Дашборд с реальными данными + ручное управление устройствами

device-control-service: HTTP/JSON API (internal/httpapi) рядом с gRPC — POST /devices/{id}/turn-on|turn-off|set-level, тот же server.Server внутри, без дублирования логики. Решение вместо gRPC-клиента на PHP: grpc/grpc через PECL компилируется в Alpine 10-20+ минут и утяжеляет образ, а диаграмма архитектуры в ТЗ и так допускала HTTP для Laravel→device-control. Laravel: DeviceShadow (чтение Device Shadow из Redis, MGET одним запросом для списка устройств), ClickHouseClient (HTTP-интерфейс ClickHouse, параметризованные {name:Type}-запросы), DeviceControlClient (HTTP-вызовы к новому Go-эндпоинту). Redis-клиент — predis (чистый PHP), а не phpredis, по той же причине, что и решение по gRPC — не добавлять ещё одну C-компиляцию в образ. DeviceController::show — страница устройства: live-статус/last_seen/ desired-reported state из Redis, история показаний из ClickHouse (для сенсоров), кнопки ручного управления (для актуаторов, только owner, с проверкой capability устройства). В devices/index — бейдж online/ offline/unknown. Дашборд дополнен счётчиком онлайн-устройств. Два реальных бага найдены и исправлены при сквозной проверке: 1. Пустой action_params сериализовался в JSON-массив "[]" (PHP не различает пустой список и пустой объект), а Go ждёт объект — rule-engine-service падал на unmarshal. Фикс — JsonObjectCast (JSON_FORCE_OBJECT) на AutomationRule::action_params. 2. Redis-ключи device shadow — общее пространство имён с Go-сервisами (сырые ключи без префикса), а Laravel по умолчанию добавляет ко всем ключам префикс "app-name-database-" — Laravel никогда не видел реальные данные. Фикс — REDIS_PREFIX="" в окружении контейнера (важно: пустое значение в docker-compose YAML нужно задавать явно через "", просто "KEY:" означает "взять из окружения хоста"). Проверено сквозным тестом через docker compose: полный цикл телеметрия → правило → команда воспроизведён вживую с реальным исправлением на лету; ручное управление (turn_on/turn_off/set_level) из Laravel UI подтверждено через браузер — HTTP-вызов к device-control-service, обновление desired_state (merge-patch), реальная MQTT-команда поймана мониторингом топика. 38/38 тестов Laravel, все Go-тесты device-control-service зелёные.
CRUD зон/устройств/правил автоматизации + RBAC owner/viewer
2026-08-11 19:48:17 +05:00 · 2026-08-11 16:54:26 +05:00
49 changed files with 2225 additions and 39 deletions
@@ -30,8 +30,9 @@ RABBITMQ_PASSWORD=change_me
 MQTT_HOST=mosquitto
 MQTT_PORT=1883

-# --- device-control-service (gRPC) ---
+# --- device-control-service (gRPC + HTTP) ---
 DEVICE_CONTROL_GRPC_PORT=50051
+DEVICE_CONTROL_HTTP_PORT=8090
 DEVICE_CONTROL_MQTT_CLIENT_ID=device-control-service
 DEVICE_CONTROL_HEALTHCHECK_TIMEOUT=60s
 DEVICE_CONTROL_HEALTHCHECK_INTERVAL=15s
@@ -121,8 +121,10 @@ services:
      dockerfile: services/device-control-service/Dockerfile
    ports:
      - "${DEVICE_CONTROL_GRPC_PORT}:50051"
+      - "${DEVICE_CONTROL_HTTP_PORT}:8090"
    environment:
      DEVICE_CONTROL_GRPC_PORT: 50051
+      DEVICE_CONTROL_HTTP_PORT: 8090
      MQTT_HOST: mosquitto
      MQTT_PORT: 1883
      REDIS_HOST: redis
@@ -193,15 +195,29 @@ services:
      SESSION_DRIVER: database
      CACHE_STORE: database
      QUEUE_CONNECTION: sync
+      REDIS_CLIENT: predis
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD}
+      # Device Shadow keys are a cross-service keyspace (device-control-service
+      # writes them raw) — Laravel's default per-app key prefix would hide them.
+      REDIS_PREFIX: ""
+      CLICKHOUSE_HOST: clickhouse
+      CLICKHOUSE_HTTP_PORT: 8123
+      CLICKHOUSE_DB: ${CLICKHOUSE_DB}
+      CLICKHOUSE_USER: ${CLICKHOUSE_USER}
+      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD}
+      DEVICE_CONTROL_HTTP_URL: http://device-control-service:8090
      LOG_CHANNEL: stderr
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
+      clickhouse:
+        condition: service_healthy
+      device-control-service:
+        condition: service_started
    networks:
      - home-automation
    restart: unless-stopped
@@ -42,11 +42,24 @@ CACHE_STORE=database

 MEMCACHED_HOST=127.0.0.1

-REDIS_CLIENT=phpredis
+REDIS_CLIENT=predis
+# Device Shadow keys are a cross-service keyspace (device-control-service
+# writes them raw) — Laravel's default per-app key prefix would hide them.
+REDIS_PREFIX=
 REDIS_HOST=127.0.0.1
 REDIS_PASSWORD=null
 REDIS_PORT=6379

+# --- ClickHouse (telemetry history) ---
+CLICKHOUSE_HOST=127.0.0.1
+CLICKHOUSE_HTTP_PORT=8123
+CLICKHOUSE_DB=telemetry
+CLICKHOUSE_USER=default
+CLICKHOUSE_PASSWORD=change_me
+
+# --- device-control-service (manual device commands, HTTP transport) ---
+DEVICE_CONTROL_HTTP_URL=http://127.0.0.1:8090
+
 MAIL_MAILER=log
 MAIL_SCHEME=null
 MAIL_HOST=127.0.0.1
@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Casts;
+
+use Illuminate\Contracts\Database\Eloquent\CastsAttributes;
+
+/**
+ * Like the built-in 'array' cast, but always serializes as a JSON object
+ * ({}), never a JSON array ([]). PHP can't tell an empty list from an empty
+ * map, so `json_encode([])` gives "[]" — Go's `json.Unmarshal` into
+ * map[string]any rejects that. automation_rules.action_params is always a
+ * flat key-value map (never a genuine list), so forcing object encoding is
+ * safe here.
+ */
+class JsonObjectCast implements CastsAttributes
+{
+    public function get($model, string $key, $value, array $attributes): array
+    {
+        return $value === null ? [] : json_decode($value, true);
+    }
+
+    public function set($model, string $key, $value, array $attributes): string
+    {
+        return json_encode($value ?? [], JSON_FORCE_OBJECT);
+    }
+}
@@ -0,0 +1,117 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Enums\DeviceCategory;
+use App\Http\Requests\AutomationRuleRequest;
+use App\Models\AutomationRule;
+use App\Models\Device;
+use App\Models\DeviceType;
+use App\Models\Zone;
+
+class AutomationRuleController extends Controller
+{
+    public function index()
+    {
+        $this->authorize('viewAny', AutomationRule::class);
+
+        $rules = AutomationRule::with(['zone', 'targetDevice', 'conditionSourceDevice'])
+            ->orderByDesc('id')
+            ->get();
+
+        return view('automation-rules.index', ['rules' => $rules]);
+    }
+
+    public function create()
+    {
+        $this->authorize('create', AutomationRule::class);
+
+        return view('automation-rules.create', $this->formOptions());
+    }
+
+    public function store(AutomationRuleRequest $request)
+    {
+        $rule = new AutomationRule($this->mapActionParams($request->validated()));
+        $rule->user()->associate($request->user());
+        $rule->save();
+
+        return redirect()->route('automation-rules.index')->with('status', 'Правило создано.');
+    }
+
+    public function edit(AutomationRule $automation_rule)
+    {
+        $this->authorize('update', $automation_rule);
+
+        return view('automation-rules.edit', [
+            'rule' => $automation_rule,
+            ...$this->formOptions(),
+        ]);
+    }
+
+    public function update(AutomationRuleRequest $request, AutomationRule $automation_rule)
+    {
+        $automation_rule->update($this->mapActionParams($request->validated()));
+
+        return redirect()->route('automation-rules.index')->with('status', 'Правило обновлено.');
+    }
+
+    public function destroy(AutomationRule $automation_rule)
+    {
+        $this->authorize('delete', $automation_rule);
+
+        $automation_rule->delete();
+
+        return redirect()->route('automation-rules.index')->with('status', 'Правило удалено.');
+    }
+
+    /**
+     * The "level" form field is a friendlier stand-in for action_params —
+     * only set_level currently takes a parameter, so there's no need for a
+     * raw JSON editor yet.
+     *
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    private function mapActionParams(array $data): array
+    {
+        $data['action_params'] = $data['action_type'] === 'set_level'
+            ? ['level' => $data['level']]
+            : [];
+
+        unset($data['level']);
+
+        return $data;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function formOptions(): array
+    {
+        $devices = Device::with(['zone', 'deviceType'])->orderBy('name')->get();
+
+        return [
+            'zones' => Zone::orderBy('name')->get(),
+            'devices' => $devices,
+            'actionTypeOptions' => $this->capabilityOptions(DeviceCategory::Actuator),
+            'sensorTypeOptions' => $this->capabilityOptions(DeviceCategory::Sensor),
+        ];
+    }
+
+    /**
+     * Distinct capability values across device_types of the given category —
+     * used as friendly select/datalist suggestions, not a hardcoded list.
+     *
+     * @return \Illuminate\Support\Collection<int, string>
+     */
+    private function capabilityOptions(DeviceCategory $category)
+    {
+        return DeviceType::where('category', $category)
+            ->get()
+            ->pluck('capabilities')
+            ->flatten()
+            ->unique()
+            ->sort()
+            ->values();
+    }
+}
@@ -2,7 +2,9 @@

 namespace App\Http\Controllers;

