<?php

use App\Models\User;
use Illuminate\Support\Facades\Broadcast;

/*
|--------------------------------------------------------------------------
| Broadcast Channels — CONVENTION: every channel is PRIVATE
|--------------------------------------------------------------------------
|
| Clusev is a control plane for a whole fleet; broadcast payloads (live CPU/MEM,
| service state, future per-server streams) are infrastructure data and must NEVER
| ride a PUBLIC channel. A public channel is subscribable by anyone who can reach the
| Reverb endpoint and knows the app key — and that key is bundled into the JS
| (VITE_REVERB_APP_KEY), so it is effectively public. With on-demand TLS the `/app/*`
| Reverb socket also answers on any host Caddy still holds a cert for (e.g. an old
| domain after a domain change), so a public channel would leak metrics on a host that
| PanelScheme otherwise refuses.
|
| RULE for new channels: declare every event with a PrivateChannel (or PresenceChannel)
| and register an authorization callback here. The `/broadcasting/auth` endpoint runs in
| the `web` group, so PanelScheme + the session guard gate it — a subscriber must be an
| authenticated panel user on the active domain. Per-server channels should additionally
| scope to records the user may see, e.g.:
|
|     Broadcast::channel('server.{uuid}', fn (User $u, string $uuid) =>
|         Server::where('uuid', $uuid)->exists());   // tighten when RBAC lands
|
*/

// Fleet-wide metrics. Any authenticated panel user may watch. The `/broadcasting/auth` endpoint runs
// in the `web` group, so PanelScheme + the session guard already require an authenticated user on the
// active host. Password rotation is OPTIONAL now (the seeded password may be kept, under a standing
// warning), so this no longer gates on `securityOnboarded()` — otherwise an operator who deliberately
// skipped the rotation would silently lose realtime metrics on a panel they are allowed to use.
Broadcast::channel('metrics', fn (User $user) => true);