feat(telemetry include referralSource in identify and clear cookie for Vercel integration

Add optional referralSource handling across auth flows and telemetry to record
where new users originate. Extend telemetry.user.identify to accept
referralSource and consolidate identify properties into a single object
before sending to PostHog. Invoke this when users sign in via GitHub or
magic link: read referralSource cookie, attach it for users created within
the last 30 seconds (treating them as new users), and clear the cookie
after use.

This improves attribution for signups by capturing and sending referral
information for new users while ensuring the referral cookie is removed
after consumption.

Author: 0ski

apps/webapp/app/routes/auth.github.callback.tsx

@@ -5,6 +5,8 @@ import { getSession, redirectWithErrorMessage } from "~/models/message.server";
 import { authenticator } from "~/services/auth.server";
 import { setLastAuthMethodHeader } from "~/services/lastAuthMethod.server";
 import { commitSession } from "~/services/sessionStorage.server";
+import { getReferralSource, clearReferralSourceCookie } from "~/services/referralSource.server";
+import { telemetry } from "~/services/telemetry.server";
 import { redirectCookie } from "./auth.github";
 import { sanitizeRedirectPath } from "~/utils";
 
@@ -56,5 +58,28 @@ export let loader: LoaderFunction = async ({ request }) => {
   headers.append("Set-Cookie", await commitSession(session));
   headers.append("Set-Cookie", await setLastAuthMethodHeader("github"));
 
+  // Read referral source cookie and set in PostHog if present (only for new users), then clear it
+  const referralSource = await getReferralSource(request);
+  if (referralSource) {
+    const user = await prisma.user.findUnique({
+      where: { id: auth.userId },
+    });
+    if (user) {
+      // Only set referralSource for new users (created within the last 30 seconds)
+      const userAge = Date.now() - user.createdAt.getTime();
+      const isNewUser = userAge < 30 * 1000; // 30 seconds
+      
+      if (isNewUser) {
+        telemetry.user.identify({
+          user,
+          isNewUser: true,
+          referralSource,
+        });
+      }
+    }
+    // Clear the cookie after using it (regardless of whether we set it)
+    headers.append("Set-Cookie", await clearReferralSourceCookie());
+  }
+
   return redirect(redirectTo, { headers });
 };

apps/webapp/app/routes/auth.google.callback.tsx

@@ -5,6 +5,8 @@ import { getSession, redirectWithErrorMessage } from "~/models/message.server";
 import { authenticator } from "~/services/auth.server";
 import { setLastAuthMethodHeader } from "~/services/lastAuthMethod.server";
 import { commitSession } from "~/services/sessionStorage.server";
+import { getReferralSource, clearReferralSourceCookie } from "~/services/referralSource.server";
+import { telemetry } from "~/services/telemetry.server";
 import { redirectCookie } from "./auth.google";
 import { sanitizeRedirectPath } from "~/utils";
 
@@ -56,6 +58,29 @@ export let loader: LoaderFunction = async ({ request }) => {
   headers.append("Set-Cookie", await commitSession(session));
   headers.append("Set-Cookie", await setLastAuthMethodHeader("google"));
 
+  // Read referral source cookie and set in PostHog if present (only for new users), then clear it
+  const referralSource = await getReferralSource(request);
+  if (referralSource) {
+    const user = await prisma.user.findUnique({
+      where: { id: auth.userId },
+    });
+    if (user) {
+      // Only set referralSource for new users (created within the last 30 seconds)
+      const userAge = Date.now() - user.createdAt.getTime();
+      const isNewUser = userAge < 30 * 1000; // 30 seconds
+      
+      if (isNewUser) {
+        telemetry.user.identify({
+          user,
+          isNewUser: true,
+          referralSource,
+        });
+      }
+    }
+    // Clear the cookie after using it (regardless of whether we set it)
+    headers.append("Set-Cookie", await clearReferralSourceCookie());
+  }
+
   return redirect(redirectTo, { headers });
 };
 

