Only inject when super user is logged in

README.md

@@ -17,6 +17,10 @@ composer require october/debugbar --dev
 
 The debugbar is enabled automatically when `APP_DEBUG=true`. You can override this with the `DEBUGBAR_ENABLED` environment variable.
 
+## Access Control
+
+The toolbar is only injected for signed-in backend super users. Anonymous frontend visitors and non-super-user backend admins see no debugbar, and no debugbar data is written to disk for their requests. This makes it safe to leave `DEBUGBAR_ENABLED=true` on a live site when you need to debug a production-only issue, since only super users can see the captured data.
+
 ## October CMS Collectors
 
 In addition to the standard Laravel Debugbar collectors, the following October-specific collectors are included:

src/Middleware/InjectDebugbar.php

@@ -0,0 +1,31 @@
+<?php declare(strict_types=1);
+
+namespace October\Debugbar\Middleware;
+
+use Closure;
+use BackendAuth;
+use Fruitcake\LaravelDebugbar\Middleware\InjectDebugbar as BaseMiddleware;
+
+/**
+ * InjectDebugbar gates toolbar injection and stored-request persistence
+ * on the current backend user being a super user. Non-super-users get
+ * the request unchanged and no debugbar data is written to disk.
+ */
+class InjectDebugbar extends BaseMiddleware
+{
+    /**
+     * handle an incoming request
+     */
+    public function handle($request, Closure $next)
+    {
+        $user = BackendAuth::getUser();
+
+        if (!$user || !$user->is_superuser) {
+            $this->debugbar->setStorage(null);
+
+            return $next($request);
+        }
+
+        return parent::handle($request, $next);
+    }
+}

src/ServiceProvider.php

@@ -15,6 +15,7 @@
 use October\Debugbar\DataCollectors\OctoberBackendCollector;
 use October\Debugbar\DataCollectors\OctoberCmsCollector;
 use October\Debugbar\DataCollectors\OctoberComponentsCollector;
+use October\Debugbar\Middleware\InjectDebugbar;
 use October\Debugbar\Middleware\InterpretsAjaxExceptions;
 use Twig\Extension\ProfilerExtension;
 use Twig\Profiler\Profile;
@@ -34,6 +35,10 @@ public function register(): void
         $this->publishes([
             base_path('vendor/fruitcake/laravel-debugbar/config/debugbar.php') => config_path('debugbar.php')
         ], 'config');
+
+        // Replace fruitcake's middleware with our gated subclass so the
+        // toolbar is only injected for signed-in super users.
+        $this->app->bind(\Fruitcake\LaravelDebugbar\Middleware\InjectDebugbar::class, InjectDebugbar::class);
     }
 
     /**