diff --git a/PLAN.md b/PLAN.md index bc56150..14b9a02 100644 --- a/PLAN.md +++ b/PLAN.md @@ -92,13 +92,13 @@ Allow users to define goals and track conversion rates. The `CollectController` currently does synchronous DB writes. This won't scale under real traffic. -- [ ] Move ingestion to a queued job (`ProcessTrackingPayload`) dispatched from the controller so the endpoint returns instantly -- [ ] Add rate limiting middleware to `POST /api/collect` (e.g., 60 req/min per IP) -- [ ] Add CORS headers to the collect endpoint so browsers allow cross-origin beacons -- [ ] Validate the incoming `referrer` / `url` against the website's `domain` to reject spoofed traffic -- [ ] Add IP-based geolocation (use MaxMind GeoLite2 via `stevebauman/location` or similar) to populate `country`, `region`, `city` on the `Visitor` -- [ ] Handle bot filtering — skip known bot user agents (use `jaybizzle/crawler-detect`) -- [ ] Add a `tracking_pixel` endpoint (1x1 GIF) as a no-JS fallback +- [x] Move ingestion to a queued job (`ProcessTrackingPayload`) dispatched from the controller so the endpoint returns instantly +- [x] Add rate limiting middleware to `POST /api/collect` (e.g., 120 req/min per IP) +- [x] Add CORS headers to the collect endpoint so browsers allow cross-origin beacons +- [x] Validate the incoming `referrer` / `url` against the website's `domain` to reject spoofed traffic +- [x] Add IP-based geolocation (use MaxMind GeoLite2 via `stevebauman/location`) to populate `country`, `region`, `city` on the `Visitor` +- [x] Handle bot filtering — skip known bot user agents (using `jaybizzle/crawler-detect`) +- [x] Add a `tracking_pixel` endpoint (1x1 GIF) as a no-JS fallback --- diff --git a/app/Http/Controllers/CollectController.php b/app/Http/Controllers/CollectController.php index fc49f1b..9520b15 100644 --- a/app/Http/Controllers/CollectController.php +++ b/app/Http/Controllers/CollectController.php @@ -2,20 +2,22 @@ namespace App\Http\Controllers; -use App\Models\AnalyticsSession; -use App\Models\Event; -use App\Models\PageView; -use App\Models\Visitor; +use App\Jobs\ProcessTrackingPayload; use App\Models\Website; -use App\Services\GoalEvaluationService; use Illuminate\Http\JsonResponse; use Illuminate\Http\Request; +use Illuminate\Http\Response; use Illuminate\Support\Carbon; +use Jaybizzle\CrawlerDetect\CrawlerDetect; class CollectController extends Controller { public function store(Request $request): JsonResponse { + if ($this->isBot($request)) { + return response()->json(['ok' => false, 'reason' => 'bot'], 200); + } + $payload = $request->validate([ 'tid' => 'required|string', 'vid' => 'required|string|max:64', @@ -55,117 +57,81 @@ class CollectController extends Controller 'is_new_session' => 'nullable|boolean', ]); - $website = Website::where('tracking_id', $payload['tid']) - ->where('is_active', true) - ->first(); - - if (! $website) { - return response()->json(['ok' => false], 404); + if (! $this->isDomainValid($payload)) { + return response()->json(['ok' => false, 'reason' => 'domain_mismatch'], 400); } - $now = Carbon::now(); - - $visitor = Visitor::updateOrCreate( - [ - 'website_id' => $website->id, - 'uid' => $payload['vid'], - ], - [ - 'last_seen_at' => $now, - 'first_seen_at' => $now, - 'device_type' => $payload['device'] ?? null, - 'browser' => $payload['browser'] ?? null, - 'browser_version' => $payload['browser_version'] ?? null, - 'os' => $payload['os'] ?? null, - 