add new api call to allow client to update amplitude events

website/server/controllers/top-level/analytics.js

@@ -1,4 +1,3 @@
-import pick from 'lodash/pick';
 import {
   NotAuthorized,
 } from '../../libs/errors';
@@ -31,7 +30,7 @@ api.trackEvent = {
     const eventProperties = req.body;
 
     res.analytics.track(req.params.eventName, {
-      user: pick(user, ['preferences', 'registeredThrough']),
+      user,
       uuid: user._id,
       headers: req.headers,
       category: 'behavior',
@@ -44,4 +43,30 @@ api.trackEvent = {
   },
 };
 
+api.updateUserProperties = {
+  method: 'POST',
+  url: '/analytics/update',
+  // we authenticate these requests to make sure they actually came from a real user
+  middlewares: [authWithHeaders()],
+  async handler (req, res) {
+    // As of now only web can track events using this route
+    if (req.headers['x-client'] !== 'habitica-web') {
+      throw new NotAuthorized('Only habitica.com is allowed to track analytics events.');
+    }
+
+    const { user } = res.locals;
+    const properties = req.body;
+
+    res.analytics.track(req.params.eventName, {
+      user,
+      uuid: user._id,
+      properties,
+    });
+
+    // not using res.respond
+    // because we don't want to send back notifications and other user-related data
+    res.status(200).send({});
+  },
+};
+
 export default api;