From 9b9da0688096ef2fe19534168bfcc0282fdb7d0e Mon Sep 17 00:00:00 2001
From: Tony Rivera <riverasafe@gmail.com>
Date: Wed, 1 Jul 2026 21:58:06 -0400
Subject: [PATCH] fix: notify per anonymous viewer, not once per tracked link

For a tracked link without email verification, every anonymous viewer was
keyed as the constant "anon". recordOpen decides "first open" per viewer, so
after the very first open the owner's notification never fired again, no
matter how many different people opened the link.

Give each browser a stable id via a first-party sentou_vid cookie and key
anonymous viewers as "anon:<id>". The viewer page mints the id when the
cookie is absent (a server component cannot set cookies, so the tracking
script persists it client-side) and passes it into the tracking token.
recordOpen's existing per-viewer logic then notifies once per distinct
browser while a refresh by the same browser still dedupes; verified viewers
keep being keyed by email. The id is a dedup bucket, not an identity, so a
client-set cookie is fine. displayViewer renders "anon:<id>" as anon-<id>.

Tests: trackingContext keys distinct browsers distinctly and ignores the id
for a verified viewer; recordOpen treats two browsers as two first opens and
a repeat as not-first; the viewer page persists the cookie. Live-smoked the
cookie round-trip: no cookie mints a fresh id, a sent cookie is reused
(refresh dedupes), and a new visitor gets a different id.
---
 app/(dashboard)/routes/[id]/page.tsx |  5 ++++-
 app/v/[slug]/page.test.ts            |  6 +++++-
 app/v/[slug]/page.tsx                | 13 ++++++++++++-
 lib/notifications.test.ts            | 20 +++++++++++++++++++-
 lib/tracking-context.test.ts         | 14 ++++++++++++++
 lib/tracking-context.ts              | 13 ++++++++++---
 6 files changed, 64 insertions(+), 7 deletions(-)

diff --git a/app/(dashboard)/routes/[id]/page.tsx b/app/(dashboard)/routes/[id]/page.tsx
index 26adb01..6f636e8 100644
--- a/app/(dashboard)/routes/[id]/page.tsx
+++ b/app/(dashboard)/routes/[id]/page.tsx
@@ -48,7 +48,10 @@ function shortDate(dateStr: string): string {
 
 function displayViewer(viewer: string, verifiedEmails: Set<string>): string {
   if (verifiedEmails.has(viewer)) return viewer;
-  const prefix = viewer.replace(/[^a-z0-9]/gi, "").slice(0, 8) || viewer.slice(0, 8);
+  // Anonymous viewers are keyed "anon" (legacy) or "anon:<per-browser id>". Strip the prefix
+  // before shortening so distinct browsers read as distinct anonymous viewers (anon-<id>).
+  const id = viewer.startsWith("anon:") ? viewer.slice(5) : viewer;
+  const prefix = id.replace(/[^a-z0-9]/gi, "").slice(0, 8) || "viewer";
   return `anon-${prefix}`;
 }
 
diff --git a/app/v/[slug]/page.test.ts b/app/v/[slug]/page.test.ts
index 6bafd7e..363fa93 100644
--- a/app/v/[slug]/page.test.ts
+++ b/app/v/[slug]/page.test.ts
@@ -134,7 +134,11 @@ describe("viewer page", () => {
     const token = html.match(/var t="([^"]+)"/)![1];
     const claim = verifyTrackToken(token)!;
     expect(claim.linkId).toBe(link.id);
-    expect(claim.viewer).toBe("anon"); // no access cookie in this render
+    // No access cookie in this render, so the viewer is anonymous. It is keyed by a per-browser
+    // id ("anon:<id>") rather than the bare "anon" so distinct viewers notify independently.
+    expect(claim.viewer.startsWith("anon")).toBe(true);
+    // The script also persists that per-browser id as a cookie so a refresh dedupes.
+    expect(html).toContain("sentou_vid=");
   });
 
