.set("utm_content", interaction);
+    url.searchParams.set("space_interaction", interaction);
+    url.searchParams.set("space_journey_id", journeyId);
+    return url.toString();
+  }
+
+  function openWebsite(path, source) {
+    var journeyId = createJourneyId();
+    var destination = siteUrl(path, "open_website", journeyId);
+    trackSpaceEvent("space_to_hfviewer_clicked", {
+      space_journey_id: journeyId,
+      space_interaction: "open_website",
+      destination_path: new URL(destination).pathname,
+      source: source || "space_link",
+      embedded_model_path: currentPath || undefined,
+    });
+    window.open(destination, "_blank", "noopener");
   }
 
   function openModel(path) {
     if (currentPath === path) { showOverlay(); return; }
     currentPath = path;
+    currentEmbedJourneyId = createJourneyId();
     loading.classList.remove("hidden");
-    frame.src = siteUrl(path);
-    openFull.href = siteUrl(path);
+    frame.src = siteUrl(path, "embedded_viewer", currentEmbedJourneyId);
+    openFull.href = siteUrl(path, "open_website", currentEmbedJourneyId);
+    trackSpaceEvent("space_model_opened", {
+      space_journey_id: currentEmbedJourneyId,
+      space_interaction: "embedded_viewer",
+      model_repo_id: path.replace(/^\//, ""),
+      destination_path: path,
+    });
     showOverlay();
     try {
       var u = new URL(window.location.href);
@@ -10140,7 +10232,8 @@ body.sx-viewer-open { overflow: hidden; }
     overlay.classList.remove("open");
     document.body.classList.remove("sx-viewer-open");
     back.style.display = "none";
-    openFull.href = SITE + "/?" + UTM;
+    currentEmbedJourneyId = null;
+    openFull.href = siteUrl("/", "open_website", createJourneyId());
     try {
       var u = new URL(window.location.href);
       u.searchParams.delete("model");
@@ -10148,7 +10241,17 @@ body.sx-viewer-open { overflow: hidden; }
     } catch (e) { /* ignore */ }
   }
 
-  frame.addEventListener("load", function () { loading.classList.add("hidden"); });
+  frame.addEventListener("load", function () {
+    loading.classList.add("hidden");
+    if (currentPath && currentEmbedJourneyId) {
+      trackSpaceEvent("space_embedded_viewer_loaded", {
+        space_journey_id: currentEmbedJourneyId,
+        space_interaction: "embedded_viewer",
+        model_repo_id: currentPath.replace(/^\//, ""),
+        destination_path: currentPath,
+      });
+    }
+  });
   back.addEventListener("click", closeOverlay);
 
   // window CAPTURE phase: fires before the shell's document-level handlers,
@@ -10165,6 +10268,18 @@ body.sx-viewer-open { overflow: hidden; }
     var isSite = url.origin === SITE || url.origin === window.location.origin;
     if (!isSite) return; // external links (HF, X, ...) behave normally
     var path = url.pathname;
+    if (a === openFull) {
+      e.preventDefault();
+      e.stopPropagation();
+      openWebsite(currentPath || "/", "viewer_header");
+      return;
+    }
+    if (a.classList.contains("sx-brand")) {
+      e.preventDefault();
+      e.stopPropagation();
+      openWebsite("/", "space_header_brand");
+      return;
+    }
     if (path === "/" || path === "") {
       e.preventDefault();
       e.stopPropagation();
@@ -10182,7 +10297,7 @@ body.sx-viewer-open { overflow: hidden; }
       // genuine site page: open the real site in a new tab, utm-tagged
       e.preventDefault();
       e.stopPropagation();
-      window.open(siteUrl(path + url.search.replace(/^\?/, "?") ), "_blank", "noopener");
+      openWebsite(path + url.search, "space_content_link");
     }
   }, true);
 

space-auth.js

@@ -40,9 +40,46 @@ function userFromResult(result) {
     name: String(raw.name || username).trim(),
     picture: String(raw.picture || raw.avatar_url || raw.avatarUrl || "").trim(),
     profile: String(raw.profile || `https://huggingface.co/${encodeURIComponent(username)}`).trim(),
+    subject: String(raw.sub || raw.id || "").trim(),
+    email: String(raw.email || "").trim().toLowerCase(),
   };
 }
 
