fix: respect proxying self-hosted domains (#718)

Author: harlan-zw

docs/content/scripts/umami-analytics.md

@@ -18,16 +18,17 @@ links:
 
 ### Self-hosted Umami
 
-If you use a self-hosted version of Umami, provide an explicit src for the script so that the browser sends API events to the correct endpoint.
+If you use a self-hosted version of Umami, set `hostUrl` to your Umami origin. This is the provider-specific way to tell Umami where to send events.
 
 ```ts
 useScriptUmamiAnalytics({
- scriptInput: {
- src: 'https://my-self-hosted/script.js'
- }
+ websiteId: 'YOUR_WEBSITE_ID',
+ hostUrl: 'https://my-self-hosted'
 })
 ```
 
+Use `scriptInput.src` only if you also need to override the script URL itself.
+
 ## Advanced Features
 
 ### Session Identification

packages/script/src/module.ts

@@ -235,6 +235,51 @@ export function applyAutoInject(
 rtEntry[autoInject.configField]=value
 }
 
+constABSOLUTE_URL_RE=/^[a-z][a-z\d+.-]*:\/\//i
+
+functionresolveConfiguredProxyDomain(value: unknown): string|undefined{
+if(typeofvalue!=='string')
+return
+
+consttrimmed=value.trim()
+if(!trimmed||(!ABSOLUTE_URL_RE.test(trimmed)&&!trimmed.startsWith('//')))
+return
+
+try{
+returnnewURL(trimmed,'https://nuxt-scripts.local').hostname||undefined
+}
+catch{
+
+}
+}
+
+exportfunctionresolveConfiguredProxyDomains(
+config: Record<string,any>|undefined,
+proxyConfig?: Pick<ProxyConfig,'autoInject'|'configDomainFields'>,
+): string[]{
+if(!config||typeofconfig!=='object')
+return[]
+
+constdomains=newSet<string>()
+constscriptSrc=resolveConfiguredProxyDomain(config.scriptInput?.src)
+if(scriptSrc)
+domains.add(scriptSrc)
+
+if(proxyConfig?.autoInject?.configField){
+constendpointDomain=resolveConfiguredProxyDomain(config[proxyConfig.autoInject.configField])
+if(endpointDomain)
+domains.add(endpointDomain)
+}
+
+for(constfieldofproxyConfig?.configDomainFields||[]){
+constdomain=resolveConfiguredProxyDomain(config[field])
+if(domain)
+domains.add(domain)
+}
+
+return[...domains].sort()
+}
+
 exportinterfaceModuleOptions{
 /**
  * Base path prefix for all script endpoints (proxy and bundled assets).
@@ -714,6 +759,7 @@ export default defineNuxtModule<ModuleOptions>({
 constunmatchedScripts: string[]=[]
 lettotalDomains=0
 constdevtoolsScripts: ProxyDevtoolsScript[]=[]
+constpublicScripts=nuxt.options.runtimeConfig.public?.scriptsasRecord<string,any>|undefined
 
 for(constkeyofregistryKeys){
 constscript=scriptByKey.get(key)
@@ -736,12 +782,22 @@ export default defineNuxtModule<ModuleOptions>({
 // Per-script privacy override from user config (stays on input after normalization)
 constentry=(config.registryasRecord<string,any>)?.[key]
 constinputPrivacy=entry?.[0]?.privacy
+construntimeEntry=publicScripts?.[key]&&typeofpublicScripts[key]==='object'
+ ? publicScripts[key]
+ : undefined
 
 for(constdomainofproxyConfig.domains){
 domainPrivacy[domain]=inputPrivacy??proxyConfig.privacy
 totalDomains++
 }
 
+for(constsourceof[entry?.[0],runtimeEntry]){
+for(constdomainofresolveConfiguredProxyDomains(source,proxyConfig)){
+domainPrivacy[domain]=inputPrivacy??proxyConfig.privacy
+totalDomains++
+}
+}
+
 if(proxyConfig.autoInject&&config.registry)
 applyAutoInject(config.registry,nuxt.options.runtimeConfig,proxyPrefix,key,proxyConfig.autoInject)
 