+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+
 abstract class Controller
 {
-    //
+    use AuthorizesRequests;
 }
@@ -0,0 +1,144 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\DeviceRequest;
+use App\Models\Device;
+use App\Models\DeviceType;
+use App\Models\Zone;
+use App\Services\ClickHouseClient;
+use App\Services\DeviceControlClient;
+use App\Services\DeviceShadow;
+use Illuminate\Http\Request;
+
+class DeviceController extends Controller
+{
+    public function index(DeviceShadow $shadow)
+    {
+        $this->authorize('viewAny', Device::class);
+
+        $devices = Device::with(['zone', 'deviceType'])->orderBy('name')->get();
+        $statuses = $shadow->statuses($devices->pluck('external_id')->all());
+
+        return view('devices.index', compact('devices', 'statuses'));
+    }
+
+    public function show(Device $device, DeviceShadow $shadow, ClickHouseClient $clickHouse)
+    {
+        $this->authorize('view', $device);
+
+        $device->load(['zone', 'deviceType']);
+
+        $telemetry = [];
+        if ($device->deviceType->category->value === 'sensor') {
+            $telemetry = $clickHouse->query(
+                'SELECT sensor_type, value, recorded_at FROM telemetry
+                 WHERE device_id = {device_id:String}
+                 ORDER BY recorded_at DESC LIMIT 50',
+                ['device_id' => $device->external_id],
+            );
+        }
+
+        return view('devices.show', [
+            'device' => $device,
+            'shadow' => $shadow->snapshot($device->external_id),
+            'telemetry' => $telemetry,
+        ]);
+    }
+
+    public function create()
+    {
+        $this->authorize('create', Device::class);
+
+        return view('devices.create', $this->formOptions());
+    }
+
+    public function store(DeviceRequest $request)
+    {
+        $device = new Device($request->validated());
+        $device->user()->associate($request->user());
+        $device->save();
+
+        return redirect()->route('devices.index')->with('status', 'Устройство добавлено.');
+    }
+
+    public function edit(Device $device)
+    {
+        $this->authorize('update', $device);
+
+        return view('devices.edit', ['device' => $device, ...$this->formOptions()]);
+    }
+
+    public function update(DeviceRequest $request, Device $device)
+    {
+        $device->update($request->validated());
+
+        return redirect()->route('devices.index')->with('status', 'Устройство обновлено.');
+    }
+
+    public function destroy(Device $device)
+    {
+        $this->authorize('delete', $device);
+
+        $device->delete();
+
+        return redirect()->route('devices.index')->with('status', 'Устройство удалено.');
+    }
+
+    public function turnOn(Device $device, DeviceControlClient $client)
+    {
+        $this->authorize('update', $device);
+        $this->ensureCapability($device, 'turn_on');
+
+        return $this->respondToCommand($client->turnOn($device->external_id));
+    }
+
+    public function turnOff(Device $device, DeviceControlClient $client)
+    {
+        $this->authorize('update', $device);
+        $this->ensureCapability($device, 'turn_off');
+
+        return $this->respondToCommand($client->turnOff($device->external_id));
+    }
+
+    public function setLevel(Request $request, Device $device, DeviceControlClient $client)
+    {
+        $this->authorize('update', $device);
+        $this->ensureCapability($device, 'set_level');
+
+        $validated = $request->validate(['level' => ['required', 'numeric']]);
+
+        return $this->respondToCommand($client->setLevel($device->external_id, (float) $validated['level']));
+    }
+
+    private function ensureCapability(Device $device, string $capability): void
+    {
+        abort_unless(
+            in_array($capability, $device->deviceType->capabilities ?? [], true),
+            422,
+            "Устройство не поддерживает действие «{$capability}».",
+        );
+    }
+
+    /**
+     * @param  array{success: bool, error: ?string}  $result
+     */
+    private function respondToCommand(array $result)
+    {
+        return back()->with(
+            $result['success'] ? 'status' : 'error',
+            $result['success'] ? 'Команда отправлена.' : ($result['error'] ?? 'Команда не выполнена.'),
+        );
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function formOptions(): array
+    {
+        return [
+            'zones' => Zone::orderBy('name')->get(),
+            'deviceTypes' => DeviceType::orderBy('code')->get(),
+        ];
+    }
+}
@@ -0,0 +1,55 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\ZoneRequest;
+use App\Models\Zone;
+
+class ZoneController extends Controller
+{
+    public function index()
+    {
+        $this->authorize('viewAny', Zone::class);
+
+        $zones = Zone::withCount('devices')->orderBy('name')->get();
+
+        return view('zones.index', compact('zones'));
+    }
+
+    public function create()
+    {
+        $this->authorize('create', Zone::class);
+
+        return view('zones.create');
+    }
+
+    public function store(ZoneRequest $request)
+    {
+        $request->user()->zones()->create($request->validated());
+
+        return redirect()->route('zones.index')->with('status', 'Зона создана.');
+    }
+
+    public function edit(Zone $zone)
+    {
+        $this->authorize('update', $zone);
+
+        return view('zones.edit', compact('zone'));
+    }
+
+    public function update(ZoneRequest $request, Zone $zone)
+    {
+        $zone->update($request->validated());
+
+        return redirect()->route('zones.index')->with('status', 'Зона обновлена.');
+    }
+
+    public function destroy(Zone $zone)
+    {
+        $this->authorize('delete', $zone);
+
+        $zone->delete();
+
+        return redirect()->route('zones.index')->with('status', 'Зона удалена.');
+    }
+}
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Enums\ConditionOperator;
+use App\Models\AutomationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class AutomationRuleRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        $rule = $this->route('automation_rule');
+
+        return $rule
+            ? $this->user()->can('update', $rule)
+            : $this->user()->can('create', AutomationRule::class);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'zone_id' => ['required', 'exists:zones,id'],
+            'target_device_id' => ['required', 'exists:devices,id'],
+            'condition_source_device_id' => ['required', 'exists:devices,id'],
+            'condition_sensor_type' => ['required', 'string', 'max:255'],
+            'condition_operator' => ['required', Rule::enum(ConditionOperator::class)],
+            'condition_value' => ['required', 'numeric'],
+            'action_type' => ['required', 'string', 'max:255'],
+            'level' => ['nullable', 'numeric', 'required_if:action_type,set_level'],
+            'is_active' => ['boolean'],
+        ];
+    }
+}
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Models\Device;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class DeviceRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        $device = $this->route('device');
+
+        return $device
+            ? $this->user()->can('update', $device)
+            : $this->user()->can('create', Device::class);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        $device = $this->route('device');
+
+        return [
+            'zone_id' => ['required', 'exists:zones,id'],
+            'device_type_id' => ['required', 'exists:device_types,id'],
+            'name' => ['required', 'string', 'max:255'],
+            'external_id' => [
+                'required', 'string', 'max:255',
+                Rule::unique('devices', 'external_id')->ignore($device),
+            ],
+            'protocol' => ['required', 'string', 'max:255'],
+        ];
+    }
+}
@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Models\Zone;
+use Illuminate\Foundation\Http\FormRequest;
+
+class ZoneRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        $zone = $this->route('zone');
+
+        return $zone
+            ? $this->user()->can('update', $zone)
+            : $this->user()->can('create', Zone::class);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'description' => ['nullable', 'string'],
+        ];
+    }
+}
@@ -2,6 +2,7 @@

 namespace App\Models;

+use App\Casts\JsonObjectCast;
 use App\Enums\ConditionOperator;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Model;
@@ -27,7 +28,7 @@ class AutomationRule extends Model
        return [
            'condition_operator' => ConditionOperator::class,
            'condition_value' => 'float',
-            'action_params' => 'array',
+            'action_params' => JsonObjectCast::class,
            'is_active' => 'boolean',
            'created_at' => 'datetime',
        ];
@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\AutomationRule;
+use App\Models\User;
+
+/** See ZonePolicy for the household-wide RBAC rationale. */
+class AutomationRulePolicy
+{
+    public function viewAny(User $user): bool
+    {
+        return true;
+    }
+
+    public function view(User $user, AutomationRule $automationRule): bool
+    {
+        return true;
+    }
+
+    public function create(User $user): bool
+    {
+        return $user->isOwner();
+    }
+
+    public function update(User $user, AutomationRule $automationRule): bool
+    {
+        return $user->isOwner();
+    }
+
+    public function delete(User $user, AutomationRule $automationRule): bool
+    {
+        return $user->isOwner();
+    }
+}
@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Device;
+use App\Models\User;
+
+/** See ZonePolicy for the household-wide RBAC rationale. */
+class DevicePolicy
+{
+    public function viewAny(User $user): bool
+    {
+        return true;
+    }
+
+    public function view(User $user, Device $device): bool
+    {
+        return true;
+    }
+
+    public function create(User $user): bool
+    {
+        return $user->isOwner();
+    }
+
+    public function update(User $user, Device $device): bool
+    {
+        return $user->isOwner();
+    }
+
+    public function delete(User $user, Device $device): bool
+    {
+        return $user->isOwner();
+    }
+}
@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\User;
+use App\Models\Zone;
+
+/**
+ * Household-wide RBAC, not per-user tenant isolation: every authenticated
+ * user (owner or viewer) sees the same zones, only `owner` can write.
+ * `zones.user_id` records who registered the zone, it isn't a visibility
+ * boundary.
+ */
+class ZonePolicy
+{
+    public function viewAny(User $user): bool
+    {
+        return true;
+    }
+
+    public function view(User $user, Zone $zone): bool
+    {
+        return true;
+    }
+
+    public function create(User $user): bool
+    {
+        return $user->isOwner();
+    }
+
+    public function update(User $user, Zone $zone): bool
+    {
+        return $user->isOwner();
+    }
+
+    public function delete(User $user, Zone $zone): bool
+    {
+        return $user->isOwner();
+    }
+}
@@ -2,6 +2,8 @@

 namespace App\Providers;

+use App\Services\ClickHouseClient;
+use App\Services\DeviceControlClient;
 use Illuminate\Support\ServiceProvider;

 class AppServiceProvider extends ServiceProvider
@@ -11,7 +13,16 @@ class AppServiceProvider extends ServiceProvider
     */
    public function register(): void
    {
-        //
+        $this->app->singleton(ClickHouseClient::class, fn () => new ClickHouseClient(
+            baseUrl: config('clickhouse.url'),
+            database: config('clickhouse.database'),
+            username: config('clickhouse.username'),
+            password: config('clickhouse.password'),
+        ));
+
+        $this->app->singleton(DeviceControlClient::class, fn () => new DeviceControlClient(
+            baseUrl: config('services.device_control.url'),
+        ));
    }

