tracking and nav

api/models/user_activity.py

@@ -22,44 +22,101 @@ def _ensure_indexes():
 _ensure_indexes()
 
 
-def ping_user(user_id, username, avatar, page_url, page_title=""):
-    """Record or update a user's presence on the site."""
+def ping_user(user_id, username, avatar, page_url, page_title="", anonymous_id=None, ip_address=None):
+    """Record or update a user's presence on the site.
+
+    For authenticated users:
+      - keyed by user_id (MongoDB ObjectId str)
+      - shows their username & avatar
+
+    For anonymous visitors:
+      - keyed by anonymous_id (client-generated UUID stored in localStorage)
+      - deduplicated by ip_address if anonymous_id not provided
+      - shows "Guest" in the activity feed
+    """
     now = datetime.now(timezone.utc)
+
+    if user_id and username:
+        # Authenticated user
+        filter_key = {"user_id": str(user_id)}
+        display_name = username
+    elif anonymous_id:
+        # Anonymous user with client ID
+        filter_key = {"anonymous_id": anonymous_id}
+        display_name = "Guest"
+    elif ip_address:
+        # Anonymous user identified by IP (fallback)
+        filter_key = {"ip_address": ip_address, "user_id": {"$exists": False}}
+        display_name = "Guest"
+    else:
+        return False
+
+    doc = {
+        "last_seen": now,
+        "page_url": page_url,
+        "page_title": page_title,
+    }
+
+    if user_id and username:
+        doc["user_id"] = str(user_id)
+        doc["username"] = username
+        doc["avatar"] = avatar or ""
+        # Remove any anonymous fields if user later logs in
+        activity_collection.update_many(
+            {"ip_address": ip_address, "user_id": {"$exists": False}},
+            {"$set": {"user_id": str(user_id), "username": username, "avatar": avatar or ""}}
+        )
+    else:
+        doc["is_anonymous"] = True
+        doc["username"] = "Guest"
+        doc["avatar"] = ""
+        if anonymous_id:
+            doc["anonymous_id"] = anonymous_id
+        if ip_address:
+            doc["ip_address"] = ip_address
+
     activity_collection.update_one(
-        {"user_id": str(user_id)},
-        {"$set": {
-            "user_id": str(user_id),
-            "username": username,
-            "avatar": avatar or "",
-            "page_url": page_url,
-            "page_title": page_title,
-            "last_seen": now,
-        },
-         "$setOnInsert": {
-            "first_seen": now,
-        }},
+        filter_key,
+        {"$set": doc, "$setOnInsert": {"first_seen": now}},
         upsert=True
     )
     return True
 
 
 def get_active_users(minutes=5):
-    """Get users active within the last N minutes."""
+    """Get users active within the last N minutes.
+    Returns: list of dicts with user info including is_anonymous flag.
+    """
     cutoff = datetime.now(timezone.utc) - timedelta(minutes=minutes)
     cursor = activity_collection.find(
         {"last_seen": {"$gte": cutoff}}
     ).sort("last_seen", DESCENDING)
-    
+
+    seen_ids = set()
     users = []
     for doc in cursor:
+        # Deduplicate: prefer authenticated version over anonymous
+        uid = doc.get("user_id") or doc.get("anonymous_id") or doc.get("ip_address") or ""
+        if uid in seen_ids:
+            continue
+        seen_ids.add(uid)
+
+        is_anon = doc.get("is_anonymous", False) or not doc.get("user_id")
+        display_name = doc.get("username", "Guest")
+        # Differentiate anonymous guests with a short ID suffix
+        if is_anon and doc.get("anonymous_id"):
+            short_id = str(doc["anonymous_id"])[-5:]
+            display_name = f"Guest_{short_id}"
+
         users.append({
             "user_id": doc.get("user_id", ""),
-            "username": doc.get("username", "Unknown"),
+            "username": display_name,
             "avatar": doc.get("avatar", ""),
             "page_url": doc.get("page_url", ""),
             "page_title": doc.get("page_title", ""),
             "last_seen": doc["last_seen"].isoformat() if doc.get("last_seen") else None,
             "first_seen": doc["first_seen"].isoformat() if doc.get("first_seen") else None,
+            "is_anonymous": is_anon,
         })
     return users
 
