pigui/landing-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial commit: Pireon Admin — headless admin panel and public API

Browse Source 
Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Josep Piguillem
2026-08-19 17:55:27 +02:00
commit 3897113313
534 changed files with 64050 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
app/Filament/Resources/Users/Pages/EditUser.php Normal file
View File

@@ -0,0 +1,16 @@
<?php
declare(strict_types=1);
namespace App\Filament\Resources\Users\Pages;
use App\Filament\Concerns\WarnsOfConcurrentEditing;
use App\Filament\Resources\Users\UserResource;
use Filament\Resources\Pages\EditRecord;
class EditUser extends EditRecord
{
use WarnsOfConcurrentEditing;
protected static string $resource = UserResource::class;
}

13
app/Filament/Resources/Users/Pages/ListUsers.php Normal file
View File

@@ -0,0 +1,13 @@
<?php
declare(strict_types=1);
namespace App\Filament\Resources\Users\Pages;
use App\Filament\Resources\Users\UserResource;
use Filament\Resources\Pages\ListRecords;
class ListUsers extends ListRecords
{
protected static string $resource = UserResource::class;
}

138
app/Filament/Resources/Users/RelationManagers/SessionsRelationManager.php Normal file
View File

@@ -0,0 +1,138 @@
<?php
declare(strict_types=1);
namespace App\Filament\Resources\Users\RelationManagers;
use App\Models\UserSession;
use Filament\Actions\Action;
use Filament\Notifications\Notification;
use Filament\Resources\RelationManagers\RelationManager;
use Filament\Tables\Columns\TextColumn;
use Filament\Tables\Table;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Str;
/**
* Every browser this account is signed in from, right now.
*
* Deactivating somebody (`is_active = false`) already cuts them off the
* moment the guard next checks — but that check runs on their *next*
* request, and until now there was nowhere to see whether one was still in
* progress, let alone end it early. This is that place: read straight from
* the `sessions` table Laravel's own database session driver already
* maintains, nothing new written anywhere.
*/
class SessionsRelationManager extends RelationManager
{
protected static string $relationship = 'sessions';
public static function getTitle(Model $ownerRecord, string $pageClass): string
{
return __('panel.sessions.title');
}
public static function getBadge(Model $ownerRecord, string $pageClass): ?string
{
$count = $ownerRecord->sessions()->count();
return $count > 0 ? (string) $count : null;
}
/**
* Gated on the same permission that governs the rest of this screen,
* rather than a permission of its own: whoever may already deactivate an
* account is exactly who should be able to see, and end, where it is
* currently signed in.
*/
public static function canViewForRecord(Model $ownerRecord, string $pageClass): bool
{
return (bool) Auth::user()?->can('users.update');
}
public function table(Table $table): Table
{
return $table
->recordTitleAttribute('id')
->defaultSort('last_activity', 'desc')
->columns([
TextColumn::make('ip_address')
->label(__('panel.sessions.fields.ip_address'))
->fontFamily('mono')
->placeholder('—'),
TextColumn::make('user_agent')
->label(__('panel.sessions.fields.device'))
->state(fn (UserSession $record) => self::describeUserAgent($record->user_agent))
->description(fn (UserSession $record) => $record->isCurrent()
? __('panel.sessions.this_one')
: null),
TextColumn::make('last_activity')
->label(__('panel.sessions.fields.last_activity'))
->state(fn (UserSession $record) => $record->last_activity)
->since()
->dateTimeTooltip(),
])
->recordActions([
Action::make('revoke')
->label(__('panel.sessions.actions.revoke'))
->icon('heroicon-o-x-circle')
->color('danger')
->requiresConfirmation()
// The one row this screen must never offer to end: doing
// so would sign out whoever is looking at it, mid-click.
->visible(fn (UserSession $record) => ! $record->isCurrent())
->action(function (UserSession $record): void {
$record->delete();
Notification::make()
->title(__('panel.sessions.revoked'))
->success()
->send();
}),
])
->emptyStateHeading(__('panel.sessions.empty.heading'))
->emptyStateDescription(__('panel.sessions.empty.description'))
->emptyStateIcon('heroicon-o-computer-desktop');
}
/**
* Browser and platform, guessed from the raw string every session row
* already carries — not a parsing library, just enough of one to turn
* "Mozilla/5.0 (Macintosh…) AppleWebKit… Safari/605.1" into something a
* person recognises at a glance.
*/
protected static function describeUserAgent(?string $userAgent): string
{
if (blank($userAgent)) {
return __('panel.sessions.unknown_device');
}
$browser = match (true) {
Str::contains($userAgent, 'Edg/') => 'Edge',
Str::contains($userAgent, 'OPR/') => 'Opera',
Str::contains($userAgent, 'Firefox/') => 'Firefox',
Str::contains($userAgent, 'Chrome/') => 'Chrome',
Str::contains($userAgent, 'Safari/') => 'Safari',
default => null,
};
$platform = match (true) {
Str::contains($userAgent, 'iPhone') || Str::contains($userAgent, 'iPad') => 'iOS',
Str::contains($userAgent, 'Android') => 'Android',
Str::contains($userAgent, 'Mac OS X') => 'macOS',
Str::contains($userAgent, 'Windows') => 'Windows',
Str::contains($userAgent, 'Linux') => 'Linux',
default => null,
};
return match (true) {
$browser && $platform => "{$browser} · {$platform}",
$browser !== null => $browser,
$platform !== null => $platform,
default => __('panel.sessions.unknown_device'),
};
}
}

