# Mattitja Analytics for Laravel

A Laravel middleware package for sending analytics data to the Mattitja Analytics API. The package automatically registers middleware for web routes and sends data synchronously to the analytics service.

## Installation

```bash
composer require mattitjaab/mattitja-analytics
```

## Configuration

Publish the configuration file (optional):

```bash
php artisan vendor:publish --tag=mattitja-analytics-config
```

Add your site key and ingest secret to your `.env` file:

```env
MATTITJA_ANALYTICS_SITE_KEY=your-site-key
MATTITJA_ANALYTICS_INGEST_SECRET=your-ingest-secret
MATTITJA_ANALYTICS_ENABLED=true
```

Both values are found under **Site → Install** in Mattitja Analytics. Click "Generate secret" to create the ingest secret. Without it the API ignores the forwarded visitor IP and user agent and rejects the request, so nothing is tracked.

## Usage

The package automatically registers middleware for the `web` group and starts collecting analytics data immediately after installation and configuration.

### Manual middleware registration

You can also add the middleware manually for specific routes:

```php
// In routes/web.php
Route::middleware(['mattitja-analytics'])->group(function () {
    // Your routes here
});
```

## Configuration Options

### Basic Settings
- `MATTITJA_ANALYTICS_SITE_KEY` - Your site key from Mattitja Analytics (required)
- `MATTITJA_ANALYTICS_INGEST_SECRET` - Your site's ingest secret, sent as a Bearer token (required)
- `MATTITJA_ANALYTICS_TIMEOUT` - HTTP timeout in seconds (default: 1)
- `MATTITJA_ANALYTICS_CONNECT_TIMEOUT` - Connect timeout in seconds (default: 0.5)
- `MATTITJA_ANALYTICS_PAUSE_ON_FAILURE` - Seconds to stop sending after the API is unreachable or returns 5xx (default: 60, `0` disables)
- `MATTITJA_ANALYTICS_ENABLED` - Enable/disable tracking (default: true)
- `MATTITJA_ANALYTICS_BOTS` - Track bots (default: false)

### Privacy Settings
- `MATTITJA_ANALYTICS_RESPECT_DNT` - Respect Do Not Track header (default: true)

### Filtering
You can configure paths and IP addresses to ignore in the config file.

## Data Sent

The package sends the following data to `https://analytics.mattitja.se/api/send`:

- `k` - Site key
- `u` - Full URL of the visited page
- `r` - Referrer URL (if available)
- `ip` - Visitor's complete IP address
- `ua` - User agent string

The request is authenticated with `Authorization: Bearer <ingest secret>`, and the visitor's `Accept-Language` header is forwarded.

Only successful `GET` requests that render HTML count as pageviews. Form posts, redirects, JSON responses and requests that expect JSON are skipped.
## Security

- Data is sent from the middleware's `terminate()` step, after the response has been sent to the browser
- IP addresses are NOT anonymized (needed for geolocation)
- No queue, worker or cache is required. If the API is down, sending pauses for `pause_on_failure` seconds, tracked with a marker file in `storage/framework`, so visitors and PHP workers are never held up
- All errors are caught and logged, so the API being down never breaks your site
- Bot traffic is filtered out by default
- Do Not Track header is respected by default

## Development

Run tests:

```bash
composer test
```

## License

MIT License