Set up Google Analytics ID and API credentials for stats reporting

[xinbenlv]

Original Request

Google Analytics ID and API authentication for reporting (dependency for adding GA tracking and auto-publishing stats to Wikipedia)

Agent's Two Cents (could be wrong)

Everything below is the AI agent's best guess based on the current codebase.
Take with a grain of salt — the original request above is the only thing that came from a human.

Problem / Motivation

To add Google Analytics tracking and automated stats reporting to a Wikipedia page, two credentials are needed: (1) a GA4 Measurement ID for the tracking snippet, and (2) Google Analytics Data API (v1) service account credentials for the server to query analytics data programmatically. Neither currently exists — the project has zero analytics infrastructure.

Proposed Solution

1. Create a GA4 property in Google Analytics for the DoubleCheck web app
2. Obtain the Measurement ID (G-XXXXXXXXXX) and store it as an environment variable
3. Create a Google Cloud service account with Analytics Data API read access
4. Store service account credentials securely for server-side reporting queries
5. Add these to Toolforge envvars and Vercel env for deployment

Dependencies & Potential Blockers

• Requires human action: A Google account with admin access must create the GA4 property and GCP service account — an agent cannot do this
• Cookie consent bar (see related issue) must be implemented before the GA tracking snippet goes live
• Service account JSON key must be stored securely (Toolforge envvars, Vercel env)

How to Validate

• GA4 Measurement ID is set as GOOGLE_ANALYTICS_ID env var
• Service account has roles/analyticsdata.viewer on the GA4 property
• Service account credentials are available to the server via env var
• Both vars documented in .env.example
• Toolforge and Vercel deployments have the vars configured

Scope Estimate

small (but requires manual Google Cloud / Analytics console work)

Key Files/Modules Likely Involved

• .env.example — document new env vars
• packages/server/src/index.ts — validate env vars on startup
• Deployment configs (Toolforge envvars, Vercel dashboard)

Rough Implementation Sketch

• Owner creates GA4 property at analytics.google.com
• Owner creates GCP service account at console.cloud.google.com
• Add env vars: GOOGLE_ANALYTICS_ID, GOOGLE_ANALYTICS_PROPERTY_ID, GOOGLE_SERVICE_ACCOUNT_KEY (base64-encoded JSON)
• Document in .env.example with comments

Open Questions

• Should the GA property be under the wikiloop GCP project or a personal account?
• Do we need GA4 Admin API access too, or just Data API for reading?
• Should the Measurement ID be public (it's visible in page source anyway) or treated as secret?

Potential Risks or Gotchas

• GA4 Measurement IDs are inherently public (embedded in client-side JS) — not a secret, but the service account key IS
• Service account JSON keys are sensitive credentials — must never be committed to git
• Google Analytics Data API has quotas (default: 10,000 requests/day) — sufficient for daily reporting but not real-time