Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/Filament/Resources/Pages/PageResource.php

@@ -0,0 +1,103 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages;
+
+use App\Filament\RelationManagers\ReviewsRelationManager;
+use App\Filament\RelationManagers\RevisionsRelationManager;
+use App\Filament\Resources\Pages\Pages\CreatePage;
+use App\Filament\Resources\Pages\Pages\EditPage;
+use App\Filament\Resources\Pages\Pages\ListPages;
+use App\Filament\Resources\Pages\Schemas\PageForm;
+use App\Filament\Resources\Pages\Tables\PagesTable;
+use App\Models\Page;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\SoftDeletingScope;
+use UnitEnum;
+
+class PageResource extends Resource
+{
+    protected static ?string $model = Page::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedDocumentText;
+
+    protected static ?int $navigationSort = 10;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.pages.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.pages.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.content');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->getTranslation('title', app()->getLocale());
+    }
+
+    /**
+     * Global search looks inside the admin's current language only, so results
+     * read the way they expect rather than surfacing a stray English match.
+     *
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['title->'.app()->getLocale()];
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return PageForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return PagesTable::configure($table);
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            ReviewsRelationManager::class,
+            RevisionsRelationManager::class,
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListPages::route('/'),
+            'create' => CreatePage::route('/create'),
+            'edit' => EditPage::route('/{record}/edit'),
+        ];
+    }
+
+    public static function getRecordRouteBindingEloquentQuery(): Builder
+    {
+        return parent::getRecordRouteBindingEloquentQuery()
+            ->withoutGlobalScopes([SoftDeletingScope::class]);
+    }
+
+    public static function getNavigationBadge(): ?string
+    {
+        $drafts = static::getModel()::query()->where('status', 'draft')->count();
+
+        return $drafts > 0 ? (string) $drafts : null;
+    }
+}

app/Filament/Resources/Pages/Pages/CreatePage.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages\Pages;
+
+use App\Enums\PageStatus;
+use App\Filament\Resources\Pages\PageResource;
+use Filament\Resources\Pages\CreateRecord;
+use Illuminate\Support\Facades\Auth;
+
+class CreatePage extends CreateRecord
+{
+    protected static string $resource = PageResource::class;
+
+    /**
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    protected function mutateFormDataBeforeCreate(array $data): array
+    {
+        $data['author_id'] ??= Auth::id();
+
+        // Creating something already marked published goes live now unless a
+        // date was chosen deliberately.
+        if (($data['status'] ?? null) === PageStatus::Published->value && blank($data['published_at'] ?? null)) {
+            $data['published_at'] = now();
+        }
+
+        return $data;
+    }
+}

app/Filament/Resources/Pages/Pages/EditPage.php

@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages\Pages;
+
+use App\Enums\PageStatus;
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Pages\PageResource;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\ForceDeleteAction;
+use Filament\Actions\RestoreAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditPage extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = PageResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+            ForceDeleteAction::make(),
+            RestoreAction::make(),
+        ];
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    protected function mutateFormDataBeforeSave(array $data): array
+    {
+        if (($data['status'] ?? null) === PageStatus::Published->value && blank($data['published_at'] ?? null)) {
+            $data['published_at'] = now();
+        }
+
+        return $data;
+    }
+}

app/Filament/Resources/Pages/Pages/ListPages.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages\Pages;
+
+use App\Filament\Resources\Pages\PageResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListPages extends ListRecords
+{
+    protected static string $resource = PageResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Pages/Schemas/PageForm.php

@@ -0,0 +1,176 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages\Schemas;
+
+use App\Enums\PageStatus;
+use App\Filament\Resources\Pages\PageResource;
+use App\Filament\Support\TranslatableTabs;
+use App\Models\Page;
+use App\Rules\UniqueTranslatedSlug;
+use App\Support\DuplicateTitles;
+use Filament\Forms\Components\DateTimePicker;
+use Filament\Forms\Components\FileUpload;
+use Filament\Forms\Components\RichEditor;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Str;
+
+class PageForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make(__('panel.pages.sections.content'))
+                ->description(__('panel.pages.sections.content_hint'))
+                ->schema([
+                    TranslatableTabs::make(fn (string $locale, bool $isDefault) => [
+                        TextInput::make("title.{$locale}")
+                            ->label(__('panel.pages.fields.title'))
+                            ->required($isDefault)
+                            ->maxLength(255)
+                            ->columnSpanFull()
+                            ->live(onBlur: true)
+                            ->afterStateUpdated(function (?string $state, ?Model $record, callable $get, callable $set) use ($locale, $isDefault) {
+                                if (blank($get("slug.{$locale}"))) {
+                                    $set("slug.{$locale}", Str::slug((string) $state));
+                                }
+
+                                // Only the language content is actually
+                                // written in matters here: a near-duplicate
+                                // in a language nobody is looking at right
+                                // now would be a warning about the wrong
+                                // thing.
