diff --git a/apps/web/playwright/fixtures/apps.ts b/apps/web/playwright/fixtures/apps.ts
index 43ce8f6c83..05127f978b 100644
--- a/apps/web/playwright/fixtures/apps.ts
+++ b/apps/web/playwright/fixtures/apps.ts
@@ -48,11 +48,11 @@ export function createAppsFixture(page: Page) {
await page.click(`[data-testid="save-event-types"]`);
- // adding valid GTM container ID to gtm-tracking-id-input because this field is required and the test fails without it
+ // adding random-tracking-id to gtm-tracking-id-input because this field is required and the test fails without it
if (app === "gtm") {
await page.waitForLoadState("domcontentloaded");
for (let index = 0; index < eventTypeIds.length; index++) {
- await page.getByTestId("gtm-tracking-id-input").nth(index).fill("GTM-ABC123");
+ await page.getByTestId("gtm-tracking-id-input").nth(index).fill("random-tracking-id");
}
}
await page.click(`[data-testid="configure-step-save"]`);
diff --git a/packages/app-store/_lib/analytics-schemas.ts b/packages/app-store/_lib/analytics-schemas.ts
deleted file mode 100644
index 5bc8466fcf..0000000000
--- a/packages/app-store/_lib/analytics-schemas.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-import { z } from "zod";
-
-export const safeUrlSchema = z
- .string()
- .transform((val) => val.trim())
- .refine(
- (val) => {
- if (!val) return true;
- try {
- const url = new URL(val);
- return url.protocol === "http:" || url.protocol === "https:";
- } catch {
- return false;
- }
- },
- { message: "Invalid URL format. Must be a valid http or https URL" }
- );
-
-// Schema for tracking IDs that should only contain letters, numbers, underscores, and hyphens
-export const alphanumericIdSchema = z
- .string()
- .transform((val) => val.trim())
- .refine((val) => !val || /^[A-Za-z0-9_-]+$/.test(val), {
- message: "Invalid ID format. Expected alphanumeric characters, underscores, or hyphens",
- });
-
-// Schema for tracking IDs that should only contain digits
-export const numericIdSchema = z
- .string()
- .transform((val) => val.trim())
- .refine((val) => !val || /^[0-9]+$/.test(val), {
- message: "Invalid ID format. Expected a numeric ID",
- });
-
-// Factory for creating prefixed ID schemas (GTM, GA4, Fathom, etc.)
-export const createPrefixedIdSchema = (options: {
- prefix?: string;
- addPrefixIfMissing?: boolean;
- allowEmpty?: boolean;
-}) => {
- const { prefix = "", addPrefixIfMissing = false, allowEmpty = true } = options;
-
- return z
- .string()
- .transform((val) => {
- let result = val.trim().toUpperCase();
- if (prefix && addPrefixIfMissing) {
- const clean = result.replace(new RegExp(`^${prefix}`, "i"), "");
- result = `${prefix}${clean}`;
- }
- return result;
- })
- .refine(
- (val) => {
- if (allowEmpty && val === "") return true;
- const pattern = prefix ? new RegExp(`^${prefix}[A-Z0-9]{1,20}$`) : /^[A-Z0-9]{1,20}$/;
- return pattern.test(val);
- },
- { message: `Invalid ID format${prefix ? `. Expected: ${prefix}XXXXXX` : ""}` }
- );
-};
diff --git a/packages/app-store/analytics-apps.test.ts b/packages/app-store/analytics-apps.test.ts
deleted file mode 100644
index 7b0b6fea95..0000000000
--- a/packages/app-store/analytics-apps.test.ts
+++ /dev/null
@@ -1,255 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { appDataSchema as databuddySchema } from "./databuddy/zod";
-import { appDataSchema as fathomSchema } from "./fathom/zod";
-import { appDataSchema as ga4Schema } from "./ga4/zod";
-import { appDataSchema as gtmSchema } from "./gtm/zod";
