- Shipped
- 20 Agosti 2026, 01:25 UTC
- Author
- Kamo
- Commit
- da767e1
A visitor who follows https://www.<apex>?mrt=<code> gets two first-party cookies from the edge middleware — an opaque GUID that lasts two years and the code itself for ninety days — and every page they open afterwards is reported once, from idle, by sendBeacon. The domain is derived from the forwarded headers, not from nextUrl. Next builds the middleware's URL from its own listen address, so nextUrl.hostname is the container's, and the Domain attribute silently never appeared: a host-only cookie pinned to www that register.<apex> cannot read, which loses the referral with nothing failing anywhere. cookie-consent deletes through the same helper, so the two cannot drift apart again. A visitor who never followed a partner link is never given a cookie and never beacons at all. That, rather than a banner toggle, is what keeps this proportionate: the record behind a partner's totals is what that partner is paid against, and a consent gate would not make the numbers smaller, it would make them wrong — the visits still happen and the signups still convert, they just stop being attributable. Both cookies are disclosed under Essential on the Cookie Policy with a control that clears them. Our own product analytics stays gated. /api/mrt is a trust boundary, not a pipe: it attaches this site's API key, so it validates the GUID, the code and the reported URL, rebuilds the payload from values it owns, refuses a cross-site caller, and forwards only the ingress-set peer IP — the inbound X-Forwarded-For chain is client-controlled at its left end and would otherwise let a caller choose the IP the commission report records. It answers 204 before forwarding, and warns at most once a minute when the upstream is unreachable, because the previous shape treated a 404 exactly like success. Static rendering is untouched: no cookies() or headers() in any page, no Script tag, no framer-motion on the beacon. check-mrt-cookie.ts pins the invariants that have no other guard — including that the beacon stays ungated and that nothing is collected from an unreferred visitor.