    /**
@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Services;
+
+use Illuminate\Support\Facades\Http;
+use RuntimeException;
+
+/**
+ * Minimal client for ClickHouse's HTTP interface — used instead of a
+ * ClickHouse composer package to avoid an extra dependency for what's just
+ * "POST a query, get JSONEachRow back". Queries are parameterized via
+ * ClickHouse's own {name:Type} placeholders (sent as param_name=value query
+ * params), never string-concatenated, so this is safe against injection.
+ */
+class ClickHouseClient
+{
+    public function __construct(
+        private readonly string $baseUrl,
+        private readonly string $database,
+        private readonly string $username,
+        private readonly string $password,
+    ) {}
+
+    /**
+     * @param  array<string, scalar>  $params  Bound to {name:Type} placeholders in $sql.
+     * @return array<int, array<string, mixed>>
+     */
+    public function query(string $sql, array $params = []): array
+    {
+        $query = array_merge(
+            ['database' => $this->database, 'default_format' => 'JSONEachRow'],
+            collect($params)->mapWithKeys(fn ($value, $key) => ["param_{$key}" => $value])->all(),
+        );
+
+        $response = Http::withBasicAuth($this->username, $this->password)
+            ->withBody($sql, 'text/plain')
+            ->post("{$this->baseUrl}/?".http_build_query($query));
+
+        if ($response->failed()) {
+            throw new RuntimeException("ClickHouse query failed ({$response->status()}): {$response->body()}");
+        }
+
+        // JSONEachRow: one JSON object per line, not a JSON array.
+        return collect(explode("\n", trim($response->body())))
+            ->filter(fn (string $line) => $line !== '')
+            ->map(fn (string $line) => json_decode($line, true))
+            ->all();
+    }
+}
@@ -0,0 +1,63 @@
+<?php
+
+namespace App\Services;
+
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * HTTP client for device-control-service's manual-command API (see that
+ * service's README for why HTTP instead of gRPC here). Mirrors the
+ * gRPC CommandResult contract: {success, error} in the body — always
+ * returned as an array here too, never an exception, so callers don't need
+ * to distinguish "device rejected it" from "service unreachable" to render
+ * a flash message.
+ */
+class DeviceControlClient
+{
+    public function __construct(private readonly string $baseUrl) {}
+
+    /** @return array{success: bool, error: ?string} */
+    public function turnOn(string $externalId): array
+    {
+        return $this->post("/devices/{$externalId}/turn-on");
+    }
+
+    /** @return array{success: bool, error: ?string} */
+    public function turnOff(string $externalId): array
+    {
+        return $this->post("/devices/{$externalId}/turn-off");
+    }
+
+    /** @return array{success: bool, error: ?string} */
+    public function setLevel(string $externalId, float $level): array
+    {
+        return $this->post("/devices/{$externalId}/set-level", ['level' => $level]);
+    }
+
+    /**
+     * @param  array<string, mixed>  $body
+     * @return array{success: bool, error: ?string}
+     */
+    private function post(string $path, array $body = []): array
+    {
+        try {
+            $response = Http::timeout(5)->post("{$this->baseUrl}{$path}", $body);
+        } catch (\Illuminate\Http\Client\ConnectionException $e) {
+            Log::error('device-control-service unreachable', ['path' => $path, 'error' => $e->getMessage()]);
+
+            return ['success' => false, 'error' => 'device-control-service недоступен'];
+        }
+
+        if ($response->failed()) {
+            Log::error('device-control-service returned an error status', ['path' => $path, 'status' => $response->status()]);
+
+            return ['success' => false, 'error' => 'device-control-service вернул ошибку'];
+        }
+
+        return [
+            'success' => (bool) $response->json('success'),
+            'error' => $response->json('error'),
+        ];
+    }
+}
@@ -0,0 +1,57 @@
+<?php
+
+namespace App\Services;
+
+use Carbon\CarbonImmutable;
+use Illuminate\Support\Facades\Redis;
+
+/**
+ * Read-only access to device-control-service's Device Shadow in Redis.
+ * Laravel never writes these keys — device-control-service owns them; this
+ * is purely for the dashboard/device pages to show live state.
+ */
+class DeviceShadow
+{
+    /**
+     * Full shadow snapshot for one device, one round-trip via pipeline.
+     *
+     * @return array{status: string, last_seen: ?CarbonImmutable, desired_state: array<string, mixed>, reported_state: array<string, mixed>}
+     */
+    public function snapshot(string $externalId): array
+    {
+        $results = Redis::pipeline(function ($pipe) use ($externalId) {
+            $pipe->get("device:{$externalId}:status");
+            $pipe->get("device:{$externalId}:last_seen");
+            $pipe->get("device:{$externalId}:desired_state");
+            $pipe->get("device:{$externalId}:reported_state");
+        });
+
+        [$status, $lastSeen, $desired, $reported] = $results;
+
+        return [
+            'status' => $status ?: 'unknown',
+            'last_seen' => $lastSeen ? CarbonImmutable::createFromTimestamp((int) $lastSeen) : null,
+            'desired_state' => $desired ? json_decode($desired, true) : [],
+            'reported_state' => $reported ? json_decode($reported, true) : [],
+        ];
+    }
+
+    /**
+     * Status for many devices in a single round-trip (MGET), so the device
+     * list doesn't do one Redis call per row.
+     *
+     * @param  array<int, string>  $externalIds
+     * @return array<string, string> external_id => status ("online"/"offline"/"unknown")
+     */
+    public function statuses(array $externalIds): array
+    {
+        if (empty($externalIds)) {
+            return [];
+        }
+
+        $keys = array_map(fn (string $id) => "device:{$id}:status", $externalIds);
+        $values = Redis::mget($keys);
+
+        return array_combine($externalIds, array_map(fn ($v) => $v ?: 'unknown', $values));
+    }
+}
@@ -9,7 +9,8 @@
        "php": "^8.3",
        "laravel/framework": "^13.8",
        "laravel/sanctum": "^4.0",
-        "laravel/tinker": "^3.0"
+        "laravel/tinker": "^3.0",
+        "predis/predis": "^3.5"
    },
    "require-dev": {
        "fakerphp/faker": "^1.23",
@@ -4,7 +4,7 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "f1ab046cb80318325a9735c77c07672f",
+    "content-hash": "483f1bf17688fcc178b8c1849ff31ddc",
    "packages": [
        {
            "name": "brick/math",
@@ -642,21 +642,21 @@
        },
        {
            "name": "guzzlehttp/guzzle",
-            "version": "7.15.1",
+            "version": "7.15.3",
            "source": {
                "type": "git",
                "url": "https://github.com/guzzle/guzzle.git",
-                "reference": "61443dfb33c62f308ee8add20f45b4d6e4bf8d2f"
+                "reference": "ae311b8f045ea93ce7b1c9cdb7cec06c53f944bc"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/guzzle/zipball/61443dfb33c62f308ee8add20f45b4d6e4bf8d2f",
-                "reference": "61443dfb33c62f308ee8add20f45b4d6e4bf8d2f",
+                "url": "https://api.github.com/repos/guzzle/guzzle/zipball/ae311b8f045ea93ce7b1c9cdb7cec06c53f944bc",
+                "reference": "ae311b8f045ea93ce7b1c9cdb7cec06c53f944bc",
                "shasum": ""
            },
            "require": {
                "ext-json": "*",
-                "guzzlehttp/promises": "^2.5.1",
+                "guzzlehttp/promises": "^2.5.2",
                "guzzlehttp/psr7": "^2.13",
                "php": "^7.2.5 || ^8.0",
                "psr/http-client": "^1.0",
@@ -750,7 +750,7 @@
            ],
            "support": {
                "issues": "https://github.com/guzzle/guzzle/issues",
-                "source": "https://github.com/guzzle/guzzle/tree/7.15.1"
+                "source": "https://github.com/guzzle/guzzle/tree/7.15.3"
            },
            "funding": [
                {
@@ -766,20 +766,20 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-07-18T11:23:11+00:00"
+            "time": "2026-08-05T19:48:21+00:00"
        },
        {
            "name": "guzzlehttp/promises",
-            "version": "2.5.1",
+            "version": "2.5.2",
            "source": {
                "type": "git",
                "url": "https://github.com/guzzle/promises.git",
-                "reference": "9ad1e4fc607446a055b95870c7f668e93b5cff29"
+                "reference": "2823687acff28b2dbe67b2508a6b300e2c3fa4ce"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/promises/zipball/9ad1e4fc607446a055b95870c7f668e93b5cff29",
-                "reference": "9ad1e4fc607446a055b95870c7f668e93b5cff29",
+                "url": "https://api.github.com/repos/guzzle/promises/zipball/2823687acff28b2dbe67b2508a6b300e2c3fa4ce",
+                "reference": "2823687acff28b2dbe67b2508a6b300e2c3fa4ce",
                "shasum": ""
            },
            "require": {
@@ -834,7 +834,7 @@
            ],
            "support": {
                "issues": "https://github.com/guzzle/promises/issues",
-                "source": "https://github.com/guzzle/promises/tree/2.5.1"
+                "source": "https://github.com/guzzle/promises/tree/2.5.2"
            },
            "funding": [
                {
@@ -850,7 +850,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-07-08T15:48:39+00:00"
+            "time": "2026-08-05T19:30:54+00:00"
        },
        {
            "name": "guzzlehttp/psr7",
@@ -1538,16 +1538,16 @@
        },
        {
            "name": "league/commonmark",
-            "version": "2.8.3",
+            "version": "2.9.2",
            "source": {
                "type": "git",
                "url": "https://github.com/thephpleague/commonmark.git",
-                "reference": "1902f60f984235023acbe03db6ad614a37b3c3e7"
+                "reference": "72e9a87efcf41a8e83be3ed0866b69d77565cb12"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/1902f60f984235023acbe03db6ad614a37b3c3e7",
-                "reference": "1902f60f984235023acbe03db6ad614a37b3c3e7",
+                "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/72e9a87efcf41a8e83be3ed0866b69d77565cb12",
+                "reference": "72e9a87efcf41a8e83be3ed0866b69d77565cb12",
                "shasum": ""
            },
            "require": {
@@ -1584,7 +1584,7 @@
            "type": "library",
            "extra": {
                "branch-alias": {
-                    "dev-main": "2.9-dev"
+                    "dev-main": "2.10-dev"
                }
            },
            "autoload": {
@@ -1641,7 +1641,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-07-12T15:29:16+00:00"
+            "time": "2026-08-11T00:58:45+00:00"
        },
        {
            "name": "league/config",
@@ -2680,6 +2680,69 @@
            ],
            "time": "2025-12-27T19:41:33+00:00"
        },
+        {
+            "name": "predis/predis",
+            "version": "v3.5.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/predis/predis.git",
+                "reference": "5c996db191ee2d9bafe651f454b1fca16754271b"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/predis/predis/zipball/5c996db191ee2d9bafe651f454b1fca16754271b",
+                "reference": "5c996db191ee2d9bafe651f454b1fca16754271b",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.2 || ^8.0",
+                "psr/http-message": "^1.0|^2.0"
+            },
+            "require-dev": {
+                "friendsofphp/php-cs-fixer": "^3.3",
+                "phpstan/phpstan": "^1.9",
+                "phpunit/phpcov": "^6.0 || ^8.0",
+                "phpunit/phpunit": "^8.0 || ~9.4.4"
+            },
+            "suggest": {
+                "ext-relay": "Faster connection with in-memory caching (>=0.6.2)"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "Predis\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Till Krüss",
+                    "homepage": "https://till.im",
+                    "role": "Maintainer"
+                }
+            ],
+            "description": "A flexible and feature-complete Redis/Valkey client for PHP.",
+            "homepage": "http://github.com/predis/predis",
+            "keywords": [
+                "nosql",
+                "predis",
+                "redis"
+            ],
+            "support": {
+                "issues": "https://github.com/predis/predis/issues",
+                "source": "https://github.com/predis/predis/tree/v3.5.1"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sponsors/tillkruss",
+                    "type": "github"
+                }
+            ],
+            "time": "2026-06-11T16:56:53+00:00"
+        },
        {
            "name": "psr/clock",
            "version": "1.0.0",
@@ -0,0 +1,8 @@
+<?php
+
+return [
+    'url' => 'http://'.env('CLICKHOUSE_HOST', 'localhost').':'.env('CLICKHOUSE_HTTP_PORT', '8123'),
+    'database' => env('CLICKHOUSE_DB', 'telemetry'),
+    'username' => env('CLICKHOUSE_USER', 'default'),
+    'password' => env('CLICKHOUSE_PASSWORD', ''),
+];
@@ -35,4 +35,8 @@ return [
        ],
    ],

+    'device_control' => [
+        'url' => env('DEVICE_CONTROL_HTTP_URL', 'http://localhost:8090'),
+    ],
+
 ];
@@ -22,6 +22,15 @@ class DatabaseSeeder extends Seeder
            'role' => UserRole::Owner,
        ]);

