#!/usr/bin/env bun
// Geographic report from the request log. Ties Cloudflare's cf-ipcountry header
// to the authenticated `user` field so we count DISTINCT USERS per country
// (not raw request volume, which is dominated by datacenter/bot traffic).
//
// Usage: bun scripts/analytics-geo.ts [--days N] [--top N]
// Streams ~/coinos-server/req (pino JSONL, multi-GB) — never loads it whole.

import { createInterface } from "readline";
import { createReadStream } from "fs";

const argDays = Number(process.argv[process.argv.indexOf("--days") + 1]) || 30;
const TOP = Number(process.argv[process.argv.indexOf("--top") + 1]) || 25;
const cutoff = Date.now() - argDays * 24 * 60 * 60 * 1000;

// Datacenter IPs that flood /login with many usernames (credential-testing
// bots). Excluded from geo counts. 195.123.220.232 = M247 NL, ~3,971 logins
// for sequential usernames (bugtraq, bugtraqq, ...) in the last 30d.
const BOT_IPS = new Set<string>(["195.123.220.232"]);

const rl = createInterface({
  input: createReadStream("/home/adam/coinos-server/req"),
  crlfDelay: Infinity,
});

// We only trust /login and /register events for geography: they are real human
// auth actions tied to a username in the body, from the user's actual device.
// Counting ALL authenticated requests pollutes the result massively — e.g.
// nostr/NWC server traffic from a single M247 datacenter IP (195.123.220.232)
// carries a stale `user` field and made NL look like 93% of users. Per-IP-per-
// country dedup on auth events is the honest signal.

// country -> Set<username>  (distinct users who logged in / registered there)
const usersByCountry = new Map<string, Set<string>>();
// country -> distinct IPs (sanity: real geography has many IPs per country)
const ipsByCountry = new Map<string, Set<string>>();
let lines = 0;
let authEvents = 0;

const extractUsername = (r: any): string | null => {
  // /login and /register carry username in the body (top-level `user` is empty
  // on these). Body shape varies: {username} or {user:{username}}.
  const b = r.body;
  if (!b) return null;
  if (typeof b.username === "string") return b.username.toLowerCase();
  if (b.user && typeof b.user.username === "string") return b.user.username.toLowerCase();
  return null;
};

for await (const line of rl) {
  lines++;
  // cheap pre-filter: must be an auth event with a country tag
  if (!line.includes("cf-ipcountry")) continue;
  if (!line.includes('"/login"') && !line.includes('"/register"')) continue;
  let r: any;
  try {
    r = JSON.parse(line);
  } catch {
    continue;
  }
  if (!r.time || r.time < cutoff) continue;
  if (r.url !== "/login" && r.url !== "/register") continue;
  const cc = r.headers?.["cf-ipcountry"];
  if (!cc || cc === "XX" || cc.length !== 2) continue;
  const ip = r.headers?.["cf-connecting-ip"];

  const user = extractUsername(r);
  if (!user) continue;

  // Drop known bot/proxy egress IPs that fire thousands of logins for many
  // usernames from a single datacenter address — these are credential-testing
  // bots, not real users, and otherwise dominate the country ranking. Heuristic
  // backstop below (users >> ips) catches the rest; this is the worst offender.
  if (ip && BOT_IPS.has(ip)) continue;
  authEvents++;

  let s = usersByCountry.get(cc);
  if (!s) usersByCountry.set(cc, (s = new Set()));
  s.add(user);

  if (ip) {
    let is = ipsByCountry.get(cc);
    if (!is) ipsByCountry.set(cc, (is = new Set()));
    is.add(ip);
  }
}
const withCountry = authEvents;

const byUsers = [...usersByCountry.entries()]
  .map(([cc, set]) => [cc, set.size, ipsByCountry.get(cc)?.size || 0] as [string, number, number])
  .sort((a, b) => b[1] - a[1]);

const totalUsers = byUsers.reduce((s, [, n]) => s + n, 0);
const max = byUsers[0]?.[1] || 1;
const bar = (n: number) =>
  "█".repeat(Math.round((n / max) * 24)) + "·".repeat(24 - Math.round((n / max) * 24));

