<?php

use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Broadcast;

Broadcast::channel('App.Models.User.{id}', function ($user, $id) {
    return (int) $user->id === (int) $id;
});

// Operator console live provisioning feed — operators only.
//
// 'guards' is not decoration: POST /broadcasting/auth carries only the 'web'
// middleware group (Laravel registers it that way, see withBroadcasting()),
// so without this, PusherBroadcaster::auth() resolves the user on the
// DEFAULT guard before this callback ever runs — finds nobody, since an
// operator is never signed in on 'web' — and throws AccessDeniedHttpException
// straight from retrieveUser(). The Auth::guard('operator') check below is
// correct but unreachable without this option.
Broadcast::channel(
    'admin.runs',
    fn () => (bool) Auth::guard('operator')->user()?->can('console.view'),
    ['guards' => ['operator', 'web']],
);

// A customer's own provisioning feed — bridged from the auth user by email.
Broadcast::channel('customer.{customerId}.run', function ($user, $customerId) {
    return \App\Models\Customer::query()
        ->whereKey($customerId)
        ->where('email', $user->email)
        ->exists();
});