Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer collective, backed by the Pireon OAuth identity server. The public site is a separate, server-rendered application consuming /api/public/v1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 17:55:27 +02:00
commit 3897113313
534 changed files with 64050 additions and 0 deletions
--- a/app/Filament/Resources/Users/RelationManagers/SessionsRelationManager.php
+++ b/app/Filament/Resources/Users/RelationManagers/SessionsRelationManager.php
@@ -0,0 +1,138 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Users\RelationManagers;
+
+use App\Models\UserSession;
+use Filament\Actions\Action;
+use Filament\Notifications\Notification;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Str;
+
+/**
+ * Every browser this account is signed in from, right now.
+ *
+ * Deactivating somebody (`is_active = false`) already cuts them off the
+ * moment the guard next checks — but that check runs on their *next*
+ * request, and until now there was nowhere to see whether one was still in
+ * progress, let alone end it early. This is that place: read straight from
+ * the `sessions` table Laravel's own database session driver already
+ * maintains, nothing new written anywhere.
+ */
+class SessionsRelationManager extends RelationManager
+{
+    protected static string $relationship = 'sessions';
+
+    public static function getTitle(Model $ownerRecord, string $pageClass): string
+    {
+        return __('panel.sessions.title');
+    }
+
+    public static function getBadge(Model $ownerRecord, string $pageClass): ?string
+    {
+        $count = $ownerRecord->sessions()->count();
+
+        return $count > 0 ? (string) $count : null;
+    }
+
+    /**
+     * Gated on the same permission that governs the rest of this screen,
+     * rather than a permission of its own: whoever may already deactivate an
+     * account is exactly who should be able to see, and end, where it is
+     * currently signed in.
+     */
+    public static function canViewForRecord(Model $ownerRecord, string $pageClass): bool
+    {
+        return (bool) Auth::user()?->can('users.update');
+    }
+
+    public function table(Table $table): Table
+    {
+        return $table
+            ->recordTitleAttribute('id')
+            ->defaultSort('last_activity', 'desc')
+            ->columns([
+                TextColumn::make('ip_address')
+                    ->label(__('panel.sessions.fields.ip_address'))
+                    ->fontFamily('mono')
+                    ->placeholder('—'),
+
+                TextColumn::make('user_agent')
+                    ->label(__('panel.sessions.fields.device'))
+                    ->state(fn (UserSession $record) => self::describeUserAgent($record->user_agent))
+                    ->description(fn (UserSession $record) => $record->isCurrent()
+                        ? __('panel.sessions.this_one')
+                        : null),
+
+                TextColumn::make('last_activity')
+                    ->label(__('panel.sessions.fields.last_activity'))
+                    ->state(fn (UserSession $record) => $record->last_activity)
+                    ->since()
+                    ->dateTimeTooltip(),
+            ])
+            ->recordActions([
+                Action::make('revoke')
+                    ->label(__('panel.sessions.actions.revoke'))
+                    ->icon('heroicon-o-x-circle')
+                    ->color('danger')
+                    ->requiresConfirmation()
+                    // The one row this screen must never offer to end: doing
+                    // so would sign out whoever is looking at it, mid-click.
+                    ->visible(fn (UserSession $record) => ! $record->isCurrent())
+                    ->action(function (UserSession $record): void {
+                        $record->delete();
+
+                        Notification::make()
+                            ->title(__('panel.sessions.revoked'))
+                            ->success()
+                            ->send();
+                    }),
+            ])
+            ->emptyStateHeading(__('panel.sessions.empty.heading'))
+            ->emptyStateDescription(__('panel.sessions.empty.description'))
+            ->emptyStateIcon('heroicon-o-computer-desktop');
+    }
+
+    /**
+     * Browser and platform, guessed from the raw string every session row
+     * already carries — not a parsing library, just enough of one to turn
+     * "Mozilla/5.0 (Macintosh…) AppleWebKit… Safari/605.1" into something a
+     * person recognises at a glance.
+     */
+    protected static function describeUserAgent(?string $userAgent): string
+    {
+        if (blank($userAgent)) {
+            return __('panel.sessions.unknown_device');
+        }
+
+        $browser = match (true) {
+            Str::contains($userAgent, 'Edg/') => 'Edge',
+            Str::contains($userAgent, 'OPR/') => 'Opera',
+            Str::contains($userAgent, 'Firefox/') => 'Firefox',
+            Str::contains($userAgent, 'Chrome/') => 'Chrome',
+            Str::contains($userAgent, 'Safari/') => 'Safari',
+            default => null,
+        };
+
+        $platform = match (true) {
+            Str::contains($userAgent, 'iPhone') || Str::contains($userAgent, 'iPad') => 'iOS',
+            Str::contains($userAgent, 'Android') => 'Android',
+            Str::contains($userAgent, 'Mac OS X') => 'macOS',
+            Str::contains($userAgent, 'Windows') => 'Windows',
+            Str::contains($userAgent, 'Linux') => 'Linux',
+            default => null,
+        };
+
+        return match (true) {
+            $browser && $platform => "{$browser} · {$platform}",
+            $browser !== null => $browser,
+            $platform !== null => $platform,
+            default => __('panel.sessions.unknown_device'),
+        };
+    }
+}