访客落地页、在线读秒与浏览轨迹

记录进线页面与换页路径，心跳刷新活跃时间；工作台展示落地页/当前页/轨迹时间线与在线时长，嵌入脚本同步宿主 SPA 路由。

server/internal/handler/page_track_test.go

@@ -0,0 +1,31 @@
+package handler
+
+import (
+	"strings"
+	"testing"
+	"unicode/utf8"
+)
+
+func TestSanitizePageURL(t *testing.T) {
+	got := sanitizePageURL("https://shop.example.com/p/1?token=secret&ok=1#hash")
+	if got == "" || strings.Contains(got, "token=") || strings.Contains(got, "#") {
+		t.Fatalf("sanitize failed: %q", got)
+	}
+	if !strings.Contains(got, "ok=1") {
+		t.Fatalf("should keep ok param: %q", got)
+	}
+	if sanitizePageURL("javascript:alert(1)") != "" {
+		t.Fatal("reject javascript")
+	}
+	if sanitizePageURL("") != "" {
+		t.Fatal("empty")
+	}
+}
+
+func TestSanitizePageTitle(t *testing.T) {
+	long := strings.Repeat("测", 300)
+	got := sanitizePageTitle(long)
+	if utf8.RuneCountInString(got) != maxPageTitleLen {
+		t.Fatalf("title len %d", utf8.RuneCountInString(got))
+	}
+}