Search by

tavp / analytics

jtdoank

Advanced analytics, fraud detection, and user behavior tracking for TAVP

Package info

github.com/tavp-stack/tavp-analytics

pkg:composer/tavp/analytics

Security

Advisories: 0

Aikido package health analysis

Transparency log

Statistics

Installs: 7

Dependents: 0

Suggesters: 0

Stars: 0

Open Issues: 0

v1.0.0 2026-07-09 20:14 UTC

Requires

Requires (Dev)

Suggests

None

Provides

None

Conflicts

None

Replaces

None

proprietary f4427ce3c4503ce9f091907faeb2e68f21daec1b

analyticstrackingfraud-detectiontavp

Published on Packagist.org on 2026-07-10 00:08 UTC

This package is auto-updated.

Last update: 2026-09-04 17:48:46 UTC

README

Advanced analytics, fraud detection, and user behavior tracking for the TAVP stack — now with full GA4 + Matomo + GTM parity.

Version: 1.0.0 — Analytics Platform Parity (Milestone v1.0.0, 2026-10-31) — see docs/PRD.md

Requirements

  • PHP 8.3+ (PHP 8.4 supported via php_version in .tavpbox.yml)
  • Phalcon 5.16+
  • tavp-core ^0.1
  • Redis (optional, for ingest queue)

Features

Privacy & Compliance (Epic A)

  • Consent Mode v2 + TCF 2.2 — banner <300ms, category analytics_storage/ad_storage/functionality/personalization/security, __tcfapi stub, gtag bridge, cookie tavp_consent 180d + audit trail
  • Anonymize IP & DNT/GPC — IPv4 /24, IPv6 /64, DNT:1 and Sec-GPC:1 downgrade to anonymized, configurable
  • Retention & Auto-Purge — raw 395d (14mo), aggregated 730d (26mo), batch 1000, daily 02:00, php artisan analytics:purge [--dry-run|--force]
  • DSAR (GDPR) — POST /api/analytics/dsar/export & POST /api/analytics/dsar/delete by user_id/email/session_id/ip, HMAC X-Tavp-Signature, audit analytics_dsar_log, 72h SLA
  • Audit Log — consent & DSAR immutable 2 years, exportable CSV

Collection (Epic B)

  • Web SDK v2 (resources/js/tracker.js 7.2KB gzipped) — sendBeacon + fetch keepalive, batch ≤10, IndexedDB offline queue retry 3× exponential, SPA history patch, DataLayer bridge, consent-aware
  • Server Collect API — POST /api/analytics/collect batch ≤100, HMAC X-Tavp-Signature, idempotency event_id 24h, enrichment geo/device/utm
  • Cookieless & Sampling — fingerprint daily rotation, sid memory, sampling rate per site

Tag Manager (Epic C)

  • Container & Workspace — CRUD analytics_containers (draft/live), versioning, publish/rollback, AnalyticsContainer model
  • Triggers — page_view, click, scroll, history_change, timer, custom_event, form_submit, visibility with AND/OR + regex + {{dl.*}}
  • Tags: Custom HTML/JS, GA4, Meta Pixel, TikTok, Webhook (see Epic F)
  • Preview/Debug — ?tavp_preview=1 panel, version diff

Processing & Storage (Epic D)

  • Ingest Queue — AnalyticsQueue (Redis analytics_redis + file fallback), analytics:queue:work --batch=100, lag <5s @10k eps, DLQ after 3 attempts
  • Sessionization — 30m timeout, sess_ deterministic hash(site+sid+day), bounce page_views==1 && duration<30, stitching via user_id
  • Archiving — hourly/daily analytics_archive_*, re-archive idempotent
  • Bot Filter & Deduplication — event_id dedup 24h, bot rate metric

Reporting (Epic E)

  • Funnels 2–8 steps strict ordering, conversion/drop-off/time, POST /api/analytics/funnel/{slug}/step + GET /funnel/{slug}/results
  • E-commerce — view_item, add_to_cart, begin_checkout, purchase (+ view_cart/add_shipping_info/add_payment_info/refund), revenue sum(price*qty), currency, transaction_id, POST /api/analytics/ecommerce/{event}
  • Realtime ≤60s, Segments, Attribution (last/first/linear/position), Cohort (stretch), Export CSV/API

Integration & Extensibility (Epic F)