-import { appDataSchema as insihtsSchema } from "./insihts/zod";
-import { appDataSchema as matomoSchema } from "./matomo/zod";
-import { appDataSchema as metapixelSchema } from "./metapixel/zod";
-import { appDataSchema as plausibleSchema } from "./plausible/zod";
-import { appDataSchema as posthogSchema } from "./posthog/zod";
-import { appDataSchema as twiplaSchema } from "./twipla/zod";
-import { appDataSchema as umamiSchema } from "./umami/zod";
-
-// Common XSS payloads that should be rejected by all schemas
-const xssPayloads = [
- "';alert(1)//",
- '">',
- "javascript:alert(1)",
- "
",
- "' onclick=alert(1) data-x='",
-];
-
-describe("Analytics Apps - Input Validation", () => {
- describe("GTM", () => {
- it("accepts valid GTM container IDs", () => {
- expect(gtmSchema.parse({ trackingId: "GTM-ABC123" }).trackingId).toBe("GTM-ABC123");
- expect(gtmSchema.parse({ trackingId: "abc123" }).trackingId).toBe("GTM-ABC123");
- expect(gtmSchema.parse({ trackingId: "gtm-xyz789" }).trackingId).toBe("GTM-XYZ789");
- });
-
- it("rejects XSS payloads", () => {
- for (const payload of xssPayloads) {
- expect(() => gtmSchema.parse({ trackingId: payload })).toThrow();
- }
- });
- });
-
- describe("GA4", () => {
- it("accepts valid GA4 measurement IDs", () => {
- expect(ga4Schema.parse({ trackingId: "G-ABC1234567" }).trackingId).toBe("G-ABC1234567");
- expect(ga4Schema.parse({ trackingId: "g-abc1234567" }).trackingId).toBe("G-ABC1234567");
- expect(ga4Schema.parse({ trackingId: "" }).trackingId).toBe("");
- });
-
- it("rejects XSS payloads", () => {
- for (const payload of xssPayloads) {
- expect(() => ga4Schema.parse({ trackingId: payload })).toThrow();
- }
- });
- });
-
- describe("Meta Pixel", () => {
- it("accepts valid pixel IDs (numeric)", () => {
- expect(metapixelSchema.parse({ trackingId: "1234567890123456" }).trackingId).toBe("1234567890123456");
- expect(metapixelSchema.parse({ trackingId: "" }).trackingId).toBe("");
- });
-
- it("rejects non-numeric values", () => {
- expect(() => metapixelSchema.parse({ trackingId: "abc123" })).toThrow();
- });
-
- it("rejects XSS payloads", () => {
- for (const payload of xssPayloads) {
- expect(() => metapixelSchema.parse({ trackingId: payload })).toThrow();
- }
- });
- });
-
- describe("PostHog", () => {
- it("accepts valid PostHog credentials", () => {
- const result = posthogSchema.parse({
- TRACKING_ID: "phc_abc123XYZ",
- API_HOST: "https://app.posthog.com",
- });
- expect(result.TRACKING_ID).toBe("phc_abc123XYZ");
- expect(result.API_HOST).toBe("https://app.posthog.com");
- });
-
- it("accepts legacy alphanumeric TRACKING_IDs", () => {
- expect(posthogSchema.parse({ TRACKING_ID: "legacy_key_123" }).TRACKING_ID).toBe("legacy_key_123");
- });
-
- it("rejects javascript: URLs", () => {
- expect(() => posthogSchema.parse({ API_HOST: "javascript:alert(1)" })).toThrow();
- });
-
- it("rejects XSS payloads", () => {
- for (const payload of xssPayloads) {
- expect(() => posthogSchema.parse({ TRACKING_ID: payload })).toThrow();
- expect(() => posthogSchema.parse({ API_HOST: payload })).toThrow();
- }
- });
- });
-
- describe("Fathom", () => {
- it("accepts valid site IDs", () => {
- expect(fathomSchema.parse({ trackingId: "ABCDEFG" }).trackingId).toBe("ABCDEFG");
- expect(fathomSchema.parse({ trackingId: "abcdefg" }).trackingId).toBe("ABCDEFG");
- });
-
- it("rejects XSS payloads", () => {
- for (const payload of xssPayloads) {
- expect(() => fathomSchema.parse({ trackingId: payload })).toThrow();
- }
- });
- });
-