apps/webapp/app/routes/callback.vercel.ts

@@ -6,7 +6,8 @@ import { env } from "~/env.server";
 import { redirectWithErrorMessage } from "~/models/message.server";
 import { VercelIntegrationRepository } from "~/models/vercelIntegration.server";
 import { logger } from "~/services/logger.server";
-import { requireUserId } from "~/services/session.server";
+import { getUserId, requireUserId } from "~/services/session.server";
+import { setReferralSourceCookie } from "~/services/referralSource.server";
 import { requestUrl } from "~/utils/requestUrl.server";
 import { v3ProjectSettingsPath } from "~/utils/pathBuilder";
 import { validateVercelOAuthState } from "~/v3/vercel/vercelOAuthState.server";
@@ -56,7 +57,23 @@ export async function loader({ request }: LoaderFunctionArgs) {
     return new Response("Method Not Allowed", { status: 405 });
   }
 
-  const userId = await requireUserId(request);
+  // Check if user is authenticated
+  const userId = await getUserId(request);
+  
+  // If not authenticated, set referral source cookie and redirect to login
+  if (!userId) {
+    const currentUrl = new URL(request.url);
+    const redirectTo = `${currentUrl.pathname}${currentUrl.search}`;
+    const referralCookie = await setReferralSourceCookie("vercel");
+    
+    const headers = new Headers();
+    headers.append("Set-Cookie", referralCookie);
+    
+    throw redirect(`/login?redirectTo=${encodeURIComponent(redirectTo)}`, { headers });
+  }
+
+  // User is authenticated, proceed with OAuth callback
+  const authenticatedUserId = await requireUserId(request);
 
   const url = requestUrl(request);
   const parsedParams = VercelCallbackSchema.safeParse(Object.fromEntries(url.searchParams));
@@ -107,7 +124,7 @@ export async function loader({ request }: LoaderFunctionArgs) {
       organization: {
         members: {
           some: {
-            userId,
+            userId: authenticatedUserId,
           },
         },
       },
@@ -120,7 +137,7 @@ export async function loader({ request }: LoaderFunctionArgs) {
   if (!project) {
     logger.error("Project not found or user does not have access", {
       projectId: stateData.projectId,
-      userId,
+      userId: authenticatedUserId,
     });
     throw new Response("Project not found", { status: 404 });
   }

apps/webapp/app/routes/login.mfa/route.tsx

@@ -26,6 +26,9 @@ import { MultiFactorAuthenticationService } from "~/services/mfa/multiFactorAuth
 import { redirectWithErrorMessage, redirectBackWithErrorMessage } from "~/models/message.server";
 import { ServiceValidationError } from "~/v3/services/baseService.server";
 import { checkMfaRateLimit, MfaRateLimitError } from "~/services/mfa/mfaRateLimiter.server";
+import { getReferralSource, clearReferralSourceCookie } from "~/services/referralSource.server";
+import { telemetry } from "~/services/telemetry.server";
+import { prisma } from "~/db.server";
 
 export const meta: MetaFunction = ({ matches }) => {
   const parentMeta = matches
@@ -160,11 +163,33 @@ async function completeLogin(request: Request, session: Session, userId: string)
   session.unset("pending-mfa-user-id");
   session.unset("pending-mfa-redirect-to");
 
-  return redirect(redirectTo, {
-    headers: {
-      "Set-Cookie": await sessionStorage.commitSession(authSession),
-    },
-  });
+  const headers = new Headers();
+  headers.append("Set-Cookie", await sessionStorage.commitSession(authSession));
+
+  // Read referral source cookie and set in PostHog if present (only for new users), then clear it
+  const referralSource = await getReferralSource(request);
+  if (referralSource) {
+    const user = await prisma.user.findUnique({
+      where: { id: userId },
+    });
+    if (user) {
+      // Only set referralSource for new users (created within the last 30 seconds)
+      const userAge = Date.now() - user.createdAt.getTime();
+      const isNewUser = userAge < 30 * 1000; // 30 seconds
+      
+      if (isNewUser) {
+        telemetry.user.identify({
+          user,
+          isNewUser: true,
+          referralSource,
+        });
+      }
+    }
+    // Clear the cookie after using it (regardless of whether we set it)
+    headers.append("Set-Cookie", await clearReferralSourceCookie());
+  }
+
+  return redirect(redirectTo, { headers });
 }
 
