Steven/ga

packages/webapp/app/layout.tsx

@@ -1,5 +1,6 @@
 import type { Metadata, Viewport } from "next"
 import { Poppins } from "next/font/google"
+import { GoogleAnalytics } from "@next/third-parties/google"
 
 import "./globals.css"
 import { PostHogIdentify } from "@/components/posthog-identify"
@@ -16,6 +17,9 @@ const poppins = Poppins({
   variable: "--font-sans",
 })
 
+// Public by design (it ships in every page), so it lives in code, not .env.
+const GA_MEASUREMENT_ID = "G-6QWVWW0NLG"
+
 const SITE_DESCRIPTION =
   "Plan your Monash degree: drag units into semesters, check prerequisites and track your WAM. Read student reviews and see requisite maps for every Monash unit and course."
 
@@ -128,6 +132,9 @@ export default function RootLayout({
             mobileOffset={{ bottom: 80 }}
           />
         </ThemeProvider>
+        {/* Page views only, Loads in dev too; filter
+            localhost out by hostname in the GA reports. */}
+        <GoogleAnalytics gaId={GA_MEASUREMENT_ID} />
         <script
           type="application/ld+json"
           dangerouslySetInnerHTML={{ __html: JSON.stringify(orgLd) }}

packages/webapp/next.config.mjs

@@ -43,16 +43,18 @@ const securityHeaders = [
         // nothing. Next's inline scripts and the ISR pages (which can't
         // carry a nonce) need 'unsafe-inline'. PostHog loads through
         // /ingest and runs its recorder in blob workers; sign-in and
-        // useSession() call the central auth origin.
+        // useSession() call the central auth origin. Google Analytics
+        // loads gtag.js from googletagmanager.com and sends hits to
+        // google-analytics.com (region1. for the AU/EU endpoints).
         {
           key: "Content-Security-Policy-Report-Only",
           value: [
             "default-src 'self'",
-            "script-src 'self' 'unsafe-inline'",
+            "script-src 'self' 'unsafe-inline' https://www.googletagmanager.com",
             "style-src 'self' 'unsafe-inline'",
             "img-src 'self' data: blob: https:",
             "font-src 'self' data:",
-            `connect-src 'self' ${authOrigin}`,
+            `connect-src 'self' ${authOrigin} https://*.google-analytics.com https://*.analytics.google.com https://www.googletagmanager.com`,
             "worker-src 'self' blob:",
             `form-action 'self' ${authOrigin}`,
           ].join("; "),
@@ -83,7 +85,9 @@ const nextConfig = {
   // container and never deletes them: 12 GB in 3 days in production,
   // on the disk that Postgres shares. The cache now starts empty after
   // each deploy.
-  experimental: { isrFlushToDisk: false },
+  // `agentUpgrade: "security"` nudges coding agents about Next.js
+  // security upgrades only, not every stable release.
+  experimental: { isrFlushToDisk: false, agentUpgrade: "security" },
 
   // /search was called /tree until 2026-10. A bare /tree redirects to
   // /search. Old /tree?unit=, ?course= and ?aos= links are rewritten

packages/webapp/package.json

@@ -23,6 +23,7 @@
     "@dagrejs/dagre": "^3.1.1",
     "@dnd-kit/core": "^6.3.1",
     "@monmap/db": "workspace:*",
+    "@next/third-parties": "^16.4.2",
     "@xyflow/react": "^12.12.0",
     "better-auth": "^1.7.7",
     "boring-avatars": "2.0.4",
@@ -33,7 +34,7 @@
     "drizzle-orm": "0.45.4",
     "jose": "^6.2.12",
     "lucide-react": "^1.53.0",
-    "next": "16.4.0",
+    "next": "16.4.3",
     "next-themes": "^0.4.6",
     "postgres": "^3.4.9",
     "posthog-js": "^1.438.3",