- describe("Plausible", () => {
- it("accepts valid domain and URL", () => {
- const result = plausibleSchema.parse({
- trackingId: "example.com",
- PLAUSIBLE_URL: "https://plausible.io/js/script.js",
- });
- expect(result.trackingId).toBe("example.com");
- expect(result.PLAUSIBLE_URL).toBe("https://plausible.io/js/script.js");
- });
-
- it("accepts valid subdomains", () => {
- expect(plausibleSchema.parse({ trackingId: "sub.example.com" }).trackingId).toBe("sub.example.com");
- expect(plausibleSchema.parse({ trackingId: "deep.sub.example.com" }).trackingId).toBe(
- "deep.sub.example.com"
- );
- });
-
- it("accepts single-label domains", () => {
- expect(plausibleSchema.parse({ trackingId: "localhost" }).trackingId).toBe("localhost");
- });
-
- it("accepts domains with hyphens in labels", () => {
- expect(plausibleSchema.parse({ trackingId: "my-site.example.com" }).trackingId).toBe(
- "my-site.example.com"
- );
- });
-
- it("rejects consecutive dots", () => {
- expect(() => plausibleSchema.parse({ trackingId: "example..com" })).toThrow();
- });
-
- it("rejects hyphens at label boundaries", () => {
- expect(() => plausibleSchema.parse({ trackingId: "-example.com" })).toThrow();
- expect(() => plausibleSchema.parse({ trackingId: "example-.com" })).toThrow();
- expect(() => plausibleSchema.parse({ trackingId: "example.-com" })).toThrow();
- });
-
- it("rejects XSS payloads", () => {
- for (const payload of xssPayloads) {
- expect(() => plausibleSchema.parse({ trackingId: payload })).toThrow();
- expect(() => plausibleSchema.parse({ PLAUSIBLE_URL: payload })).toThrow();
- }
- });
- });
-
- describe("Matomo", () => {
- it("accepts valid URL and numeric site ID", () => {
- const result = matomoSchema.parse({
- MATOMO_URL: "https://matomo.example.com",
- SITE_ID: "42",
- });
- expect(result.MATOMO_URL).toBe("https://matomo.example.com");
- expect(result.SITE_ID).toBe("42");
- });
-
- it("rejects non-numeric SITE_ID", () => {
- expect(() => matomoSchema.parse({ SITE_ID: "abc" })).toThrow();
- });
-
- it("rejects XSS payloads", () => {
- for (const payload of xssPayloads) {
- expect(() => matomoSchema.parse({ MATOMO_URL: payload })).toThrow();
- expect(() => matomoSchema.parse({ SITE_ID: payload })).toThrow();
- }
- });
- });
-
- describe("Umami", () => {
- it("accepts UUID (v2) and URL", () => {
- const result = umamiSchema.parse({
- SITE_ID: "4fb7fa4c-5b46-438d-94b3-3a8fb9bc2e8b",
- SCRIPT_URL: "https://umami.example.com/script.js",
- });
- expect(result.SITE_ID).toBe("4fb7fa4c-5b46-438d-94b3-3a8fb9bc2e8b");
- expect(result.SCRIPT_URL).toBe("https://umami.example.com/script.js");
- });
-
- it("accepts numeric ID (v1)", () => {
- expect(umamiSchema.parse({ SITE_ID: "12345" }).SITE_ID).toBe("12345");
- });
-
- it("rejects invalid format", () => {
- expect(() => umamiSchema.parse({ SITE_ID: "not-a-valid-id!" })).toThrow();
- });
-
- it("rejects XSS payloads", () => {
- for (const payload of xssPayloads) {
- expect(() => umamiSchema.parse({ SITE_ID: payload })).toThrow();
- expect(() => umamiSchema.parse({ SCRIPT_URL: payload })).toThrow();
- }
- });
- });
-
- describe("Twipla", () => {
- it("accepts valid site IDs", () => {
- expect(twiplaSchema.parse({ SITE_ID: "abc123" }).SITE_ID).toBe("abc123");
- expect(twiplaSchema.parse({ SITE_ID: "4fb7fa4c-5b46-438d-94b3-3a8fb9bc2e8b" }).SITE_ID).toBe(
- "4fb7fa4c-5b46-438d-94b3-3a8fb9bc2e8b"
- );
- });
-
- it("rejects XSS payloads", () => {
- for (const payload of xssPayloads) {
