phase 5

PLAN.md

@@ -92,13 +92,13 @@ Allow users to define goals and track conversion rates.
 
 The `CollectController` currently does synchronous DB writes. This won't scale under real traffic.
 
-- [ ] Move ingestion to a queued job (`ProcessTrackingPayload`) dispatched from the controller so the endpoint returns instantly
+- [x] Move ingestion to a queued job (`ProcessTrackingPayload`) dispatched from the controller so the endpoint returns instantly
-- [ ] Add rate limiting middleware to `POST /api/collect` (e.g., 60 req/min per IP)
+- [x] Add rate limiting middleware to `POST /api/collect` (e.g., 120 req/min per IP)
-- [ ] Add CORS headers to the collect endpoint so browsers allow cross-origin beacons
+- [x] Add CORS headers to the collect endpoint so browsers allow cross-origin beacons
-- [ ] Validate the incoming `referrer` / `url` against the website's `domain` to reject spoofed traffic
+- [x] Validate the incoming `referrer` / `url` against the website's `domain` to reject spoofed traffic
-- [ ] Add IP-based geolocation (use MaxMind GeoLite2 via `stevebauman/location` or similar) to populate `country`, `region`, `city` on the `Visitor`
+- [x] Add IP-based geolocation (use MaxMind GeoLite2 via `stevebauman/location`) to populate `country`, `region`, `city` on the `Visitor`
-- [ ] Handle bot filtering — skip known bot user agents (use `jaybizzle/crawler-detect`)
+- [x] Handle bot filtering — skip known bot user agents (using `jaybizzle/crawler-detect`)
-- [ ] Add a `tracking_pixel` endpoint (1x1 GIF) as a no-JS fallback
+- [x] Add a `tracking_pixel` endpoint (1x1 GIF) as a no-JS fallback
 
 ---
 

app/Http/Controllers/CollectController.php

@@ -2,20 +2,22 @@
 
 namespace App\Http\Controllers;
 
-use App\Models\AnalyticsSession;
+use App\Jobs\ProcessTrackingPayload;
-use App\Models\Event;
-use App\Models\PageView;
-use App\Models\Visitor;
 use App\Models\Website;
-use App\Services\GoalEvaluationService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 use Illuminate\Support\Carbon;
+use Jaybizzle\CrawlerDetect\CrawlerDetect;
 
 class CollectController extends Controller
 {
     public function store(Request $request): JsonResponse
     {
+        if ($this->isBot($request)) {
+            return response()->json(['ok' => false, 'reason' => 'bot'], 200);
+        }
+
         $payload = $request->validate([
             'tid' => 'required|string',
             'vid' => 'required|string|max:64',
@@ -55,117 +57,81 @@ class CollectController extends Controller
             'is_new_session' => 'nullable|boolean',
         ]);
 
-        $website = Website::where('tracking_id', $payload['tid'])
+        if (! $this->isDomainValid($payload)) {
-            ->where('is_active', true)
+            return response()->json(['ok' => false, 'reason' => 'domain_mismatch'], 400);
-            ->first();
-
-        if (! $website) {
-            return response()->json(['ok' => false], 404);
         }
 