@@ -70,4 +127,3 @@ def get_active_user_count(minutes=5):
     return activity_collection.count_documents({"last_seen": {"$gte": cutoff}})
 
 
-

api/routes/shared/bug_reports_api.py

@@ -296,21 +296,40 @@ def remove_announcement(announcement_id):
 
 @bug_reports_api_bp.route("/activity/ping", methods=["POST"])
 def user_heartbeat():
-    """POST /api/activity/ping — record user activity (public, requires auth)."""
-    if "username" not in session or "_id" not in session:
-        return jsonify({"success": False, "message": "Login required"}), 401
-
+    """POST /api/activity/ping — record user activity.
+    Works for both logged-in and anonymous visitors.
+    """
     data = request.get_json() or {}
     page_url = data.get("page_url", request.referrer or "/")
     page_title = data.get("page_title", "")
+    anonymous_id = data.get("anonymous_id")
+    ip_address = request.remote_addr or ""
+
+    if "username" in session and "_id" in session:
+        # Logged-in user
+        ping_user(
+            user_id=str(session["_id"]),
+            username=session["username"],
+            avatar=session.get("avatar", ""),
+            page_url=page_url,
+            page_title=page_title,
+            ip_address=ip_address,
+        )
+    elif anonymous_id:
+        # Anonymous visitor with client ID
+        ping_user(
+            user_id=None,
+            username=None,
+            avatar=None,
+            page_url=page_url,
+            page_title=page_title,
+            anonymous_id=anonymous_id,
+            ip_address=ip_address,
+        )
+    else:
+        # Anonymous without ID — skip silently
+        return jsonify({"success": False, "message": "No identifier"}), 200
 
-    ping_user(
-        user_id=session["_id"],
-        username=session["username"],
-        avatar=session.get("avatar", ""),
-        page_url=page_url,
-        page_title=page_title,
-    )
     return jsonify({"success": True})
 
 

api/templates/shared/admin_announcements.html

@@ -344,8 +344,11 @@
 </style>
 {% endblock %}
 
-{% block content %}
-<div class="aa-page">
+{% block content %}    <div class="aa-page">
+    <a href="/admin" style="display:inline-flex;align-items:center;gap:5px;font-size:0.78rem;color:#555;text-decoration:none;margin-bottom:14px;transition:color 0.2s;" onmouseover="this.style.color='#fff'" onmouseout="this.style.color='#555'">
+        <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="15 18 9 12 15 6"/></svg>
+        Back to Dashboard
+    </a>
     <div class="aa-header">
         <h1>
             <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="color: var(--aa-warning);">

api/templates/shared/admin_bug_reports.html

@@ -482,8 +482,11 @@
 </style>
 {% endblock %}
 
-{% block content %}
-<div class="abg-page">
+{% block content %}    <div class="abg-page">
+    <a href="/admin" style="display:inline-flex;align-items:center;gap:5px;font-size:0.78rem;color:#555;text-decoration:none;margin-bottom:14px;transition:color 0.2s;" onmouseover="this.style.color='#fff'" onmouseout="this.style.color='#555'">
+        <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="15 18 9 12 15 6"/></svg>
+        Back to Dashboard
+    </a>
     <div class="abg-header">
         <h1>
             <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="color: var(--abg-error);">

api/templates/shared/admin_dashboard.html

@@ -635,18 +635,32 @@
                 activityList.innerHTML = '<div class="ad-empty">No users currently active.</div>';
             } else {
                 activityList.innerHTML = activeUsers.map(u => {
-                    const initial = (u.username || '?')[0].toUpperCase();
-                    const avatar = u.avatar
-                        ? `<img class="ad-activity-avatar" src="${u.avatar}" alt="${u.username}" onerror="this.style.display='none'">`
-                        : `<div class="ad-activity-avatar-placeholder">${initial}</div>`;
-                    const pageLabel = u.page_title || getPageLabel(u.page_url);
-                    const timeLabel = timeAgo(u.last_seen);
+                    var isGuest = u.is_anonymous === true;
+                    var initial = (u.username || '?')[0].toUpperCase();
+                    var avatarHtml;
+                    if (isGuest) {
+                        avatarHtml = `<div class="ad-activity-avatar-placeholder" style="background:#1a1a2e;color:#888;">
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                <path d="M17 21v-2a4 4 0 0 0-4-4H5a4 4 0 0 0-4 4v2"></path>
+                                <circle cx="9" cy="7" r="4"></circle>
+                            </svg>
+                        </div>`;
+                    } else if (u.avatar) {
+                        avatarHtml = `<img class="ad-activity-avatar" src="${u.avatar}" alt="${u.username}" onerror="this.style.display='none'">`;
+                    } else {
+                        avatarHtml = `<div class="ad-activity-avatar-placeholder">${initial}</div>`;
+                    }
+                    var usernameHtml = isGuest
+                        ? `<span style="color:#666;">${u.username}</span>`
+                        : `<span>${u.username}</span>`;
+                    var pageLabel = u.page_title || getPageLabel(u.page_url);
+                    var timeLabel = timeAgo(u.last_seen);
 