- expect(() => twiplaSchema.parse({ SITE_ID: payload })).toThrow();
- }
- });
- });
-
- describe("Insihts", () => {
- it("accepts valid site ID and URL", () => {
- const result = insihtsSchema.parse({
- SITE_ID: "site_abc123",
- SCRIPT_URL: "https://collector.insihts.com/script.js",
- });
- expect(result.SITE_ID).toBe("site_abc123");
- expect(result.SCRIPT_URL).toBe("https://collector.insihts.com/script.js");
- });
-
- it("rejects XSS payloads", () => {
- for (const payload of xssPayloads) {
- expect(() => insihtsSchema.parse({ SITE_ID: payload })).toThrow();
- expect(() => insihtsSchema.parse({ SCRIPT_URL: payload })).toThrow();
- }
- });
- });
-
- describe("Databuddy", () => {
- it("accepts valid client ID and URLs", () => {
- const result = databuddySchema.parse({
- CLIENT_ID: "client_abc123",
- DATABUDDY_SCRIPT_URL: "https://cdn.databuddy.cc/databuddy.js",
- DATABUDDY_API_URL: "https://basket.databuddy.cc",
- });
- expect(result.CLIENT_ID).toBe("client_abc123");
- expect(result.DATABUDDY_SCRIPT_URL).toBe("https://cdn.databuddy.cc/databuddy.js");
- expect(result.DATABUDDY_API_URL).toBe("https://basket.databuddy.cc");
- });
-
- it("rejects XSS payloads", () => {
- for (const payload of xssPayloads) {
- expect(() => databuddySchema.parse({ CLIENT_ID: payload })).toThrow();
- expect(() => databuddySchema.parse({ DATABUDDY_SCRIPT_URL: payload })).toThrow();
- expect(() => databuddySchema.parse({ DATABUDDY_API_URL: payload })).toThrow();
- }
- });
- });
-});
diff --git a/packages/app-store/databuddy/zod.ts b/packages/app-store/databuddy/zod.ts
index 6c2887d44b..71315dd1c9 100644
--- a/packages/app-store/databuddy/zod.ts
+++ b/packages/app-store/databuddy/zod.ts
@@ -1,13 +1,16 @@
import { z } from "zod";
import { eventTypeAppCardZod } from "../eventTypeAppCardZod";
-import { alphanumericIdSchema, safeUrlSchema } from "@calcom/app-store/_lib/analytics-schemas";
export const appDataSchema = eventTypeAppCardZod.merge(
z.object({
- DATABUDDY_SCRIPT_URL: safeUrlSchema.optional().default("https://cdn.databuddy.cc/databuddy.js").or(z.undefined()),
- DATABUDDY_API_URL: safeUrlSchema.optional().default("https://basket.databuddy.cc").or(z.undefined()),
- CLIENT_ID: alphanumericIdSchema.optional(),
+ DATABUDDY_SCRIPT_URL: z
+ .string()
+ .optional()
+ .default("https://cdn.databuddy.cc/databuddy.js")
+ .or(z.undefined()),
+ DATABUDDY_API_URL: z.string().optional().default("https://basket.databuddy.cc").or(z.undefined()),
+ CLIENT_ID: z.string().default("").optional(),
})
);
diff --git a/packages/app-store/fathom/zod.ts b/packages/app-store/fathom/zod.ts
index a8fb1d04c1..674bf3405d 100644
--- a/packages/app-store/fathom/zod.ts
+++ b/packages/app-store/fathom/zod.ts
@@ -1,11 +1,10 @@
import { z } from "zod";
import { eventTypeAppCardZod } from "../eventTypeAppCardZod";
-import { createPrefixedIdSchema } from "@calcom/app-store/_lib/analytics-schemas";
export const appDataSchema = eventTypeAppCardZod.merge(
z.object({
- trackingId: createPrefixedIdSchema({ allowEmpty: true }).optional(),
+ trackingId: z.string().default("").optional(),
})
);
diff --git a/packages/app-store/ga4/zod.ts b/packages/app-store/ga4/zod.ts
index d043adfbab..674bf3405d 100644
--- a/packages/app-store/ga4/zod.ts
+++ b/packages/app-store/ga4/zod.ts
@@ -1,11 +1,10 @@
import { z } from "zod";
import { eventTypeAppCardZod } from "../eventTypeAppCardZod";
-import { createPrefixedIdSchema } from "@calcom/app-store/_lib/analytics-schemas";
export const appDataSchema = eventTypeAppCardZod.merge(
z.object({
