fix(dashboard): support custom-domain self-host onboarding

[izadoesdev]

Self-hosted production dashboards blocked requests to custom API origins, could not share sessions across explicitly configured subdomains, and generated tracking snippets that sent events to hosted ingestion. This change uses the configured origins and ingestion URL—including the copied AI installation prompt—honors BETTER_AUTH_COOKIE_DOMAIN, and skips automatic verification email when verification is disabled.

Rebased onto current staging (c88bc6d1f), preserving the new hosted Dub attribution while disabling it in self-host mode. Signup keeps a sign-in link available. SELFHOST=true omits the dashboard's first-party tracker and advertising/attribution scripts; Turbo includes that setting in its build environment and cache key. Hosted authentication, cookie security, verification, and telemetry defaults remain unchanged. Self-host signup also skips internal Dub and Slack notifications, and the build clears copied OpenAI pixel IDs so the direct registration handler cannot initialize tracking. The AI installation prompt reuses the existing React, Vue, and HTML snippet generators, removing duplicated options and cloud-only instructions.

Validation

• bun run lint and bun run check-types pass; the pre-push test hook completed all 27 tasks successfully.
• 17 targeted regressions cover custom CSP origins, all four SDK snippets and the copied AI prompt, real Better Auth cookie settings, verification opt-in/out, hosted/self-hosted/E2E telemetry behavior, and signup attribution with copied credentials. CI runs these checks explicitly.
• Combined validation on c88bc6d1f: all eight slices pass lint, all 33 typecheck tasks, all 27 root test tasks, and a production dashboard build. The built config sets NEXT_PUBLIC_SELFHOST=true and clears a copied advertising key; the key is absent from browser JavaScript.
• Earlier combined Docker browser smoke passed: signup without email, login, authenticated website creation, pageview ingestion, and a real analytics query/display for /selfhost-smoke, with no email, Autumn, AI, or Kafka credentials.
• The browser receives the configured API/Basket CSP origins and no Databuddy/OpenAI tracking script tags in self-host mode.

Scope and overlaps

Based directly on staging. The self-host quick start in #804 depends on this fix alongside #803 (email senders) and #805 (optional ingestion integrations). The auth changes touch the configuration surface also used by #656 and #692; dependency upgrades and session storage are unchanged.

#816 handles local feature access without Autumn, and #814 keeps omitted self-host URL defaults local. When integrating #816, retain both CI test steps and both Next env entries (NEXT_PUBLIC_SELFHOST and NEXT_PUBLIC_OPENAI_ADS_PIXEL_ID).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
dashboard	Ready	Preview	Sep 16, 2026 8:16pm UTC
databuddy-status	Ready	Preview	Sep 16, 2026 8:16pm UTC
documentation	Ready	Preview	Sep 16, 2026 8:16pm UTC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d11fc50a-f316-4c78-8441-534e5bc365a7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[unkey-deploy]

The latest updates on your projects. Learn more about Unkey Deploy

Name	Status	Preview	Inspect	Updated (UTC)
links (preview)	Ready	Visit Preview	Inspect	Sep 16, 2026 8:15pm

[greptile-apps]

Confidence Score: 4/5

The behavioral changes appear sound, but the explicit prohibition against mocks and placeholder data must be satisfied before merging.

Findings

1.  Prohibited Test Placeholders ▶

Summary

This PR aligns self-hosted dashboard onboarding and authentication with deployment-specific origins and policy settings.

• Adds configured API and Basket origins to the dashboard CSP and generated SDK installation snippets.
• Disables first-party analytics and advertising/attribution integrations for self-hosted dashboards.
• Supports explicitly configured cross-subdomain authentication cookies and verification opt-in/opt-out.
• Adds focused regression coverage and CI execution, although the new test fixtures violate an explicit repository rule.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Env[Self-host environment] --> Dashboard[Dashboard configuration]
  Env --> Auth[Authentication configuration]
  Dashboard --> CSP[Custom API and Basket CSP origins]
  Dashboard --> Snippets[Generated React, Vue, HTML and Node snippets]
  Dashboard --> Telemetry{SELFHOST enabled?}
  Telemetry -->|Yes| Disabled[Omit dashboard analytics, ads and attribution]
  Telemetry -->|No| Hosted[Retain hosted telemetry defaults]
  Auth --> Cookies[Optional shared cookie domain]
  Auth --> Verification[Configured email-verification policy]
  Snippets --> Basket[Configured Basket ingestion service]

Loading

_{Reviews (1) · Last reviewed commit: "fix(dashboard): skip signup attribution ..."}