packages/script/src/registry.ts

@@ -308,6 +308,7 @@ export async function registry(resolve?: (path: string) => Promise<string>): Pro
 proxy: {
 domains: ['va.vercel-scripts.com','vitals.vercel-insights.com'],
 privacy: PRIVACY_IP_ONLY,
+configDomainFields: ['endpoint'],
 },
 }),
 def('posthog',{
@@ -352,6 +353,7 @@ export async function registry(resolve?: (path: string) => Promise<string>): Pro
 proxy: {
 domains: ['cdn.matomo.cloud'],
 privacy: PRIVACY_IP_ONLY,
+configDomainFields: ['matomoUrl','trackerUrl'],
 },
 partytown: {forwards: ['_paq.push']},
 }),
@@ -387,6 +389,7 @@ export async function registry(resolve?: (path: string) => Promise<string>): Pro
 domains: ['cdn.databuddy.cc','basket.databuddy.cc'],
 privacy: PRIVACY_IP_ONLY,
 autoInject: {field: 'apiUrl',target: 'basket.databuddy.cc'},
+configDomainFields: ['scriptUrl'],
 },
 }),
 def('segment',{
@@ -860,6 +863,7 @@ export function buildProxyConfigsFromRegistry(
 domains: proxyDef.domains.map(d=>typeofd==='string' ? d : d.domain),
 privacy: proxyDef.privacy||{ip: false,userAgent: false,language: false,screen: false,timezone: false,hardware: false},
 autoInject: proxyDef.autoInject ? resolveAutoInject(proxyDef.autoInject) : undefined,
+configDomainFields: proxyDef.configDomainFields,
 sdkPatches: proxyDef.sdkPatches,
 }
 }

packages/script/src/runtime/types.ts

@@ -395,6 +395,8 @@ export interface ProxyCapability {
 privacy: import('../runtime/server/utils/privacy').ProxyPrivacyInput
 /** Auto-inject proxy endpoint into the script's SDK config. */
 autoInject?: ProxyAutoInject
+/** Config fields that may contain custom external hosts or endpoints. */
+configDomainFields?: string[]
 /** AST-level SDK patches applied during URL rewriting. */
 sdkPatches?: SdkPatch[]
 }
@@ -540,6 +542,8 @@ export interface ProxyConfig {
 privacy: ProxyPrivacyInput
 /** Auto-inject proxy endpoint config into the script's SDK options (resolved form) */
 autoInject?: ResolvedProxyAutoInject
+/** Config fields that may contain custom external hosts or endpoints. */
+configDomainFields?: string[]
 /** AST-level SDK patches applied during URL rewriting. */
 sdkPatches?: SdkPatch[]
 }

playground/pages/third-parties/umami-analytics.vue

@@ -8,7 +8,7 @@ useHead({
 // Umami Analytics with custom configuration
 const { proxy, status } =useScriptUmamiAnalytics({
  websiteId: 'demo-website-id-123',
- hostUrl: 'https://analytics.example.com', //Optional: custom Umami instance
+ hostUrl: 'https://analytics.example.com', //Self-hosted Umami origin
  autoTrack: true,
  domains: ['localhost', 'example.com'],
  tag: 'playground',
@@ -149,7 +149,7 @@ function trackUserFlow() {
  <li>Auto-tracking enabled for page views</li>
  <li>Domain filtering: localhost, example.com</li>
  <li>Tagged as: playground</li>
- <li>Custom host URL configured</li>
+ <li>Self-hosted Umami origin configured via <code>hostUrl</code></li>
  <li>Privacy-focused (no cookies, no personal data)</li>
  </ul>
  </div>
@@ -276,7 +276,7 @@ function trackUserFlow() {
  </h3>
  <preclass="bg-gray-100 dark:bg-gray-800 p-3 rounded text-xs overflow-x-auto"><code>const { proxy, status } = useScriptUmamiAnalytics({
  websiteId: 'your-website-id',
- hostUrl: 'https://your-umami-instance.com', // optional
+ hostUrl: 'https://your-umami-instance.com', // self-hosted origin
  autoTrack: true,
  domains: ['yourdomain.com'],
  tag: 'environment-tag',
@@ -313,7 +313,7 @@ proxy.identify({ user_id: '123', subscription: 'premium' })</code></pre>
  <li>No personal data collection</li>
  <li>GDPR compliant by design</li>
  <li>Lightweight script (&lt; 2KB)</li>
- <li>Self-hosted option available</li>
+ <li>Self-hosted instances configured with <code>hostUrl</code></li>
  </ul>
  </div>
  </div>

test/unit/first-party.test.ts

@@ -1,5 +1,6 @@
 importtype{RegistryScript}from'../../packages/script/src/runtime/types'
 import{describe,expect,it}from'vitest'
+import{resolveConfiguredProxyDomains}from'../../packages/script/src/module'
 import{buildProxyConfigsFromRegistry,registry}from'../../packages/script/src/registry'
 import{
 anonymizeIP,
@@ -165,6 +166,38 @@ describe('first-party mode', () => {
 expect(configs.metaPixel.autoInject).toBeUndefined()
 expect(configs.clarity.autoInject).toBeUndefined()
 })
+
+it('derives extra allowlist domains for self-hosted Umami',async()=>{
+constconfigs=awaitgetProxyConfigs()
+expect(resolveConfiguredProxyDomains({
+scriptInput: {
+src: 'https://analytics.example.com/script.js',
+},
+},configs.umamiAnalytics)).toEqual(['analytics.example.com'])
+})
+
+it('derives extra allowlist domains for custom Matomo hosts',async()=>{
+constconfigs=awaitgetProxyConfigs()
+expect(resolveConfiguredProxyDomains({
+matomoUrl: 'https://analytics.example.com',
+trackerUrl: 'https://analytics.example.com/matomo.php',
+},configs.matomoAnalytics)).toEqual(['analytics.example.com'])
+})
+
+it('derives extra allowlist domains for self-hosted Vercel Analytics',async()=>{
+constconfigs=awaitgetProxyConfigs()
+expect(resolveConfiguredProxyDomains({
+endpoint: 'https://analytics.example.com/v1/vitals',
+},configs.vercelAnalytics)).toEqual(['analytics.example.com'])
+})
+
+it('derives extra allowlist domains for custom Databuddy script hosts',async()=>{
+constconfigs=awaitgetProxyConfigs()
+expect(resolveConfiguredProxyDomains({
+scriptUrl: 'https://cdn.analytics.example.com/databuddy.js',
+apiUrl: 'https://events.analytics.example.com',
+},configs.databuddyAnalytics)).toEqual(['cdn.analytics.example.com','events.analytics.example.com'])
+})
 })
 