+                                if ($isDefault) {
+                                    DuplicateTitles::warnIfSimilar(
+                                        Page::class,
+                                        PageResource::class,
+                                        $state,
+                                        $locale,
+                                        $record?->getKey(),
+                                    );
+                                }
+                            }),
+
+                        TextInput::make("slug.{$locale}")
+                            ->label(__('panel.pages.fields.slug'))
+                            ->required($isDefault)
+                            ->maxLength(255)
+                            ->columnSpanFull()
+                            ->rules(fn ($record) => [new UniqueTranslatedSlug(Page::class, $record?->id)]),
+
+                        Textarea::make("excerpt.{$locale}")
+                            ->label(__('panel.pages.fields.excerpt'))
+                            ->rows(2)
+                            ->maxLength(500)
+                            ->columnSpanFull(),
+
+                        RichEditor::make("body.{$locale}")
+                            ->label(__('panel.pages.fields.body'))
+                            ->columnSpanFull(),
+                    ]),
+                ]),
+
+            Section::make(__('panel.pages.sections.publishing'))
+                ->columns(2)
+                ->schema([
+                    Select::make('status')
+                        ->label(__('panel.pages.fields.status'))
+                        ->options(PageStatus::class)
+                        ->default(PageStatus::Draft)
+                        ->required()
+                        ->live()
+                        // Editing content and pushing it live are separate
+                        // permissions, so the status field itself is locked
+                        // for users who may only write.
+                        ->disabled(fn () => Auth::user()?->cannot('pages.publish'))
+                        ->dehydrated(),
+
+                    DateTimePicker::make('published_at')
+                        ->label(__('panel.pages.fields.published_at'))
+                        ->seconds(false)
+                        ->helperText(__('panel.pages.fields.published_at_hint')),
+
+                    // The date nobody remembers on their own. A notice about
+                    // something that already happened stays up until somebody
+                    // trips over it.
+                    DateTimePicker::make('unpublish_at')
+                        ->label(__('panel.pages.fields.unpublish_at'))
+                        ->helperText(__('panel.pages.fields.unpublish_at_hint'))
+                        ->seconds(false)
+                        ->after('published_at')
+                        ->disabled(fn () => Auth::user()?->cannot('pages.publish'))
+                        ->dehydrated(),
+
+                    Select::make('category_id')
+                        ->label(__('panel.pages.fields.category'))
+                        ->relationship('category', 'name->'.config('locales.default'))
+                        ->searchable()
+                        ->preload(),
+
+                    Select::make('author_id')
+                        ->label(__('panel.pages.fields.author'))
+                        ->relationship('author', 'name')
+                        ->searchable()
+                        ->preload()
+                        ->default(fn () => Auth::id())
+                        ->visible(fn () => Auth::user()?->can('users.view_any')),
+
+                    FileUpload::make('featured_image')
+                        ->label(__('panel.pages.fields.featured_image'))
+                        ->image()
+                        // Explicit: the default disk is private, and the
+                        // frontend runs on another host and has to be able to
+                        // fetch what you upload.
