Cookieless pageview collector

<?php

namespace App\Http\Controllers;

use App\Analytics\VisitorHasher;
use Illuminate\Http\Request;
use Illuminate\Http\Response;
use Illuminate\Support\Facades\DB;

class CollectController extends Controller
{
    public function __invoke(Request $request): Response
    {
        // sendBeacon posts text/plain, so decode the body ourselves.
        $data = validator(json_decode($request->getContent(), true) ?? [], [
            'site' => ['required', 'integer', 'exists:sites,id'],
            'path' => ['required', 'string', 'max:500'],
            'ref' => ['nullable', 'string', 'max:500'],
        ])->validate();

        DB::table('pageviews')->insert([
            'site_id' => $data['site'],
            // IP and user agent are used for hashing only and never stored.
            'visitor' => VisitorHasher::make($data['site'], (string) $request->ip(), (string) $request->userAgent()),
            'path' => parse_url($data['path'], PHP_URL_PATH) ?: '/',
            'referrer' => parse_url($data['ref'] ?? '', PHP_URL_HOST),
            'created_at' => now(),
        ]);

        return response()->noContent(202);
    }
}

<?php

namespace App\Analytics;

use Illuminate\Support\Facades\DB;
use Illuminate\Support\Str;

final class VisitorHasher
{
    /** One random salt per UTC day. Deleting yesterday's salt makes old ids unrecoverable. */
    public static function salt(): string
    {
        $day = now()->utc()->toDateString();

        // insertOrIgnore + re-read: concurrent first requests all end up with the same stored salt.
        DB::table('daily_salts')->insertOrIgnore(['day' => $day, 'salt' => Str::random(48)]);

        return (string) DB::table('daily_salts')->where('day', $day)->value('salt');
    }

    public static function make(int $siteId, string $ip, string $ua): string
    {
        return substr(hash('sha256', self::salt().'|'.$siteId.'|'.self::ip($ip).'|'.strtolower(trim($ua))), 0, 32);
    }

    /** IPv6 collapses to its /64 prefix. */
    private static function ip(string $ip): string
    {
        $bin = @inet_pton(trim($ip));

        if ($bin === false) {
            return strtolower(trim($ip));
        }

        return (string) inet_ntop(strlen($bin) === 16 ? substr($bin, 0, 8).str_repeat("\0", 8) : $bin);
    }
}