'os_version' => $payload['os_version'] ?? null, - 'screen_resolution' => $payload['sr'] ?? null, - 'language' => $payload['lang'] ?? null, - ], - ); - - if ($visitor->wasRecentlyCreated) { - $visitor->update(['first_seen_at' => $now]); - } - - $session = AnalyticsSession::firstOrCreate( - ['uid' => $payload['sid']], - [ - 'website_id' => $website->id, - 'visitor_id' => $visitor->id, - 'started_at' => $now, - 'entry_page' => $payload['path'] ?? $payload['url'] ?? null, - 'ip_address' => $request->ip(), - 'referrer_url' => $payload['referrer'] ?? null, - 'referrer_domain' => $payload['ref_domain'] ?? null, - 'utm_source' => $payload['utm_source'] ?? null, - 'utm_medium' => $payload['utm_medium'] ?? null, - 'utm_campaign' => $payload['utm_campaign'] ?? null, - 'utm_term' => $payload['utm_term'] ?? null, - 'utm_content' => $payload['utm_content'] ?? null, - ], - ); - - if ($payload['type'] === 'pageview') { - $this->recordPageView($website, $visitor, $session, $payload, $now); - } - - if ($payload['type'] === 'event') { - $this->recordEvent($website, $visitor, $session, $payload, $now); - } - - $session->update([ - 'ended_at' => $now, - 'duration' => $now->diffInSeconds($session->started_at), - 'exit_page' => $payload['path'] ?? $payload['url'] ?? $session->exit_page, - 'pages_count' => $session->pageViews()->count(), - 'is_bounce' => $session->pageViews()->count() <= 1, - ]); - - $session->refresh(); - - app(GoalEvaluationService::class)->evaluate($website, $visitor, $session, $payload, $now); + ProcessTrackingPayload::dispatch($payload, $request->ip(), Carbon::now()); return response()->json(['ok' => true]); } - private function recordPageView( - Website $website, - Visitor $visitor, - AnalyticsSession $session, - array $payload, - Carbon $now, - ): void { - PageView::create([ - 'website_id' => $website->id, - 'visitor_id' => $visitor->id, - 'analytics_session_id' => $session->id, - 'url' => $payload['url'] ?? '', - 'path' => $payload['path'] ?? '/', - 'title' => $payload['title'] ?? null, - 'referrer' => $payload['referrer'] ?? null, - 'time_on_page' => $payload['time_on_page'] ?? null, - 'viewed_at' => $now, - ]); + /** + * 1x1 transparent GIF tracking pixel for no-JS fallback. + * Usage: + */ + public function pixel(Request $request): Response + { + if ($this->isBot($request)) { + return $this->gifResponse(); + } + + $tid = $request->get('tid'); + + if ($tid) { + $payload = [ + 'tid' => $tid, + 'vid' => $request->get('vid', md5($request->ip() . $request->userAgent())), + 'sid' => $request->get('sid', md5($request->ip() . $request->userAgent() . date('Y-m-d-H'))), + 'type' => 'pageview', + 'url' => $request->get('url', $request->header('Referer')), + 'path' => $request->get('path', parse_url($request->header('Referer', '/'), PHP_URL_PATH)), + 'referrer' => $request->header('Referer'), + ]; + + ProcessTrackingPayload::dispatch($payload, $request->ip(), Carbon::now()); + } + + return $this->gifResponse(); } - private function recordEvent( - Website $website, - Visitor $visitor, - AnalyticsSession $session, - array $payload, - Carbon $now, - ): void { - Event::create([ - 'website_id' => $website->id, - 'visitor_id' => $visitor->id, - 'analytics_session_id' => $session->id, - 'name' => $payload['event_name'] ?? 