Takt Symfony Laravel Package

Getting Started

This release is an incremental feature bump on the existing Takt analytics integration, not a new package. If you already have it wired up, start with the dependency bump:

composer require vskstudio/takt-core-php:^0.6
php artisan vendor:publish --tag=takt-config   # only if you don't have config/takt.php yet

Verify the resolved version before assuming the new keys exist — v0.6.0 of the Laravel wrapper explicitly requires vskstudio/takt-core-php 0.6, and config keys that aren't understood by the core are silently ignored rather than erroring. A stale lockfile is the most likely cause of "the feature doesn't work."

Then look at config/takt.php for the two new keys:

'mode' => 'sdk',            // required for snippet-side redaction
'redact_routes' => [],      // list of sensitive routes
'route_templates' => false, // send every page as its route pattern

Your first use case is almost certainly the obvious one: a tokenized or user-identifying URL. A verification, invite, or share link like /verify/abc123 currently lands in analytics as a unique page per user, which both pollutes your pageview reports and puts a credential-shaped string into a third-party system. Add the route to redact_routes and confirm that the payload becomes /verify/{token}.

If you'd rather never think about it route-by-route, flip route_templates to true. Every page is then reported as its Symfony route path, resolved from the _route of the main request through the router. That's a coarser but safer default for a privacy-sensitive app, at the cost of losing per-page granularity for paginated or filtered URLs.

For anything not driven by the HTTP request lifecycle — queued jobs, console commands, virtual pages in a SPA — use the autowired Takt service directly and pass the route yourself.

Implementation Patterns

Autowire the service, don't resolve it manually. The Takt service is container-bound, so constructor or method injection is the intended path:

use Vskstudio\Takt\Takt;

public function show(Takt $takt, string $token)
{
    $takt->pageview(); // route defaults to the current route path
}

Let the default do the work. As of 0.6, the current route path is the default route for both pageview() and event(). Most controllers need no arguments at all. Only pass route explicitly when the real-world "page" differs from the URL:

$takt->event('checkout_started', ['route' => 'checkout.step.1']);
$takt->pageview(['route' => '/settings/billing']);

This is also your escape hatch for non-request contexts, where there is no current route to fall back on:

// inside a queued job
$takt->event('invoice_sent', ['route' => '/invoices/{id}']);

Pick redaction strategy per route, not globally, if you can afford the bookkeeping. redact_routes is the surgical option; route_templates is the blanket option. A common split is route_templates => false plus an explicit redact_routes list covering auth flows, invite links, and anything with a signed URL. When route_templates is on, everything is a template anyway, so redact_routes becomes redundantly satisfied — don't maintain both as if they compose.

Middleware for cross-cutting redaction. If you have a family of routes (all /api/..., all /auth/...), centralize the decision in a small middleware or a service provider using Route::matched() rather than scattering route arguments through controllers. Keep the list in config so it's auditable in one place.

Treat redaction as a security boundary and test it. Feature-test the outbound payload, not the config:

public function test_verification_token_is_redacted()
{
    $this->get('/verify/secret-token-abc');

    // assert against the fake/client the package exposes,
    // or a container-swapped spy, that the route is '/verify/{token}'
    // and that 'secret-token-abc' appears nowhere in the payload
}

Asserting the absence of the token is the part people skip, and it's the part that actually catches a regression when someone changes the route name or moves the handler into a controller action with a different signature.

Keep the snippet and SDK paths aligned. Both mechanisms apply to the takt() snippet and to the autowired service, but the snippet path only honors them in mode: sdk. If you're in a JS-only mode, redaction is a server-side concern you have to solve before rendering the snippet, or it doesn't happen at all.

Gotchas and Tips

mode: sdk is a hard prerequisite for snippet redaction. In any other mode the redact_routes and route_templates settings have no effect on the takt() snippet. Nothing warns you. Check config('takt.mode') first when redaction "isn't working."

Version-skew failures are silent. The wrapper requires core 0.6. If you pin the wrapper but leave vskstudio/takt-core-php at 0.5 in the lockfile, unknown config keys are typically ignored rather than rejected. Run composer show vskstudio/takt-core-php and confirm 0.6 is actually installed before debugging anything else.

Verify what redact_routes matches — names or URIs. The release notes describe the output (/verify/abc → /verify/{token}) but not the input format. Read the published config stub and the core source before filling the array; a list of route names and a list of URI patterns behave very differently, and a mismatch looks identical to "redaction isn't working."

route_templates degrades gracefully only where _route exists. The pattern is resolved from the main request's _route through the router. Requests that never matched a route — 404s, some fallback and catch-all handlers, requests short-circuited in middleware before routing — may fall through to the real path. If you're relying on blanket templating for privacy, add a fallback for the no-route case rather than trusting the default.

Expect a data discontinuity in existing dashboards. Routes previously reported as raw paths (/orders/1234) start arriving as patterns (/orders/{id}) as soon as you enable templating, and event() calls that previously sent no route now send one by default. Historical and new data won't group together. Roll this out at a known timestamp and annotate your dashboards, or you'll spend an afternoon explaining a "traffic drop."

Watch the double-count on manual pageview() calls. If you call pageview() manually and have automatic pageview tracking on, the 0.6 default route doesn't create duplicates — but it does make the two sources harder to distinguish in reports now that both carry a route value. Pick one mechanism per surface area.

Explicit route overrides beat redaction. If a controller passes route explicitly, that value is what gets sent — the config list doesn't rewrite it. Don't hand-roll a route string in one place and rely on redact_routes to sanitize it in another.

Console and queue contexts have no current route. pageview() with no argument in a job will produce an empty or null route rather than the sensible default you'd expect. Always pass route explicitly outside HTTP.

Extension point: the autowired binding is the seam. If you need conditional redaction (per-tenant, per-plan, based on a feature flag), decorate the Takt service in a service provider rather than forking the package — you can inspect the current route and rewrite the payload there, keeping policy in your app and mechanics in the package.