Toolvana: production-ready media tools platform (CodeIgniter 4)

- 134-tool registry with programmatic SEO (unique titles/H1/descriptions, JSON-LD graphs, sitemap index, canonical 301 enforcement via required filter) - DB-backed job queue (SKIP LOCKED) with drivers: Ffmpeg, Images (GD), Pdf (qpdf/gs/poppler), Youtube (thumbnails), Qr (server-side PNG) - Security: SSRF guard, MIME validation, rate limits, API-key auth, bcrypt admin login, security headers - Admin panel: dashboard, tools/categories/guides CRUD, SEO audit, analytics, job inspector with retry, system health, feature flags - Docker deployment (nginx + web/api FPM pools + scalable workers), PHPUnit suite (19 tests / 1139 assertions), PWA manifest + service worker
2026-08-23 07:10:30 +00:00
commit beaf0e1f37
217 changed files with 19619 additions and 0 deletions
@@ -0,0 +1,76 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Libraries;
+
+use App\Models\AnalyticsEventModel;
+
+/**
+ * Anonymous, privacy-first analytics. Sessions/IPs are stored only as
+ * salted one-way hashes; no cookies are set for tracking and no PII is
+ * ever persisted.
+ */
+final class Analytics
+{
+    public const EVENTS = [
+        'tool_view', 'tool_start', 'tool_success', 'tool_failure',
+        'conversion_format', 'download', 'upload', 'search', 'error',
+    ];
+
+    public function sessionHash(): string
+    {
+        static $hash = null;
+        if ($hash === null) {
+            try {
+                // make sure the session actually exists before reading its id
+                if (session_id() === '') {
+                    service('session')->start();
+                }
+                $sid = session_id() ?: bin2hex(random_bytes(16));
+            } catch (\Throwable) {
+                $sid = 'no-session'; // CLI/tests: stable, never random
+            }
+            $salt = env('encryption.key', 'tv-fallback-salt');
+            $hash = hash('sha256', $sid . '|' . $salt);
+        }
+
+        return substr($hash, 0, 32);
+    }
+
+    public function ipHash(): string
+    {
+        $salt = env('encryption.key', 'tv-fallback-salt');
+
+        return hash('sha256', service('request')->getIPAddress() . '|' . $salt);
+    }
+
+    public function track(string $name, array $data = []): void
+    {
+        if (! in_array($name, self::EVENTS, true)) {
+            return;
+        }
+        try {
+            model(AnalyticsEventModel::class)->record([
+                'name'       => $name,
+                'tool_slug'  => $data['tool'] ?? null,
+                'format'     => isset($data['format']) ? mb_substr((string) $data['format'], 0, 16) : null,
+                'value'      => (int) ($data['value'] ?? 0),
+                'session_id' => $this->sessionHash(),
+                'country'    => $this->guessCountry(),
+                'meta'       => json_encode($data['meta'] ?? new \stdClass(), JSON_UNESCAPED_UNICODE),
+                'created_at' => date('Y-m-d H:i:s'),
+            ]);
+        } catch (\Throwable $e) {
+            log_message('error', 'analytics write failed: {m}', ['m' => $e->getMessage()]);
+        }
+    }
+
+    /** Country from CDN geo headers when present (Cloudflare/Fastly), else null. */
+    private function guessCountry(): ?string
+    {
+        $cc = $_SERVER['HTTP_CF_IPCOUNTRY'] ?? $_SERVER['X-Geo-Country'] ?? null;
+
+        return is_string($cc) && preg_match('/^[A-Z]{2}$/', $cc) === 1 ? $cc : null;
+    }
+}