'unknown', - 'category' => $payload['event_category'] ?? null, - 'action' => $payload['event_action'] ?? null, - 'label' => $payload['event_label'] ?? null, - 'value' => $payload['event_value'] ?? null, - 'properties' => $payload['event_properties'] ?? null, - 'occurred_at' => $now, + private function isBot(Request $request): bool + { + return (new CrawlerDetect)->isCrawler($request->userAgent()); + } + + private function isDomainValid(array $payload): bool + { + $url = $payload['url'] ?? null; + if (! $url) { + return true; + } + + $host = parse_url($url, PHP_URL_HOST); + if (! $host) { + return true; + } + + $website = Website::where('tracking_id', $payload['tid'])->first(); + if (! $website) { + return true; // let the job handle the 404 + } + + $domain = $website->domain; + + // Allow exact match or subdomain match (e.g. www.example.com matches example.com) + return $host === $domain || str_ends_with($host, '.' . $domain); + } + + private function gifResponse(): Response + { + // 1x1 transparent GIF + $gif = base64_decode('R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7'); + + return response($gif, 200, [ + 'Content-Type' => 'image/gif', + 'Content-Length' => strlen($gif), + 'Cache-Control' => 'no-store, no-cache, must-revalidate, max-age=0', ]); } } diff --git a/app/Http/Middleware/CollectCors.php b/app/Http/Middleware/CollectCors.php new file mode 100644 index 0000000..5af5054 --- /dev/null +++ b/app/Http/Middleware/CollectCors.php @@ -0,0 +1,35 @@ +isMethod('OPTIONS')) { + return response('', 204, $this->corsHeaders($request)); + } + + $response = $next($request); + + foreach ($this->corsHeaders($request) as $key => $value) { + $response->headers->set($key, $value); + } + + return $response; + } + + private function corsHeaders(Request $request): array + { + return [ + 'Access-Control-Allow-Origin' => '*', + 'Access-Control-Allow-Methods' => 'GET, POST, OPTIONS', + 'Access-Control-Allow-Headers' => 'Content-Type, X-Requested-With', + 'Access-Control-Max-Age' => '86400', + ]; + } +} diff --git a/app/Jobs/ProcessTrackingPayload.php b/app/Jobs/ProcessTrackingPayload.php new file mode 100644 index 0000000..c02fb80 --- /dev/null +++ b/app/Jobs/ProcessTrackingPayload.php @@ -0,0 +1,142 @@ +payload['tid']) + ->where('is_active', true) + ->first(); + + if (! $website) { + return; + } + + $now = $this->receivedAt; + + $visitor = Visitor::updateOrCreate( + [ + 'website_id' => $website->id, + 'uid' => $this->payload['vid'], + ], + [ + 'last_seen_at' => $now, + 'first_seen_at' => $now, + 'device_type' => $this->payload['device'] ?? null, + 'browser' => $this->payload['browser'] ?? null, + 'browser_version' => $this->payload['browser_version'] ?? null, + 'os' => $this->payload['os'] ?? null, + 'os_version' => $this->payload['os_version'] ?? null, + 'screen_resolution' => $this->payload['sr'] ?? null, + 'language' => $this->payload['lang'] ?? null, + ], + ); + + if ($visitor->wasRecentlyCreated) { + $visitor->update(['first_seen_at' => $now]); + $this->geolocate($visitor); + } + + $session = AnalyticsSession::firstOrCreate( + ['uid' => $this->payload['sid']], + [ + 'website_id' => $website->id, + 'visitor_id' => $visitor->id, + 'started_at' => $now, + 'entry_page' => $this->payload['path'] ?? $this->payload['url'] ?? null, + 'ip_address' => $this->ip, + 'referrer_url' => $this->payload['referrer'] ?? null, + 'referrer_domain' => $this->payload['ref_domain'] ?? null, + 'utm_source' => $this->payload['utm_source'] ?? null, + 'utm_medium' => $this->payload['utm_medium'] ?? null, + 'utm_campaign' => $this->payload['utm_campaign'] ?? null, + 'utm_term' => $this->payload['utm_term'] ?? null, + 