bootstrap.php

<?php

/**
 * auto_prepend_file entry point.
 *
 * This is ONE way to run the sensor and deliberately not the headline one. A
 * prepended file executes for every PHP process on the host, which is a far
 * larger blast radius than a framework middleware, so it is offered for
 * operators who want coverage without touching application code and who
 * understand what they are switching on.
 *
 * Prefer a middleware where you have one. See README.md.
 *
 *   php.ini:    auto_prepend_file = /path/to/webdecoy/bootstrap.php
 *   .htaccess:  php_value auto_prepend_file /path/to/webdecoy/bootstrap.php
 *
 * Turning it off, without a deploy and without editing php.ini:
 *
 *   WEBDECOY_DISABLE=1        in the environment, or
 *   touch /path/to/webdecoy.disabled  with WEBDECOY_DISABLE_FILE pointing at it
 *
 * Everything below is wrapped. A prepended file that raises kills every request
 * on the host, so this one cannot be allowed to.
 */

declare(strict_types=1);

(static function (): void {
    try {
        // Never let a half-installed sensor break a site. If the autoloader is
        // missing we are not configured, and doing nothing is correct.
        $autoload = __DIR__ . '/vendor/autoload.php';
        if (!is_file($autoload)) {
            $autoload = __DIR__ . '/../../autoload.php'; // installed as a dependency
        }
        if (!is_file($autoload)) {
            return;
        }
        require_once $autoload;

        if (!class_exists(\WebDecoy\Sensor\Sensor::class)) {
            return;
        }

        $config = \WebDecoy\Sensor\Config::fromEnvironment();
        if ($config->apiKey === '') {
            return;
        }

        $sensor = new \WebDecoy\Sensor\Sensor($config);

        // Reported at shutdown rather than inline, so the visitor's page is
        // already on its way before we spend anything on telemetry. The request
        // facts are captured now, because $_SERVER is not guaranteed intact by
        // the time shutdown functions run.
        $request = \WebDecoy\Sensor\Request::fromGlobals();
        register_shutdown_function(static function () use ($sensor, $request): void {
            try {
                $sensor->observe($request);
            } catch (\Throwable $e) {
                // Nothing. See the file comment.
            }
        });
    } catch (\Throwable $e) {
        // Nothing. A sensor is never worth a 500.
    }
})();