-        $now = Carbon::now();
+        ProcessTrackingPayload::dispatch($payload, $request->ip(), Carbon::now());
-
-        $visitor = Visitor::updateOrCreate(
-            [
-                'website_id' => $website->id,
-                'uid' => $payload['vid'],
-            ],
-            [
-                'last_seen_at' => $now,
-                'first_seen_at' => $now,
-                'device_type' => $payload['device'] ?? null,
-                'browser' => $payload['browser'] ?? null,
-                'browser_version' => $payload['browser_version'] ?? null,
-                'os' => $payload['os'] ?? null,
-                'os_version' => $payload['os_version'] ?? null,
-                'screen_resolution' => $payload['sr'] ?? null,
-                'language' => $payload['lang'] ?? null,
-            ],
-        );
-
-        if ($visitor->wasRecentlyCreated) {
-            $visitor->update(['first_seen_at' => $now]);
-        }
-
-        $session = AnalyticsSession::firstOrCreate(
-            ['uid' => $payload['sid']],
-            [
-                'website_id' => $website->id,
-                'visitor_id' => $visitor->id,
-                'started_at' => $now,
-                'entry_page' => $payload['path'] ?? $payload['url'] ?? null,
-                'ip_address' => $request->ip(),
-                'referrer_url' => $payload['referrer'] ?? null,
-                'referrer_domain' => $payload['ref_domain'] ?? null,
-                'utm_source' => $payload['utm_source'] ?? null,
-                'utm_medium' => $payload['utm_medium'] ?? null,
-                'utm_campaign' => $payload['utm_campaign'] ?? null,
-                'utm_term' => $payload['utm_term'] ?? null,
-                'utm_content' => $payload['utm_content'] ?? null,
-            ],
-        );
-
-        if ($payload['type'] === 'pageview') {
-            $this->recordPageView($website, $visitor, $session, $payload, $now);
-        }
-
-        if ($payload['type'] === 'event') {
-            $this->recordEvent($website, $visitor, $session, $payload, $now);
-        }
-
-        $session->update([
-            'ended_at' => $now,
-            'duration' => $now->diffInSeconds($session->started_at),
-            'exit_page' => $payload['path'] ?? $payload['url'] ?? $session->exit_page,
-            'pages_count' => $session->pageViews()->count(),
-            'is_bounce' => $session->pageViews()->count() <= 1,
-        ]);
-
-        $session->refresh();
-
-        app(GoalEvaluationService::class)->evaluate($website, $visitor, $session, $payload, $now);
 
         return response()->json(['ok' => true]);
     }
 
-    private function recordPageView(
+    /**
-        Website $website,
+     * 1x1 transparent GIF tracking pixel for no-JS fallback.
-        Visitor $visitor,
+     * Usage: <img src="/api/pixel?tid=TA-XXX" width="1" height="1" alt="">
-        AnalyticsSession $session,
+     */
-        array $payload,
+    public function pixel(Request $request): Response
-        Carbon $now,
+    {
-    ): void {
+        if ($this->isBot($request)) {
-        PageView::create([
+            return $this->gifResponse();
-            'website_id' => $website->id,
-            'visitor_id' => $visitor->id,
-            'analytics_session_id' => $session->id,
-            'url' => $payload['url'] ?? '',
-            'path' => $payload['path'] ?? '/',
-            'title' => $payload['title'] ?? null,
-            'referrer' => $payload['referrer'] ?? null,
-            'time_on_page' => $payload['time_on_page'] ?? null,
-            'viewed_at' => $now,
-        ]);
         }
 
-    private function recordEvent(
+        $tid = $request->get('tid');
-        Website $website,
+
-        Visitor $visitor,
+        if ($tid) {
-        AnalyticsSession $session,
+            $payload = [
-        array $payload,
+                'tid' => $tid,
-        Carbon $now,
+                'vid' => $request->get('vid', md5($request->ip() . $request->userAgent())),
-    ): void {
+                'sid' => $request->get('sid', md5($request->ip() . $request->userAgent() . date('Y-m-d-H'))),
-        Event::create([
+                'type' => 'pageview',
-            'website_id' => $website->id,
+                'url' => $request->get('url', $request->header('Referer')),
-            'visitor_id' => $visitor->id,
+                'path' => $request->get('path', parse_url($request->header('Referer', '/'), PHP_URL_PATH)),
-            'analytics_session_id' => $session->id,
+                'referrer' => $request->header('Referer'),
-            'name' => $payload['event_name'] ?? 'unknown',
+            ];
-            'category' => $payload['event_category'] ?? null,
+
-            'action' => $payload['event_action'] ?? null,
+            ProcessTrackingPayload::dispatch($payload, $request->ip(), Carbon::now());
-            'label' => $payload['event_label'] ?? null,
+        }
-            'value' => $payload['event_value'] ?? null,
+
-            'properties' => $payload['event_properties'] ?? null,
+        return $this->gifResponse();
-            'occurred_at' => $now,
+    }
+
+    private function isBot(Request $request): bool
+    {
+        return (new CrawlerDetect)->isCrawler($request->userAgent());
+    }
+
+    private function isDomainValid(array $payload): bool
+    {
+        $url = $payload['url'] ?? null;
+        if (! $url) {
+            return true;
+        }
+
+        $host = parse_url($url, PHP_URL_HOST);
+        if (! $host) {
+            return true;
+        }
+
+        $website = Website::where('tracking_id', $payload['tid'])->first();
+        if (! $website) {
+            return true; // let the job handle the 404
+        }
+
+        $domain = $website->domain;
+
+        // Allow exact match or subdomain match (e.g. www.example.com matches example.com)
+        return $host === $domain || str_ends_with($host, '.' . $domain);
+    }
+
+    private function gifResponse(): Response
+    {
+        // 1x1 transparent GIF
+        $gif = base64_decode('R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7');
+
+        return response($gif, 200, [
+            'Content-Type' => 'image/gif',
+            'Content-Length' => strlen($gif),
+            'Cache-Control' => 'no-store, no-cache, must-revalidate, max-age=0',
         ]);
     }
 }

