feat: admin Dashboard with analytics overview#327
Conversation
Adds a new Dashboard page to the weDocs admin (route #/dashboard + submenu): - Stat cards: total docs, articles, total views, helpful rate - Popular Docs (by views) and Most Helpful Docs (net-positive only) - Recently Updated table - A Pro slot rendered via the wedocs_dashboard_pro_section filter (hidden when Pro is inactive) Backend (includes/Analytics.php): - Lightweight per-doc view counter (wedocs_views meta) on single doc views, deduped 6h per visitor, skips users who can edit the doc - REST GET /wp/v2/docs/dashboard-stats with aggregated counts, views, helpful votes, popular/most-helpful/recent lists
|
Warning Review limit reached
Next review available in: 39 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
WalkthroughAdds server-side document view tracking and aggregated dashboard statistics through a REST endpoint. A new React dashboard fetches and displays those statistics, with admin submenu and hash-router integration plus a Pro analytics extension slot. ChangesAnalytics Dashboard Feature
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@includes/Analytics.php`:
- Around line 162-173: The helpful totals in Analytics::get_helpful_totals() are
counting all docs regardless of status, which makes them inconsistent with the
rest of the published-only dashboard metrics. Update the positive and negative
aggregate queries to join the same published-doc filter used by the other
analytics queries, so they only sum meta for docs where the post status is
published. Keep the change scoped to the existing positive/negative queries in
includes/Analytics.php.
- Around line 72-73: The view counter update in Analytics::incrementViews is not
atomic, so concurrent requests can overwrite each other and lose increments.
Update the logic around get_post_meta and update_post_meta to use an atomic
increment strategy (for example, a single SQL-level update or a
lock/compare-and-swap flow) so each view is counted once even under simultaneous
first-time hits.
- Around line 48-65: The bot exclusion promised in the docs view counter is
missing, so crawlers can still increment wedocs_views in maybe_count_view(). Add
a bot-detection guard in Analytics::maybe_count_view() before the view is
counted, alongside the existing singular/preview/feed and edit-cap checks, and
make sure it returns early for known crawler traffic before the de-dupe and
increment logic runs.
- Around line 64-66: The visitor fingerprint used in Analytics.php is built with
plain MD5 from IP and user agent, which should be replaced with a salted HMAC
for the transient key. Update the logic in the visitor-key generation path (the
get_visitor_ip() / user-agent hashing block that builds $visitor and $key) to
derive the fingerprint with a secret application salt or keyed HMAC while
preserving the same de-duplication behavior. Keep the key format in the same
place where the transient name is assembled, but ensure the identifier is no
longer a reusable raw hash of IP + user agent.
In `@src/components/Dashboard/index.js`:
- Around line 232-245: The icon-only action links in Dashboard/index.js use only
title attributes, so they may be announced as unlabeled links; update the two
anchor elements in the doc action area (the Edit and View links) to include
accessible names via aria-label or hidden sr-only text while keeping the
existing PencilSquareIcon and link behavior unchanged.
🪄 Autofix (Beta)
❌ Autofix failed (check again to retry)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 3eb65775-e717-43f8-bc19-ce6ca5fc6a6e
📒 Files selected for processing (7)
includes/Admin/Menu.phpincludes/Analytics.phpsrc/components/App.jssrc/components/Dashboard/ProAnalytics.jssrc/components/Dashboard/StatCard.jssrc/components/Dashboard/index.jswedocs.php
| $user_agent = isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : ''; | ||
| $visitor = md5( $this->get_visitor_ip() . $user_agent ); | ||
| $key = 'wedocs_view_' . $post_id . '_' . $visitor; |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the target file and nearby usage.
git ls-files includes/Analytics.php
wc -l includes/Analytics.php
cat -n includes/Analytics.php | sed -n '1,180p'
# Find related visitor-key/transient usage.
rg -n "get_visitor_ip|HTTP_USER_AGENT|md5\\(|hash_hmac|wedocs_view_" includesRepository: weDevsOfficial/wedocs-plugin
Length of output: 8403
Use a salted HMAC for the transient key. The current key hashes IP + user agent with plain MD5, which is deterministic and easier to correlate if the options table is exposed; a keyed HMAC keeps the same de-dupe behavior without exposing a reusable visitor fingerprint.
🧰 Tools
🪛 ast-grep (0.44.0)
[error] 64-64: Do not use a weak hash algorithm
Context: md5( $this->get_visitor_ip() . $user_agent )
Note: [CWE-328] Use of Weak Hash.
(weak-hash-algorithm)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@includes/Analytics.php` around lines 64 - 66, The visitor fingerprint used in
Analytics.php is built with plain MD5 from IP and user agent, which should be
replaced with a salted HMAC for the transient key. Update the logic in the
visitor-key generation path (the get_visitor_ip() / user-agent hashing block
that builds $visitor and $key) to derive the fingerprint with a secret
application salt or keyed HMAC while preserving the same de-duplication
behavior. Keep the key format in the same place where the transient name is
assembled, but ensure the identifier is no longer a reusable raw hash of IP +
user agent.
Source: Linters/SAST tools
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. An unexpected error occurred while generating fixes: Not Found - https://docs.github.com/rest/git/refs#get-a-reference |
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
2 participants
Admin Dashboard (free)
New Dashboard page in the weDocs admin (
#/dashboard+ submenu), in the weDocs React idiom.includes/Analytics.php: per-doc view counter (wedocs_viewsmeta, deduped 6h, skips editors) + RESTGET /wp/v2/docs/dashboard-statswedocs_dashboard_pro_sectionfilter (hidden when Pro inactive)Pairs with the Pro PR in
wedocs-pro(Advanced Analytics section).Ref: weDevsOfficial/wedocs-pro#340
Summary by CodeRabbit