-        $this->call(DeviceTypeSeeder::class);
+        User::factory()->create([
+            'name' => 'Test Viewer',
+            'email' => 'viewer@example.com',
+            'role' => UserRole::Viewer,
+        ]);
+
+        $this->call([
+            DeviceTypeSeeder::class,
+            DemoGrowboxSeeder::class,
+        ]);
    }
 }
@@ -0,0 +1,70 @@
+<?php
+
+namespace Database\Seeders;
+
+use App\Models\AutomationRule;
+use App\Models\Device;
+use App\Models\DeviceType;
+use App\Models\User;
+use App\Models\Zone;
+use Illuminate\Database\Seeder;
+
+/**
+ * Demo data for the growbox zone — the first zone implemented on the
+ * platform. Purely example content so the CRUD screens aren't empty on
+ * first run; nothing here is special-cased in application code.
+ */
+class DemoGrowboxSeeder extends Seeder
+{
+    public function run(): void
+    {
+        $owner = User::where('email', 'owner@example.com')->firstOrFail();
+
+        $zone = Zone::query()->firstOrCreate(
+            ['name' => 'Гроубокс'],
+            ['user_id' => $owner->id, 'description' => 'Демо-зона для проверки платформы']
+        );
+
+        $sensorType = DeviceType::where('code', 'sensor_temp_humidity')->firstOrFail();
+        $fanType = DeviceType::where('code', 'fan')->firstOrFail();
+
+        $sensor = Device::query()->firstOrCreate(
+            ['external_id' => 'sensor-1'],
+            [
+                'user_id' => $owner->id,
+                'zone_id' => $zone->id,
+                'device_type_id' => $sensorType->id,
+                'name' => 'Датчик температуры',
+                'protocol' => 'mqtt',
+            ]
+        );
+
+        $fan = Device::query()->firstOrCreate(
+            ['external_id' => 'fan-1'],
+            [
+                'user_id' => $owner->id,
+                'zone_id' => $zone->id,
+                'device_type_id' => $fanType->id,
+                'name' => 'Вентилятор',
+                'protocol' => 'mqtt',
+            ]
+        );
+
+        AutomationRule::query()->firstOrCreate(
+            [
+                'condition_source_device_id' => $sensor->id,
+                'target_device_id' => $fan->id,
+            ],
+            [
+                'user_id' => $owner->id,
+                'zone_id' => $zone->id,
+                'condition_sensor_type' => 'temperature',
+                'condition_operator' => '>',
+                'condition_value' => 28,
+                'action_type' => 'turn_on',
+                'action_params' => [],
+                'is_active' => true,
+            ]
+        );
+    }
+}
@@ -0,0 +1,116 @@
+@csrf
+@isset($rule)
+    @method('PUT')
+@endisset
+
+<div x-data="{ actionType: '{{ old('action_type', $rule->action_type ?? '') }}' }">
+    <div>
+        <x-input-label for="zone_id" :value="__('Зона')" />
+        <select id="zone_id" name="zone_id" required
+            class="mt-1 block w-full border-gray-300 focus:border-indigo-500 focus:ring-indigo-500 rounded-md shadow-sm">
+            <option value="">{{ __('— выбрать —') }}</option>
+            @foreach ($zones as $zone)
+                <option value="{{ $zone->id }}" @selected(old('zone_id', $rule->zone_id ?? '') == $zone->id)>{{ $zone->name }}</option>
+            @endforeach
+        </select>
+        <x-input-error :messages="$errors->get('zone_id')" class="mt-2" />
+    </div>
+
+    <div class="mt-4">
+        <x-input-label for="condition_source_device_id" :value="__('Устройство-источник показания')" />
+        <select id="condition_source_device_id" name="condition_source_device_id" required
+            class="mt-1 block w-full border-gray-300 focus:border-indigo-500 focus:ring-indigo-500 rounded-md shadow-sm">
+            <option value="">{{ __('— выбрать —') }}</option>
+            @foreach ($devices as $device)
+                <option value="{{ $device->id }}" @selected(old('condition_source_device_id', $rule->condition_source_device_id ?? '') == $device->id)>
+                    {{ $device->zone->name }} — {{ $device->name }} ({{ $device->deviceType->code }})
+                </option>
+            @endforeach
+        </select>
+        <x-input-error :messages="$errors->get('condition_source_device_id')" class="mt-2" />
+    </div>
+
+    <div class="mt-4 grid grid-cols-3 gap-4">
+        <div>
+            <x-input-label for="condition_sensor_type" :value="__('Тип показания')" />
+            <input list="sensor-types" id="condition_sensor_type" name="condition_sensor_type" type="text"
+                value="{{ old('condition_sensor_type', $rule->condition_sensor_type ?? '') }}" required
+                class="mt-1 block w-full border-gray-300 focus:border-indigo-500 focus:ring-indigo-500 rounded-md shadow-sm" />
+            <datalist id="sensor-types">
+                @foreach ($sensorTypeOptions as $option)
+                    <option value="{{ $option }}"></option>
+                @endforeach
+            </datalist>
+            <x-input-error :messages="$errors->get('condition_sensor_type')" class="mt-2" />
+        </div>
+
+        <div>
+            <x-input-label for="condition_operator" :value="__('Оператор')" />
+            <select id="condition_operator" name="condition_operator" required
+                class="mt-1 block w-full border-gray-300 focus:border-indigo-500 focus:ring-indigo-500 rounded-md shadow-sm">
+                @foreach (\App\Enums\ConditionOperator::cases() as $operator)
+                    <option value="{{ $operator->value }}" @selected(old('condition_operator', $rule->condition_operator->value ?? '') == $operator->value)>
+                        {{ $operator->value }}
+                    </option>
+                @endforeach
+            </select>
+            <x-input-error :messages="$errors->get('condition_operator')" class="mt-2" />
+        </div>
+
+        <div>
+            <x-input-label for="condition_value" :value="__('Порог')" />
+            <x-text-input id="condition_value" name="condition_value" type="number" step="any" class="mt-1 block w-full"
+                :value="old('condition_value', $rule->condition_value ?? '')" required />
+            <x-input-error :messages="$errors->get('condition_value')" class="mt-2" />
+        </div>
+    </div>
+
+    <div class="mt-4">
+        <x-input-label for="target_device_id" :value="__('Устройство-исполнитель')" />
+        <select id="target_device_id" name="target_device_id" required
+            class="mt-1 block w-full border-gray-300 focus:border-indigo-500 focus:ring-indigo-500 rounded-md shadow-sm">
+            <option value="">{{ __('— выбрать —') }}</option>
+            @foreach ($devices as $device)
+                <option value="{{ $device->id }}" @selected(old('target_device_id', $rule->target_device_id ?? '') == $device->id)>
+                    {{ $device->zone->name }} — {{ $device->name }} ({{ $device->deviceType->code }})
+                </option>
+            @endforeach
+        </select>
+        <x-input-error :messages="$errors->get('target_device_id')" class="mt-2" />
+    </div>
+
+    <div class="mt-4 grid grid-cols-2 gap-4">
+        <div>
+            <x-input-label for="action_type" :value="__('Действие')" />
+            <select id="action_type" name="action_type" required x-model="actionType"
+                class="mt-1 block w-full border-gray-300 focus:border-indigo-500 focus:ring-indigo-500 rounded-md shadow-sm">
+                <option value="">{{ __('— выбрать —') }}</option>
+                @foreach ($actionTypeOptions as $option)
+                    <option value="{{ $option }}">{{ $option }}</option>
+                @endforeach
+            </select>
+            <x-input-error :messages="$errors->get('action_type')" class="mt-2" />
+        </div>
+
+        <div x-show="actionType === 'set_level'">
+            <x-input-label for="level" :value="__('Уровень')" />
+            <x-text-input id="level" name="level" type="number" step="any" class="mt-1 block w-full"
+                :value="old('level', $rule->action_params['level'] ?? '')" />
+            <x-input-error :messages="$errors->get('level')" class="mt-2" />
+        </div>
+    </div>
+
+    <div class="mt-4">
+        <label class="inline-flex items-center">
+            <input type="hidden" name="is_active" value="0">
+            <input type="checkbox" name="is_active" value="1" class="rounded border-gray-300 text-indigo-600 shadow-sm"
+                @checked(old('is_active', $rule->is_active ?? true))>
+            <span class="ms-2 text-sm text-gray-600">{{ __('Правило активно') }}</span>
+        </label>
+    </div>
+
+    <div class="mt-4 flex items-center gap-4">
+        <x-primary-button>{{ __('Сохранить') }}</x-primary-button>
+        <a href="{{ route('automation-rules.index') }}" class="text-sm text-gray-600 hover:underline">{{ __('Отмена') }}</a>
+    </div>
+</div>
@@ -0,0 +1,15 @@
+<x-app-layout>
+    <x-slot name="header">
+        <h2 class="font-semibold text-xl text-gray-800 leading-tight">{{ __('Новое правило автоматизации') }}</h2>
+    </x-slot>
+
+    <div class="py-12">
+        <div class="max-w-2xl mx-auto sm:px-6 lg:px-8">
+            <div class="bg-white overflow-hidden shadow-sm sm:rounded-lg p-6">
+                <form method="POST" action="{{ route('automation-rules.store') }}">
+                    @include('automation-rules._form')
+                </form>
+            </div>
+        </div>
+    </div>
+</x-app-layout>
@@ -0,0 +1,15 @@
+<x-app-layout>
+    <x-slot name="header">
+        <h2 class="font-semibold text-xl text-gray-800 leading-tight">{{ __('Изменить правило автоматизации') }}</h2>
+    </x-slot>
+
+    <div class="py-12">
+        <div class="max-w-2xl mx-auto sm:px-6 lg:px-8">
+            <div class="bg-white overflow-hidden shadow-sm sm:rounded-lg p-6">
+                <form method="POST" action="{{ route('automation-rules.update', $rule) }}">
+                    @include('automation-rules._form')
+                </form>
+            </div>
+        </div>
+    </div>
+</x-app-layout>
@@ -0,0 +1,72 @@
+<x-app-layout>
+    <x-slot name="header">
+        <div class="flex justify-between items-center">
+            <h2 class="font-semibold text-xl text-gray-800 leading-tight">
+                {{ __('Правила автоматизации') }}
+            </h2>
+            @can('create', \App\Models\AutomationRule::class)
+                <x-primary-button onclick="window.location='{{ route('automation-rules.create') }}'">
+                    {{ __('Добавить правило') }}
+                </x-primary-button>
+            @endcan
+        </div>
+    </x-slot>
+
+    <div class="py-12">
+        <div class="max-w-7xl mx-auto sm:px-6 lg:px-8">
+            <div class="bg-white overflow-hidden shadow-sm sm:rounded-lg p-6">
+                @if (session('status'))
+                    <div class="mb-4 text-sm text-green-600">{{ session('status') }}</div>
+                @endif
+
+                <table class="w-full text-left text-sm">
+                    <thead>
+                        <tr class="border-b">
+                            <th class="py-2">{{ __('Зона') }}</th>
+                            <th class="py-2">{{ __('Условие') }}</th>
+                            <th class="py-2">{{ __('Действие') }}</th>
+                            <th class="py-2">{{ __('Активно') }}</th>
+                            <th class="py-2"></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        @forelse ($rules as $rule)
+                            <tr class="border-b">
+                                <td class="py-2">{{ $rule->zone->name }}</td>
+                                <td class="py-2">
+                                    {{ $rule->conditionSourceDevice->name }}:
+                                    {{ $rule->condition_sensor_type }}
+                                    {{ $rule->condition_operator->value }}
+                                    {{ $rule->condition_value }}
+                                </td>
+                                <td class="py-2">
+                                    {{ $rule->targetDevice->name }}: {{ $rule->action_type }}
+                                    @if (!empty($rule->action_params))
+                                        ({{ json_encode($rule->action_params) }})
+                                    @endif
+                                </td>
+                                <td class="py-2">{{ $rule->is_active ? __('да') : __('нет') }}</td>
+                                <td class="py-2 text-right space-x-2">
+                                    @can('update', $rule)
+                                        <a href="{{ route('automation-rules.edit', $rule) }}" class="text-indigo-600 hover:underline">{{ __('Изменить') }}</a>
+                                    @endcan
+                                    @can('delete', $rule)
+                                        <form method="POST" action="{{ route('automation-rules.destroy', $rule) }}" class="inline" onsubmit="return confirm('{{ __('Удалить правило?') }}')">
+                                            @csrf
+                                            @method('DELETE')
+                                            <button type="submit" class="text-red-600 hover:underline">{{ __('Удалить') }}</button>
+                                        </form>
+                                    @endcan
+                                </td>
+                            </tr>
+                        @empty
+                            <tr>
+                                <td colspan="5" class="py-4 text-gray-500">{{ __('Правил пока нет.') }}</td>
+                            </tr>
+                        @endforelse
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+</x-app-layout>
@@ -6,12 +6,23 @@
    </x-slot>