 export default function LoginMfaPage() {

apps/webapp/app/routes/magic.tsx

@@ -6,6 +6,8 @@ import { authenticator } from "~/services/auth.server";
 import { setLastAuthMethodHeader } from "~/services/lastAuthMethod.server";
 import { getRedirectTo } from "~/services/redirectTo.server";
 import { commitSession, getSession } from "~/services/sessionStorage.server";
+import { getReferralSource, clearReferralSourceCookie } from "~/services/referralSource.server";
+import { telemetry } from "~/services/telemetry.server";
 
 export async function loader({ request }: LoaderFunctionArgs) {
   const redirectTo = await getRedirectTo(request);
@@ -53,5 +55,28 @@ export async function loader({ request }: LoaderFunctionArgs) {
   headers.append("Set-Cookie", await commitSession(session));
   headers.append("Set-Cookie", await setLastAuthMethodHeader("email"));
 
+  // Read referral source cookie and set in PostHog if present (only for new users), then clear it
+  const referralSource = await getReferralSource(request);
+  if (referralSource) {
+    const user = await prisma.user.findUnique({
+      where: { id: auth.userId },
+    });
+    if (user) {
+      // Only set referralSource for new users (created within the last 30 seconds)
+      const userAge = Date.now() - user.createdAt.getTime();
+      const isNewUser = userAge < 30 * 1000; // 30 seconds
+      
+      if (isNewUser) {
+        telemetry.user.identify({
+          user,
+          isNewUser: true,
+          referralSource,
+        });
+      }
+    }
+    // Clear the cookie after using it (regardless of whether we set it)
+    headers.append("Set-Cookie", await clearReferralSourceCookie());
+  }
+
   return redirect(redirectTo ?? "/", { headers });
 }

apps/webapp/app/services/postAuth.server.ts

@@ -10,5 +10,8 @@ export async function postAuthentication({
   loginMethod: User["authenticationMethod"];
   isNewUser: boolean;
 }) {
-  telemetry.user.identify({ user, isNewUser });
+  telemetry.user.identify({
+    user,
+    isNewUser,
+  });
 }

apps/webapp/app/services/referralSource.server.ts

@@ -0,0 +1,31 @@
+import { createCookie } from "@remix-run/node";
+import { env } from "~/env.server";
+
+export type ReferralSource = "vercel";
+
+// Cookie that persists for 1 hour to track referral source during login flow
+export const referralSourceCookie = createCookie("referral-source", {
+  maxAge: 60 * 60, // 1 hour
+  httpOnly: true,
+  sameSite: "lax",
+  secure: env.NODE_ENV === "production",
+});
+
+export async function getReferralSource(request: Request): Promise<ReferralSource | null> {
+  const cookie = request.headers.get("Cookie");
+  const value = await referralSourceCookie.parse(cookie);
+  if (value === "vercel") {
+    return value;
+  }
+  return null;
+}
+
+export async function setReferralSourceCookie(source: ReferralSource): Promise<string> {
+  return referralSourceCookie.serialize(source);
+}
+
+export async function clearReferralSourceCookie(): Promise<string> {
+  return referralSourceCookie.serialize("", {
+    maxAge: 0,
+  });
+}

apps/webapp/app/services/telemetry.server.ts

@@ -28,18 +28,32 @@ class Telemetry {
   }
 
   user = {
-    identify: ({ user, isNewUser }: { user: User; isNewUser: boolean }) => {
+    identify: ({
+      user,
+      isNewUser,
+      referralSource,
+    }: {
+      user: User;
+      isNewUser: boolean;
+      referralSource?: string;
+    }) => {
       if (this.#posthogClient) {
+        const properties: Record<string, any> = {
+          email: user.email,
+          name: user.name,
+          authenticationMethod: user.authenticationMethod,
+          admin: user.admin,
+          createdAt: user.createdAt,
+          isNewUser,
+        };
+        
+        if (referralSource) {
+          properties.referralSource = referralSource;
+        }
+        
         this.#posthogClient.identify({
           distinctId: user.id,
-          properties: {
-            email: user.email,
-            name: user.name,
-            authenticationMethod: user.authenticationMethod,
-            admin: user.admin,
-            createdAt: user.createdAt,
-            isNewUser,
-          },
+          properties,
         });
       }
       if (isNewUser) {