Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/Http/Middleware/CachePublicResponse.php

@@ -0,0 +1,89 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * HTTP caching for the public API.
+ *
+ * With an SSR frontend this API sits in the critical path of every page view,
+ * so these headers are not a nicety: they are what lets a CDN or the frontend
+ * server avoid a round trip per visitor.
+ *
+ * `stale-while-revalidate` matters most — it means a brief outage or a slow
+ * response here degrades into slightly stale content rather than a broken page.
+ */
+class CachePublicResponse
+{
+    public function handle(Request $request, Closure $next, int $seconds = 60): Response
+    {
+        $response = $next($request);
+
+        // Never cache a preview: the whole point is seeing unpublished work
+        // the moment it changes. Nor anything that was not a read — a
+        // submission's confirmation belongs to one visitor only.
+        if ($request->attributes->get('preview', false)
+            || ! $request->isMethodCacheable()
+            || $response->getStatusCode() >= 400) {
+            $response->headers->set('Cache-Control', 'no-store, private');
+
+            return $response;
+        }
+
+        $response->headers->set(
+            'Cache-Control',
+            "public, max-age=0, s-maxage={$seconds}, stale-while-revalidate=".($seconds * 10),
+        );
+
+        // Responses vary by language, and the language is negotiated from the
+        // header as well as the query string. Without this a shared cache
+        // would serve Catalan to a Spanish visitor.
+        $response->headers->set('Vary', 'Accept-Language, Accept, Origin');
+
+        $this->applyEntityTag($request, $response);
+
+        return $response;
+    }
+
+    /**
+     * A content-derived ETag, so an unchanged payload costs the caller a 304
+     * with an empty body instead of the full JSON.
+     */
+    protected function applyEntityTag(Request $request, Response $response): void
+    {
+        if (! $response->getContent()) {
+            return;
+        }
+
+        $etag = '"'.hash('xxh128', $response->getContent()).'"';
+        $response->headers->set('ETag', $etag);
+
+        $ifNoneMatch = $request->headers->get('If-None-Match');
+
+        if ($ifNoneMatch !== null && $this->matches($ifNoneMatch, $etag)) {
+            $response->setNotModified();
+        }
+    }
+
+    /**
+     * `If-None-Match` may carry several tags, and a proxy may have weakened
+     * ours with a `W/` prefix along the way.
+     */
+    protected function matches(string $ifNoneMatch, string $etag): bool
+    {
+        foreach (explode(',', $ifNoneMatch) as $candidate) {
+            $candidate = ltrim(trim($candidate), 'W/');
+
+            if ($candidate === '*' || hash_equals($etag, $candidate)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}