                     return `
                         <div class="ad-activity-item">
-                            ${avatar}
+                            ${avatarHtml}
                             <div class="ad-activity-info">
-                                <div class="ad-activity-username">${u.username}</div>
+                                <div class="ad-activity-username">${usernameHtml}</div>
                                 <div class="ad-activity-page" title="${u.page_url || ''}">📍 ${pageLabel}</div>
                             </div>
                             <div class="ad-activity-time">${timeLabel}</div>

api/templates/shared/base.html

@@ -1061,21 +1061,38 @@
     <script src="{{ url_for('static', filename='js/search.js') }}"></script>
     <script src="{{ url_for('static', filename='js/notifications.js') }}"></script>
 
-    <!-- User Activity Heartbeat -->
-    {% if session.get('username') %}
+    <!-- User Activity Heartbeat (tracks ALL visitors — logged-in + anonymous) -->
     <script>
     (function() {
+        // Get or create anonymous visitor ID
+        var ANON_KEY = '_ac_anon_id';
+        var anonymousId = null;
+        try {
+            anonymousId = localStorage.getItem(ANON_KEY);
+            if (!anonymousId) {
+                anonymousId = 'anon_' + Date.now() + '_' + Math.random().toString(36).substring(2, 10);
+                localStorage.setItem(ANON_KEY, anonymousId);
+            }
+        } catch (e) {
+            anonymousId = 'anon_' + Date.now();
+        }
+
         var heartbeatInterval = 30000; // 30 seconds
 
         function sendHeartbeat() {
             var pageUrl = window.location.pathname + window.location.search;
             var pageTitle = document.title;
 
-            var payload = JSON.stringify({ page_url: pageUrl, page_title: pageTitle });
+            var payload = JSON.stringify({
+                page_url: pageUrl,
+                page_title: pageTitle,
+                anonymous_id: anonymousId
+            });
 
-            // Use sendBeacon for reliability on page unload, fallback to fetch
+            // Use sendBeacon for unload reliability, fallback to fetch
             if (navigator.sendBeacon) {
                 try {
+                    // Must use a Blob with explicit content-type so Flask parses it as JSON
                     var blob = new Blob([payload], { type: 'application/json' });
                     navigator.sendBeacon('/api/activity/ping', blob);
                 } catch (e) {
@@ -1083,6 +1100,7 @@
                         method: 'POST',
                         headers: { 'Content-Type': 'application/json' },
                         body: payload,
+                        credentials: 'same-origin',
                         keepalive: true
                     }).catch(function(){});
                 }
@@ -1090,18 +1108,20 @@
                 fetch('/api/activity/ping', {
                     method: 'POST',
                     headers: { 'Content-Type': 'application/json' },
-                    body: payload
+                    body: payload,
+                    credentials: 'same-origin',
+                    keepalive: true
                 }).catch(function(){});
             }
         }
 
-        // Send immediately on page load
-        sendHeartbeat();
+        // Send immediately on page load (with slight delay to not block rendering)
+        setTimeout(sendHeartbeat, 500);
 
         // Send periodically
         setInterval(sendHeartbeat, heartbeatInterval);
 
-        // Send heartbeat when user leaves the page (visibility + beacon for reliability)
+        // Send heartbeat when user leaves the page
         window.addEventListener('visibilitychange', function() {
             if (document.visibilityState === 'hidden') {
                 sendHeartbeat();
@@ -1109,7 +1129,6 @@
         });
     })();
     </script>
-    {% endif %}
 
     <!-- Announcement Popup Script -->
     <script>