feat(analytics): attribute sign-ups and demo requests to their acquisition source

[waleedlatif1]

Summary

• Record the first and last marketing touch (UTM / ref params, ad network that clicked through, referring domain, landing path) in two first-party cookies, written only under measurement consent and only on marketing and sign-in pages. The server reads them in the better-auth account hook and attaches them to user_created and as $set_once person properties, so OAuth sign-ups stop looking like they came from the identity provider
• Cookie values are re-validated and bounded server-side (unknown keys dropped, control and line-separator chars stripped, size-capped under the cookie limit); no full URLs, query strings, or click ids are stored. SameSite=None; Secure so SAML's cross-site POST callback still sees them; cookies are cleared when measurement consent is withdrawn
• Add $pageview on every marketing route, landing_demo_request_submitted (was cataloged but never fired), landing_demo_booked, external_sign_in_started (Google/GitHub/Microsoft/SSO), and email_type (work/personal) on identify
• Add useCaptureWhenReady: view events captured in a mount effect were dropped on hard loads because PostHogProvider publishes the client after consent resolves. Moved landing, signup/login, settings tab, table opened, and knowledge base opened events onto it
• Collapse the three social sign-in handlers into one startSocialSignIn wrapper; share campaign param lists with the Google tag context
• Include attribution in the demo-request sales notification email; list the new cookies in the cookie policy

Type of Change

• New feature

Testing

• lib/analytics/attribution.test.ts: each guard (intermediary/IdP referrers, auth-path referrals, customer-owned pages, own-site referrals, first-touch immutability and repair, click-id redaction, size and line-separator bounding, tampered cookies) verified red with the guard removed, green restored
• Root bun run test (all workspaces + scripts), bun run lint, bun run type-check, bun run check:audits, docs-manifest:check, block registry check against origin/staging
• Not yet exercised against a live consent banner + Google OAuth round trip; verify on staging: land with ?utm_source=test, accept analytics, sign up, confirm first_touch_utm_source on user_created

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 8, 2026 11:34pm UTC

[cubic-dev-ai]

2 issues found across 31 files

Confidence score: 3/5

• In attribution-cookie-guard.tsx, signup can proceed while consent is unresolved, so the server-side auth hook may use attribution cookies before the guard clears stale ones. Gate server attribution on consent or block signup until the guard clears them.
• In social-sign-in.ts, OAuth can navigate away before PostHog publishes its consented client, dropping the start event. Make capture readiness-aware before navigating.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/lib/auth/social-sign-in.ts">

<violation number="1" location="apps/sim/lib/auth/social-sign-in.ts:27">
P3: `captureClientEvent` drops this event until PostHog publishes its consented client, but the OAuth flow immediately navigates away. Make the start capture readiness-aware before navigating, without capturing before measurement consent.</violation>
</file>

<file name="apps/sim/app/_shell/consent/attribution-cookie-guard.tsx">

<violation number="1" location="apps/sim/app/_shell/consent/attribution-cookie-guard.tsx:17">
P2: The auth hook reads these cookies server-side, but signup remains usable while consent is unresolved. Gate server attribution on consent or block signup until this guard clears stale cookies.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The latest changes appear safe to merge, with no new actionable issue found.

Summary

This PR records first and last acquisition sources in consent-gated cookies and adds them to sign-up analytics and demo-request emails. It also waits for PostHog before sending view events.

• The latest changes cap cookie lifetimes at the stored consent expiry.
• Stored landing paths lose queries and fragments; referring domains must be bare hostnames.
• All social provider buttons stay disabled while a sign-in request is pending.
• The three previous, unnumbered findings are addressed. No new actionable issue or repository-rule violation was established.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Visit[Marketing or sign-in visit] --> Consent{Measurement allowed?}
  Consent -->|Yes| Cookies[Bounded first and last touch cookies]
  Cookies --> Expiry[Expire within stored consent grant]
  Cookies --> Signup[Account creation]
  Cookies --> Demo[Demo request]
  Signup --> Analytics[Sign-up event and person properties]
  Demo --> Email[Sales notification]
  Consent -->|No| Clear[Clear attribution cookies]

Loading

_{Reviews (2) · Last reviewed commit: "fix(analytics): cap attribution cookies ..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 32 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}