[mnapoli]

Summary

The lite mobile app counts as web on its page visits, and any signed API request it makes would count as other, so the People by app chart can't show it. This gives it its own flag, line and export field.

Changes

• Data: user_active_days gets lite_mobile_app. Past rows stay as they are: the app only has internal testers so far.
• Attribution: web routes with DevNullLite/ in the user agent are lite, and so is the API when the device's app_id is MobileAuthorization::LiteMobileAppId. The user agent is self-declared, which is fine because only metrics read it.
• Sign-in: POST /api/v1/devices now puts the new device on the request, so its sign-in counts for the right app. This also moves a NativePHP sign-in from other to mobile. It uses request() because the form request is a copy, and an attribute set on it never reaches UpdateLastSeenAt.
• Chart: a lite line in the next colour of the palette, which is why it comes after other. Magenta only passes the colour-blind checks in that order.
• Export: each active_days entry gets lite_mobile_app, and schema_version goes to 8.
• Docs: PRODUCT_METRICS.md, dated 2026-11-07, so adjust it if this merges later. The privacy policy already says "which of our apps" and KNOWLEDGE_BASE.md stays accurate, so neither changes.

New column

Why the feature can't work without it	Nothing else records that the lite app was used on a day
Who can see it	Admins as aggregates, and the person in their export
When it is deleted	With the account

Visual evidence

Local site with seeded data, Chromium. Layout shift is 0 in every capture, with no page errors or horizontal overflow.

Before, 1440×900, light	After, 1440×900, light

After, 1440×900, dark	Hover, 1440×900, light

After, 1366×650, light	After, 1366×650, dark

After, 390×844, light, emulated	After, 390×844, dark, emulated

Device verification

No mobile interaction changed: this is an admin chart that gains one line, so the phone width was only checked by emulation in Chromium. The lite app itself wasn't run. Its web view is covered by tests sending its user agent.

Limitations

• apps/mobile doesn't sign API requests or send an app_id yet, so only the web view's user agent counts today. The device path takes effect once native sign-in ships.
• The lite line reads zero from the start of tracking until this ships, when its testers counted as web. Only PRODUCT_METRICS.md says so, not the page.
• With five close values, the end labels can sit a little away from their dots. They keep their order, and hovering gives exact numbers.

Summary by CodeRabbit

• New Features
  • App-usage metrics now track Lite mobile app activity, including daily counts and a chart series.
  • Sign-ins from Lite mobile devices are categorized as Lite activity.
  • Active-day exports now include a Lite mobile activity flag.
• Documentation
  • Metrics documentation clarifies Lite activity classification and historical reporting: Lite counts are zero before November 7, 2026.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The change adds Lite Mobile classification to active-day records. It includes Lite activity in app-usage metrics, charts, and data exports.

Changes: Lite Mobile tracking

Layer / File(s)	Summary
Classify and record Lite Mobile activity database/migrations/*, app/Enums/ActiveDayApp.php, app/Http/Controllers/Api/DeviceController.php, tests/Feature/Controllers/Api/DeviceControllerTest.php, tests/Feature/LastSeenTest.php, tests/Unit/Enums/ActiveDayAppTest.php, PRODUCT_METRICS.md	Adds a lite_mobile_app flag. Web-view requests are classified by the DevNullLite/ user-agent token; API requests are classified by the device app ID. The device controller attaches the approved device to the request. Tests cover classification and recorded active-day flags.
Include Lite activity in metrics app/Queries/AppUsageQuery.php, resources/js/types/operations.ts, resources/js/pages/operations/metrics.tsx, tests/Feature/Controllers/ProductMetricsControllerTest.php, tests/Unit/Queries/AppUsageQueryTest.php, PRODUCT_METRICS.md	Adds Lite daily counts and includes Lite activity when determining the earliest tracked non-web app day. The operations chart displays a Lite series.
Add Lite flag to active-day exports app/Actions/CreateExport.php, tests/Feature/Controllers/ExportControllerTest.php	Increments the export schema version to 8 and includes the stored Lite flag in active-day export records.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant WebView
  participant DeviceController
  participant ActiveDayApp
  participant UpdateLastSeenAt
  participant user_active_days
  WebView->>ActiveDayApp: classify DevNullLite/ user agent
  ActiveDayApp->>UpdateLastSeenAt: return LiteMobile
  DeviceController->>UpdateLastSeenAt: attach approved device to request
  UpdateLastSeenAt->>ActiveDayApp: classify device app_id
  ActiveDayApp->>UpdateLastSeenAt: return LiteMobile
  UpdateLastSeenAt->>user_active_days: record lite_mobile_app

Loading

Possibly related PRs

• dev-null-sh/dev-null.sh#1505: Adds per-app active-day tracking, the usage chart, and app flags in exports, which this change extends with Lite activity.
• dev-null-sh/dev-null.sh#1503: Changes the Lite app user-agent token to DevNullLite/, which this change uses for web-view classification.
• dev-null-sh/dev-null.sh#1339: Adds device app_id to the authorization flow, which this change uses to classify API activity.

Suggested reviewers: xheaven, simonhamp

Merge Risk: Minimal · up to 83959

The Lite activity changes are ready to merge after normal checks; no unresolved issue was established.

Security architecture risk: Low · up to 83959

The new activity flag remains within existing account, administrator, and export access controls. No introduced authorization bypass was identified. Residual risk is concentrated in coordinating the database change with application deployment.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — A signed-in client can influence its own daily app classification through its user agent or approved device metadata. The added data is published as site-wide daily counts to administrators and as account-scoped rows in the current user's export; the inspected changes do not provide a way to select another user's activity rows.

Trust Boundaries and Controls

• observed — Device registration retains signature verification, per-key rate limiting, authorization-code fingerprint and PKCE checks, and an account-existence check. The existing redemption guard rejects a second redemption before device attachment. Export delivery retains current-user injection and private, no-store headers; metrics retain administrator authorization.

Resilience and Maintainability Implications

• inferred — Activity attribution remains best-effort rather than part of granting device authority. An interruption after device creation can leave a registered device without an activity record, while a recording failure is contained and does not undo or broaden the device's authorization. These failure semantics predate the added classification.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly describes the main change: separate lite mobile app usage metrics.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 5 functions across 13 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6d313952-b137-4560-8f17-bf8ad450cbf4

Commits

Reviewing files that changed from the base of the PR and between 394b411 and 839599d.

Files selected for processing: 14

• PRODUCT_METRICS.md
• app/Actions/CreateExport.php
• app/Enums/ActiveDayApp.php
• app/Http/Controllers/Api/DeviceController.php
• app/Queries/AppUsageQuery.php
• database/migrations/2026_11_07_120000_add_lite_mobile_app_to_user_active_days_table.php
• resources/js/pages/operations/metrics.tsx
• resources/js/types/operations.ts
• tests/Feature/Controllers/Api/DeviceControllerTest.php
• tests/Feature/Controllers/ExportControllerTest.php
• tests/Feature/Controllers/ProductMetricsControllerTest.php
• tests/Feature/LastSeenTest.php
• tests/Unit/Enums/ActiveDayAppTest.php
• tests/Unit/Queries/AppUsageQueryTest.php

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.