- trackingId: createPrefixedIdSchema({ prefix: "G-", allowEmpty: true }).optional(),
+ trackingId: z.string().default("").optional(),
})
);
diff --git a/packages/app-store/gtm/zod.ts b/packages/app-store/gtm/zod.ts
index 71ee5440ab..297950930c 100644
--- a/packages/app-store/gtm/zod.ts
+++ b/packages/app-store/gtm/zod.ts
@@ -2,11 +2,14 @@ import { z } from "zod";
import { eventTypeAppCardZod } from "@calcom/app-store/eventTypeAppCardZod";
-import { createPrefixedIdSchema } from "@calcom/app-store/_lib/analytics-schemas";
-
export const appDataSchema = eventTypeAppCardZod.merge(
z.object({
- trackingId: createPrefixedIdSchema({ prefix: "GTM-", addPrefixIfMissing: true, allowEmpty: false }),
+ trackingId: z.string().transform((val) => {
+ let trackingId = val.trim();
+ // Ensure that trackingId is transformed if needed to begin with "GTM-" always
+ trackingId = !trackingId.startsWith("GTM-") ? `GTM-${trackingId}` : trackingId;
+ return trackingId;
+ }),
})
);
diff --git a/packages/app-store/insihts/zod.ts b/packages/app-store/insihts/zod.ts
index d8f0b3a24b..83716cb0a5 100644
--- a/packages/app-store/insihts/zod.ts
+++ b/packages/app-store/insihts/zod.ts
@@ -2,12 +2,10 @@ import { z } from "zod";
import { eventTypeAppCardZod } from "@calcom/app-store/eventTypeAppCardZod";
-import { alphanumericIdSchema, safeUrlSchema } from "@calcom/app-store/_lib/analytics-schemas";
-
export const appDataSchema = eventTypeAppCardZod.merge(
z.object({
- SITE_ID: alphanumericIdSchema.optional(),
- SCRIPT_URL: safeUrlSchema.optional(),
+ SITE_ID: z.string().optional(),
+ SCRIPT_URL: z.string().optional(),
})
);
diff --git a/packages/app-store/matomo/zod.ts b/packages/app-store/matomo/zod.ts
index ee39ec1697..c13304b444 100644
--- a/packages/app-store/matomo/zod.ts
+++ b/packages/app-store/matomo/zod.ts
@@ -2,12 +2,10 @@ import { z } from "zod";
import { eventTypeAppCardZod } from "@calcom/app-store/eventTypeAppCardZod";
-import { numericIdSchema, safeUrlSchema } from "@calcom/app-store/_lib/analytics-schemas";
-
export const appDataSchema = eventTypeAppCardZod.merge(
z.object({
- MATOMO_URL: safeUrlSchema.optional(),
- SITE_ID: numericIdSchema.optional(),
+ MATOMO_URL: z.string().optional(),
+ SITE_ID: z.string().optional(),
})
);
diff --git a/packages/app-store/metapixel/zod.ts b/packages/app-store/metapixel/zod.ts
index 532f72d529..367b0dd2a3 100644
--- a/packages/app-store/metapixel/zod.ts
+++ b/packages/app-store/metapixel/zod.ts
@@ -2,18 +2,9 @@ import { z } from "zod";
import { eventTypeAppCardZod } from "@calcom/app-store/eventTypeAppCardZod";
-// Meta Pixel IDs are numeric strings of 15-16 digits
-const metaPixelIdSchema = z
- .string()
- .transform((val) => val.trim())
- .refine((val) => val === "" || /^[0-9]{15,16}$/.test(val), {
- message: "Invalid Meta Pixel ID format. Expected a numeric ID (e.g., 1234567890123456)",
- })
- .optional();
-
export const appDataSchema = eventTypeAppCardZod.merge(
z.object({
- trackingId: metaPixelIdSchema,
+ trackingId: z.string().default("").optional(),
})
);
export const appKeysSchema = z.object({});
diff --git a/packages/app-store/plausible/zod.ts b/packages/app-store/plausible/zod.ts
index df2c16b8bf..ee8d9a8dc4 100644
--- a/packages/app-store/plausible/zod.ts
+++ b/packages/app-store/plausible/zod.ts
@@ -1,25 +1,11 @@
import { z } from "zod";
import { eventTypeAppCardZod } from "../eventTypeAppCardZod";
-import { safeUrlSchema } from "@calcom/app-store/_lib/analytics-schemas";
-
-// Domain schema for Plausible tracking (e.g., example.com, sub.example.com)
