Loading challenges
Nobody has started this yet — be first.
Business impact
Any account with more than one short URL gets a total_clicks number on every link's analytics page that is inflated by every other link's traffic too. A customer comparing two campaign links to see which performed better would see the same (wrong, identical-ish) inflated number on both. If this analytics endpoint feeds a billing or reporting pipeline (e.g. "pay per click"), this bug means every customer with multiple links is billed/reported against the wrong number, and it gets worse -- silently -- the more links they create.
Problem
total_clicks = db.session.query(func.count(ClickEvent.id)).scalar() has no .filter(ClickEvent.short_url_id == short_url.id) at all -- a straight SELECT COUNT(*) FROM click_events, global across the whole table, disguised as per-slug because it is returned inside GET /api/urls/<slug>/analytics.
Current behavior
total_clicks for slug A includes every other slug's clicks too, e.g. reporting 3 when link-a was only clicked twice and link-b once.
Expected behavior
total_clicks for a given slug reflects only that slug's ClickEvent rows.
Steps to reproduce
Why this matters
clicks_per_day, top_referrers, and top_user_agents in the very same function all correctly filter on ClickEvent.short_url_id == short_url.id -- total_clicks is the one query that does not, exactly the kind of copy-paste-and-forget-one-line mistake that is easy to miss in review because the surrounding code looks so consistent.
Suggested approach
Compare total_clicks's query against clicks_per_day's query immediately below it in the same function -- they should be scoped the same way.
Acceptance criteria
Verification
pytest practice_tickets/tests/test_ticket_05_analytics_total_clicks.py -v
Hints (0/2)
Try it without hints first — the reading is the exercise.
Working on this ticket
Work on a branch named for the ticket — that's what you'll submit.
Branch off your fork
Sign in to create it automatically, or do it yourself:
$git checkout -b fix/analytics-total-clicks-leakFix it and commit
Meet every acceptance criterion, and add a test that would have caught this.
Push the branch
$git push -u origin fix/analytics-total-clicks-leakSubmit it below
Paste your fork URL and the branch name, with a short write-up of the root cause.
Questions
Ask about anything unclear in the ticket — the maintainer and anyone who has solved it can answer. Please don't post full solutions.
Sign in to ask a question or reply.
Sign indocker-entrypoint.shcurl -X POST http://localhost:5000/api/urls \
-H "Content-Type: application/json" \
-d '{"target_url": "https://anthropic.com", "custom_slug": "claude"}'
# -> {"slug": "claude", "short_url": "http://localhost:5000/claude", "expires_at": null}
curl -i http://localhost:5000/claude # 302 redirect, records a click
make seed # or: docker compose exec web flask seed-db
If something is already listening on 5432/6379 locally, uncomment POSTGRES_HOST_PORT / REDIS_HOST_PORT in .env to remap the host side — the app always talks to db/redis over the compose network regardless. Run production-style (gunicorn, no dev server, no bind mount) with docker compose -f docker-compose.prod.yml up --build. GET /healthz checks both Postgres and Redis connectivity.
You do not need Docker running at all to work the tickets — the test suite uses TestingConfig (SQLite in-memory via StaticPool) and fakeredis instead of a real Postgres/Redis, so everything runs against a plain virtualenv:
python3 -m venv .venv && .venv/bin/pip install -r requirements-dev.txt
.venv/bin/pytest practice_tickets/tests/test_ticket_01_base62_roundtrip.py -v # a single ticket
./practice_tickets/run_tickets.sh # all 20, clean pass/fail summary
./practice_tickets/run_tickets.sh 05 13 16 # just a few, by number
All 20 tests fail at the start; as you fix each ticket in app/, its test (and only its test) should flip to passing. .venv/bin/pytest tests/ (via make test) runs the project's own main suite — some ticket bugs (TICKET-05, 07, 08, 09, 14 among others) also break assertions in that suite, since they are real bugs in shared code paths; fixing the ticket fixes those too, not a separate task.
Level 1
Fix a bug
Read existing behaviour, correct it.