app/Http/Middleware/CollectCors.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class CollectCors
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        if ($request->isMethod('OPTIONS')) {
+            return response('', 204, $this->corsHeaders($request));
+        }
+
+        $response = $next($request);
+
+        foreach ($this->corsHeaders($request) as $key => $value) {
+            $response->headers->set($key, $value);
+        }
+
+        return $response;
+    }
+
+    private function corsHeaders(Request $request): array
+    {
+        return [
+            'Access-Control-Allow-Origin' => '*',
+            'Access-Control-Allow-Methods' => 'GET, POST, OPTIONS',
+            'Access-Control-Allow-Headers' => 'Content-Type, X-Requested-With',
+            'Access-Control-Max-Age' => '86400',
+        ];
+    }
+}

app/Jobs/ProcessTrackingPayload.php

@@ -0,0 +1,142 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\AnalyticsSession;
+use App\Models\Event;
+use App\Models\PageView;
+use App\Models\Visitor;
+use App\Models\Website;
+use App\Services\GoalEvaluationService;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Carbon;
+use Stevebauman\Location\Facades\Location;
+
+class ProcessTrackingPayload implements ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public int $tries = 3;
+
+    public function __construct(
+        private readonly array $payload,
+        private readonly string $ip,
+        private readonly Carbon $receivedAt,
+    ) {}
+
+    public function handle(GoalEvaluationService $goalService): void
+    {
+        $website = Website::where('tracking_id', $this->payload['tid'])
+            ->where('is_active', true)
+            ->first();
+
+        if (! $website) {
+            return;
+        }
+
+        $now = $this->receivedAt;
+
+        $visitor = Visitor::updateOrCreate(
+            [
+                'website_id' => $website->id,
+                'uid' => $this->payload['vid'],
+            ],
+            [
+                'last_seen_at' => $now,
+                'first_seen_at' => $now,
+                'device_type' => $this->payload['device'] ?? null,
+                'browser' => $this->payload['browser'] ?? null,
+                'browser_version' => $this->payload['browser_version'] ?? null,
+                'os' => $this->payload['os'] ?? null,
+                'os_version' => $this->payload['os_version'] ?? null,
+                'screen_resolution' => $this->payload['sr'] ?? null,
+                'language' => $this->payload['lang'] ?? null,
+            ],
+        );
+
+        if ($visitor->wasRecentlyCreated) {
+            $visitor->update(['first_seen_at' => $now]);
+            $this->geolocate($visitor);
+        }
+
+        $session = AnalyticsSession::firstOrCreate(
+            ['uid' => $this->payload['sid']],
+            [
+                'website_id' => $website->id,
+                'visitor_id' => $visitor->id,
+                'started_at' => $now,
+                'entry_page' => $this->payload['path'] ?? $this->payload['url'] ?? null,
+                'ip_address' => $this->ip,
+                'referrer_url' => $this->payload['referrer'] ?? null,
+                'referrer_domain' => $this->payload['ref_domain'] ?? null,
+                'utm_source' => $this->payload['utm_source'] ?? null,
+                'utm_medium' => $this->payload['utm_medium'] ?? null,
+                'utm_campaign' => $this->payload['utm_campaign'] ?? null,
+                'utm_term' => $this->payload['utm_term'] ?? null,
+                'utm_content' => $this->payload['utm_content'] ?? null,
+            ],
+        );
+
+        if ($this->payload['type'] === 'pageview') {
+            PageView::create([
