horizon secret

app/Http/Middleware/VerifyCsrfToken.php

@@ -12,6 +12,6 @@ class VerifyCsrfToken extends Middleware
      * @var array<int, string>
      */
     protected $except = [
-        //
+        'horizon/*',
     ];
 }

app/Providers/HorizonServiceProvider.php

@@ -28,8 +28,12 @@ class HorizonServiceProvider extends HorizonApplicationServiceProvider
      */
     protected function gate(): void
     {
-        Gate::define('viewHorizon', function ($user) {
-            return $user->hasRole('super-admin');
+        Gate::define('viewHorizon', function ($user = null) {
+            if (empty($user)) {
+                return request()->bearerToken() === config('services.horizon.secret');
+            } else {
+                return $user->hasRole('horizon-admin');
+            }
         });
     }
 }

config/cors.php

@@ -15,7 +15,7 @@ return [
     |
     */
 
-    'paths' => ['api/*', 'sanctum/csrf-cookie'],
+    'paths' => ['api/*', 'sanctum/csrf-cookie', 'horizon/*'],
 
     'allowed_methods' => ['*'],
 

config/services.php

@@ -14,6 +14,10 @@ return [
     |
     */
 
+    'horizon' => [
+        'secret' => env('HORIZON_SECRET'),
+    ],
+
     'mailgun' => [
         'domain'   => env('MAILGUN_DOMAIN'),
         'secret'   => env('MAILGUN_SECRET'),