95
app/Filament/Resources/Users/Schemas/UserForm.php Normal file
View File

@@ -0,0 +1,95 @@
<?php
declare(strict_types=1);
namespace App\Filament\Resources\Users\Schemas;
use Filament\Forms\Components\Select;
use Filament\Forms\Components\TextInput;
use Filament\Forms\Components\Toggle;
use Filament\Schemas\Components\Section;
use Filament\Schemas\Schema;
use Illuminate\Support\Facades\Auth;
use Spatie\Permission\Models\Role;
class UserForm
{
public static function configure(Schema $schema): Schema
{
return $schema->components([
// Everything the identity server owns. Shown for context, disabled
// because any edit here would be overwritten on the user's next
// sign-in — these fields are changed at oauth.pireon.dev.
Section::make(__('panel.users.sections.identity'))
->description(__('panel.users.sections.identity_hint'))
->columns(2)
->schema([
TextInput::make('name')
->label(__('panel.users.fields.name'))
->disabled(),
TextInput::make('email')
->label(__('panel.users.fields.email'))
->disabled(),
TextInput::make('oauth_id')
->label(__('panel.users.fields.oauth_id'))
->disabled(),
TextInput::make('remote_roles')
->label(__('panel.users.fields.remote_roles'))
->formatStateUsing(fn ($state) => implode(', ', (array) $state) ?: '—')
->helperText(__('pireon.account.remote_roles_hint'))
->disabled()
->dehydrated(false),
]),
// Everything this application owns.
Section::make(__('panel.users.sections.access'))
->description(__('panel.users.sections.access_hint'))
->columns(2)
->schema([
Select::make('roles')
->label(__('panel.users.fields.roles'))
->relationship('roles', 'name')
->multiple()
->preload()
->searchable()
// Only a super admin can hand out super_admin; without
// this, an admin could promote themselves.
->options(fn () => Role::query()
->when(
! Auth::user()?->hasRole('super_admin'),
fn ($q) => $q->where('name', '!=', 'super_admin')
)
->pluck('name', 'name')
->all())
->saveRelationshipsUsing(function ($record, ?array $state): void {
$roles = $state ?? [];
// Preserve a super_admin assignment the current
// editor was not allowed to see in the list.
if ($record->hasRole('super_admin') && ! Auth::user()?->hasRole('super_admin')) {
$roles[] = 'super_admin';
}
$record->syncRoles(array_unique($roles));
})
->columnSpanFull(),
Select::make('locale')
->label(__('panel.users.fields.locale'))
->options(fn () => collect(config('locales.supported'))
->map(fn (array $meta, string $code) => $meta['native'] ?? $code)
->all())
->native(false),
Toggle::make('is_active')
->label(__('panel.users.fields.is_active'))
// Deactivating locally cuts off both the panel and the
// API immediately, without touching the OAuth server.
->disabled(fn ($record) => $record?->id === Auth::id()),
]),
]);
}
}