    <div class="py-12">
-        <div class="max-w-7xl mx-auto sm:px-6 lg:px-8">
-            <div class="bg-white overflow-hidden shadow-sm sm:rounded-lg">
-                <div class="p-6 text-gray-900">
-                    {{ __("You're logged in!") }}
-                </div>
-            </div>
+        <div class="max-w-7xl mx-auto sm:px-6 lg:px-8 grid grid-cols-1 sm:grid-cols-4 gap-6">
+            <a href="{{ route('zones.index') }}" class="bg-white overflow-hidden shadow-sm sm:rounded-lg p-6 hover:shadow-md transition">
+                <div class="text-sm text-gray-500">{{ __('Зоны') }}</div>
+                <div class="text-3xl font-semibold text-gray-900">{{ $zonesCount }}</div>
+            </a>
+            <a href="{{ route('devices.index') }}" class="bg-white overflow-hidden shadow-sm sm:rounded-lg p-6 hover:shadow-md transition">
+                <div class="text-sm text-gray-500">{{ __('Устройства') }}</div>
+                <div class="text-3xl font-semibold text-gray-900">{{ $devicesCount }}</div>
+            </a>
+            <a href="{{ route('devices.index') }}" class="bg-white overflow-hidden shadow-sm sm:rounded-lg p-6 hover:shadow-md transition">
+                <div class="text-sm text-gray-500">{{ __('Онлайн') }}</div>
+                <div class="text-3xl font-semibold text-green-600">{{ $onlineDevicesCount }}</div>
+            </a>
+            <a href="{{ route('automation-rules.index') }}" class="bg-white overflow-hidden shadow-sm sm:rounded-lg p-6 hover:shadow-md transition">
+                <div class="text-sm text-gray-500">{{ __('Активных правил') }}</div>
+                <div class="text-3xl font-semibold text-gray-900">{{ $activeRulesCount }}</div>
+            </a>
        </div>
    </div>
 </x-app-layout>
@@ -0,0 +1,56 @@
+@csrf
+@isset($device)
+    @method('PUT')
+@endisset
+
+<div>
+    <x-input-label for="name" :value="__('Название')" />
+    <x-text-input id="name" name="name" type="text" class="mt-1 block w-full"
+        :value="old('name', $device->name ?? '')" required autofocus />
+    <x-input-error :messages="$errors->get('name')" class="mt-2" />
+</div>
+
+<div class="mt-4">
+    <x-input-label for="zone_id" :value="__('Зона')" />
+    <select id="zone_id" name="zone_id" required
+        class="mt-1 block w-full border-gray-300 focus:border-indigo-500 focus:ring-indigo-500 rounded-md shadow-sm">
+        <option value="">{{ __('— выбрать —') }}</option>
+        @foreach ($zones as $zone)
+            <option value="{{ $zone->id }}" @selected(old('zone_id', $device->zone_id ?? '') == $zone->id)>{{ $zone->name }}</option>
+        @endforeach
+    </select>
+    <x-input-error :messages="$errors->get('zone_id')" class="mt-2" />
+</div>
+
+<div class="mt-4">
+    <x-input-label for="device_type_id" :value="__('Тип устройства')" />
+    <select id="device_type_id" name="device_type_id" required
+        class="mt-1 block w-full border-gray-300 focus:border-indigo-500 focus:ring-indigo-500 rounded-md shadow-sm">
+        <option value="">{{ __('— выбрать —') }}</option>
+        @foreach ($deviceTypes as $deviceType)
+            <option value="{{ $deviceType->id }}" @selected(old('device_type_id', $device->device_type_id ?? '') == $deviceType->id)>
+                {{ $deviceType->code }} ({{ $deviceType->category->value }})
+            </option>
+        @endforeach
+    </select>
+    <x-input-error :messages="$errors->get('device_type_id')" class="mt-2" />
+</div>
+
+<div class="mt-4">
+    <x-input-label for="external_id" :value="__('External ID (идентификатор физического устройства)')" />
+    <x-text-input id="external_id" name="external_id" type="text" class="mt-1 block w-full font-mono"
+        :value="old('external_id', $device->external_id ?? '')" required />
+    <x-input-error :messages="$errors->get('external_id')" class="mt-2" />
+</div>
+
+<div class="mt-4">
+    <x-input-label for="protocol" :value="__('Протокол')" />
+    <x-text-input id="protocol" name="protocol" type="text" class="mt-1 block w-full"
+        :value="old('protocol', $device->protocol ?? 'mqtt')" required />
+    <x-input-error :messages="$errors->get('protocol')" class="mt-2" />
+</div>
+
+<div class="mt-4 flex items-center gap-4">
+    <x-primary-button>{{ __('Сохранить') }}</x-primary-button>
+    <a href="{{ route('devices.index') }}" class="text-sm text-gray-600 hover:underline">{{ __('Отмена') }}</a>
+</div>
@@ -0,0 +1,15 @@
+<x-app-layout>
+    <x-slot name="header">
+        <h2 class="font-semibold text-xl text-gray-800 leading-tight">{{ __('Новое устройство') }}</h2>
+    </x-slot>
+
+    <div class="py-12">
+        <div class="max-w-xl mx-auto sm:px-6 lg:px-8">
+            <div class="bg-white overflow-hidden shadow-sm sm:rounded-lg p-6">
+                <form method="POST" action="{{ route('devices.store') }}">
+                    @include('devices._form')
+                </form>
+            </div>
+        </div>
+    </div>
+</x-app-layout>
@@ -0,0 +1,15 @@
+<x-app-layout>
+    <x-slot name="header">
+        <h2 class="font-semibold text-xl text-gray-800 leading-tight">{{ __('Изменить устройство') }}</h2>
+    </x-slot>
+
+    <div class="py-12">
+        <div class="max-w-xl mx-auto sm:px-6 lg:px-8">
+            <div class="bg-white overflow-hidden shadow-sm sm:rounded-lg p-6">
+                <form method="POST" action="{{ route('devices.update', $device) }}">
+                    @include('devices._form')
+                </form>
+            </div>
+        </div>
+    </div>
+</x-app-layout>
@@ -0,0 +1,77 @@
+<x-app-layout>
+    <x-slot name="header">
+        <div class="flex justify-between items-center">
+            <h2 class="font-semibold text-xl text-gray-800 leading-tight">
+                {{ __('Устройства') }}
+            </h2>
+            @can('create', \App\Models\Device::class)
+                <x-primary-button onclick="window.location='{{ route('devices.create') }}'">
+                    {{ __('Добавить устройство') }}
+                </x-primary-button>
+            @endcan
+        </div>
+    </x-slot>
+
+    <div class="py-12">
+        <div class="max-w-7xl mx-auto sm:px-6 lg:px-8">
+            <div class="bg-white overflow-hidden shadow-sm sm:rounded-lg p-6">
+                @if (session('status'))
+                    <div class="mb-4 text-sm text-green-600">{{ session('status') }}</div>
+                @endif
+                @if (session('error'))
+                    <div class="mb-4 text-sm text-red-600">{{ session('error') }}</div>
+                @endif
+
+                <table class="w-full text-left text-sm">
+                    <thead>
+                        <tr class="border-b">
+                            <th class="py-2">{{ __('Название') }}</th>
+                            <th class="py-2">{{ __('Зона') }}</th>
+                            <th class="py-2">{{ __('Тип') }}</th>
+                            <th class="py-2">{{ __('Статус') }}</th>
+                            <th class="py-2">{{ __('External ID') }}</th>
+                            <th class="py-2"></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        @forelse ($devices as $device)
+                            @php $status = $statuses[$device->external_id] ?? 'unknown'; @endphp
+                            <tr class="border-b">
+                                <td class="py-2">
+                                    <a href="{{ route('devices.show', $device) }}" class="text-indigo-600 hover:underline">{{ $device->name }}</a>
+                                </td>
+                                <td class="py-2">{{ $device->zone->name }}</td>
+                                <td class="py-2">{{ $device->deviceType->code }}</td>
+                                <td class="py-2">
+                                    <span @class([
+                                        'inline-block px-2 py-0.5 rounded text-xs',
+                                        'bg-green-100 text-green-800' => $status === 'online',
+                                        'bg-gray-100 text-gray-600' => $status === 'offline',
+                                        'bg-yellow-100 text-yellow-800' => $status === 'unknown',
+                                    ])>{{ $status }}</span>
+                                </td>
+                                <td class="py-2 font-mono text-xs">{{ $device->external_id }}</td>
+                                <td class="py-2 text-right space-x-2">
+                                    @can('update', $device)
+                                        <a href="{{ route('devices.edit', $device) }}" class="text-indigo-600 hover:underline">{{ __('Изменить') }}</a>
+                                    @endcan
+                                    @can('delete', $device)
+                                        <form method="POST" action="{{ route('devices.destroy', $device) }}" class="inline" onsubmit="return confirm('{{ __('Удалить устройство?') }}')">
+                                            @csrf
+                                            @method('DELETE')
+                                            <button type="submit" class="text-red-600 hover:underline">{{ __('Удалить') }}</button>
+                                        </form>
+                                    @endcan
+                                </td>
+                            </tr>
+                        @empty
+                            <tr>
+                                <td colspan="6" class="py-4 text-gray-500">{{ __('Устройств пока нет.') }}</td>
+                            </tr>
+                        @endforelse
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+</x-app-layout>
@@ -0,0 +1,105 @@
+<x-app-layout>
+    <x-slot name="header">
+        <h2 class="font-semibold text-xl text-gray-800 leading-tight">{{ $device->name }}</h2>
+    </x-slot>
+
+    <div class="py-12">
+        <div class="max-w-4xl mx-auto sm:px-6 lg:px-8 space-y-6">
+            @if (session('status'))
+                <div class="text-sm text-green-600">{{ session('status') }}</div>
+            @endif
+            @if (session('error'))
+                <div class="text-sm text-red-600">{{ session('error') }}</div>
+            @endif
+
+            <div class="bg-white overflow-hidden shadow-sm sm:rounded-lg p-6">
+                <h3 class="font-semibold mb-4">{{ __('Живое состояние (Redis device shadow)') }}</h3>
+                <dl class="grid grid-cols-2 gap-4 text-sm">
+                    <div>
+                        <dt class="text-gray-500">{{ __('Статус') }}</dt>
+                        <dd @class([
+                            'inline-block px-2 py-0.5 rounded text-xs mt-1',
+                            'bg-green-100 text-green-800' => $shadow['status'] === 'online',
+                            'bg-gray-100 text-gray-600' => $shadow['status'] === 'offline',
+                            'bg-yellow-100 text-yellow-800' => $shadow['status'] === 'unknown',
+                        ])>{{ $shadow['status'] }}</dd>
+                    </div>
+                    <div>
+                        <dt class="text-gray-500">{{ __('Последняя активность') }}</dt>
+                        <dd>{{ $shadow['last_seen']?->diffForHumans() ?? __('нет данных') }}</dd>
+                    </div>
+                    <div>
+                        <dt class="text-gray-500">{{ __('Желаемое состояние (desired)') }}</dt>
+                        <dd class="font-mono text-xs">{{ json_encode($shadow['desired_state']) }}</dd>
+                    </div>
+                    <div>
+                        <dt class="text-gray-500">{{ __('Подтверждённое состояние (reported)') }}</dt>
+                        <dd class="font-mono text-xs">{{ json_encode($shadow['reported_state']) }}</dd>
+                    </div>
+                </dl>
+            </div>
+
+            @can('update', $device)
+                @php $capabilities = $device->deviceType->capabilities ?? []; @endphp
+                @if (!empty(array_intersect($capabilities, ['turn_on', 'turn_off', 'set_level'])))
+                    <div class="bg-white overflow-hidden shadow-sm sm:rounded-lg p-6">
+                        <h3 class="font-semibold mb-4">{{ __('Ручное управление') }}</h3>
+                        <div class="flex items-center gap-4 flex-wrap">
+                            @if (in_array('turn_on', $capabilities))
+                                <form method="POST" action="{{ route('devices.turn-on', $device) }}">
+                                    @csrf
+                                    <x-primary-button>{{ __('Включить') }}</x-primary-button>
+                                </form>
+                            @endif
+                            @if (in_array('turn_off', $capabilities))
+                                <form method="POST" action="{{ route('devices.turn-off', $device) }}">
+                                    @csrf
+                                    <x-secondary-button>{{ __('Выключить') }}</x-secondary-button>
+                                </form>
+                            @endif
+                            @if (in_array('set_level', $capabilities))
+                                <form method="POST" action="{{ route('devices.set-level', $device) }}" class="flex items-center gap-2">
+                                    @csrf
+                                    <input type="number" step="any" name="level" required
+                                        class="border-gray-300 focus:border-indigo-500 focus:ring-indigo-500 rounded-md shadow-sm text-sm"
+                                        placeholder="{{ __('уровень') }}">
+                                    <x-primary-button>{{ __('Установить уровень') }}</x-primary-button>
+                                </form>
+                            @endif
+                        </div>
+                    </div>
+                @endif
+            @endcan
+
+            @if ($device->deviceType->category->value === 'sensor')
+                <div class="bg-white overflow-hidden shadow-sm sm:rounded-lg p-6">
+                    <h3 class="font-semibold mb-4">{{ __('Последние показания (ClickHouse)') }}</h3>
+                    <table class="w-full text-left text-sm">
+                        <thead>
+                            <tr class="border-b">
+                                <th class="py-2">{{ __('Тип') }}</th>
+                                <th class="py-2">{{ __('Значение') }}</th>
+                                <th class="py-2">{{ __('Время') }}</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            @forelse ($telemetry as $row)
+                                <tr class="border-b">
+                                    <td class="py-2">{{ $row['sensor_type'] }}</td>
+                                    <td class="py-2">{{ $row['value'] }}</td>
+                                    <td class="py-2">{{ $row['recorded_at'] }}</td>
+                                </tr>
+                            @empty
+                                <tr>
+                                    <td colspan="3" class="py-4 text-gray-500">{{ __('Показаний пока нет.') }}</td>
+                                </tr>
+                            @endforelse
+                        </tbody>
+                    </table>
+                </div>
+            @endif
+
+            <a href="{{ route('devices.index') }}" class="text-sm text-gray-600 hover:underline">{{ __('← Назад к устройствам') }}</a>
+        </div>
+    </div>
+</x-app-layout>
@@ -15,6 +15,15 @@
                    <x-nav-link :href="route('dashboard')" :active="request()->routeIs('dashboard')">
                        {{ __('Dashboard') }}
                    </x-nav-link>
+                    <x-nav-link :href="route('zones.index')" :active="request()->routeIs('zones.*')">
+                        {{ __('Зоны') }}
+                    </x-nav-link>
+                    <x-nav-link :href="route('devices.index')" :active="request()->routeIs('devices.*')">
+                        {{ __('Устройства') }}
+                    </x-nav-link>
+                    <x-nav-link :href="route('automation-rules.index')" :active="request()->routeIs('automation-rules.*')">
+                        {{ __('Правила') }}
+                    </x-nav-link>
                </div>
            </div>