+                'website_id' => $website->id,
+                'visitor_id' => $visitor->id,
+                'analytics_session_id' => $session->id,
+                'url' => $this->payload['url'] ?? '',
+                'path' => $this->payload['path'] ?? '/',
+                'title' => $this->payload['title'] ?? null,
+                'referrer' => $this->payload['referrer'] ?? null,
+                'time_on_page' => $this->payload['time_on_page'] ?? null,
+                'viewed_at' => $now,
+            ]);
+        }
+
+        if ($this->payload['type'] === 'event') {
+            Event::create([
+                'website_id' => $website->id,
+                'visitor_id' => $visitor->id,
+                'analytics_session_id' => $session->id,
+                'name' => $this->payload['event_name'] ?? 'unknown',
+                'category' => $this->payload['event_category'] ?? null,
+                'action' => $this->payload['event_action'] ?? null,
+                'label' => $this->payload['event_label'] ?? null,
+                'value' => $this->payload['event_value'] ?? null,
+                'properties' => $this->payload['event_properties'] ?? null,
+                'occurred_at' => $now,
+            ]);
+        }
+
+        $session->update([
+            'ended_at' => $now,
+            'duration' => $now->diffInSeconds($session->started_at),
+            'exit_page' => $this->payload['path'] ?? $this->payload['url'] ?? $session->exit_page,
+            'pages_count' => $session->pageViews()->count(),
+            'is_bounce' => $session->pageViews()->count() <= 1,
+        ]);
+
+        $session->refresh();
+
+        $goalService->evaluate($website, $visitor, $session, $this->payload, $now);
+    }
+
+    private function geolocate(Visitor $visitor): void
+    {
+        try {
+            $position = Location::get($this->ip);
+
+            if ($position) {
+                $visitor->update(array_filter([
+                    'country' => $position->countryCode ?? null,
+                    'region' => $position->regionName ?? null,
+                    'city' => $position->cityName ?? null,
+                ]));
+            }
+        } catch (\Throwable) {
+            // Geolocation is best-effort; never fail the job over it
+        }
+    }
+}

app/Providers/AppServiceProvider.php

@@ -2,23 +2,22 @@
 
 namespace App\Providers;
 
+use Illuminate\Cache\RateLimiting\Limit;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\ServiceProvider;
 
 class AppServiceProvider extends ServiceProvider
 {
-    /**
-     * Register any application services.
-     */
     public function register(): void
     {
         //
     }
 
-    /**
-     * Bootstrap any application services.
-     */
     public function boot(): void
     {
-        //
+        RateLimiter::for('collect', function (Request $request) {
+            return Limit::perMinute(120)->by($request->ip());
+        });
     }
 }

bootstrap/app.php

@@ -12,7 +12,9 @@ return Application::configure(basePath: dirname(__DIR__))
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
-        //
+        $middleware->alias([
+            'collect.cors' => \App\Http\Middleware\CollectCors::class,
+        ]);
     })
     ->withExceptions(function (Exceptions $exceptions): void {
         //

composer.json

@@ -7,9 +7,11 @@
     "license": "MIT",
     "require": {
         "php": "^8.2",
+        "jaybizzle/crawler-detect": "^1.3",
         "laravel/fortify": "^1.36",
         "laravel/framework": "^12.0",
-        "laravel/tinker": "^2.10.1"
+        "laravel/tinker": "^2.10.1",
+        "stevebauman/location": "^7.6"
     },
     "require-dev": {
         "fakerphp/faker": "^1.23",

