latest

backend/app/Providers/AppServiceProvider.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Providers;
+
+use App\Events\RoleAssigned;
+use App\Events\UserCreated;
+use App\Events\UserDeleted;
+use App\Events\UserUpdated;
+use App\Listeners\PublishUserEventToMqtt;
+use App\Models\User;
+use Illuminate\Cache\RateLimiting\Limit;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Gate;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\ServiceProvider;
+
+class AppServiceProvider extends ServiceProvider
+{
+    /**
+     * Register any application services.
+     */
+    public function register(): void
+    {
+        //
+    }
+
+    /**
+     * Bootstrap any application services.
+     */
+    public function boot(): void
+    {
+        // Defense-in-depth: super-admin bypasses every permission/policy check,
+        // even if a permission is later removed or misconfigured — except
+        // self-delete, which must never be allowed for any role, so that
+        // check is enforced here too rather than left to fall through to
+        // a policy this bypass would otherwise short-circuit.
+        Gate::before(function (User $user, string $ability, array $arguments = []) {
+            if ($ability === 'delete' && ($arguments[0] ?? null) instanceof User && $arguments[0]->id === $user->id) {
+                return false;
+            }
+
+            return $user->hasRole('super-admin') ? true : null;
+        });
+
+        RateLimiter::for('api', function (Request $request) {
+            return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
+        });
+
+        // Registered explicitly — auto-discovery doesn't reliably match a
+        // union-typed handle() parameter across multiple event classes.
+        Event::listen([UserCreated::class, UserUpdated::class, UserDeleted::class, RoleAssigned::class], PublishUserEventToMqtt::class);
+    }
+}