// Handled by Filament middleware
if (! auth()->check()) {
    return redirect()->route('filament.auth.login');
}

// ShellGatePlugin configuration in AdminPanelProvider.php
use OctadecimalHQ\ShellGate\ShellGatePlugin;

ShellGatePlugin::make()
    ->authorize(function (): bool {
        $user = auth()->user();

        // Option 1: is_super_admin attribute (simplest)
        return $user?->is_super_admin ?? false;

        // Option 2: Spatie roles
        // return $user?->hasRole('super_admin');

        // Option 3: Permission-based
        // return $user?->can('access-terminal');
    });

protected function casts(): array
{
    return ['is_super_admin' => 'boolean'];
}

// Token structure
[
    'iss' => 'shell-gate',
    'sub' => $user->id,
    'session_id' => $sessionId,
    'iat' => time(),
    'exp' => time() + 300,  // 5 minutes
    'ip' => request()->ip(),
    'ua_hash' => md5(request()->userAgent()),
]

// AuditService.php
class AuditService
{
    public function logSessionStart(TerminalSession $session): void
    {
        Log::channel('shell-gate-audit')->info('Session started', [
            'session_id' => $session->id,
            'user_id' => $session->user_id,
            'ip' => $session->ip_address,
            'user_agent' => $session->user_agent,
        ]);
    }
    
    public function logCommand(string $sessionId, string $command): void
    {
        if (config('shell-gate.audit.log_commands', true)) {
            Log::channel('shell-gate-audit')->info('Command executed', [
                'session_id' => $sessionId,
                'command' => $this->sanitizeCommand($command),
            ]);
        }
    }
    
    private function sanitizeCommand(string $command): string
    {
        // Redact potential secrets
        return preg_replace(
            '/(password|secret|token|key)=[^\s]+/i',
            '$1=[REDACTED]',
            $command
        );
    }
}

// config/logging.php
'channels' => [
    'shell-gate-audit' => [
        'driver' => 'daily',
        'path' => storage_path('logs/shell-gate-audit.log'),
        'level' => 'info',
        'days' => 90,  // Retention period
        'permission' => 0600,
    ],
],

// config/shell-gate.php
'rate_limits' => [
    // Per user
    'max_sessions_per_user' => 2,
    'token_requests_per_minute' => 5,
    
    // Global
    'max_total_sessions' => 50,
    'max_connections_per_ip' => 3,
],

// TerminalTokenController.php
public function __invoke(Request $request): JsonResponse
{
    // Rate limit token requests
    $key = 'terminal-token:' . $request->user()->id;
    
    if (RateLimiter::tooManyAttempts($key, 5)) {
        return response()->json([
            'error' => 'Too many requests. Try again later.',
        ], 429);
    }
    
    RateLimiter::hit($key, 60);
    
    // Check concurrent session limit
    $activeSessions = TerminalSession::where('user_id', $request->user()->id)
        ->whereNull('ended_at')
        ->count();
    
    if ($activeSessions >= config('shell-gate.rate_limits.max_sessions_per_user')) {
        return response()->json([
            'error' => 'Maximum concurrent sessions reached.',
        ], 429);
    }
    
    // ... generate token
}