@@ -70,6 +79,15 @@
            <x-responsive-nav-link :href="route('dashboard')" :active="request()->routeIs('dashboard')">
                {{ __('Dashboard') }}
            </x-responsive-nav-link>
+            <x-responsive-nav-link :href="route('zones.index')" :active="request()->routeIs('zones.*')">
+                {{ __('Зоны') }}
+            </x-responsive-nav-link>
+            <x-responsive-nav-link :href="route('devices.index')" :active="request()->routeIs('devices.*')">
+                {{ __('Устройства') }}
+            </x-responsive-nav-link>
+            <x-responsive-nav-link :href="route('automation-rules.index')" :active="request()->routeIs('automation-rules.*')">
+                {{ __('Правила') }}
+            </x-responsive-nav-link>
        </div>

        <!-- Responsive Settings Options -->
@@ -0,0 +1,23 @@
+@csrf
+@isset($zone)
+    @method('PUT')
+@endisset
+
+<div>
+    <x-input-label for="name" :value="__('Название')" />
+    <x-text-input id="name" name="name" type="text" class="mt-1 block w-full"
+        :value="old('name', $zone->name ?? '')" required autofocus />
+    <x-input-error :messages="$errors->get('name')" class="mt-2" />
+</div>
+
+<div class="mt-4">
+    <x-input-label for="description" :value="__('Описание')" />
+    <textarea id="description" name="description" rows="3"
+        class="mt-1 block w-full border-gray-300 focus:border-indigo-500 focus:ring-indigo-500 rounded-md shadow-sm">{{ old('description', $zone->description ?? '') }}</textarea>
+    <x-input-error :messages="$errors->get('description')" class="mt-2" />
+</div>
+
+<div class="mt-4 flex items-center gap-4">
+    <x-primary-button>{{ __('Сохранить') }}</x-primary-button>
+    <a href="{{ route('zones.index') }}" class="text-sm text-gray-600 hover:underline">{{ __('Отмена') }}</a>
+</div>
@@ -0,0 +1,15 @@
+<x-app-layout>
+    <x-slot name="header">
+        <h2 class="font-semibold text-xl text-gray-800 leading-tight">{{ __('Новая зона') }}</h2>
+    </x-slot>
+
+    <div class="py-12">
+        <div class="max-w-xl mx-auto sm:px-6 lg:px-8">
+            <div class="bg-white overflow-hidden shadow-sm sm:rounded-lg p-6">
+                <form method="POST" action="{{ route('zones.store') }}">
+                    @include('zones._form')
+                </form>
+            </div>
+        </div>
+    </div>
+</x-app-layout>
@@ -0,0 +1,15 @@
+<x-app-layout>
+    <x-slot name="header">
+        <h2 class="font-semibold text-xl text-gray-800 leading-tight">{{ __('Изменить зону') }}</h2>
+    </x-slot>
+
+    <div class="py-12">
+        <div class="max-w-xl mx-auto sm:px-6 lg:px-8">
+            <div class="bg-white overflow-hidden shadow-sm sm:rounded-lg p-6">
+                <form method="POST" action="{{ route('zones.update', $zone) }}">
+                    @include('zones._form')
+                </form>
+            </div>
+        </div>
+    </div>
+</x-app-layout>
@@ -0,0 +1,60 @@
+<x-app-layout>
+    <x-slot name="header">
+        <div class="flex justify-between items-center">
+            <h2 class="font-semibold text-xl text-gray-800 leading-tight">
+                {{ __('Зоны') }}
+            </h2>
+            @can('create', \App\Models\Zone::class)
+                <x-primary-button onclick="window.location='{{ route('zones.create') }}'">
+                    {{ __('Добавить зону') }}
+                </x-primary-button>
+            @endcan
+        </div>
+    </x-slot>
+
+    <div class="py-12">
+        <div class="max-w-7xl mx-auto sm:px-6 lg:px-8">
+            <div class="bg-white overflow-hidden shadow-sm sm:rounded-lg p-6">
+                @if (session('status'))
+                    <div class="mb-4 text-sm text-green-600">{{ session('status') }}</div>
+                @endif
+
+                <table class="w-full text-left text-sm">
+                    <thead>
+                        <tr class="border-b">
+                            <th class="py-2">{{ __('Название') }}</th>
+                            <th class="py-2">{{ __('Описание') }}</th>
+                            <th class="py-2">{{ __('Устройств') }}</th>
+                            <th class="py-2"></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        @forelse ($zones as $zone)
+                            <tr class="border-b">
+                                <td class="py-2">{{ $zone->name }}</td>
+                                <td class="py-2 text-gray-500">{{ $zone->description }}</td>
+                                <td class="py-2">{{ $zone->devices_count }}</td>
+                                <td class="py-2 text-right space-x-2">
+                                    @can('update', $zone)
+                                        <a href="{{ route('zones.edit', $zone) }}" class="text-indigo-600 hover:underline">{{ __('Изменить') }}</a>
+                                    @endcan
+                                    @can('delete', $zone)
+                                        <form method="POST" action="{{ route('zones.destroy', $zone) }}" class="inline" onsubmit="return confirm('{{ __('Удалить зону?') }}')">
+                                            @csrf
+                                            @method('DELETE')
+                                            <button type="submit" class="text-red-600 hover:underline">{{ __('Удалить') }}</button>
+                                        </form>
+                                    @endcan
+                                </td>
+                            </tr>
+                        @empty
+                            <tr>
+                                <td colspan="4" class="py-4 text-gray-500">{{ __('Зон пока нет.') }}</td>
+                            </tr>
+                        @endforelse
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+</x-app-layout>
@@ -1,16 +1,45 @@
 <?php

+use App\Http\Controllers\AutomationRuleController;
+use App\Http\Controllers\DeviceController;
 use App\Http\Controllers\ProfileController;
+use App\Http\Controllers\ZoneController;
+use App\Models\AutomationRule;
+use App\Models\Device;
+use App\Models\Zone;
+use App\Services\DeviceShadow;
 use Illuminate\Support\Facades\Route;

 Route::get('/', function () {
    return view('welcome');
 });

-Route::get('/dashboard', function () {
-    return view('dashboard');
+Route::get('/dashboard', function (DeviceShadow $shadow) {
+    $devices = Device::all();
+    $onlineCount = collect($shadow->statuses($devices->pluck('external_id')->all()))
+        ->filter(fn (string $status) => $status === 'online')
+        ->count();
+
+    return view('dashboard', [
+        'zonesCount' => Zone::count(),
+        'devicesCount' => $devices->count(),
+        'onlineDevicesCount' => $onlineCount,
+        'activeRulesCount' => AutomationRule::where('is_active', true)->count(),
+    ]);
 })->middleware(['auth', 'verified'])->name('dashboard');