'utm_content' => $this->payload['utm_content'] ?? null, + ], + ); + + if ($this->payload['type'] === 'pageview') { + PageView::create([ + 'website_id' => $website->id, + 'visitor_id' => $visitor->id, + 'analytics_session_id' => $session->id, + 'url' => $this->payload['url'] ?? '', + 'path' => $this->payload['path'] ?? '/', + 'title' => $this->payload['title'] ?? null, + 'referrer' => $this->payload['referrer'] ?? null, + 'time_on_page' => $this->payload['time_on_page'] ?? null, + 'viewed_at' => $now, + ]); + } + + if ($this->payload['type'] === 'event') { + Event::create([ + 'website_id' => $website->id, + 'visitor_id' => $visitor->id, + 'analytics_session_id' => $session->id, + 'name' => $this->payload['event_name'] ?? 'unknown', + 'category' => $this->payload['event_category'] ?? null, + 'action' => $this->payload['event_action'] ?? null, + 'label' => $this->payload['event_label'] ?? null, + 'value' => $this->payload['event_value'] ?? null, + 'properties' => $this->payload['event_properties'] ?? null, + 'occurred_at' => $now, + ]); + } + + $session->update([ + 'ended_at' => $now, + 'duration' => $now->diffInSeconds($session->started_at), + 'exit_page' => $this->payload['path'] ?? $this->payload['url'] ?? $session->exit_page, + 'pages_count' => $session->pageViews()->count(), + 'is_bounce' => $session->pageViews()->count() <= 1, + ]); + + $session->refresh(); + + $goalService->evaluate($website, $visitor, $session, $this->payload, $now); + } + + private function geolocate(Visitor $visitor): void + { + try { + $position = Location::get($this->ip); + + if ($position) { + $visitor->update(array_filter([ + 'country' => $position->countryCode ?? null, + 'region' => $position->regionName ?? null, + 'city' => $position->cityName ?? null, + ])); + } + } catch (\Throwable) { + // Geolocation is best-effort; never fail the job over it + } + } +} diff --git a/app/Providers/AppServiceProvider.php b/app/Providers/AppServiceProvider.php index 452e6b6..1a02609 100644 --- a/app/Providers/AppServiceProvider.php +++ b/app/Providers/AppServiceProvider.php @@ -2,23 +2,22 @@ namespace App\Providers; +use Illuminate\Cache\RateLimiting\Limit; +use Illuminate\Http\Request; +use Illuminate\Support\Facades\RateLimiter; use Illuminate\Support\ServiceProvider; class AppServiceProvider extends ServiceProvider { - /** - * Register any application services. - */ public function register(): void { // } - /** - * Bootstrap any application services. - */ public function boot(): void { - // + RateLimiter::for('collect', function (Request $request) { + return Limit::perMinute(120)->by($request->ip()); + }); } } diff --git a/bootstrap/app.php b/bootstrap/app.php index c3928c5..52e947e 100644 --- a/bootstrap/app.php +++ b/bootstrap/app.php @@ -12,7 +12,9 @@ return Application::configure(basePath: dirname(__DIR__)) health: '/up', ) ->withMiddleware(function (Middleware $middleware): void { - // + $middleware->alias([ + 'collect.cors' => \App\Http\Middleware\CollectCors::class, + ]); }) ->withExceptions(function (Exceptions $exceptions): void { // diff --git a/composer.json b/composer.json index bf1e45d..b42db3d 100644 --- a/composer.json +++ b/composer.json @@ -7,9 +7,11 @@ "license": "MIT", "require": { "php": "^8.2", + "jaybizzle/crawler-detect": "^1.3", "laravel/fortify": "^1.36", "laravel/framework": "^12.0", - "laravel/tinker": "^2.10.1" + "laravel/tinker": "^2.10.1", + "stevebauman/location": "^7.6" }, "require-dev": { "fakerphp/faker": "^1.23", diff --git a/composer.lock b/composer.lock index 6a184f9..7156cff 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "becabed4078ee42d7bbc4bbb883de3eb", + "content-hash": "9d9708b2d4e7cc126272d691e95fa963", "packages": [ { "name": "bacon/bacon-qr-code", @@ -190,6 +190,78 @@ ], "time": "2024-02-09T16:56:22+00:00" }, + { + "name": "composer/ca-bundle", + "version": "1.5.10", + "source": { + "type": "git", + "url": "https://github.com/composer/ca-bundle.git", + "reference": "961a5e4056dd2e4a2eedcac7576075947c28bf63" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/composer/ca-bundle/zipball/961a5e4056dd2e4a2eedcac7576075947c28bf63", + "reference": "961a5e4056dd2e4a2eedcac7576075947c28bf63", + "shasum": "" + }, + "require": { + "ext-openssl": "*", + "ext-pcre": "*", + "php": "^7.2 || ^8.0" + }, + "require-dev": { + "phpstan/phpstan": "^1.10", + "phpunit/phpunit": "^8 || ^9", + "psr/log": "^1.0 || ^2.0 || ^3.0", + "symfony/process": "^4.0 || ^5.0 || ^6.0 || ^7.0" + }, + "type": "library", + "extra": { + "branch-alias": { + "dev-main": "1.x-dev" + } + }, + "autoload": { + "psr-4": { + "Composer\\CaBundle\\": "src" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Jordi Boggiano", + "email": "j.boggiano@seld.be", + "homepage": "http://seld.be" + } + ], + "description": "Lets you find a path to the system CA bundle, and includes a fallback to the Mozilla CA bundle.", + "keywords": [ + "cabundle", + "cacert", + "certificate", + "ssl", + "tls" + ], + "support": { + "irc": "irc://irc.freenode.org/composer", + "issues": "https://github.com/composer/ca-bundle/issues", + "source": "https://github.com/composer/ca-bundle/tree/1.5.10" + }, + "funding": [ + { + "url": "https://packagist.com", + "type": "custom" + }, + { + "url": "https://github.com/composer", + "type": "github" + } + ], + "time": "2025-12-08T15:06:51+00:00" + }, { "name": "dasprid/enum", "version": "1.0.7", @@ -684,6 +756,64 @@ ], "time": "2025-12-03T09:33:47+00:00" }, + { + "name": "geoip2/geoip2", + "version": "v3.3.0", + "source": { + "type": "git", + "url": "https://github.com/maxmind/GeoIP2-php.git", + "reference": "49fceddd694295e76e970a32848e03bb19e56b42" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/maxmind/GeoIP2-php/zipball/49fceddd694295e76e970a32848e03bb19e56b42", + "reference": "49fceddd694295e76e970a32848e03bb19e56b42", + "shasum": "" + }, + "require": { + "ext-json": "*", + "maxmind-db/reader": "^1.13.0", + "maxmind/web-service-common": "~0.11", + "php": ">=8.1" + }, + "require-dev": { + "friendsofphp/php-cs-fixer": "3.*", + "phpstan/phpstan": "*", + "phpunit/phpunit": "^10.0", + "squizlabs/php_codesniffer": "4.*" + }, + "type": "library", + "autoload": { + "psr-4": { + "GeoIp2\\": "src" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "Apache-2.0" + ], + "authors": [ + { + "name": "Gregory J. Oschwald", + "email": "goschwald@maxmind.com", + "homepage": "https://www.maxmind.com/" + } + ], + "description": "MaxMind GeoIP2 PHP API", + "homepage": "https://github.com/maxmind/GeoIP2-php", + "keywords": [ + "IP", + "geoip", + "geoip2", + "geolocation", + "maxmind" + ], + "support": { + "issues": "https://github.com/maxmind/GeoIP2-php/issues", + "source": "https://github.com/maxmind/GeoIP2-php/tree/v3.3.0" + }, + "time": "2025-11-20T18:50:15+00:00" + }, { "name": "graham-campbell/result-type", "version": "v1.1.4", @@ -1158,6 +1288,58 @@ ], "time": "2025-08-22T14:27:06+00:00" }, + { + "name": "jaybizzle/crawler-detect", + "version": "v1.3.7", + "source": { + "type": "git", + "url": "https://github.com/JayBizzle/Crawler-Detect.git", + "reference": "7f7a45b5d5df9c95ba6b2008544e6cf8e66de6f5" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/JayBizzle/Crawler-Detect/zipball/7f7a45b5d5df9c95ba6b2008544e6cf8e66de6f5", + "reference": "7f7a45b5d5df9c95ba6b2008544e6cf8e66de6f5", + "shasum": "" + }, + "require": { + "php": ">=7.1.0" + }, + "require-dev": { + "phpunit/phpunit": "^4.8|^5.5|^6.5|^7.5|^8.5|^9.4" + }, + "type": "library", + "autoload": { + "psr-4": { + "Jaybizzle\\CrawlerDetect\\": "src/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Mark Beech", + "email": "m@rkbee.ch", + "role": "Developer" + } + ], + "description": "CrawlerDetect is a PHP class for detecting bots/crawlers/spiders via the user agent", + "homepage": "https://github.com/JayBizzle/Crawler-Detect/", + "keywords": [ + "crawler", + "crawler detect", + "crawler detector", + "crawlerdetect", + "php crawler detect" + ], + "support": { + "issues": "https://github.com/JayBizzle/Crawler-Detect/issues", + "source": "https://github.com/JayBizzle/Crawler-Detect/tree/v1.3.7" + }, + "time": "2026-02-02T19:15:54+00:00" + }, { "name": "laravel/fortify", "version": "v1.36.1", @@ -2188,6 +2370,121 @@ ], "time": "2026-03-08T20:05:35+00:00" }, + { + "name": "maxmind-db/reader", + "version": "v1.13.1", + "source": { + "type": "git", + "url": "https://github.com/maxmind/MaxMind-DB-Reader-php.git", + "reference": "2194f58d0f024ce923e685cdf92af3daf9951908" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/maxmind/MaxMind-DB-Reader-php/zipball/2194f58d0f024ce923e685cdf92af3daf9951908", + "reference": "2194f58d0f024ce923e685cdf92af3daf9951908", + "shasum": "" + }, + "require": { + "php": ">=7.2" + }, + "conflict": { + "ext-maxminddb": "<1.11.1 || >=2.0.0" + }, + "require-dev": { + "friendsofphp/php-cs-fixer": "3.*", + "phpstan/phpstan": "*", + "phpunit/phpunit": ">=8.0.0,<10.0.0", + "squizlabs/php_codesniffer": "4.*" + }, + "suggest": { + "ext-bcmath": "bcmath or gmp is required for decoding larger integers with the pure PHP decoder", + "ext-gmp": "bcmath or gmp is required for decoding larger integers with the pure PHP decoder", + "ext-maxminddb": "A C-based database decoder that provides significantly faster lookups", + "maxmind-db/reader-ext": "C extension for significantly faster IP lookups (install via PIE: pie install maxmind-db/reader-ext)" + }, + "type": "library", + "autoload": { + "psr-4": { + "MaxMind\\Db\\": "src/MaxMind/Db" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "Apache-2.0" + ], + "authors": [ + { + "name": "Gregory J. Oschwald", + "email": "goschwald@maxmind.com", + "homepage": "https://www.maxmind.com/" + } + ], + "description": "MaxMind DB Reader API", + "homepage": "https://github.com/maxmind/MaxMind-DB-Reader-php", + "keywords": [ + "database", + "geoip", + "geoip2", + "geolocation", + "maxmind" + ], + "support": { + "issues": "https://github.com/maxmind/MaxMind-DB-Reader-php/issues", + "source": "https://github.com/maxmind/MaxMind-DB-Reader-php/tree/v1.13.1" + }, + "time": "2025-11-21T22:24:26+00:00" + }, + { + "name": "maxmind/web-service-common", + "version": "v0.11.1", + "source": { + "type": "git", + "url": "https://github.com/maxmind/web-service-common-php.git", + "reference": "c309236b5a5555b96cf560089ec3cead12d845d2" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/maxmind/web-service-common-php/zipball/c309236b5a5555b96cf560089ec3cead12d845d2", + "reference": "c309236b5a5555b96cf560089ec3cead12d845d2", + "shasum": "" + }, + "require": { + "composer/ca-bundle": "^1.0.3", + "ext-curl": "*", + "ext-json": "*", + "php": ">=8.1" + }, + "require-dev": { + "friendsofphp/php-cs-fixer": "3.