fix: DSN token precedence — prefer Bearer, parse URL-shaped dsn (fixes #1)

[yzzztech]

Fix: DSN token precedence — prefer Bearer, parse URL-shaped dsn

Fixes #1

Problem

When a client sends the full DSN URL (e.g. http://TOKEN@host:3456/api/ingest/PROJECT_ID) in the JSON body's dsn field — which the official Claude Code hook does — the full URL string shadows the Bearer token. The Prisma lookup fails because it searches for the full URL as if it were a token.

Result: all Claude Code events are silently dropped with 401 Invalid DSN token.

Fix

// Before: dsn || bearerToken
// After:  bearerToken || token_from_url || plain_dsn

let dsnFromUrl: string | undefined;
if (rawDsn?.includes("@")) {
  const match = rawDsn.match(/:\\/\\/([^@]+)@/);
  dsnFromUrl = match?.[1];
}
const dsnToken = bearerToken || dsnFromUrl || rawDsn;

Precedence

1. Bearer header (strongest — explicit auth)
2. Token extracted from DSN URL (http://TOKEN@host/...)
3. Plain DSN token (backward compatible)

Tested

# Full DSN URL → works
DSN="http://TOKEN@localhost:3456/api/ingest/PROJECT"
curl -H "Content-Type: application/json" -d "{\"dsn\":\"$DSN\",\"batch\":[...]}" ...

# Plain token → still works (backward compat)
curl -H "Content-Type: application/json" -d "{\"dsn\":\"TOKEN\",\"batch\":[...]}" ...

# Bearer → still works
curl -H "Authorization: Bearer TOKEN" -H "Content-Type: application/json" -d "{\"batch\":[...]}" ...