+Route::middleware(['auth', 'verified'])->group(function () {
+    Route::resource('zones', ZoneController::class)->except('show');
+    Route::resource('devices', DeviceController::class);
+    Route::resource('automation-rules', AutomationRuleController::class)
+        ->except('show')
+        ->parameters(['automation-rules' => 'automation_rule']);
+
+    Route::post('/devices/{device}/turn-on', [DeviceController::class, 'turnOn'])->name('devices.turn-on');
+    Route::post('/devices/{device}/turn-off', [DeviceController::class, 'turnOff'])->name('devices.turn-off');
+    Route::post('/devices/{device}/set-level', [DeviceController::class, 'setLevel'])->name('devices.set-level');
+});
+
 Route::middleware('auth')->group(function () {
    Route::get('/profile', [ProfileController::class, 'edit'])->name('profile.edit');
    Route::patch('/profile', [ProfileController::class, 'update'])->name('profile.update');
@@ -0,0 +1,127 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Enums\DeviceCategory;
+use App\Enums\UserRole;
+use App\Models\Device;
+use App\Models\DeviceType;
+use App\Models\User;
+use App\Models\Zone;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AutomationRuleControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private function makeZoneWithDevices(User $owner): array
+    {
+        $zone = Zone::forceCreate(['user_id' => $owner->id, 'name' => 'Гроубокс']);
+
+        $sensorType = DeviceType::create([
+            'code' => 'sensor_temp_humidity',
+            'category' => DeviceCategory::Sensor,
+            'capabilities' => ['temperature', 'humidity'],
+        ]);
+        $fanType = DeviceType::create([
+            'code' => 'fan',
+            'category' => DeviceCategory::Actuator,
+            'capabilities' => ['turn_on', 'turn_off', 'set_level'],
+        ]);
+
+        $sensor = Device::forceCreate([
+            'user_id' => $owner->id, 'zone_id' => $zone->id, 'device_type_id' => $sensorType->id,
+            'name' => 'Датчик', 'external_id' => 'sensor-1', 'protocol' => 'mqtt',
+        ]);
+        $fan = Device::forceCreate([
+            'user_id' => $owner->id, 'zone_id' => $zone->id, 'device_type_id' => $fanType->id,
+            'name' => 'Вентилятор', 'external_id' => 'fan-1', 'protocol' => 'mqtt',
+        ]);
+
+        return [$zone, $sensor, $fan];
+    }
+
+    public function test_owner_can_create_rule_with_turn_on_action(): void
+    {
+        $owner = User::factory()->create(['role' => UserRole::Owner]);
+        [$zone, $sensor, $fan] = $this->makeZoneWithDevices($owner);
+
+        $response = $this->actingAs($owner)->post(route('automation-rules.store'), [
+            'zone_id' => $zone->id,
+            'condition_source_device_id' => $sensor->id,
+            'condition_sensor_type' => 'temperature',
+            'condition_operator' => '>',
+            'condition_value' => 28,
+            'target_device_id' => $fan->id,
+            'action_type' => 'turn_on',
+            'is_active' => '1',
+        ]);
+
+        $response->assertRedirect(route('automation-rules.index'));
+        // '{}', not '[]' — Go's json.Unmarshal into map[string]any rejects an
+        // empty JSON array, so empty action_params must serialize as an object.
+        $this->assertDatabaseHas('automation_rules', [
+            'condition_source_device_id' => $sensor->id,
+            'target_device_id' => $fan->id,
+            'action_type' => 'turn_on',
+            'action_params' => '{}',
+        ]);
+    }
+
+    public function test_set_level_action_requires_and_stores_level_param(): void
+    {
+        $owner = User::factory()->create(['role' => UserRole::Owner]);
+        [$zone, $sensor, $fan] = $this->makeZoneWithDevices($owner);
+
+        // Missing level should fail validation.
+        $missingLevel = $this->actingAs($owner)->post(route('automation-rules.store'), [
+            'zone_id' => $zone->id,
+            'condition_source_device_id' => $sensor->id,
+            'condition_sensor_type' => 'temperature',
+            'condition_operator' => '>',
+            'condition_value' => 28,
+            'target_device_id' => $fan->id,
+            'action_type' => 'set_level',
+        ]);
+        $missingLevel->assertSessionHasErrors('level');
+
+        $response = $this->actingAs($owner)->post(route('automation-rules.store'), [
+            'zone_id' => $zone->id,
+            'condition_source_device_id' => $sensor->id,
+            'condition_sensor_type' => 'temperature',
+            'condition_operator' => '>',
+            'condition_value' => 28,
+            'target_device_id' => $fan->id,
+            'action_type' => 'set_level',
+            'level' => 42,
+        ]);
+
+        $response->assertRedirect(route('automation-rules.index'));
+        $this->assertDatabaseHas('automation_rules', [
+            'target_device_id' => $fan->id,
+            'action_type' => 'set_level',
+            'action_params' => '{"level":42}',
+        ]);
+    }
+
+    public function test_viewer_cannot_create_rule(): void
+    {
+        $owner = User::factory()->create(['role' => UserRole::Owner]);
+        $viewer = User::factory()->create(['role' => UserRole::Viewer]);
+        [$zone, $sensor, $fan] = $this->makeZoneWithDevices($owner);
+
+        $response = $this->actingAs($viewer)->post(route('automation-rules.store'), [
+            'zone_id' => $zone->id,
+            'condition_source_device_id' => $sensor->id,
+            'condition_sensor_type' => 'temperature',
+            'condition_operator' => '>',
+            'condition_value' => 28,
+            'target_device_id' => $fan->id,
+            'action_type' => 'turn_on',
+        ]);
+
+        $response->assertForbidden();
+        $this->assertDatabaseCount('automation_rules', 0);
+    }
+}
@@ -0,0 +1,129 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Enums\DeviceCategory;
+use App\Enums\UserRole;
+use App\Models\Device;
+use App\Models\DeviceType;
+use App\Models\User;
+use App\Models\Zone;
+use App\Services\ClickHouseClient;
+use App\Services\DeviceControlClient;
+use App\Services\DeviceShadow;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class DeviceControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private function makeDevice(User $owner, array $capabilities): Device
+    {
+        $zone = Zone::forceCreate(['user_id' => $owner->id, 'name' => 'Гроубокс']);
+        $type = DeviceType::create([
+            'code' => 'fan',
+            'category' => DeviceCategory::Actuator,
+            'capabilities' => $capabilities,
+        ]);
+
+        return Device::forceCreate([
+            'user_id' => $owner->id, 'zone_id' => $zone->id, 'device_type_id' => $type->id,
+            'name' => 'Вентилятор', 'external_id' => 'fan-1', 'protocol' => 'mqtt',
+        ]);
+    }
+
+    public function test_owner_can_turn_on_device(): void
+    {
+        $owner = User::factory()->create(['role' => UserRole::Owner]);
+        $device = $this->makeDevice($owner, ['turn_on', 'turn_off']);
+
+        $this->mock(DeviceControlClient::class, function ($mock) {
+            $mock->shouldReceive('turnOn')->once()->with('fan-1')
+                ->andReturn(['success' => true, 'error' => null]);
+        });
+
+        $response = $this->actingAs($owner)->post(route('devices.turn-on', $device));
+
+        $response->assertRedirect();
+        $response->assertSessionHas('status');
+    }
+
+    public function test_turn_on_rejected_when_device_lacks_capability(): void
+    {
+        $owner = User::factory()->create(['role' => UserRole::Owner]);
+        $device = $this->makeDevice($owner, ['turn_off']); // no turn_on
+
+        $this->mock(DeviceControlClient::class, function ($mock) {
+            $mock->shouldNotReceive('turnOn');
+        });
+
+        $response = $this->actingAs($owner)->post(route('devices.turn-on', $device));
+
+        $response->assertStatus(422);
+    }
+
+    public function test_viewer_cannot_turn_on_device(): void
+    {
+        $owner = User::factory()->create(['role' => UserRole::Owner]);
+        $viewer = User::factory()->create(['role' => UserRole::Viewer]);
+        $device = $this->makeDevice($owner, ['turn_on']);
+
+        $this->mock(DeviceControlClient::class, function ($mock) {
+            $mock->shouldNotReceive('turnOn');
+        });
+
+        $response = $this->actingAs($viewer)->post(route('devices.turn-on', $device));
+
+        $response->assertForbidden();
+    }
+
+    public function test_failed_command_flashes_error(): void
+    {
+        $owner = User::factory()->create(['role' => UserRole::Owner]);
+        $device = $this->makeDevice($owner, ['turn_on']);
+
+        $this->mock(DeviceControlClient::class, function ($mock) {
+            $mock->shouldReceive('turnOn')->once()
+                ->andReturn(['success' => false, 'error' => 'device offline']);
+        });
+
+        $response = $this->actingAs($owner)->post(route('devices.turn-on', $device));
+
+        $response->assertSessionHas('error', 'device offline');
+    }
+
+    public function test_show_page_renders_shadow_and_telemetry(): void
+    {
+        $owner = User::factory()->create(['role' => UserRole::Owner]);
+        $zone = Zone::forceCreate(['user_id' => $owner->id, 'name' => 'Гроубокс']);
+        $type = DeviceType::create([
+            'code' => 'sensor_temp_humidity',
+            'category' => DeviceCategory::Sensor,
+            'capabilities' => ['temperature'],
+        ]);
+        $device = Device::forceCreate([
+            'user_id' => $owner->id, 'zone_id' => $zone->id, 'device_type_id' => $type->id,
+            'name' => 'Датчик', 'external_id' => 'sensor-1', 'protocol' => 'mqtt',
+        ]);
+
+        $this->mock(DeviceShadow::class, function ($mock) {
+            $mock->shouldReceive('snapshot')->once()->with('sensor-1')->andReturn([
+                'status' => 'online',
+                'last_seen' => null,
+                'desired_state' => [],
+                'reported_state' => [],
+            ]);
+        });
+        $this->mock(ClickHouseClient::class, function ($mock) {
+            $mock->shouldReceive('query')->once()
+                ->andReturn([['sensor_type' => 'temperature', 'value' => 24.5, 'recorded_at' => '2026-01-01 00:00:00']]);
+        });
+
+        $response = $this->actingAs($owner)->get(route('devices.show', $device));
+
+        $response->assertOk();
+        $response->assertSee('online');
+        $response->assertSee('24.5');
+    }
+}
@@ -0,0 +1,68 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Enums\UserRole;
+use App\Models\User;
+use App\Models\Zone;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class ZoneControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_owner_can_create_zone(): void
+    {
+        $owner = User::factory()->create(['role' => UserRole::Owner]);
+
+        $response = $this->actingAs($owner)->post(route('zones.store'), [
+            'name' => 'Гостиная',
+            'description' => 'Тест',
+        ]);
+
+        $response->assertRedirect(route('zones.index'));
+        $this->assertDatabaseHas('zones', ['name' => 'Гостиная', 'user_id' => $owner->id]);
+    }
+
+    public function test_viewer_cannot_create_zone(): void
+    {
+        $viewer = User::factory()->create(['role' => UserRole::Viewer]);
+
+        $response = $this->actingAs($viewer)->post(route('zones.store'), [
+            'name' => 'Гостиная',
+        ]);
+
+        $response->assertForbidden();
+        $this->assertDatabaseMissing('zones', ['name' => 'Гостиная']);
+    }
+
+    public function test_viewer_can_view_zones_index(): void
+    {
+        $viewer = User::factory()->create(['role' => UserRole::Viewer]);
+        Zone::forceCreate(['user_id' => $viewer->id, 'name' => 'Гроубокс']);
+
+        $response = $this->actingAs($viewer)->get(route('zones.index'));
+
+        $response->assertOk();
+        $response->assertSee('Гроубокс');
+    }
+
+    public function test_viewer_cannot_delete_zone(): void
+    {
+        $viewer = User::factory()->create(['role' => UserRole::Viewer]);
+        $zone = Zone::forceCreate(['user_id' => $viewer->id, 'name' => 'Гроубокс']);
+
+        $response = $this->actingAs($viewer)->delete(route('zones.destroy', $zone));
+
+        $response->assertForbidden();
+        $this->assertDatabaseHas('zones', ['id' => $zone->id]);
+    }
+
+    public function test_guest_is_redirected_to_login(): void
+    {
+        $response = $this->get(route('zones.index'));
+
+        $response->assertRedirect(route('login'));
+    }
+}
@@ -5,8 +5,11 @@
 Зона ответственности:
 - Предоставляет gRPC API (см. `proto/device_control/device_control.proto`:
  `TurnOn`, `TurnOff`, `SetLevel` → `CommandResult`) для отправки команд
-  устройствам — вызывается из Laravel (ручное управление) и из
-  rule-engine-service (действия по срабатыванию правил).
+  устройствам — вызывается из rule-engine-service (действия по срабатыванию
+  правил).
+- Тот же функционал доступен и по HTTP/JSON (`internal/httpapi`,
+  `POST /devices/{device_id}/turn-on|turn-off|set-level`) — для Laravel
+  (ручное управление из UI), см. «Архитектурные решения» почему не gRPC.
 - Публикует команду в MQTT-топик устройства (`devices/{device_id}/commands`)
  и слушает подтверждения (`devices/{device_id}/ack`).
 - Поддерживает паттерн Device Shadow в Redis: `desired_state` (чего хочет
@@ -37,6 +40,14 @@
  телеметрии/ack, а не выгружается из таблицы `devices`. Это удерживает
  сервис в границах MQTT+Redis+RabbitMQ+gRPC, как и в диаграмме архитектуры
  корневого README.
+- **HTTP рядом с gRPC, а не вместо.** ТЗ подразумевало gRPC-вызов и от
+  Laravel тоже, но `grpc/grpc` под PHP требует PECL-расширение, которое в
+  Alpine компилируется мучительно долго (C-код, 10-20+ минут) и утяжеляет
+  образ. `internal/httpapi` — тонкий транспорт поверх ТОГО ЖЕ
+  `server.Server` (никакой логики не дублируется, просто JSON вместо
+  Protobuf): диаграмма архитектуры в ТЗ и так допускала «HTTP/очередь» для
+  Laravel→device-control. gRPC-контракт между Go-сервисами (rule-engine)
+  не тронут.

