From e7561d29dd3303ee8fb721315596c6cd9bb7a901 Mon Sep 17 00:00:00 2001
From: Marcel Pociot <m.pociot@gmail.com>
Date: Thu, 22 Nov 2018 11:29:12 +0100
Subject: [PATCH] wip

---
 src/LaravelEcho/Pusher/Exceptions/UnknownAppId.php | 12 ++++++++++++
 src/LaravelEcho/WebSocket/PusherServer.php         | 11 +++++++++++
 2 files changed, 23 insertions(+)
 create mode 100644 src/LaravelEcho/Pusher/Exceptions/UnknownAppId.php

diff --git a/src/LaravelEcho/Pusher/Exceptions/UnknownAppId.php b/src/LaravelEcho/Pusher/Exceptions/UnknownAppId.php
new file mode 100644
index 0000000..71a20d0
--- /dev/null
+++ b/src/LaravelEcho/Pusher/Exceptions/UnknownAppId.php
@@ -0,0 +1,12 @@
+<?php
+
+namespace BeyondCode\LaravelWebSockets\LaravelEcho\Pusher\Exceptions;
+
+class UnknownAppId extends PusherException
+{
+    public function __construct(string $appId)
+    {
+        $this->message = "Could not find app key {$appId}";
+        $this->code = 4001;
+    }
+}
\ No newline at end of file
diff --git a/src/LaravelEcho/WebSocket/PusherServer.php b/src/LaravelEcho/WebSocket/PusherServer.php
index e54bdbd..9c10d5e 100644
--- a/src/LaravelEcho/WebSocket/PusherServer.php
+++ b/src/LaravelEcho/WebSocket/PusherServer.php
@@ -3,6 +3,7 @@
 namespace BeyondCode\LaravelWebSockets\LaravelEcho\WebSocket;
 
 use BeyondCode\LaravelWebsockets\LaravelEcho\Pusher\Exceptions\PusherException;
+use BeyondCode\LaravelWebSockets\LaravelEcho\Pusher\Exceptions\UnknownAppId;
 use Exception;
 use Ratchet\ConnectionInterface;
 use Ratchet\RFC6455\Messaging\MessageInterface;
@@ -39,6 +40,8 @@ class PusherServer extends WebSocketController
 
         $connection->appId = $queryParameters['appId'];
 
+        $this->verifyConnection($connection);
+
         $connection->send(json_encode([
             'event' => 'pusher:connection_established',
             'data' => json_encode([
@@ -68,4 +71,12 @@ class PusherServer extends WebSocketController
             ));
         }
     }
+
+    protected function verifyConnection(ConnectionInterface $connection)
+    {
+        // Todo: Lookup app-id for multi-tenancy support
+        if ($connection->appId !== config('broadcasting.connections.pusher.app_id')) {
+            throw new UnknownAppId($connection->appId);
+        }
+    }
 }
\ No newline at end of file