feat: use environment variable for Horizon access control

- Add HORIZON_ALLOWED_EMAILS env variable support
- Comma-separated list of emails allowed to access Horizon in production

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: paulocastellano

app/Providers/HorizonServiceProvider.php

@@ -14,10 +14,6 @@ class HorizonServiceProvider extends HorizonApplicationServiceProvider
     public function boot(): void
     {
         parent::boot();
-
-        // Horizon::routeSmsNotificationsTo('15556667777');
-        // Horizon::routeMailNotificationsTo('example@example.com');
-        // Horizon::routeSlackNotificationsTo('slack-webhook-url', '#channel');
     }
 
     /**
@@ -28,9 +24,11 @@ public function boot(): void
     protected function gate(): void
     {
         Gate::define('viewHorizon', function ($user = null) {
-            return in_array(optional($user)->email, [
-                //
-            ]);
+            $allowedEmails = array_filter(
+                array_map('trim', explode(',', config('horizon.allowed_emails', '')))
+            );
+
+            return in_array(optional($user)->email, $allowedEmails);
         });
     }
 }

config/horizon.php

@@ -30,6 +30,18 @@
 
     'domain' => env('HORIZON_DOMAIN'),
 
+    /*
+    |--------------------------------------------------------------------------
+    | Horizon Allowed Emails
+    |--------------------------------------------------------------------------
+    |
+    | This is a comma-separated list of email addresses that are allowed to
+    | access Horizon in non-local environments. Leave empty to deny all.
+    |
+    */
+
+    'allowed_emails' => env('HORIZON_ALLOWED_EMAILS', ''),
+
     /*
     |--------------------------------------------------------------------------
     | Horizon Path