fix(analytics): track CardView events on direct card route (closes #495)

[Ridanshi]

Problem

Direct card views via GET /api/u/card/:cardId were silently bypassing analytics. The getCardById service function returned card data without creating a CardView record, and the route handler performed no JWT verification — so even authenticated viewers left no analytics trail. This made share-link access invisible to card owners.

Root Cause

Two gaps in the existing implementation:

1. publicService.getCardById accepted no viewer context and created no CardView
2. The /card/:cardId route did not attempt soft JWT authentication, so viewerId was never available even if the service could have used it

The two other public card access paths (/:username and /:username/card/:cardId) both performed soft auth and recorded views — only the direct-card path was missing this.

Fix

apps/backend/src/services/publicService.ts

• Extended getCardById(app, cardId, viewerId, request) to accept viewer context
• Creates a CardView when viewerId is present and is not the card owner, matching the contract of getUserCard
• Source defaults to "link" (consistent with profile views from share links); overridable via ?source= query param

apps/backend/src/routes/public.ts

• Added soft JWT verification block to /card/:cardId handler (same try/catch pattern as /:username and /:username/card/:cardId)
• Passes extracted viewerId and request to getCardById

Tests

Six new tests added to src/__tests__/public.test.ts covering the direct card route:

Test	Assertion
Returns 200 with correct card shape	Response includes id, title, owner, links
404 when card not found	{ error: "Card not found" }
Records CardView for authenticated non-owner	cardView.create called with correct ownerId, cardId, viewerId
No CardView for anonymous request	cardView.create not called
No CardView when viewer is the owner	Self-views excluded, cardView.create not called
Default source is "link"	source: "link" in created record
Custom source from query param	?source=web propagates to CardView

Full suite results: 213 passing, 1 failing (pre-existing analytics mock failure on main, unrelated to this change).

Analytics Integrity

• No double-counting: CardView records are append-only; the direct-card path previously created zero records, so adding one per authenticated non-owner visit is strictly additive
• Owner self-view exclusion (viewerId !== card.user.id) is consistent across all three tracked paths
• Anonymous traffic remains untracked, matching the existing behaviour on profile and QR card routes

[vercel]

@Ridanshi is attempting to deploy a commit to the Prashantkumar Khatri's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Hi @Ridanshi,

Thanks for opening this pull request.

This PR has been automatically classified based on the files modified.

Applied Labels

• gssoc:approved
• backend

Primary Review Area

• backend

Reviewer

@Harxhit has been identified as the primary reviewer for this pull request.

If you have any questions regarding the affected area or implementation details, feel free to reach out to the assigned reviewer.

Thank you for your contribution!

[github-actions]

CI — Checks Failed

Backend — FAIL

Check	Result
Lint	FAIL
Test	PASS
Typecheck	FAIL

Mobile — SKIP

Check	Result
Lint	-
Test	-

Web — SKIP

Check	Result
Build	-

---

Last updated: Sun, 21 Jun 2026 07:25:26 GMT