   const formGate = { requireEmail: true, allowedDomains: null, expiresAt: null, revoked: false };
diff --git a/app/v/[slug]/page.tsx b/app/v/[slug]/page.tsx
index 151f58e..49f765c 100644
--- a/app/v/[slug]/page.tsx
+++ b/app/v/[slug]/page.tsx
@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import { notFound } from "next/navigation";
 import { cookies } from "next/headers";
 import { getLinkBySlug } from "@/lib/links";
@@ -360,7 +361,15 @@ export default async function ViewerPage({
   // ── Viewer: artifact in sandboxed iframe ───────────────────────────────────
   // STRUCTURE: main's DIRECT children must be [maybe-notice-div, iframe, maybe-script].
   // No extra wrappers here — tests verify direct siblings to prove sandbox isolation.
-  const tracking = trackingContext(link, claim);
+  //
+  // Per-browser id for anonymous open-notification dedup. A server component cannot set a
+  // cookie, so mint one when absent, use it for this render's tracking token, and persist it
+  // client-side in the tracking script below. It is only a dedup bucket (not an identity or a
+  // security token), so a client-set, non-httpOnly cookie is fine; tampering only affects that
+  // viewer's own notification dedup. Only meaningful when tracking is on.
+  const VISITOR_COOKIE = "sentou_vid";
+  const visitorId = cookieStore.get(VISITOR_COOKIE)?.value || randomUUID();
+  const tracking = trackingContext(link, claim, visitorId);
   const iframe = (
     <iframe
       title="artifact"
@@ -386,6 +395,8 @@ export default async function ViewerPage({
         <script
           dangerouslySetInnerHTML={{
             __html:
+              // Persist the per-browser id so a refresh reuses it and dedupes; ~1yr, lax.
+              `document.cookie=${JSON.stringify(`${VISITOR_COOKIE}=${visitorId}; path=/; max-age=31536000; samesite=lax`)};` +
               `(function(){var t=${JSON.stringify(tracking.token)},s=Date.now();` +
               `function send(type,extra){try{navigator.sendBeacon('/api/track',new Blob([JSON.stringify(Object.assign({token:t,type:type},extra||{}))],{type:'application/json'}))}catch(e){}}` +
               `send('open');` +
diff --git a/lib/notifications.test.ts b/lib/notifications.test.ts
index b678edf..c724fc2 100644
--- a/lib/notifications.test.ts
+++ b/lib/notifications.test.ts
@@ -5,7 +5,7 @@ import path from "node:path";
 import { eq } from "drizzle-orm";
 import { migrate } from "drizzle-orm/better-sqlite3/migrator";
 import { getDb } from "@/lib/db/client";
-import { createLink } from "@/lib/links";
+import { createLink, recordOpen } from "@/lib/links";
 import { getStore } from "@/lib/server-store";
 import * as schema from "@/lib/db/schema";
 import { maybeNotifyOpen } from "@/lib/notifications";
@@ -279,3 +279,21 @@ describe("notification_prefs — DB read/write", () => {
     expect(updated?.webhookUrl).toBeNull();
   });
 });
+
+// recordOpen returns firstOpen (the flag /api/track uses to decide whether to notify). With
+// per-browser anonymous ids, each distinct browser is a first open (one notification each) while
+// a refresh by the same browser is not — the fix for anonymous notifications collapsing to one.
+describe("recordOpen first-open gating for anonymous viewers", () => {
+  it("treats distinct per-browser anon viewers as separate first opens, and a repeat as not first", async () => {
+    const store = getStore();
+    const link = await createLink(store, "<h1>x</h1>", undefined, true);
+    const open = (viewer: string, eventId: string) =>
+      recordOpen(store, { eventId, linkId: link.id, viewer, version: 1, openedAt: new Date().toISOString(), dwellMs: 0 });
+
+    // Two different browsers → both are a first open → both would notify.
