Enhanced analytics tracking by adding Google Analytics 4 and Hotjar integration, updated Sidebar to conditionally display Admin link for admin users, and refactored search tracking logic in DiscoverPageContent for improved performance and reliability. Removed console logs for logo resolution in DataCatalogCard and OrganizationCard components.

Author: John Rogers

.cursor-updates

@@ -72,4 +72,6 @@
 - Fixed 'No results' message flashing during search - now only shows after search actually completes (loading goes from true to false), preventing false "0 results" display while search is in progress
 - Fixed variables table hiding logic - now correctly hides when get_variables returns no results on first page, regardless of whether there's a search query
 - Replaced /items/[slug] with catch-all route /items/[[...slug]] that pre-generates and pre-renders all item routes (by slug and UUID, 21k+ routes) with data at build time, just like studies pages - fetches from cache/API during build and passes to component, fetchResultByUuid handles both slugs and UUIDs
-- Removed all optional parameters (query, alpha, maxVectorDistance, maxDistanceMode) from fetchResultByUuid and fetchResultsByUuids lookup endpoints - now only passes uuid or slug to improve API performance, batch lookup still supported
+- Removed all optional parameters (query, alpha, maxVectorDistance, maxDistanceMode) from fetchResultByUuid and fetchResultsByUuids lookup endpoints - now only passes uuid or slug to improve API performance, batch lookup still supported
+- Added Google Analytics 4 with anonymized IP tracking (no cookie consent required) - configured with anonymize_ip, allow_google_signals: false, and allow_ad_personalization_signals: false for GDPR compliance
+- Added Hotjar tracking gated behind harmonyCookieConsent cookie (shared with harmonydata.github.io) - created HotjarTracker client component that checks for consent cookie and polls for changes to enable cross-site consent sharing

firestore.rules

@@ -0,0 +1,68 @@
+rules_version = '2';
+service cloud.firestore {
+  match /databases/{database}/documents {
+    
+    // Helper function to check if user is admin
+    // Admin users have a document in 'users' collection with their UID as document ID
+    // and isAdmin: true field
+    function isAdmin() {
+      return request.auth != null && 
+             exists(/databases/$(database)/documents/users/$(request.auth.uid)) &&
+             get(/databases/$(database)/documents/users/$(request.auth.uid)).data.isAdmin == true;
+    }
+    
+    // Users collection: Only admins can read their own admin status document
+    // Document ID must match the authenticated user's UID
+    match /users/{userId} {
+      allow read: if request.auth != null && 
+                     request.auth.uid == userId &&
+                     isAdmin();
+      // Only admins can write (for creating admin users)
+      allow write: if isAdmin();
+    }
+    
+    // Analytics events: Public can create, admins can read
+    match /analytics_events/{eventId} {
+      allow create: if true; // Anyone can create analytics events
+      allow read: if isAdmin(); // Only admins can read
+      allow update, delete: if isAdmin(); // Only admins can modify
+    }
+    
+    // Ratings/Feedback: Public can create, admins can read
+    match /ratings/{ratingId} {
+      allow create: if true; // Anyone can create feedback/ratings
+      allow read: if isAdmin(); // Only admins can read
+      allow update, delete: if isAdmin(); // Only admins can modify
+    }
+    
+    // Mismatches (Harmony quality feedback): Public can create, admins can read
+    match /mismatches/{mismatchId} {
+      allow create: if true; // Anyone can create mismatch reports
+      allow read: if isAdmin(); // Only admins can read
+      allow update, delete: if isAdmin(); // Only admins can modify
+    }
+    
+    // Other collections (saved_searches, saved_resources, harmonisations, etc.)
+    // These are user-specific, so users can read/write their own data
+    match /saved_searches/{searchId} {
+      allow read, write: if request.auth != null && 
+                            resource.data.userId == request.auth.uid;
+      allow create: if request.auth != null && 
+                      request.resource.data.userId == request.auth.uid;
+    }
+    
+    match /saved_resources/{resourceId} {
+      allow read, write: if request.auth != null && 
+                            resource.data.userId == request.auth.uid;
+      allow create: if request.auth != null && 
+                      request.resource.data.userId == request.auth.uid;
+    }
+    
+    match /harmonisations/{harmonisationId} {
+      allow read, write: if request.auth != null && 
+                            resource.data.userId == request.auth.uid;
+      allow create: if request.auth != null && 
+                      request.resource.data.userId == request.auth.uid;
+    }
+  }
+}