fix(analytics): accept beacon download tracking payloads (v1.1.1)

Co-authored-by: Cursor <cursoragent@cursor.com>

test/adminApi.test.mjs

@@ -19,10 +19,10 @@ function listen(server) {
   });
 }
 
-function request(port, method, pathname, { token, body, origin } = {}) {
+function request(port, method, pathname, { token, body, origin, headers: extraHeaders, rawBody } = {}) {
   return new Promise((resolve, reject) => {
-    const headers = {};
-    if (body) headers['Content-Type'] = 'application/json';
+    const headers = { ...extraHeaders };
+    if (body && !headers['Content-Type']) headers['Content-Type'] = 'application/json';
     if (token) headers.Authorization = `Bearer ${token}`;
     if (origin) headers.Origin = origin;
     const req = http.request(
@@ -41,7 +41,8 @@ function request(port, method, pathname, { token, body, origin } = {}) {
       },
     );
     req.on('error', reject);
-    if (body) req.write(JSON.stringify(body));
+    if (rawBody !== undefined) req.write(rawBody);
+    else if (body) req.write(JSON.stringify(body));
     req.end();
   });
 }
@@ -386,6 +387,46 @@ void test('OPTIONS /v1/track/download rejects unknown origin', async () => {
   }
 });
 
+void test('POST /v1/track/download accepts text/plain beacon body', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
+
+  const { server } = await makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const res = await request(port, 'POST', '/v1/track/download', {
+      rawBody: JSON.stringify({ platform: 'linux' }),
+      origin: 'https://ttrpgplayer.ru',
+      headers: { 'Content-Type': 'text/plain;charset=UTF-8' },
+    });
+    assert.equal(res.status, 200);
+    assert.equal(res.body.platform, 'linux');
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+void test('OPTIONS /v1/track/download allows localhost:5174', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
+
+  const { server } = await makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const res = await request(port, 'OPTIONS', '/v1/track/download', {
+      origin: 'http://localhost:5174',
+    });
+    assert.equal(res.status, 204);
+    assert.equal(res.headers['access-control-allow-origin'], 'http://localhost:5174');
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
 void test('admin endpoints reject missing token', async () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
   const dataPath = path.join(tmp, 'data.json');