[BUG] - The redirect to the Labs annual report(s) reports visits in Plausible from preview builds, not just the live site

[bskinn]

What site is this for?

Quansight Labs

Expected behavior

The Plausible analytics should only show download traffic for Labs Annual Reports from the live site at https://labs.quansight.org

Actual behavior

Traffic to the Labs Report on Vercel preview builds also is captured in Plausible.

I opened an incognito window (since I have Plausible capture disabled on my browser) and navigated to:

https://labs-git-fix-test-homepage-quansight.vercel.app/annual-reports/quansight-labs-annual-report-2022.pdf?utm_source=checking-report-visit-capture-on-vercel-preview-builds

This took me to the current stand-in NumFOCUS report PDF, as expected.

Checking Plausible, my visit was registered:

The same sort of behavior should be observed with any vercel.app preview build of the site.

I think we want the Plausible tracking call in /apps/labs/pages/api/annual-report.pdf.ts to be guarded by a check for the live labs.quansight.org domain.

How to Reproduce the problem?

No response

Anything else?

No response

[bskinn]

Attn: @gabalafou

[bskinn]

I don't think this is urgent to fix, to include in tomorrow's build to live.

Once the report is live, any testing of links and such will be using the live site PDF redirect, so this bug won't be active.

But I think we want to fix it overall sooner than later.

[gabalafou]

Oh right, we turned off the Plausible script so that it doesn't load except when the website/Nextjs app is loaded from the production .com or .org domain.

Not sure how to fix off the top of my head but thanks for filing this.

[bskinn]

I think we can mimic the guard that's used for the broader site -- here's how it's done on Consulting.

Could possibly refactor some pieces of the domain check into a common function; but, not sure if each occurrence of this check will be idiosyncratic enough that it's not worth trying to DRY.

[gabalafou]

No because that code is executed client-side, whereas the redirect is server-side. I think we can use request.host but I'd have to check

[gabalafou]

But yes, the guard will essentially be the same in the sense: is this instantiation (client: page load, server: request) on the production domain?