 ## Запуск

@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"log/slog"
 	"net"
+	"net/http"
 	"os"
 	"os/signal"
 	"strings"
@@ -20,6 +21,7 @@ import (
 	devicecontrol "git.cactoz.su/cacto/home_automatization/proto/device_control"
 	"git.cactoz.su/cacto/home_automatization/services/device-control-service/internal/config"
 	"git.cactoz.su/cacto/home_automatization/services/device-control-service/internal/healthcheck"
+	"git.cactoz.su/cacto/home_automatization/services/device-control-service/internal/httpapi"
 	"git.cactoz.su/cacto/home_automatization/services/device-control-service/internal/mqttclient"
 	"git.cactoz.su/cacto/home_automatization/services/device-control-service/internal/rabbitmq"
 	"git.cactoz.su/cacto/home_automatization/services/device-control-service/internal/server"
@@ -81,20 +83,36 @@ func run(logger *slog.Logger) error {
 	checker.Start()
 	defer checker.Stop()

+	srv := server.New(shadowStore, mqttClient, logger)
+
 	lis, err := net.Listen("tcp", fmt.Sprintf(":%d", cfg.GRPCPort))
 	if err != nil {
 		return fmt.Errorf("listen on grpc port %d: %w", cfg.GRPCPort, err)
 	}
 	grpcServer := grpc.NewServer()
-	devicecontrol.RegisterDeviceControlServer(grpcServer, server.New(shadowStore, mqttClient, logger))
+	devicecontrol.RegisterDeviceControlServer(grpcServer, srv)
+
+	// Same server instance, second transport — for callers where a full
+	// gRPC client is impractical (Laravel/PHP; see README).
+	httpServer := &http.Server{
+		Addr:    fmt.Sprintf(":%d", cfg.HTTPPort),
+		Handler: httpapi.NewRouter(srv, logger),
+	}

 	go func() {
-		logger.Info("device-control-service started", "grpc_port", cfg.GRPCPort)
+		logger.Info("grpc server started", "grpc_port", cfg.GRPCPort)
 		if err := grpcServer.Serve(lis); err != nil {
 			logger.Error("grpc server stopped", "error", err)
 		}
 	}()

+	go func() {
+		logger.Info("http server started", "http_port", cfg.HTTPPort)
+		if err := httpServer.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+			logger.Error("http server stopped", "error", err)
+		}
+	}()
+
 	stop := make(chan os.Signal, 1)
 	signal.Notify(stop, syscall.SIGINT, syscall.SIGTERM)
 	<-stop
@@ -102,6 +120,12 @@ func run(logger *slog.Logger) error {
 	logger.Info("shutting down")
 	grpcServer.GracefulStop()

+	shutdownCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	if err := httpServer.Shutdown(shutdownCtx); err != nil {
+		logger.Error("http server shutdown failed", "error", err)
+	}
+
 	return nil
 }

@@ -11,6 +11,7 @@ import (

 type Config struct {
 	GRPCPort int
+	HTTPPort int

 	MQTTBrokerURL string
 	MQTTClientID  string
@@ -45,6 +46,9 @@ func Load() (Config, error) {
 	if cfg.GRPCPort, err = getEnvInt("DEVICE_CONTROL_GRPC_PORT", 50051); err != nil {
 		return Config{}, err
 	}
+	if cfg.HTTPPort, err = getEnvInt("DEVICE_CONTROL_HTTP_PORT", 8090); err != nil {
+		return Config{}, err
+	}
 	if cfg.RedisDB, err = getEnvInt("REDIS_DB", 0); err != nil {
 		return Config{}, err
 	}
@@ -0,0 +1,80 @@
+// Package httpapi exposes the same device commands as the gRPC server over
+// plain HTTP/JSON, for callers where a full gRPC client is impractical
+// (Laravel/PHP, in this platform's case — see the service README for why).
+// It's a thin transport: all the actual logic (Device Shadow patch + MQTT
+// publish) lives in internal/server and is reused as-is.
+package httpapi
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"net/http"
+
+	devicecontrol "git.cactoz.su/cacto/home_automatization/proto/device_control"
+)
+
+// Dispatcher is the subset of server.Server this package needs.
+type Dispatcher interface {
+	TurnOn(ctx context.Context, req *devicecontrol.TurnOnRequest) (*devicecontrol.CommandResult, error)
+	TurnOff(ctx context.Context, req *devicecontrol.TurnOffRequest) (*devicecontrol.CommandResult, error)
+	SetLevel(ctx context.Context, req *devicecontrol.SetLevelRequest) (*devicecontrol.CommandResult, error)
+}
+
+type commandResult struct {
+	Success bool   `json:"success"`
+	Error   string `json:"error,omitempty"`
+}
+
+func NewRouter(dispatcher Dispatcher, logger *slog.Logger) http.Handler {
+	mux := http.NewServeMux()
+
+	mux.HandleFunc("POST /devices/{device_id}/turn-on", func(w http.ResponseWriter, r *http.Request) {
+		deviceID := r.PathValue("device_id")
+		res, err := dispatcher.TurnOn(r.Context(), &devicecontrol.TurnOnRequest{DeviceId: deviceID})
+		writeResult(w, logger, res, err)
+	})
+
+	mux.HandleFunc("POST /devices/{device_id}/turn-off", func(w http.ResponseWriter, r *http.Request) {
+		deviceID := r.PathValue("device_id")
+		res, err := dispatcher.TurnOff(r.Context(), &devicecontrol.TurnOffRequest{DeviceId: deviceID})
+		writeResult(w, logger, res, err)
+	})
+
+	mux.HandleFunc("POST /devices/{device_id}/set-level", func(w http.ResponseWriter, r *http.Request) {
+		deviceID := r.PathValue("device_id")
+
+		var body struct {
+			Level float64 `json:"level"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusBadRequest)
+			_ = json.NewEncoder(w).Encode(commandResult{Success: false, Error: "invalid JSON body: expected {\"level\": number}"})
+			return
+		}
+
+		res, err := dispatcher.SetLevel(r.Context(), &devicecontrol.SetLevelRequest{DeviceId: deviceID, Level: body.Level})
+		writeResult(w, logger, res, err)
+	})
+
+	return mux
+}
+
+// writeResult always answers 200 with the command's success/error in the
+// body — the wire contract mirrors devicecontrol.CommandResult exactly, the
+// same as the gRPC transport. A non-nil err here is a transport-layer bug in
+// the dispatcher (it isn't supposed to return one), logged and surfaced as a
+// generic failure rather than leaking internals to the caller.
+func writeResult(w http.ResponseWriter, logger *slog.Logger, res *devicecontrol.CommandResult, err error) {
+	w.Header().Set("Content-Type", "application/json")
+
+	if err != nil {
+		logger.Error("dispatcher returned unexpected error", "error", err)
+		w.WriteHeader(http.StatusInternalServerError)
+		_ = json.NewEncoder(w).Encode(commandResult{Success: false, Error: "internal error"})
+		return
+	}
+
+	_ = json.NewEncoder(w).Encode(commandResult{Success: res.GetSuccess(), Error: res.GetError()})
+}
@@ -0,0 +1,161 @@
+package httpapi
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	devicecontrol "git.cactoz.su/cacto/home_automatization/proto/device_control"
+)
+
+type fakeDispatcher struct {
+	turnOnReq   *devicecontrol.TurnOnRequest
+	turnOffReq  *devicecontrol.TurnOffRequest
+	setLevelReq *devicecontrol.SetLevelRequest
+	result      *devicecontrol.CommandResult
+	err         error
+}
+
+func (f *fakeDispatcher) TurnOn(_ context.Context, req *devicecontrol.TurnOnRequest) (*devicecontrol.CommandResult, error) {
+	f.turnOnReq = req
+	return f.result, f.err
+}
+
+func (f *fakeDispatcher) TurnOff(_ context.Context, req *devicecontrol.TurnOffRequest) (*devicecontrol.CommandResult, error) {
+	f.turnOffReq = req
+	return f.result, f.err
+}
+
+func (f *fakeDispatcher) SetLevel(_ context.Context, req *devicecontrol.SetLevelRequest) (*devicecontrol.CommandResult, error) {
+	f.setLevelReq = req
+	return f.result, f.err
+}
+
+func discardLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(io.Discard, nil))
+}
+
+func decodeResult(t *testing.T, rec *httptest.ResponseRecorder) commandResult {
+	t.Helper()
+	var res commandResult
+	if err := json.Unmarshal(rec.Body.Bytes(), &res); err != nil {
+		t.Fatalf("decode response body %q: %v", rec.Body.String(), err)
+	}
+	return res
+}
+
+func TestTurnOn_Success(t *testing.T) {
+	fake := &fakeDispatcher{result: &devicecontrol.CommandResult{Success: true}}
+	router := NewRouter(fake, discardLogger())
+
+	req := httptest.NewRequest(http.MethodPost, "/devices/fan-1/turn-on", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("got status %d, want 200", rec.Code)
+	}
+	if fake.turnOnReq == nil || fake.turnOnReq.DeviceId != "fan-1" {
+		t.Fatalf("got TurnOn request %+v, want device_id=fan-1", fake.turnOnReq)
+	}
+	if res := decodeResult(t, rec); !res.Success {
+		t.Fatalf("got %+v, want success", res)
+	}
+}
+
+func TestTurnOff_Success(t *testing.T) {
+	fake := &fakeDispatcher{result: &devicecontrol.CommandResult{Success: true}}
+	router := NewRouter(fake, discardLogger())
+
+	req := httptest.NewRequest(http.MethodPost, "/devices/fan-1/turn-off", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("got status %d, want 200", rec.Code)
+	}
+	if fake.turnOffReq == nil || fake.turnOffReq.DeviceId != "fan-1" {
+		t.Fatalf("got TurnOff request %+v, want device_id=fan-1", fake.turnOffReq)
+	}
+}
+
+func TestSetLevel_Success(t *testing.T) {
+	fake := &fakeDispatcher{result: &devicecontrol.CommandResult{Success: true}}
+	router := NewRouter(fake, discardLogger())
+
+	body := bytes.NewBufferString(`{"level": 42.5}`)
+	req := httptest.NewRequest(http.MethodPost, "/devices/light-1/set-level", body)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("got status %d, want 200", rec.Code)
+	}
+	if fake.setLevelReq == nil || fake.setLevelReq.Level != 42.5 {
+		t.Fatalf("got SetLevel request %+v, want level=42.5", fake.setLevelReq)
+	}
+}
+
+func TestSetLevel_InvalidBody(t *testing.T) {
+	fake := &fakeDispatcher{}
+	router := NewRouter(fake, discardLogger())
+
+	req := httptest.NewRequest(http.MethodPost, "/devices/light-1/set-level", bytes.NewBufferString(`not json`))
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("got status %d, want 400", rec.Code)
+	}
+	if fake.setLevelReq != nil {
+		t.Fatal("dispatcher should not have been called with an invalid body")
+	}
+}
+
+func TestBusinessFailure_PassesThroughAs200(t *testing.T) {
+	fake := &fakeDispatcher{result: &devicecontrol.CommandResult{Success: false, Error: "device offline"}}
+	router := NewRouter(fake, discardLogger())
+
+	req := httptest.NewRequest(http.MethodPost, "/devices/fan-1/turn-on", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("got status %d, want 200 (business failures aren't transport errors)", rec.Code)
+	}
+	res := decodeResult(t, rec)
+	if res.Success || res.Error != "device offline" {
+		t.Fatalf("got %+v, want business failure passed through", res)
+	}
+}
+
+func TestDispatcherError_Returns500(t *testing.T) {
+	fake := &fakeDispatcher{err: errors.New("boom")}
+	router := NewRouter(fake, discardLogger())
+
+	req := httptest.NewRequest(http.MethodPost, "/devices/fan-1/turn-on", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusInternalServerError {
+		t.Fatalf("got status %d, want 500", rec.Code)
+	}
+}
+
+func TestUnknownRoute_404(t *testing.T) {
+	router := NewRouter(&fakeDispatcher{}, discardLogger())
+
+	req := httptest.NewRequest(http.MethodGet, "/devices/fan-1/turn-on", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusMethodNotAllowed && rec.Code != http.StatusNotFound {
+		t.Fatalf("got status %d for GET on a POST-only route, want 404 or 405", rec.Code)
+	}
+}