+                        ->disk(config('media.disk'))
+                        ->directory('pages')
+                        ->imageEditor()
+                        // So the description field appears as soon as there is
+                        // something to describe.
+                        ->live()
+                        ->columnSpanFull(),
+
+                    // Alt text lives with the record rather than with the
+                    // file, because the same image can need a different
+                    // description depending on where it is used.
+                    TranslatableTabs::make(fn (string $locale) => [
+                        TextInput::make("featured_image_alt.{$locale}")
+                            ->label(__('panel.pages.fields.featured_image_alt'))
+                            ->helperText(__('panel.pages.fields.featured_image_alt_hint'))
+                            ->maxLength(255)
+                            ->columnSpanFull(),
+                    ])
+                        ->visible(fn (callable $get) => filled($get('featured_image')))
+                        ->columnSpanFull(),
+
+                    Toggle::make('is_featured')
+                        ->label(__('panel.pages.fields.is_featured')),
+                ]),
+
+            Section::make(__('panel.pages.sections.seo'))
+                ->description(__('panel.pages.sections.seo_hint'))
+                ->collapsed()
+                ->schema([
+                    TranslatableTabs::make(fn (string $locale) => [
+                        TextInput::make("meta_title.{$locale}")
+                            ->label(__('panel.pages.fields.meta_title'))
+                            ->maxLength(60)
+                            ->columnSpanFull(),
+
+                        Textarea::make("meta_description.{$locale}")
+                            ->label(__('panel.pages.fields.meta_description'))
+                            ->rows(2)
+                            ->maxLength(160)
+                            ->columnSpanFull(),
+                    ], label: __('panel.pages.sections.seo')),
+                ]),
+        ]);
+    }
+}

app/Filament/Resources/Pages/Tables/PagesTable.php

@@ -0,0 +1,270 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages\Tables;
+
+use App\Enums\PageStatus;
+use App\Filament\Support\PreviewAction;
+use App\Filament\Support\ReviewActions;
+use App\Filament\Support\ReviewStatusColumn;
+use App\Filament\Support\TranslationStatusColumn;
+use App\Filament\Support\ViewsColumn;
+use App\Models\Page;
+use App\Support\TranslationFreshness;
+use Filament\Actions\Action;
+use Filament\Actions\BulkAction;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\ForceDeleteBulkAction;
+use Filament\Actions\ReplicateAction;
+use Filament\Actions\RestoreBulkAction;
+use Filament\Notifications\Notification;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Filters\TrashedFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Support\Facades\Auth;
+
+class PagesTable
+{
+    public static function configure(Table $table): Table
+    {
+        $locale = app()->getLocale();
+
+        return $table
+            // One grouped query for the whole page of rows, so the reading
+            // figures cost the listing nothing per row.
+            ->modifyQueryUsing(fn (Builder $query) => $query->withRecentViews())
+            ->defaultSort('created_at', 'desc')
+            ->columns([
+                TextColumn::make('title')
+                    ->label(__('panel.pages.fields.title'))
+                    ->weight('medium')
+                    ->description(fn (Page $record) => $record->getTranslation('slug', $locale, false) ?: null)
+                    ->searchable(query: fn (Builder $query, string $search) => $query
+                        ->where("title->{$locale}", 'like', "%{$search}%"))
+                    ->sortable(query: fn (Builder $query, string $direction) => $query
+                        ->orderBy("title->{$locale}", $direction)),
+
+                TranslationStatusColumn::make('translations')
+                    ->label(__('panel.pages.fields.translations'))
+                    ->trackedAttribute('title'),
+
+                // The state the *site* is in, not only the one stored. A
+                // page waiting for its date, or one whose date has passed, is
+                // not "Published" however the column reads.