+function trackAuthEvent(eventName, properties = {}) {
+  try {
+    window.hfviewerAnalyticsBridge?.capture?.(eventName, {
+      product_surface: "hf_space",
+      space_repo: "embedl/hfviewer",
+      space_revision: "hf-space-2e4848474064",
+      auth_provider: "hugging_face",
+      ...properties,
+    });
+  } catch {
+    // Authentication must remain independent of analytics availability.
+  }
+}
+
+function identifyAuthenticatedUser(user, source) {
+  if (!user?.username) return;
+  try {
+    window.hfviewerAnalyticsBridge?.identifyHfSession?.(
+      {
+        authenticated: true,
+        email: user.email || "",
+        user: {
+          id: user.subject || "",
+          username: user.username,
+          name: user.name || user.username,
+          email: user.email || "",
+        },
+      },
+      source || "hf_space_native_oauth"
+    );
+  } catch {
+    // Consent-gated identity is best effort only.
+  }
+}
+
 function keepReleasePills() {
   if (!authHost) return [];
   return Array.from(authHost.children).filter((element) =>
@@ -76,7 +113,13 @@ function makeLoggedOutControl() {
   link.href = loginUrl || "#";
   if (!loginUrl) link.setAttribute("aria-disabled", "true");
   link.addEventListener("click", (event) => {
-    if (!loginUrl) event.preventDefault();
+    if (!loginUrl) {
+      event.preventDefault();
+      return;
+    }
+    trackAuthEvent("space_hf_login_clicked", {
+      component: "space_nav",
+    });
   });
   return link;
 }
@@ -107,6 +150,11 @@ function makeLoggedInControl(user) {
   profile.rel = "noopener";
   profile.textContent = "Hugging Face profile";
   profile.setAttribute("role", "menuitem");
+  profile.addEventListener("click", () => {
+    trackAuthEvent("space_hf_profile_opened", {
+      component: "space_nav",
+    });
+  });
 
   const logout = document.createElement("button");
   logout.type = "button";
@@ -114,6 +162,9 @@ function makeLoggedInControl(user) {
   logout.textContent = "Log out";
   logout.setAttribute("role", "menuitem");
   logout.addEventListener("click", () => {
+    trackAuthEvent("space_hf_logout", {
+      component: "space_nav",
+    });
     oauthResult = null;
     writeStoredResult(null);
     renderAuth();
@@ -161,6 +212,7 @@ function cleanCallbackQuery() {
 
 async function initialize() {
   renderAuth();
+  identifyAuthenticatedUser(userFromResult(oauthResult), "hf_space_native_oauth_restored");
   try {
     const callbackResult = await oauthHandleRedirectIfPresent();
     if (callbackResult) {
@@ -168,9 +220,22 @@ async function initialize() {
       writeStoredResult(callbackResult);
       cleanCallbackQuery();
       renderAuth();
+      const user = userFromResult(callbackResult);
+      identifyAuthenticatedUser(user, "hf_space_native_oauth_callback");
+      trackAuthEvent("space_hf_login_completed", {
+        component: "space_nav",
+        username_present: !!user?.username,
+        subject_present: !!user?.subject,
+        email_present: !!user?.email,
+      });
     }
   } catch (error) {
     console.warn("Hugging Face Space login callback failed", error);
+    trackAuthEvent("space_hf_login_failed", {
+      component: "space_nav",
+      failure_stage: "oauth_callback",
+      error_name: String(error?.name || "Error").slice(0, 80),
+    });
   }
 
   try {
@@ -178,6 +243,11 @@ async function initialize() {
     loginUrl = await oauthLoginUrl(scopes ? { scopes } : undefined);
   } catch (error) {
     console.warn("Could not prepare Hugging Face Space login", error);
+    trackAuthEvent("space_hf_login_failed", {
+      component: "space_nav",
+      failure_stage: "login_url",
+      error_name: String(error?.name || "Error").slice(0, 80),
+    });
   }
   renderAuth();
 }