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "becabed4078ee42d7bbc4bbb883de3eb",
+    "content-hash": "9d9708b2d4e7cc126272d691e95fa963",
     "packages": [
         {
             "name": "bacon/bacon-qr-code",
@@ -190,6 +190,78 @@
             ],
             "time": "2024-02-09T16:56:22+00:00"
         },
+        {
+            "name": "composer/ca-bundle",
+            "version": "1.5.10",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/composer/ca-bundle.git",
+                "reference": "961a5e4056dd2e4a2eedcac7576075947c28bf63"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/composer/ca-bundle/zipball/961a5e4056dd2e4a2eedcac7576075947c28bf63",
+                "reference": "961a5e4056dd2e4a2eedcac7576075947c28bf63",
+                "shasum": ""
+            },
+            "require": {
+                "ext-openssl": "*",
+                "ext-pcre": "*",
+                "php": "^7.2 || ^8.0"
+            },
+            "require-dev": {
+                "phpstan/phpstan": "^1.10",
+                "phpunit/phpunit": "^8 || ^9",
+                "psr/log": "^1.0 || ^2.0 || ^3.0",
+                "symfony/process": "^4.0 || ^5.0 || ^6.0 || ^7.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "1.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Composer\\CaBundle\\": "src"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Jordi Boggiano",
+                    "email": "j.boggiano@seld.be",
+                    "homepage": "http://seld.be"
+                }
+            ],
+            "description": "Lets you find a path to the system CA bundle, and includes a fallback to the Mozilla CA bundle.",
+            "keywords": [
+                "cabundle",
+                "cacert",
+                "certificate",
+                "ssl",
+                "tls"
+            ],
+            "support": {
+                "irc": "irc://irc.freenode.org/composer",
+                "issues": "https://github.com/composer/ca-bundle/issues",
+                "source": "https://github.com/composer/ca-bundle/tree/1.5.10"
+            },
+            "funding": [
+                {
+                    "url": "https://packagist.com",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/composer",
+                    "type": "github"
+                }
+            ],
+            "time": "2025-12-08T15:06:51+00:00"
+        },
         {
             "name": "dasprid/enum",
             "version": "1.0.7",
@@ -684,6 +756,64 @@
             ],
             "time": "2025-12-03T09:33:47+00:00"
         },
+        {
+            "name": "geoip2/geoip2",
+            "version": "v3.3.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/maxmind/GeoIP2-php.git",
+                "reference": "49fceddd694295e76e970a32848e03bb19e56b42"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/maxmind/GeoIP2-php/zipball/49fceddd694295e76e970a32848e03bb19e56b42",
+                "reference": "49fceddd694295e76e970a32848e03bb19e56b42",
+                "shasum": ""
+            },
+            "require": {
+                "ext-json": "*",
+                "maxmind-db/reader": "^1.13.0",
+                "maxmind/web-service-common": "~0.11",
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "friendsofphp/php-cs-fixer": "3.*",
+                "phpstan/phpstan": "*",
+                "phpunit/phpunit": "^10.0",
+                "squizlabs/php_codesniffer": "4.*"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "GeoIp2\\": "src"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "Apache-2.0"
+            ],
+            "authors": [
+                {
+                    "name": "Gregory J. Oschwald",
+                    "email": "goschwald@maxmind.com",
+                    "homepage": "https://www.maxmind.com/"
+                }
+            ],
+            "description": "MaxMind GeoIP2 PHP API",
+            "homepage": "https://github.com/maxmind/GeoIP2-php",
+            "keywords": [
+                "IP",
+                "geoip",
+                "geoip2",
+                "geolocation",
+                "maxmind"
+            ],
+            "support": {
+                "issues": "https://github.com/maxmind/GeoIP2-php/issues",
+                "source": "https://github.com/maxmind/GeoIP2-php/tree/v3.3.0"
+            },
+            "time": "2025-11-20T18:50:15+00:00"
+        },
         {
             "name": "graham-campbell/result-type",
             "version": "v1.1.4",