+                TextColumn::make('status')
+                    ->label(__('panel.pages.fields.status'))
+                    ->badge()
+                    ->formatStateUsing(fn (PageStatus $state, Page $record) => match (true) {
+                        $record->hasExpired() => __('panel.publishing.expired'),
+                        $record->isScheduled() && $state === PageStatus::Published => __('panel.publishing.scheduled'),
+                        default => $state->getLabel(),
+                    })
+                    ->color(fn (PageStatus $state, Page $record) => match (true) {
+                        $record->hasExpired() => 'gray',
+                        $record->isScheduled() && $state === PageStatus::Published => 'info',
+                        default => $state->getColor(),
+                    })
+                    ->description(fn (Page $record) => match (true) {
+                        $record->hasExpired() => __('panel.publishing.expired_at', ['time' => $record->unpublish_at->isoFormat('LLL')]),
+                        $record->isScheduled() => $record->published_at->diffForHumans(),
+                        $record->expiresSoon() => __('panel.publishing.expires_in', ['time' => $record->unpublish_at->diffForHumans()]),
+                        default => null,
+                    })
+                    ->sortable(),
+
+                ReviewStatusColumn::make('review')
+                    ->label(__('panel.reviews.column')),
+
+                TextColumn::make('category.name')
+                    ->label(__('panel.pages.fields.category'))
+                    ->badge()
+                    ->color('gray')
+                    ->toggleable(),
+
+                TextColumn::make('author.name')
+                    ->label(__('panel.pages.fields.author'))
+                    ->toggleable(isToggledHiddenByDefault: true),
+
+                IconColumn::make('is_featured')
+                    ->label(__('panel.pages.fields.is_featured'))
+                    ->boolean()
+                    ->toggleable(),
+
+                ViewsColumn::make('recent_views')
+                    ->label(__('panel.views.column'))
+                    ->tooltip(__('panel.views.column_hint')),
+
+                TextColumn::make('published_at')
+                    ->label(__('panel.pages.fields.published_at'))
+                    ->dateTime()
+                    ->sortable()
+                    ->placeholder('—'),
+            ])
+            ->filters([
+                SelectFilter::make('status')
+                    ->label(__('panel.pages.fields.status'))
+                    ->options(PageStatus::options())
+                    ->multiple(),
+
+                // The reviewer's own queue. Unaddressed requests are in it
+                // too: a review nobody was named for is everybody's.
+                Filter::make('awaiting_review')
+                    ->label(__('panel.reviews.filters.mine'))
+                    ->query(fn (Builder $query) => Auth::user()
+                        ? $query->awaitingReviewBy(Auth::user())
+                        : $query->awaitingReview()),
+
+                SelectFilter::make('category')
+                    ->label(__('panel.pages.fields.category'))
+                    ->relationship('category', 'name->'.config('locales.default'))
+                    ->searchable()
+                    ->preload(),
+
+                TernaryFilter::make('is_featured')
+                    ->label(__('panel.pages.fields.is_featured')),
+
+                // The editorial workhorse: "what still needs translating?"
+                SelectFilter::make('missing_translation')
+                    ->label(__('panel.pages.filters.missing_translation'))
+                    ->options(fn () => collect(config('locales.supported'))
+                        ->map(fn (array $meta, string $code) => $meta['native'] ?? $code)
+                        ->all())
+                    ->query(function (Builder $query, array $data): Builder {
+                        if (blank($data['value'] ?? null)) {
+                            return $query;
+                        }
+
+                        $target = $data['value'];
+
+                        return $query->where(fn (Builder $q) => $q
+                            ->whereNull("title->{$target}")
+                            ->orWhere("title->{$target}", ''));
+                    }),
+
+                // Translated and left behind by the original. Worked out
+                // from the change history rather than a column, so it is
+                // resolved here and handed to the query as a list.
