For the first rule (limited number of videos per hour) you could use caching. If you use something like Redis or Memcache you have the ability to call Cache::increment and it'll add one to a given value.

So, for example, when a user goes to post a video you could do something like this.

$key = 'uploads:'.$user->username;

Cache::add($key, 0, 60);
Cache::increment($key);

if (Cache::get($key) > 3)
{
    // User has uploaded 3 videos already, don't let them upload any more until the hour is up.
}

Cache::add only adds the value if the key does not already exist. So you can safely call that every time. Then Cache::increment will add 1 to the value.

As for your second rule you're going to have to have a database table that stores hashes of banned videos. You'll also probably need to store the hash of a video once it's uploaded as well. Then, you'll need to compare the hash of the currently uploaded video to that of the banned and already uploaded videos. You can use something like hash_file() to get the hash of a file. This won't always work though so you'll still have to moderate uploaded videos.

Lastly you'll need to check the length of videos. You can use ffmpeg by using something like passthru() or a package like getID3. I've not done this before so you'll have to try it out. Whenever a video is uploaded you'll need to grab its length and store that in the database. Then it's just a matter of checking if the newly uploaded videos length will make the playlist length exceed an hour.

Note: I just re-read your question and realized you only want to know where to put them, not how to do it. Woops. I'm going to leave all that I wrote though just because.

Where to put them? You could probably write your own validation rules for each of these actually. So they could be used like standard Laravel validation rules. See custom validation rules.

Thanks very much Jason!

I'm hesitant to put these conditions in custom validation rules as I'm not checking the validity of the data itself, but if more general conditions about what's already in the database have been met.

I.e. to call a custom rule I'd have to attach it to a particular field of the form, even though it's not validating that data.

I've built the functionality into my controller, but I know controllers are intended to be light "traffic directors" and not do very much in themselves, so there must be a better home for this code!

Yeah if that's the case I'd pull it from the controller and perhaps make a class that handles this.