fix: restore ANALYTICS_ENABLED=true default for consent flow

The security hardening commit changed this to false, which prevents
the analytics consent page from appearing on first login. Users see
"disabled by administrator" instead of being asked to opt in/out.

With ANALYTICS_ENABLED=true, the SDK initializes but NO user data is
sent until the user explicitly accepts on the consent page. The consent
page is the privacy safeguard, not the server-side flag. Self-hosters
who want to fully disable analytics can still set ANALYTICS_ENABLED=false.
This commit is contained in:
SnapOtter
2026-06-08 18:07:04 +08:00
parent 0631c41eb9
commit a3cd33f37f
+1 -1
View File
@@ -81,7 +81,7 @@ const envSchema = z
COOKIE_SECRET: z.string().default(""),
ANALYTICS_ENABLED: z
.enum(["true", "false"])
.default("false")
.default("true")
.transform((v) => v === "true"),
ANALYTICS_SAMPLE_RATE: z.coerce.number().min(0).max(1).default(1.0),
POSTHOG_API_KEY: z.string().default("phc_CVHjGivwWVzh76M5EjijTwP5LpiqWie3EbCzXU7w2Smy"),