Fix shared link download link (#884)

* Fix shared link download link

* Add test and changelog entry

* Format

CHANGELOG.md

@@ -15,6 +15,7 @@ All notable changes to this project will be documented in this file.
 - Capitalized date/time selection keybinds not working plausible/analytics#709
 - Invisible text on Google Search Console settings page in dark mode plausible/analytics#759
 - Disable analytics tracking when running Cypress tests
+- CSV reports can be downloaded via shared links plausible/analytics#884
 
 ## [1.2] - 2021-01-26
 

assets/js/dashboard/api.js

@@ -41,6 +41,7 @@ export function serializeQuery(query, extraQuery=[]) {
   if (query.from)    { queryObj.from = formatISO(query.from)  }
   if (query.to)      { queryObj.to = formatISO(query.to)  }
   if (query.filters) { queryObj.filters = serializeFilters(query.filters)  }
+  if (SHARED_LINK_AUTH) { queryObj.auth = SHARED_LINK_AUTH }
   Object.assign(queryObj, ...extraQuery)
 
   return '?' + serialize(queryObj)

lib/plausible_web/plugs/authorize_stats_plug.ex

@@ -8,8 +8,8 @@ defmodule PlausibleWeb.AuthorizeStatsPlug do
 
   def call(conn, _opts) do
     site = Repo.get_by(Plausible.Site, domain: conn.params["domain"])
-    shared_link_auth = get_req_header(conn, "x-shared-link-auth") |> List.first()
-    # SHOULD GENERATE A NEW PHOENIX TOKEN WHEN MOUNTING THE STATS
+    shared_link_auth = conn.params["auth"]
+
     shared_link_record =
       shared_link_auth && Repo.get_by(Plausible.Site.SharedLink, slug: shared_link_auth)
 

test/plausible_web/controllers/stats_controller_test.exs

@@ -50,6 +50,19 @@ defmodule PlausibleWeb.StatsControllerTest do
     end
   end
 
+  describe "GET /:website/visitors.csv - via shared link" do
+    test "exports graph as csv", %{conn: conn} do
+      site = insert(:site, domain: "test-site.com")
+      link = insert(:shared_link, site: site)
+
+      today = Timex.today() |> Timex.format!("{ISOdate}")
+
+      conn = get(conn, "/" <> site.domain <> "/visitors.csv?auth=#{link.slug}")
+      assert response(conn, 200) =~ "Date,Visitors"
+      assert response(conn, 200) =~ "#{today},3"
+    end
+  end
+
   describe "GET /share/:slug" do
     test "prompts a password for a password-protected link", %{conn: conn} do
       site = insert(:site)