+                Filter::make('stale_translation')
+                    ->label(__('panel.translations.filters.stale'))
+                    ->query(fn (Builder $query) => $query->whereIn(
+                        'id',
+                        TranslationFreshness::staleIds($query->getModel()::query()),
+                    )),
+
+                Filter::make('published')
+                    ->label(__('enums.page_status.published'))
+                    ->query(fn (Builder $query) => $query->published()),
+
+                // Published and, as far as anybody can tell, read by nobody.
+                Filter::make('unread')
+                    ->label(__('panel.views.filters.unread'))
+                    ->query(fn (Builder $query) => $query
+                        ->published()
+                        ->whereDoesntHave('views', fn (Builder $views) => $views->since(30))),
+
+                Filter::make('scheduled')
+                    ->label(__('panel.publishing.scheduled'))
+                    ->query(fn (Builder $query) => $query->scheduled()),
+
+                Filter::make('expired')
+                    ->label(__('panel.publishing.expired'))
+                    ->query(fn (Builder $query) => $query->expired()),
+
+                TrashedFilter::make(),
+            ])
+            ->recordActions([
+                ReviewActions::request(),
+                ReviewActions::returnForChanges(),
+
+                // One-click publish for users who hold the separate
+                // pages.publish permission.
+                Action::make('publish')
+                    ->label(__('panel.pages.actions.publish'))
+                    ->icon('heroicon-o-check-circle')
+                    ->color('success')
+                    ->requiresConfirmation()
+                    ->visible(fn (Page $record) => $record->status !== PageStatus::Published
+                        && Auth::user()?->can('publish', $record))
+                    ->action(fn (Page $record) => $record->update([
+                        'status' => PageStatus::Published,
+                        'published_at' => $record->published_at ?? now(),
+                    ])),
+
+                Action::make('unpublish')
+                    ->label(__('panel.pages.actions.unpublish'))
+                    ->icon('heroicon-o-eye-slash')
+                    ->color('warning')
+                    ->requiresConfirmation()
+                    ->visible(fn (Page $record) => $record->status === PageStatus::Published
+                        && Auth::user()?->can('publish', $record))
+                    ->action(fn (Page $record) => $record->update(['status' => PageStatus::Draft])),
+
+                // A near-copy is a real workflow: the third similar service,
+                // next year's call. The slug is cleared because two records
+                // cannot answer at the same URL.
+                ReplicateAction::make()
+                    ->label(__('panel.actions.duplicate'))
+                    ->icon('heroicon-o-document-duplicate')
+                    ->excludeAttributes(['slug', 'published_at', 'unpublish_at'])
+                    ->modalHeading(__('panel.actions.duplicate_heading'))
+                    ->successNotificationTitle(__('panel.actions.duplicated')),
+
+                PreviewAction::for('page'),
+
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    ReviewActions::requestBulk(Page::class),
+
+                    BulkAction::make('publish')
+                        ->label(__('panel.pages.actions.publish'))
+                        ->icon('heroicon-o-check-circle')
+                        ->color('success')
+                        ->requiresConfirmation()
+                        ->visible(fn () => Auth::user()?->can('pages.publish') ?? false)
+                        ->deselectRecordsAfterCompletion()
+                        ->action(function (Collection $records): void {
+                            $published = 0;
+
+                            // One at a time, not a single UPDATE across every
+                            // selected row: publishing fires the revision
+                            // entry and closes any pending review, and a mass
+                            // update would skip both without a sound.
+                            foreach ($records as $record) {
+                                if ($record->status === PageStatus::Published) {
+                                    continue;
+                                }
+
+                                $record->update([
+                                    'status' => PageStatus::Published,
+                                    'published_at' => $record->published_at ?? now(),
+                                ]);
+
+                                $published++;
+                            }
+
+                            Notification::make()
+                                ->title(trans_choice('panel.publishing.published_count', $published, ['count' => $published]))
+                                ->success()
+                                ->send();
+                        }),
+
+                    DeleteBulkAction::make(),
+                    ForceDeleteBulkAction::make(),
+                    RestoreBulkAction::make(),
+                ]),
+            ]);
+    }
+}