  • Webhooks Outbound — POST /api/analytics/webhooks (HMAC SHA256 X-Tavp-Signature, retry 3× 1s/2s/4s, delivery log)
  • Ads CAPI — Meta graph.facebook.com/v18.0/{pixel}/events, Google googleadservices, TikTok business-api.tiktok.com, hashing sha256(lower(trim)), consent ad_storage gating, queue ads_conversions
  • Marketplace / Import — GA4/Matomo import (stretch), plugin hooks analytics.event.ingest

Installation

composer require tavp/analytics
tavp migrate

Add tracker:

<script src="/js/tracker.js" defer></script>
<script>
  // Grant consent after banner
  window.tavpAnalytics.consent.grant({analytics_storage:'granted', ad_storage:'denied'});
  window.tavpAnalytics.event('button_click','engagement','signup');
</script>

Configuration

config/analytics.php:

return [
  'enabled' => true,
  'track_page_views' => true,
  'anonymize_ip' => true,          // A2
  'respect_dnt' => true,           // A2
  'respect_gpc' => true,           // A2
  'consent' => [                   // A1
    'enabled' => true,
    'default_denied' => true,
    'cookie_name' => 'tavp_consent',
    'expiry_days' => 180,
    'tcf_enabled' => true,
  ],
  'retention' => [                 // A4
    'raw_days' => 395,
    'aggregated_days' => 730,
    'purge_batch_size' => 1000,
    'auto_purge_enabled' => true,
    'cron' => '0 2 * * *',
  ],
  'queue' => [                     // D1
    'enabled' => false,
    'connection' => 'analytics_redis',
    'batch' => 100,
  ],
  'ads' => [                       // F2
    'meta' => ['pixel_id'=>env('META_PIXEL_ID'), 'access_token'=>env('META_CAPI_TOKEN'), 'enabled'=>false],
  ],
];

Schedule purge (pick one):

// Tavp schedule: config/schedule.php -> Schedule->call(fn()=> (new PurgeAnalyticsCommand)->purge(), '0 2 * * *')
// Laravel: Kernel $schedule->command('analytics:purge --force')->dailyAt('02:00');
// Cron: 0 2 * * * cd /path && php artisan analytics:purge --force

API Endpoints

Method Endpoint Description
POST /api/analytics/collect Batch collect ≤100, HMAC, dedup
POST /api/analytics/track Page view
POST /api/analytics/event Custom event
POST /api/analytics/consent Grant/deny/withdraw consent
GET /api/analytics/consent Get consent state
POST /api/analytics/dsar/export DSAR export (user_id/email/session/ip)
POST /api/analytics/dsar/delete DSAR delete + audit
POST /api/analytics/container Create container (Tag Manager)
GET /api/analytics/container/{id} Get container
POST /api/analytics/container/{id}/publish Publish
POST /api/analytics/container/{id}/rollback Rollback
POST /api/analytics/container/{id}/trigger Create trigger
GET /api/analytics/container/{id}/triggers List triggers
POST /api/analytics/trigger/evaluate Evaluate trigger
POST /api/analytics/funnel/{slug}/step Funnel step
GET /api/analytics/funnel/{slug}/results Funnel stats
POST /api/analytics/ecommerce/track E-commerce batch
POST /api/analytics/ecommerce/{event} Single e-commerce event
GET /api/analytics/ecommerce/stats E-commerce stats
POST /api/analytics/webhooks Register webhook
GET /api/analytics/webhooks List webhooks
DELETE /api/analytics/webhooks/{id} Delete webhook
POST /api/analytics/ads/convert Ads CAPI convert
GET /api/analytics/stats Overall stats
POST /api/analytics/session Session recording
POST /api/analytics/verify Fraudless verify
* /api/analytics/queue:work CLI analytics:queue:work

Dashboard & Tag Manager

  • Dashboard: /analytics — realtime, funnels, e-commerce, segments
  • Tag Manager Studio: /analytics/tag-manager — containers, triggers, preview ?tavp_preview=1

Testing

php vendor/bin/phpunit --testdox   # 267 tests, 1138 assertions (v1.0.0)

Changelog

  • 1.0.0 (2026-08-29) — Platform parity: Privacy (A1/A2/A4/A5), Collection (B1/B2), Tag Manager (C1/C3), Processing (D1/D3), Reporting (E3/E4), Integration (F1/F2). See docs/PRD.md and Milestone v1.0.0.
  • 0.0.1 — Initial core analytics + fraud detection.

License

MIT