1 files changed, 40 insertions, 0 deletions
diff --git a/api/course/event.php b/api/course/event.php
new file mode 100644
index 0000000..696d1c5
--- /dev/null
+++ b/api/course/event.php
@@ -0,0 +1,40 @@
+<?php
+// api/course/event.php — anonymous course telemetry. No IP/UA stored.
+header('Content-Type: application/json; charset=utf-8');
+header('Access-Control-Allow-Origin: https://webx11.duckdns.org');
+header('Access-Control-Allow-Methods: POST, OPTIONS');
+header('Access-Control-Allow-Headers: Content-Type');
+if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') { http_response_code(204); exit; }
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') { http_response_code(405); echo json_encode(['error' => 'POST only']); exit; }
+
+$raw = file_get_contents('php://input');
+if ($raw === false || strlen($raw) === 0) { http_response_code(400); echo json_encode(['error' => 'empty body']); exit; }
+if (strlen($raw) > 4096) { http_response_code(413); echo json_encode(['error' => 'payload too large']); exit; }
+$p = json_decode($raw, true);
+if (!is_array($p)) { http_response_code(400); echo json_encode(['error' => 'invalid json']); exit; }
+
+$sid = isset($p['sid']) ? substr(preg_replace('/[^a-zA-Z0-9_-]/', '', (string)$p['sid']), 0, 64) : '';
+$type = isset($p['type']) ? (string)$p['type'] : '';
+$allowed = ['lesson_open','lesson_complete','exercise_fail','question','project_open','project_view','quiz_answer'];
+if (strlen($sid) < 8 || !in_array($type, $allowed, true)) { http_response_code(400); echo json_encode(['error' => 'sid/type invalid']); exit; }
+
+$ip = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
+$dir = __DIR__ . '/../../data/course';
+if (!is_dir($dir)) { mkdir($dir, 0775, true); }
+$rlFile = $dir . '/.rl-' . substr(hash('sha256', $ip), 0, 16) . '-' . date('YmdH');
+$hits = file_exists($rlFile) ? (int)file_get_contents($rlFile) : 0;
+if ($hits > 120) { http_response_code(429); echo json_encode(['error' => 'rate limited']); exit; }
+file_put_contents($rlFile, (string)($hits + 1), LOCK_EX);
+if (random_int(1, 50) === 1) {
+    foreach (glob($dir . '/.rl-*') as $f) { if (filemtime($f) < time() - 172800) @unlink($f); }
+}
+
+$detail = isset($p['detail']) && is_array($p['detail']) ? array_slice($p['detail'], 0, 8, true) : [];
+foreach ($detail as $k => $v) { if (is_string($v)) $detail[$k] = substr($v, 0, 300); }
+$row = ['ts' => gmdate('c'), 'type' => $type, 'sid' => $sid,
+        'version' => substr((string)($p['version'] ?? ''), 0, 40), 'detail' => $detail];
+$out = $dir . '/events-' . date('Ym') . '.jsonl';
+$fp = fopen($out, 'a');
+if ($fp && flock($fp, LOCK_EX)) { fwrite($fp, json_encode($row, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . "\n"); flock($fp, LOCK_UN); fclose($fp); }
+http_response_code(200);
+echo json_encode(['ok' => true]);