 describe('full chain: capabilities → proxy config → domains',()=>{

test/unit/proxy-configs.test.ts

@@ -340,6 +340,13 @@ describe('proxy configs', () => {
 expect(config?.domains).toContain('plausible.io')
 })
 
+it('returns config domain fields for providers with custom hosts',async()=>{
+constconfigs=awaitgetProxyConfigs()
+expect(configs.matomoAnalytics?.configDomainFields).toEqual(['matomoUrl','trackerUrl'])
+expect(configs.vercelAnalytics?.configDomainFields).toEqual(['endpoint'])
+expect(configs.databuddyAnalytics?.configDomainFields).toEqual(['scriptUrl'])
+})
+
 it('returns proxy config for cloudflareWebAnalytics',async()=>{
 constconfig=(awaitgetProxyConfigs()).cloudflareWebAnalytics
 expect(config).toBeDefined()

test/unit/setup.test.ts

@@ -1,6 +1,6 @@
 importtype{NuxtConfigScriptRegistry}from'../../packages/script/src/runtime/types'
 import{describe,expect,it}from'vitest'
-import{applyAutoInject}from'../../packages/script/src/module'
+import{applyAutoInject,resolveConfiguredProxyDomains}from'../../packages/script/src/module'
 
 describe('applyAutoInject',()=>{
 constposthogAutoInject={
@@ -89,3 +89,63 @@ describe('applyAutoInject', () => {
 expect((registryasany).posthog[0].apiHost).toBe('/_analytics/us.i.posthog.com')
 })
 })
+
+describe('resolveConfiguredProxyDomains',()=>{
+constumamiProxyConfig={
+autoInject: {
+configField: 'hostUrl',
+computeValue: (proxyPrefix: string)=>`${proxyPrefix}/cloud.umami.is`,
+},
+}
+
+it('includes the hostname from a custom scriptInput src',()=>{
+expect(resolveConfiguredProxyDomains({
+scriptInput: {
+src: 'https://analytics.example.com/script.js',
+},
+},umamiProxyConfig)).toEqual(['analytics.example.com'])
+})
+
+it('includes the hostname from an explicit endpoint field',()=>{
+expect(resolveConfiguredProxyDomains({
+hostUrl: 'https://analytics.example.com',
+},umamiProxyConfig)).toEqual(['analytics.example.com'])
+})
+
+it('ignores relative proxy paths injected by the module',()=>{
+expect(resolveConfiguredProxyDomains({
+hostUrl: '/_scripts/p/cloud.umami.is',
+},umamiProxyConfig)).toEqual([])
+})
+
+it('deduplicates equivalent domains',()=>{
+expect(resolveConfiguredProxyDomains({
+hostUrl: 'https://analytics.example.com',
+scriptInput: {
+src: 'https://analytics.example.com/script.js',
+},
+},umamiProxyConfig)).toEqual(['analytics.example.com'])
+})
+
+it('includes additional registry-declared config domain fields',()=>{
+expect(resolveConfiguredProxyDomains({
+trackerUrl: 'https://analytics.example.com/matomo.php',
+matomoUrl: 'https://analytics.example.com',
+},{
+configDomainFields: ['matomoUrl','trackerUrl'],
+})).toEqual(['analytics.example.com'])
+})
+
+it('handles multiple custom hosts across script and endpoint fields',()=>{
+expect(resolveConfiguredProxyDomains({
+scriptUrl: 'https://cdn.analytics.example.com/databuddy.js',
+apiUrl: 'https://events.analytics.example.com',
+},{
+autoInject: {
+configField: 'apiUrl',
+computeValue: (proxyPrefix: string)=>`${proxyPrefix}/basket.databuddy.cc`,
+},
+configDomainFields: ['scriptUrl'],
+})).toEqual(['cdn.analytics.example.com','events.analytics.example.com'])
+})
+})