aggressive data collection :PP

server.cjs

@@ -385,6 +385,43 @@ function sanitizePath(value) {
   return raw
 }
 
+function headerValue(req, name, maxLength = 200) {
+  const value = req.headers[name]
+  if (Array.isArray(value)) return sanitizeText(value.join(', '), maxLength)
+  return sanitizeText(value, maxLength)
+}
+
+function analyticsMetadata(req, payload) {
+  const metadata = payload.metadata && typeof payload.metadata === 'object' ? payload.metadata : {}
+  const preferences = metadata.preferences && typeof metadata.preferences === 'object'
+    ? metadata.preferences
+    : {}
+
+  if (!preferences.diagnostics) return metadata
+
+  return {
+    ...metadata,
+    request: {
+      http_version: req.httpVersion || '',
+      method: req.method || '',
+      url_path: sanitizePath(req.url?.split('?')[0] || ''),
+      protocol: headerValue(req, 'x-forwarded-proto', 40) || (req.socket.encrypted ? 'https' : 'http'),
+      host: headerValue(req, 'x-forwarded-host', 160) || headerValue(req, 'host', 160),
+      content_type: headerValue(req, 'content-type', 120),
+      content_length: headerValue(req, 'content-length', 40),
+      accept: headerValue(req, 'accept', 300),
+      accept_encoding: headerValue(req, 'accept-encoding', 160),
+      accept_language: preferences.locale ? headerValue(req, 'accept-language', 200) : '',
+      sec_fetch_site: headerValue(req, 'sec-fetch-site', 40),
+      sec_fetch_mode: headerValue(req, 'sec-fetch-mode', 40),
+      sec_fetch_dest: headerValue(req, 'sec-fetch-dest', 40),
+      forwarded_port: headerValue(req, 'x-forwarded-port', 20),
+      forwarded_host_present: Boolean(req.headers['x-forwarded-host']),
+      forwarded_proto_present: Boolean(req.headers['x-forwarded-proto']),
+    },
+  }
+}
+
 function parseClient(userAgent = '') {
   const ua = String(userAgent)
   let browser = 'Unknown'
@@ -475,7 +512,7 @@ function recordViewerEvent(req, payload) {
     language: sanitizeText(payload.language, 40),
     timezone: sanitizeText(payload.timezone, 80),
     consent: payload.consent === 'analytics' ? 'analytics' : '',
-    metadata: JSON.stringify(payload.metadata && typeof payload.metadata === 'object' ? payload.metadata : {}),
+    metadata: JSON.stringify(analyticsMetadata(req, payload)),
   }
 
   if (event.consent !== 'analytics') {