+    expect(await open("anon:browser-a", "e1")).toBe(true);
+    expect(await open("anon:browser-b", "e2")).toBe(true);
+    // Same browser opening again (a refresh: new page-load, new eventId) → not a first open.
+    expect(await open("anon:browser-a", "e3")).toBe(false);
+  });
+});
diff --git a/lib/tracking-context.test.ts b/lib/tracking-context.test.ts
index 3a3692c..841999e 100644
--- a/lib/tracking-context.test.ts
+++ b/lib/tracking-context.test.ts
@@ -33,4 +33,18 @@ describe("trackingContext", () => {
     const ctx = trackingContext(link, { linkId: "some-other-link-id", email: "a@x.com" }) as { track: true; token: string };
     expect(verifyTrackToken(ctx.token)!.viewer).toBe("anon");
   });
+  it("keys an anonymous viewer by the per-browser id so distinct browsers are distinct viewers", async () => {
+    const link = await createLink(createMemoryStore(), "<h1>x</h1>", undefined, true);
+    const a = trackingContext(link, null, "browser-a") as { track: true; token: string };
+    const b = trackingContext(link, null, "browser-b") as { track: true; token: string };
+    expect(verifyTrackToken(a.token)!.viewer).toBe("anon:browser-a");
+    expect(verifyTrackToken(b.token)!.viewer).toBe("anon:browser-b");
+    // Distinct browsers must map to distinct viewers, or the owner's open-notification collapses.
+    expect(verifyTrackToken(a.token)!.viewer).not.toBe(verifyTrackToken(b.token)!.viewer);
+  });
+  it("ignores the visitor id for a VERIFIED viewer (email still wins)", async () => {
+    const link = await createLink(createMemoryStore(), "<h1>x</h1>", undefined, true);
+    const ctx = trackingContext(link, { linkId: link.id, email: "a@x.com", verified: true }, "browser-a") as { track: true; token: string };
+    expect(verifyTrackToken(ctx.token)!.viewer).toBe("a@x.com");
+  });
 });
diff --git a/lib/tracking-context.ts b/lib/tracking-context.ts
index b304447..1af7e03 100644
--- a/lib/tracking-context.ts
+++ b/lib/tracking-context.ts
@@ -6,11 +6,18 @@ import { signTrackToken } from "@/lib/track-token";
 export function trackingContext(
   link: Link,
   claim: { linkId: string; email: string; verified?: boolean } | null,
+  visitorId?: string,
 ): { track: false } | { track: true; token: string } {
   if (!link.track) return { track: false };
-  // Attribute opens to an email only when it was actually verified; an unverified (record-only)
-  // viewer is "anon", so tracking never stores an address Sentou could not confirm either.
-  const viewer = claim && claim.linkId === link.id && claim.verified ? claim.email : "anon";
+  // Attribute opens to an email only when it was actually verified; an unverified viewer is
+  // anonymous, so tracking never stores an address Sentou could not confirm. Key an anonymous
+  // viewer by a stable per-browser id ("anon:<id>") rather than the bare constant "anon": with a
+  // single "anon" bucket, recordOpen's per-viewer first-open check treats every distinct person
+  // after the first as a repeat, so the owner's open-notification fires only once for the whole
+  // link. A per-browser id makes distinct viewers distinct (each notifies once) while a refresh
+  // by the same browser still dedupes. Falls back to "anon" when no id is supplied.
+  const verified = claim && claim.linkId === link.id && claim.verified;
+  const viewer = verified ? claim.email : visitorId ? `anon:${visitorId}` : "anon";
   const version = currentVersion(link);
   // 24h covers a long-open tab still firing its close beacon, while bounding indefinite replay.
   const token = signTrackToken({ linkId: link.id, version, viewer, eventId: nanoid(), exp: Date.now() + 24 * 3600_000 });