@@ -1158,6 +1288,58 @@
             ],
             "time": "2025-08-22T14:27:06+00:00"
         },
+        {
+            "name": "jaybizzle/crawler-detect",
+            "version": "v1.3.7",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/JayBizzle/Crawler-Detect.git",
+                "reference": "7f7a45b5d5df9c95ba6b2008544e6cf8e66de6f5"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/JayBizzle/Crawler-Detect/zipball/7f7a45b5d5df9c95ba6b2008544e6cf8e66de6f5",
+                "reference": "7f7a45b5d5df9c95ba6b2008544e6cf8e66de6f5",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.1.0"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^4.8|^5.5|^6.5|^7.5|^8.5|^9.4"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "Jaybizzle\\CrawlerDetect\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Mark Beech",
+                    "email": "m@rkbee.ch",
+                    "role": "Developer"
+                }
+            ],
+            "description": "CrawlerDetect is a PHP class for detecting bots/crawlers/spiders via the user agent",
+            "homepage": "https://github.com/JayBizzle/Crawler-Detect/",
+            "keywords": [
+                "crawler",
+                "crawler detect",
+                "crawler detector",
+                "crawlerdetect",
+                "php crawler detect"
+            ],
+            "support": {
+                "issues": "https://github.com/JayBizzle/Crawler-Detect/issues",
+                "source": "https://github.com/JayBizzle/Crawler-Detect/tree/v1.3.7"
+            },
+            "time": "2026-02-02T19:15:54+00:00"
+        },
         {
             "name": "laravel/fortify",
             "version": "v1.36.1",
@@ -2188,6 +2370,121 @@
             ],
             "time": "2026-03-08T20:05:35+00:00"
         },
+        {
+            "name": "maxmind-db/reader",
+            "version": "v1.13.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/maxmind/MaxMind-DB-Reader-php.git",
+                "reference": "2194f58d0f024ce923e685cdf92af3daf9951908"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/maxmind/MaxMind-DB-Reader-php/zipball/2194f58d0f024ce923e685cdf92af3daf9951908",
+                "reference": "2194f58d0f024ce923e685cdf92af3daf9951908",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.2"
+            },
+            "conflict": {
+                "ext-maxminddb": "<1.11.1 || >=2.0.0"
+            },
+            "require-dev": {
+                "friendsofphp/php-cs-fixer": "3.*",
+                "phpstan/phpstan": "*",
+                "phpunit/phpunit": ">=8.0.0,<10.0.0",
+                "squizlabs/php_codesniffer": "4.*"
+            },
+            "suggest": {
+                "ext-bcmath": "bcmath or gmp is required for decoding larger integers with the pure PHP decoder",
+                "ext-gmp": "bcmath or gmp is required for decoding larger integers with the pure PHP decoder",
+                "ext-maxminddb": "A C-based database decoder that provides significantly faster lookups",
+                "maxmind-db/reader-ext": "C extension for significantly faster IP lookups (install via PIE: pie install maxmind-db/reader-ext)"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "MaxMind\\Db\\": "src/MaxMind/Db"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "Apache-2.0"
+            ],
+            "authors": [
+                {
+                    "name": "Gregory J. Oschwald",
+                    "email": "goschwald@maxmind.com",
+                    "homepage": "https://www.maxmind.com/"
+                }
+            ],
+            "description": "MaxMind DB Reader API",
+            "homepage": "https://github.com/maxmind/MaxMind-DB-Reader-php",
+            "keywords": [
+                "database",
+                "geoip",
+                "geoip2",
+                "geolocation",
+                "maxmind"
+            ],
+            "support": {
+                "issues": "https://github.com/maxmind/MaxMind-DB-Reader-php/issues",
+                "source": "https://github.com/maxmind/MaxMind-DB-Reader-php/tree/v1.13.1"
+            },
+            "time": "2025-11-21T22:24:26+00:00"
+        },
+        {
+            "name": "maxmind/web-service-common",
+            "version": "v0.11.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/maxmind/web-service-common-php.git",