*", + "phpstan/phpstan": "*", + "phpunit/phpunit": "^10.0", + "squizlabs/php_codesniffer": "4.*" + }, + "type": "library", + "autoload": { + "psr-4": { + "MaxMind\\Exception\\": "src/Exception", + "MaxMind\\WebService\\": "src/WebService" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "Apache-2.0" + ], + "authors": [ + { + "name": "Gregory Oschwald", + "email": "goschwald@maxmind.com" + } + ], + "description": "Internal MaxMind Web Service API", + "homepage": "https://github.com/maxmind/web-service-common-php", + "support": { + "issues": "https://github.com/maxmind/web-service-common-php/issues", + "source": "https://github.com/maxmind/web-service-common-php/tree/v0.11.1" + }, + "time": "2026-01-13T17:56:03+00:00" + }, { "name": "monolog/monolog", "version": "3.10.0", @@ -3584,6 +3881,75 @@ }, "time": "2025-12-14T04:43:48+00:00" }, + { + "name": "stevebauman/location", + "version": "v7.6.2", + "source": { + "type": "git", + "url": "https://github.com/stevebauman/location.git", + "reference": "2f7686b685b924f193d6a6b82074861b8cc5aa3a" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/stevebauman/location/zipball/2f7686b685b924f193d6a6b82074861b8cc5aa3a", + "reference": "2f7686b685b924f193d6a6b82074861b8cc5aa3a", + "shasum": "" + }, + "require": { + "ext-curl": "*", + "ext-json": "*", + "geoip2/geoip2": "^2.0|^3.0", + "guzzlehttp/guzzle": "^7.0", + "illuminate/support": "^8.0|^9.0|^10.0|^11.0|^12.0", + "php": ">=8.1" + }, + "require-dev": { + "mockery/mockery": "^1.0", + "orchestra/testbench": "^6.0|^7.0|^8.0|^9.0|^10.0", + "pestphp/pest": "^1.0|^2.0|^3.7" + }, + "type": "library", + "extra": { + "laravel": { + "aliases": { + "Location": "Stevebauman\\Location\\Facades\\Location" + }, + "providers": [ + "Stevebauman\\Location\\LocationServiceProvider" + ] + } + }, + "autoload": { + "psr-4": { + "Stevebauman\\Location\\": "src/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Steve Bauman", + "email": "steven_bauman@outlook.com" + } + ], + "description": "Retrieve a user's location by their IP Address", + "keywords": [ + "IP", + "geo", + "geo-location", + "geoip", + "laravel", + "location", + "php" + ], + "support": { + "issues": "https://github.com/stevebauman/location/issues", + "source": "https://github.com/stevebauman/location/tree/v7.6.2" + }, + "time": "2026-02-11T16:06:17+00:00" + }, { "name": "symfony/clock", "version": "v8.0.0", diff --git a/routes/api.php b/routes/api.php index 5380171..115ccfc 100644 --- a/routes/api.php +++ b/routes/api.php @@ -5,7 +5,15 @@ use App\Http\Controllers\TrackingScriptController; use Illuminate\Support\Facades\Route; Route::get('/t/{trackingId}.js', [TrackingScriptController::class, 'script']) + ->middleware('collect.cors') ->name('tracking.script'); -Route::post('/collect', [CollectController::class, 'store']) - ->name('collect.store'); +Route::middleware('collect.cors')->group(function () { + Route::post('/collect', [CollectController::class, 'store']) + ->middleware('throttle:collect') + ->name('collect.store'); + + Route::get('/pixel', [CollectController::class, 'pixel']) + ->middleware('throttle:collect') + ->name('collect.pixel'); +});