console.log("═".repeat(64));
console.log(`  COINOS GEO — last ${argDays} days (login/register events only)`);
console.log(`  scanned ${lines.toLocaleString()} log lines, ${withCountry.toLocaleString()} auth events`);
console.log("═".repeat(64));
console.log("\n▏TOP COUNTRIES (distinct users who logged in / registered)");
console.log("    cc  distribution                    users   ips   share");
byUsers.slice(0, TOP).forEach(([cc, n, ips], i) => {
  const pct = ((n / totalUsers) * 100).toFixed(1);
  console.log(
    `  ${String(i + 1).padStart(2)}. ${cc}  ${bar(n)} ${String(n).padStart(5)}  ${String(ips).padStart(4)}  ${pct.padStart(5)}%`,
  );
});
console.log(
  `\n  (ips column = distinct source IPs; a country with users >> ips is likely a proxy/VPN egress, not real geography)`,
);
console.log("\n" + "═".repeat(64));
process.exit(0);
5%; }
td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }
span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }
td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }
span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }
.highlight .hll { background-color: #ffffcc }
.highlight .c { color: #888 } /* Comment */
.highlight .err { color: #A61717; background-color: #E3D2D2 } /* Error */
.highlight .k { color: #080; font-weight: bold } /* Keyword */
.highlight .ch { color: #888 } /* Comment.Hashbang */
.highlight .cm { color: #888 } /* Comment.Multiline */
.highlight .cp { color: #C00; font-weight: bold } /* Comment.Preproc */
.highlight .cpf { color: #888 } /* Comment.PreprocFile */
.highlight .c1 { color: #888 } /* Comment.Single */
.highlight .cs { color: #C00; font-weight: bold; background-color: #FFF0F0 } /* Comment.Special */
.highlight .gd { color: #000; background-color: #FDD } /* Generic.Deleted */
.highlight .ge { font-style: italic } /* Generic.Emph */
.highlight .ges { font-weight: bold; font-style: italic } /* Generic.EmphStrong */
.highlight .gr { color: #A00 } /* Generic.Error */
.highlight .gh { color: #333 } /* Generic.Heading */
.highlight .gi { color: #000; background-color: #DFD } /* Generic.Inserted */
.highlight .go { color: #888 } /* Generic.Output */
.highlight .gp { color: #555 } /* Generic.Prompt */
.highlight .gs { font-weight: bold } /* Generic.Strong */
.highlight .gu { color: #666 } /* Generic.Subheading */
.highlight .gt { color: #A00 } /* Generic.Traceback */
.highlight .kc { color: #080; font-weight: bold } /* Keyword.Constant */
.highlight .kd { color: #080; font-weight: bold } /* Keyword.Declaration */
.highlight .kn { color: #080; font-weight: bold } /* Keyword.Namespace */
.highlight .kp { color: #080 } /* Keyword.Pseudo */
.highlight .kr { color: #080; font-weight: bold } /* Keyword.Reserved */
.highlight .kt { color: #888; font-weight: bold } /* Keyword.Type */
.highlight .m { color: #00D; font-weight: bold } /* Literal.Number */
.highlight .s { color: #D20; background-color: #FFF0F0 } /* Literal.String */
.highlight .na { color: #369 } /* Name.Attribute */
.highlight .nb { color: #038 } /* Name.Builtin */
.highlight .nc { color: #B06; font-weight: bold } /* Name.Class */
.highlight .no { color: #036; font-weight: bold } /* Name.Constant */
.highlight .nd { color: #555 } /* Name.Decorator */
.highlight .ne { color: #B06; font-weight: bold } /* Name.Exception */
.highlight .nf { color: #06B; font-weight: bold } /* Name.Function */
.highlight .nl { color: #369; font-style: italic } /* Name.Label */
.highlight .nn { color: #B06; font-weight: bold } /* Name.Namespace */
.highlight .py { color: #369; font-weight: bold } /* Name.Property */
.highlight .nt { color: #B06; font-weight: bold } /* Name.Tag */
.highlight .nv { color: #369 } /* Name.Variable */
.highlight .ow { color: #080 } /* Operator.Word */
.highlight .w { color: #BBB } /* Text.Whitespace */
.highlight .mb { color: #00D; font-weight: bold } /* Literal.Number.Bin */