-const domainSchema = z
- .string()
- .transform((val) => val.trim().toLowerCase())
- .refine(
- (val) =>
- val === "" || /^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(val),
- {
- message: "Invalid domain format. Expected format: example.com",
- }
- )
- .optional();
export const appDataSchema = eventTypeAppCardZod.merge(
z.object({
- PLAUSIBLE_URL: safeUrlSchema.optional().default("https://plausible.io/js/script.js").or(z.undefined()),
- trackingId: domainSchema,
+ PLAUSIBLE_URL: z.string().optional().default("https://plausible.io/js/script.js").or(z.undefined()),
+ trackingId: z.string().default("").optional(),
})
);
diff --git a/packages/app-store/posthog/zod.ts b/packages/app-store/posthog/zod.ts
index 26ccc8cbba..d1eba3b034 100644
--- a/packages/app-store/posthog/zod.ts
+++ b/packages/app-store/posthog/zod.ts
@@ -2,21 +2,10 @@ import { z } from "zod";
import { eventTypeAppCardZod } from "@calcom/app-store/eventTypeAppCardZod";
-import { safeUrlSchema } from "@calcom/app-store/_lib/analytics-schemas";
-
-// PostHog Project API Keys (typically start with phc_) - allow alphanumeric to not break legacy data
-const posthogIdSchema = z
- .string()
- .transform((val) => val.trim())
- .refine((val) => !val || /^[A-Za-z0-9_]+$/.test(val), {
- message: "Invalid PostHog Project API Key format. Expected alphanumeric characters or underscores",
- })
- .optional();
-
export const appDataSchema = eventTypeAppCardZod.merge(
z.object({
- TRACKING_ID: posthogIdSchema,
- API_HOST: safeUrlSchema.optional(),
+ TRACKING_ID: z.string().optional(),
+ API_HOST: z.string().optional(),
})
);
diff --git a/packages/app-store/twipla/zod.ts b/packages/app-store/twipla/zod.ts
index b337018986..3339ccae14 100644
--- a/packages/app-store/twipla/zod.ts
+++ b/packages/app-store/twipla/zod.ts
@@ -2,18 +2,9 @@ import { z } from "zod";
import { eventTypeAppCardZod } from "@calcom/app-store/eventTypeAppCardZod";
-// Twipla Site IDs can be UUID or alphanumeric strings
-const twiplaSiteIdSchema = z
- .string()
- .transform((val) => val.trim())
- .refine((val) => !val || /^[A-Za-z0-9-]+$/.test(val), {
- message: "Invalid Twipla Site ID format. Expected alphanumeric characters or UUID",
- })
- .optional();
-
export const appDataSchema = eventTypeAppCardZod.merge(
z.object({
- SITE_ID: twiplaSiteIdSchema,
+ SITE_ID: z.string().optional(),
})
);
diff --git a/packages/app-store/umami/zod.ts b/packages/app-store/umami/zod.ts
index 10b654ce66..9318935021 100644
--- a/packages/app-store/umami/zod.ts
+++ b/packages/app-store/umami/zod.ts
@@ -2,27 +2,10 @@ import { z } from "zod";
import { eventTypeAppCardZod } from "@calcom/app-store/eventTypeAppCardZod";
-import { safeUrlSchema } from "@calcom/app-store/_lib/analytics-schemas";
-
-// Umami Website IDs: UUID in v2 (e.g., 4fb7fa4c-5b46-438d-94b3-3a8fb9bc2e8b) or numeric in v1
-const umamiSiteIdSchema = z
- .string()
- .transform((val) => val.trim().toLowerCase())
- .refine(
- (val) =>
- !val ||
- /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(val) ||
- /^[0-9]+$/.test(val),
- {
- message: "Invalid Umami Website ID format. Expected UUID or numeric ID",
- }
- )
- .optional();
-
export const appDataSchema = eventTypeAppCardZod.merge(
z.object({
- SITE_ID: umamiSiteIdSchema,
- SCRIPT_URL: safeUrlSchema.default("https://cloud.umami.is/script.js").or(z.undefined()),
+ SITE_ID: z.string().optional(),
+ SCRIPT_URL: z.string().optional().default("https://cloud.umami.is/script.js").or(z.undefined()),
})
);