Install the tracking snippet

<script src="https://cdn.davazmysel.com/t.js" data-site="acct_a1b2c3d4" defer></script>

window.dava.checkConsent()

{
  "name": "dava-proxy",
  "main": "src/index.ts",
  "compatibility_date": "2026-07-18",
  "vars": {
    // Paste the value from Dáva workspace settings → Settings & Integrations → Worker endpoint URL.
    "DAVA_WORKER_URL": "https://dava-worker.YOUR_CF_ACCOUNT.workers.dev",
    // Dáva's public snippet CDN — same URL as the standard script tag.
    "DAVA_SNIPPET_URL": "https://cdn.davazmysel.com/t.js"
  }
}

// Paths this Worker intercepts — change to whatever you prefer.
// Use the same values in the snippet's src attribute and data-endpoint on your pages.
const LISTEN_PATH = "/_dava/listen.js";
const EVENTS_PATH = "/_dava/events";

// This Worker is bound to a DEDICATED subdomain (Cloudflare Custom Domain), not
// your main site — so requests from the real page arrive cross-origin. List every
// real origin your pages are served from.
const ALLOWED_ORIGINS = new Set([
  "https://yourdomain.com",
  "https://www.yourdomain.com",
]);

export interface Env {
  /** Dáva event Worker endpoint — copy from workspace settings → Settings & Integrations. */
  DAVA_WORKER_URL: string;
  /** Dáva snippet CDN. Default: https://cdn.davazmysel.com/t.js */
  DAVA_SNIPPET_URL: string;
}

export default {
  async fetch(request: Request, env: Env): Promise<Response> {
    const url = new URL(request.url);
    const origin = request.headers.get("Origin");

    if (request.method === "OPTIONS") {
      return new Response(null, { status: 204, headers: corsHeaders(origin) });
    }

    if (url.pathname === LISTEN_PATH) {
      return proxySnippet(env);
    }

    if (url.pathname === EVENTS_PATH && request.method === "POST") {
      // The real page hostname (e.g. yourdomain.com) is NOT url.hostname here —
      // this Worker sits on its own dedicated subdomain. Derive it from Origin
      // instead. Not required for account-wide-pixel installs (data_site in the
      // payload bypasses this entirely), kept for defense-in-depth.
      const pageHostname = origin ? new URL(origin).hostname : url.hostname;
      return proxyEvent(request, env, pageHostname, origin);
    }

    // All other paths pass through to your origin unchanged.
    return fetch(request);
  },
} satisfies ExportedHandler<Env>;

function corsHeaders(origin: string | null): HeadersInit {
  if (!origin || !ALLOWED_ORIGINS.has(origin)) return {};
  return {
    "Access-Control-Allow-Origin": origin,
    // Required: the snippet's sendBeacon fallback (clicks, form_submits, and the
    // fetch-failure retry) is ALWAYS credentialed, so the browser demands
    // Allow-Credentials: true on both the preflight and the response — omit it and
    // every beacon-delivered event is silently dropped by CORS. Safe with a
    // specific (non-"*") Allow-Origin, which is exactly what we echo above.
    "Access-Control-Allow-Credentials": "true",
    "Access-Control-Allow-Methods": "POST, OPTIONS",
    "Access-Control-Allow-Headers": "Content-Type",
    "Access-Control-Max-Age": "86400",
    Vary: "Origin",
  };
}

/** 1:1 passthrough of the Dáva snippet from the CDN. No CORS needed — <script src> is not origin-restricted. */
async function proxySnippet(env: Env): Promise<Response> {
  const upstream = await fetch(env.DAVA_SNIPPET_URL);
  return new Response(upstream.body, {
    status: upstream.status,
    headers: upstream.headers,
  });
}

/**
 * Forward a browser event to Dáva's event Worker.
 *
 * X-Forwarded-Host is set for defense-in-depth (non-data_site installs); it is
 * NOT required for the account-wide-pixel (data_site) install used above.
 *
 * User-Agent and X-Forwarded-For MUST be forwarded — Dáva parses
 * device_type/browser/os from User-Agent and truncates client_ip from the
 * first hop of X-Forwarded-For. Without them, Dáva sees this Worker's own
 * outbound fetch() as "the request" and every proxied event silently loses/
 * corrupts those fields (they land as null/null/"desktop" regardless of the
 * real visitor's device — confirmed in production, not a hypothetical).
 *
 * Use X-Forwarded-For, NOT CF-Connecting-IP, to carry the visitor's IP. This
 * Worker → Dáva's Worker is a CROSS-ZONE subrequest (different Cloudflare
 * accounts) — Cloudflare unconditionally overwrites any CF-*-prefixed header
 * on a cross-zone subrequest with its own internal value (anti-spoofing), so
 * setting CF-Connecting-IP here is silently discarded before Dáva ever sees
 * it. Confirmed by tracing a live test event through to Dáva's DB (landed
 * with client_ip_truncated null and country resolved to wherever Cloudflare
 * routed this Worker's own connection to Dáva, not the visitor's, despite
 * this header being set). X-Forwarded-For has no such restriction and
 * survives the hop intact — the same reason Dáva's own Caddy relay (for
 * customer-CNAME installs) uses X-Forwarded-For rather than CF-Connecting-IP.
 */
async function proxyEvent(
  request: Request,
  env: Env,
  pageHostname: string,
  origin: string | null,
): Promise<Response> {
  const forwardHeaders = new Headers({
    "Content-Type": "application/json",
    "X-Forwarded-Host": pageHostname,
  });
  const userAgent = request.headers.get("User-Agent");
  if (userAgent) forwardHeaders.set("User-Agent", userAgent);
  const clientIp = request.headers.get("CF-Connecting-IP");
  if (clientIp) forwardHeaders.set("X-Forwarded-For", clientIp);

  const upstream = await fetch(
    new Request(`${env.DAVA_WORKER_URL}/t/event`, {
      method: "POST",
      headers: forwardHeaders,
      body: request.body,
    }),
  );

  // Dáva's own backend already sets its own CORS headers (echoing Origin, or
  // falling back to "*" since this server-to-server call carries no Origin
  // header). Strip those before applying ours, or the browser sees two
  // conflicting Access-Control-Allow-Origin values and rejects the response
  // outright — a plain object spread does not overwrite same-name headers
  // cleanly, it appends, producing an invalid combined value like
  // "*, https://yourdomain.com".
  const headers = new Headers(upstream.headers);
  headers.delete("Access-Control-Allow-Origin");
  headers.delete("Access-Control-Allow-Credentials");
  headers.delete("Access-Control-Allow-Methods");
  headers.delete("Access-Control-Allow-Headers");
  headers.delete("Vary");
  for (const [key, value] of Object.entries(corsHeaders(origin))) {
    headers.set(key, value as string);
  }
  return new Response(upstream.body, { status: upstream.status, headers });
}