Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/Http/Middleware/AllowPreview.php

@@ -0,0 +1,81 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Middleware;
+
+use App\Support\PreviewLink;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Lets the frontend render unpublished content when it presents the preview
+ * secret.
+ *
+ * Because the frontend renders on the server, this is simple: the preview route
+ * forwards the secret on its own fetch, and nothing about it reaches the
+ * visitor's browser. The flag is read by the public controllers to decide
+ * whether to apply the `published` scope.
+ */
+class AllowPreview
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $request->attributes->set('preview', $this->isPreview($request));
+
+        return $next($request);
+    }
+
+    protected function isPreview(Request $request): bool
+    {
+        return $this->hasSharedSecret($request) || $this->hasSignedLink($request);
+    }
+
+    /**
+     * The shared secret: one value, held by the frontend, that unlocks
+     * everything unpublished.
+     */
+    protected function hasSharedSecret(Request $request): bool
+    {
+        $secret = (string) config('site.preview_token');
+
+        // An unset secret must never mean "everyone gets preview access".
+        if (blank($secret)) {
+            return false;
+        }
+
+        $presented = $request->header('X-Preview-Token')
+            ?? $request->query('preview_token');
+
+        return is_string($presented) && hash_equals($secret, $presented);
+    }
+
+    /**
+     * A link generated for one record.
+     *
+     * Signed and short-lived, and it says which record it is for — so one
+     * forwarded to the wrong person leaks a single draft rather than every
+     * unpublished thing on the site.
+     */
+    protected function hasSignedLink(Request $request): bool
+    {
+        $token = $request->header('X-Preview-Link') ?? $request->query('preview');
+
+        if (! is_string($token) || blank($token)) {
+            return false;
+        }
+
+        $payload = PreviewLink::open($token);
+
+        if ($payload === null) {
+            return false;
+        }
+
+        // Handed to the controllers so a link for one draft cannot be used to
+        // read another.
+        $request->attributes->set('preview_scope', $payload);
+
+        return true;
+    }
+}