+                "reference": "c309236b5a5555b96cf560089ec3cead12d845d2"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/maxmind/web-service-common-php/zipball/c309236b5a5555b96cf560089ec3cead12d845d2",
+                "reference": "c309236b5a5555b96cf560089ec3cead12d845d2",
+                "shasum": ""
+            },
+            "require": {
+                "composer/ca-bundle": "^1.0.3",
+                "ext-curl": "*",
+                "ext-json": "*",
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "friendsofphp/php-cs-fixer": "3.*",
+                "phpstan/phpstan": "*",
+                "phpunit/phpunit": "^10.0",
+                "squizlabs/php_codesniffer": "4.*"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "MaxMind\\Exception\\": "src/Exception",
+                    "MaxMind\\WebService\\": "src/WebService"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "Apache-2.0"
+            ],
+            "authors": [
+                {
+                    "name": "Gregory Oschwald",
+                    "email": "goschwald@maxmind.com"
+                }
+            ],
+            "description": "Internal MaxMind Web Service API",
+            "homepage": "https://github.com/maxmind/web-service-common-php",
+            "support": {
+                "issues": "https://github.com/maxmind/web-service-common-php/issues",
+                "source": "https://github.com/maxmind/web-service-common-php/tree/v0.11.1"
+            },
+            "time": "2026-01-13T17:56:03+00:00"
+        },
         {
             "name": "monolog/monolog",
             "version": "3.10.0",
@@ -3584,6 +3881,75 @@
             },
             "time": "2025-12-14T04:43:48+00:00"
         },
+        {
+            "name": "stevebauman/location",
+            "version": "v7.6.2",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/stevebauman/location.git",
+                "reference": "2f7686b685b924f193d6a6b82074861b8cc5aa3a"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/stevebauman/location/zipball/2f7686b685b924f193d6a6b82074861b8cc5aa3a",
+                "reference": "2f7686b685b924f193d6a6b82074861b8cc5aa3a",
+                "shasum": ""
+            },
+            "require": {
+                "ext-curl": "*",
+                "ext-json": "*",
+                "geoip2/geoip2": "^2.0|^3.0",
+                "guzzlehttp/guzzle": "^7.0",
+                "illuminate/support": "^8.0|^9.0|^10.0|^11.0|^12.0",
+                "php": ">=8.1"
+            },
+            "require-dev": {
+                "mockery/mockery": "^1.0",
+                "orchestra/testbench": "^6.0|^7.0|^8.0|^9.0|^10.0",
+                "pestphp/pest": "^1.0|^2.0|^3.7"
+            },
+            "type": "library",
+            "extra": {
+                "laravel": {
+                    "aliases": {
+                        "Location": "Stevebauman\\Location\\Facades\\Location"
+                    },
+                    "providers": [
+                        "Stevebauman\\Location\\LocationServiceProvider"
+                    ]
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Stevebauman\\Location\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Steve Bauman",
+                    "email": "steven_bauman@outlook.com"
+                }
+            ],
+            "description": "Retrieve a user's location by their IP Address",
+            "keywords": [
+                "IP",
+                "geo",
+                "geo-location",
+                "geoip",
+                "laravel",
+                "location",
+                "php"
+            ],
+            "support": {
+                "issues": "https://github.com/stevebauman/location/issues",
+                "source": "https://github.com/stevebauman/location/tree/v7.6.2"
+            },
+            "time": "2026-02-11T16:06:17+00:00"
+        },
         {
             "name": "symfony/clock",
             "version": "v8.0.0",

routes/api.php

@@ -5,7 +5,15 @@ use App\Http\Controllers\TrackingScriptController;
 use Illuminate\Support\Facades\Route;
 
 Route::get('/t/{trackingId}.js', [TrackingScriptController::class, 'script'])
+    ->middleware('collect.cors')
     ->name('tracking.script');
 
+Route::middleware('collect.cors')->group(function () {
     Route::post('/collect', [CollectController::class, 'store'])
+        ->middleware('throttle:collect')
         ->name('collect.store');
+
+    Route::get('/pixel', [CollectController::class, 'pixel'])
+        ->middleware('throttle:collect')
+        ->name('collect.pixel');
+});