87
app/Filament/Resources/Users/Tables/UsersTable.php Normal file
View File

@@ -0,0 +1,87 @@
<?php
declare(strict_types=1);
namespace App\Filament\Resources\Users\Tables;
use App\Models\User;
use Filament\Actions\Action;
use Filament\Actions\EditAction;
use Filament\Tables\Columns\IconColumn;
use Filament\Tables\Columns\ImageColumn;
use Filament\Tables\Columns\TextColumn;
use Filament\Tables\Filters\SelectFilter;
use Filament\Tables\Filters\TernaryFilter;
use Filament\Tables\Table;
use Illuminate\Support\Facades\Auth;
class UsersTable
{
public static function configure(Table $table): Table
{
return $table
->defaultSort('name')
->columns([
ImageColumn::make('avatar_url')
->label('')
->circular()
->defaultImageUrl(fn (User $record) => 'https://ui-avatars.com/api/?name='.urlencode($record->name)),
TextColumn::make('name')
->label(__('panel.users.fields.name'))
->description(fn (User $record) => $record->email)
->searchable(['name', 'email'])
->sortable(),
TextColumn::make('roles.name')
->label(__('panel.users.fields.roles'))
->badge()
->color(fn (string $state) => $state === 'super_admin' ? 'danger' : 'primary')
->placeholder('—'),
TextColumn::make('locale')
->label(__('panel.users.fields.locale'))
->formatStateUsing(fn (?string $state) => $state
? (config("locales.supported.{$state}.native") ?? $state)
: '—')
->toggleable(),
IconColumn::make('is_active')
->label(__('panel.users.fields.is_active'))
->boolean()
->sortable(),
TextColumn::make('last_login_at')
->label(__('panel.users.fields.last_login_at'))
->dateTime()
->since()
->placeholder(__('panel.users.fields.never'))
->sortable(),
])
->filters([
SelectFilter::make('roles')
->label(__('panel.users.fields.roles'))
->relationship('roles', 'name')
->multiple()
->preload(),
TernaryFilter::make('is_active')
->label(__('panel.users.fields.is_active')),
])
->recordActions([
Action::make('toggleActive')
->label(fn (User $record) => $record->is_active
? __('panel.users.actions.deactivate')
: __('panel.users.actions.activate'))
->icon(fn (User $record) => $record->is_active ? 'heroicon-o-lock-closed' : 'heroicon-o-lock-open')
->color(fn (User $record) => $record->is_active ? 'danger' : 'success')
->requiresConfirmation()
// Locking yourself out mid-session is never the intent.
->visible(fn (User $record) => $record->id !== Auth::id()
&& Auth::user()?->can('update', $record))
->action(fn (User $record) => $record->update(['is_active' => ! $record->is_active])),
EditAction::make(),
]);
}
}

95
app/Filament/Resources/Users/UserResource.php Normal file
View File

@@ -0,0 +1,95 @@
<?php
declare(strict_types=1);
namespace App\Filament\Resources\Users;
use App\Filament\Resources\Users\Pages\EditUser;
use App\Filament\Resources\Users\Pages\ListUsers;
use App\Filament\Resources\Users\RelationManagers\SessionsRelationManager;
use App\Filament\Resources\Users\Schemas\UserForm;
use App\Filament\Resources\Users\Tables\UsersTable;
use App\Models\User;
use BackedEnum;
use Filament\Resources\Resource;
use Filament\Schemas\Schema;
use Filament\Support\Icons\Heroicon;
use Filament\Tables\Table;
use UnitEnum;
/**
* Local user administration.
*
* There is deliberately no "create" page: accounts originate on the identity
* server and appear here on first sign-in. What this screen manages is the
* half this application owns — roles, the active flag, and locale.
*/
class UserResource extends Resource
{
protected static ?string $model = User::class;
protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedUsers;
protected static ?int $navigationSort = 30;
protected static ?string $recordTitleAttribute = 'name';
public static function getModelLabel(): string
{
return __('panel.users.label');
}
public static function getPluralModelLabel(): string
{
return __('panel.users.plural');
}
public static function getNavigationGroup(): string|UnitEnum|null
{
return __('panel.groups.administration');
}
public static function form(Schema $schema): Schema
{
return UserForm::configure($schema);
}
public static function table(Table $table): Table
{
return UsersTable::configure($table);
}
/**
* @return array<int, class-string>
*/
public static function getRelations(): array
{
return [
SessionsRelationManager::class,
];
}
/**
* @return array<int, string>
*/
public static function getGloballySearchableAttributes(): array
{
return ['name', 'email'];
}
public static function getPages(): array
{
return [
'index' => ListUsers::route('/'),
'edit' => EditUser::route('/{record}/edit'),
];
}
/**
* Accounts are provisioned by the OAuth login flow, never by hand.
*/
public static function canCreate(): bool
{
return false;
}
}