.highlight .mf { color: #00D; font-weight: bold } /* Literal.Number.Float */
.highlight .mh { color: #00D; font-weight: bold } /* Literal.Number.Hex */
.highlight .mi { color: #00D; font-weight: bold } /* Literal.Number.Integer */
.highlight .mo { color: #00D; font-weight: bold } /* Literal.Number.Oct */
.highlight .sa { color: #D20; background-color: #FFF0F0 } /* Literal.String.Affix */
.highlight .sb { color: #D20; background-color: #FFF0F0 } /* Literal.String.Backtick */
.highlight .sc { color: #D20; background-color: #FFF0F0 } /* Literal.String.Char */
.highlight .dl { color: #D20; background-color: #FFF0F0 } /* Literal.String.Delimiter */
.highlight .sd { color: #D20; background-color: #FFF0F0 } /* Literal.String.Doc */
.highlight .s2 { color: #D20; background-color: #FFF0F0 } /* Literal.String.Double */
.highlight .se { color: #04D; background-color: #FFF0F0 } /* Literal.String.Escape */
.highlight .sh { color: #D20; background-color: #FFF0F0 } /* Literal.String.Heredoc */
.highlight .si { color: #33B; background-color: #FFF0F0 } /* Literal.String.Interpol */
.highlight .sx { color: #2B2; background-color: #F0FFF0 } /* Literal.String.Other */
.highlight .sr { color: #080; background-color: #FFF0FF } /* Literal.String.Regex */
.highlight .s1 { color: #D20; background-color: #FFF0F0 } /* Literal.String.Single */
.highlight .ss { color: #A60; background-color: #FFF0F0 } /* Literal.String.Symbol */
.highlight .bp { color: #038 } /* Name.Builtin.Pseudo */
.highlight .fm { color: #06B; font-weight: bold } /* Name.Function.Magic */
.highlight .vc { color: #369 } /* Name.Variable.Class */
.highlight .vg { color: #D70 } /* Name.Variable.Global */
.highlight .vi { color: #33B } /* Name.Variable.Instance */
.highlight .vm { color: #369 } /* Name.Variable.Magic */
.highlight .il { color: #00D; font-weight: bold } /* Literal.Number.Integer.Long */</style><div class="highlight"><pre><span></span>{&quot;version&quot;:3,&quot;file&quot;:&quot;app.js&quot;,&quot;sourceRoot&quot;:&quot;&quot;,&quot;sources&quot;:[&quot;app.ts&quot;],&quot;names&quot;:[],&quot;mappings&quot;:&quot;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAA6B;AAC7B,oDAA8B;AAC9B,iEAAkD;AAClD,2DAA4C;AAC5C,+DAAgD;AAChD,2EAA2D;AAC3D,uDAAiC;AAEjC,8CAAwB;AACxB,8CAAwB;AAExB,kCAAwC;AAExC,IAAM,GAAG,GAAG,IAAA,iBAAO,EAAC;IAClB,MAAM,EAAE,IAAA,cAAI,GAAE;IACd,qBAAqB,EAAE,IAAI;IAC3B,cAAc,EAAE,GAAG;CACpB,CAAC,CAAC;AAEH,MAAM,GAAG,CAAC,QAAQ,kEAAQ,qBAAqB,QAAG;IAChD,SAAS,EAAE,UAAC,GAAG,EAAE,GAAG,IAAK,OAAA,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAA9B,CAA8B;IACvD,GAAG,EAAE,GAAG;IACR,UAAU,EAAE,IAAI;IAChB,YAAY,EAAE,UAAC,GAAG,IAAK,OAAA,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAA/B,CAA+B;IACtD,oBAAoB,EAAE,UAAC,GAAG,EAAE,OAAO;QACjC,OAAO;YACL,UAAU,EAAE,GAAG;YACf,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,yCAAyC;SACnD,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,GAAG,CAAC,QAAQ,CAAC,wBAAoB,EAAE;IACjC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAM,CAAC,GAAG,EAAE,KAAK,CAAC;CACpC,CAAC,CAAC;AAEH,GAAG,CAAC,QAAQ,CAAC,kBAAe,CAAC,UAAU,EAAE,CAAC,CAAC;AAC3C,GAAG,CAAC,QAAQ,CAAC,kBAAe,CAAC,aAAa,EAAE,CAAC,CAAC;AAE9C,kBAAe,CAAC,GAAG,CAAC,KAAK,EAAE,kBAAW,CAAC,CAAC;AAExC,GAAG,CAAC,QAAQ,CAAC,mBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAA,EAAE,EAAI,CAAC,CAAA,EAAE,EAAE,CAAC,CAAC;AAElE,GAAG,CAAC,QAAQ,CAAC,gBAAa,EAAE;IAC1B,IAAI,EAAE,cAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC;IAC7C,MAAM,EAAE,UAAU;CACnB,CAAC,CAAC;AAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,cAAI,EAAE;IACvB,MAAM,EAAE,IAAI;CACb,CAAC,CAAC;AAEH,GAAG,CAAC,eAAe,CAAC,UAAC,KAAK,EAAE,OAAO,EAAE,KAAK;IACxC,IAAI,KAAK,YAAY,iBAAO,CAAC,UAAU,CAAC,uBAAuB,EAAE,CAAC;QAChE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,GAAG,CAAC,kBAAkB,CAAC,UAAC,OAAO,EAAE,KAAK;IACpC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,kBAAe,GAAG,CAAC&quot;}
</pre></div>