Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/Filament/Resources/Users/Schemas/UserForm.php

@@ -0,0 +1,95 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Users\Schemas;
+
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Illuminate\Support\Facades\Auth;
+use Spatie\Permission\Models\Role;
+
+class UserForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->components([
+            // Everything the identity server owns. Shown for context, disabled
+            // because any edit here would be overwritten on the user's next
+            // sign-in — these fields are changed at oauth.pireon.dev.
+            Section::make(__('panel.users.sections.identity'))
+                ->description(__('panel.users.sections.identity_hint'))
+                ->columns(2)
+                ->schema([
+                    TextInput::make('name')
+                        ->label(__('panel.users.fields.name'))
+                        ->disabled(),
+
+                    TextInput::make('email')
+                        ->label(__('panel.users.fields.email'))
+                        ->disabled(),
+
+                    TextInput::make('oauth_id')
+                        ->label(__('panel.users.fields.oauth_id'))
+                        ->disabled(),
+
+                    TextInput::make('remote_roles')
+                        ->label(__('panel.users.fields.remote_roles'))
+                        ->formatStateUsing(fn ($state) => implode(', ', (array) $state) ?: '—')
+                        ->helperText(__('pireon.account.remote_roles_hint'))
+                        ->disabled()
+                        ->dehydrated(false),
+                ]),
+
+            // Everything this application owns.
+            Section::make(__('panel.users.sections.access'))
+                ->description(__('panel.users.sections.access_hint'))
+                ->columns(2)
+                ->schema([
+                    Select::make('roles')
+                        ->label(__('panel.users.fields.roles'))
+                        ->relationship('roles', 'name')
+                        ->multiple()
+                        ->preload()
+                        ->searchable()
+                        // Only a super admin can hand out super_admin; without
+                        // this, an admin could promote themselves.
+                        ->options(fn () => Role::query()
+                            ->when(
+                                ! Auth::user()?->hasRole('super_admin'),
+                                fn ($q) => $q->where('name', '!=', 'super_admin')
+                            )
+                            ->pluck('name', 'name')
+                            ->all())
+                        ->saveRelationshipsUsing(function ($record, ?array $state): void {
+                            $roles = $state ?? [];
+
+                            // Preserve a super_admin assignment the current
+                            // editor was not allowed to see in the list.
+                            if ($record->hasRole('super_admin') && ! Auth::user()?->hasRole('super_admin')) {
+                                $roles[] = 'super_admin';
+                            }
+
+                            $record->syncRoles(array_unique($roles));
+                        })
+                        ->columnSpanFull(),
+
+                    Select::make('locale')
+                        ->label(__('panel.users.fields.locale'))
+                        ->options(fn () => collect(config('locales.supported'))
+                            ->map(fn (array $meta, string $code) => $meta['native'] ?? $code)
+                            ->all())
+                        ->native(false),
+
+                    Toggle::make('is_active')
+                        ->label(__('panel.users.fields.is_active'))
+                        // Deactivating locally cuts off both the panel and the
+                        // API immediately, without touching the OAuth server.
+                        ->disabled(fn ($record) => $record?->id === Auth::id()),
+                ]),
+        ]);
+    }
+}