Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/Http/Requests/Api/V1/CategoryRequest.php

@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use App\Models\Category;
+use App\Rules\Translatable;
+use App\Rules\UniqueTranslatedSlug;
+use Illuminate\Foundation\Http\FormRequest;
+
+class CategoryRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        $category = $this->route('category');
+        $creating = ! $category instanceof Category;
+        $sometimes = $creating ? 'required' : 'sometimes';
+
+        return [
+            'name' => [$sometimes, new Translatable(requireDefaultLocale: $creating, max: 255)],
+            'slug' => [
+                $sometimes,
+                new Translatable(requireDefaultLocale: $creating, max: 255),
+                new UniqueTranslatedSlug(Category::class, $category?->id),
+            ],
+            'description' => ['sometimes', 'nullable', new Translatable(max: 1000)],
+
+            'color' => ['sometimes', 'nullable', 'string', 'regex:/^#[0-9a-fA-F]{6}$/'],
+            'position' => ['sometimes', 'integer', 'min:0'],
+            'is_visible' => ['sometimes', 'boolean'],
+        ];
+    }
+}

app/Http/Requests/Api/V1/PageRequest.php

@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use App\Enums\PageStatus;
+use App\Models\Page;
+use App\Rules\Translatable;
+use App\Rules\UniqueTranslatedSlug;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\Validator;
+
+/**
+ * Shared validation for creating and updating pages. On update every field is
+ * optional (PATCH semantics) but keeps the same shape rules.
+ */
+class PageRequest extends FormRequest
+{
+    /**
+     * Authorisation is handled by the controller's policy calls, which produce
+     * clearer 403s than a boolean here would.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        $page = $this->route('page');
+        $creating = ! $page instanceof Page;
+        $sometimes = $creating ? 'required' : 'sometimes';
+
+        return [
+            'title' => [$sometimes, new Translatable(requireDefaultLocale: $creating, max: 255)],
+            'slug' => [
+                $sometimes,
+                new Translatable(requireDefaultLocale: $creating, max: 255),
+                new UniqueTranslatedSlug(Page::class, $page?->id),
+            ],
+            'excerpt' => ['sometimes', 'nullable', new Translatable(max: 500)],
+            'body' => ['sometimes', 'nullable', new Translatable],
+            'meta_title' => ['sometimes', 'nullable', new Translatable(max: 60)],
+            'meta_description' => ['sometimes', 'nullable', new Translatable(max: 160)],
+
+            'category_id' => ['sometimes', 'nullable', 'integer', Rule::exists('categories', 'id')->whereNull('deleted_at')],
+            'status' => ['sometimes', Rule::enum(PageStatus::class)],
+            'featured_image' => ['sometimes', 'nullable', 'string', 'max:2048'],
+            'featured_image_alt' => ['sometimes', 'nullable', new Translatable(max: 255)],
+            'is_featured' => ['sometimes', 'boolean'],
+            'published_at' => ['sometimes', 'nullable', 'date'],
+            'unpublish_at' => ['sometimes', 'nullable', 'date', 'after:published_at'],
+        ];
+    }
+
+    public function withValidator(Validator $validator): void
+    {
+        $validator->after(function (Validator $validator): void {
+            // Publishing is a distinct permission from editing, so a caller
+            // who may write content still cannot push it live on their own.
+            $status = $this->input('status');
+
+            if ($status === PageStatus::Published->value && $this->user()?->cannot('pages.publish')) {
+                $validator->errors()->add('status', __('rules.pages.cannot_publish'));
+            }
+        });
+    }
+}

app/Http/Requests/PublicApi/ReportMissingUrlRequest.php

@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\PublicApi;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * What the frontend could not resolve.
+ *
+ * Two shapes are accepted, because both are natural on the other side: a
+ * single report, which is what one rendered 404 produces, and a batch, which
+ * is what a queue on the frontend flushes. The single form is folded into a
+ * batch of one before validation, so there is one code path from here on.
+ */
+class ReportMissingUrlRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        // The shared secret is the authorisation, and the middleware has
+        // already checked it.
+        return true;
+    }
+
+    /**
+     * Accept `{"path": "..."}` as `{"hits": [{"path": "..."}]}`.
+     */
+    protected function prepareForValidation(): void
+    {
+        if ($this->has('path') && ! $this->has('hits')) {
+            $this->merge(['hits' => [$this->only(['path', 'locale', 'referrer'])]]);
+        }
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'hits' => ['required', 'array', 'min:1', 'max:'.$this->maxBatch()],
+
+            // Paths, not URLs: the frontend knows its own origin, and a report
+            // carrying a full address would let a caller file a 404 against
+            // somebody else's domain.
+            'hits.*.path' => ['required', 'string', 'max:500', 'starts_with:/'],
+
+            'hits.*.locale' => [
+                'sometimes', 'nullable', 'string',
+                Rule::in(array_keys((array) config('locales.supported'))),
+            ],
+
+            // Where the visitor came from, verbatim from the Referer header,
+            // so it can be a URL on anybody's domain.
+            'hits.*.referrer' => ['sometimes', 'nullable', 'string', 'url:http,https', 'max:500'],
+        ];
+    }
+
+    /**
+     * @return array<int, array<string, string|null>>
+     */
+    public function hits(): array
+    {
+        return array_values((array) $this->validated('hits'));
+    }
+
+    public function maxBatch(): int
+    {
+        return max(1, (int) config('site.telemetry.max_batch', 50));
+    }
+}

app/Http/Requests/PublicApi/ReportViewsRequest.php

@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\PublicApi;
+
+use App\Support\ContentTypes;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * What the frontend rendered.
+ *
+ * Addressed the way the frontend already thinks: it fetched
+ * `/public/v1/projects/mi-web` to draw the page, so it knows the type and the
+ * slug without having to parse its own URL back apart. That also means a
+ * report can only ever name something this API serves.
+ */
+class ReportViewsRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Accept one report the same as a batch of one.
+     */
+    protected function prepareForValidation(): void
+    {
+        if ($this->has('type') && ! $this->has('views')) {
+            $this->merge(['views' => [$this->only(['type', 'slug', 'locale', 'count'])]]);
+        }
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'views' => ['required', 'array', 'min:1', 'max:'.$this->maxBatch()],
+
+            'views.*.type' => ['required', 'string', Rule::in(ContentTypes::keys())],
+            'views.*.slug' => ['required', 'string', 'max:200'],
+
+            'views.*.locale' => [
+                'sometimes', 'nullable', 'string',
+                Rule::in(array_keys((array) config('locales.supported'))),
+            ],
+
+            /*
+             * Optional, because the obvious client sends one report per page
+             * view. Capped because the frontend is trusted to count its own
+             * renders and not to invent an audience: a number nobody can
+             * check is a number worth bounding.
+             */
+            'views.*.count' => ['sometimes', 'integer', 'min:1', 'max:1000'],
+        ];
+    }
+
+    /**
+     * @return array<int, array<string, mixed>>
+     */
+    public function views(): array
+    {
+        return array_values((array) $this->validated('views'));
+    }
+
+    public function maxBatch(): int
+    {
+        return max(1, (int) config('site.telemetry.max_batch', 50));
+    }
+}

app/Http/Requests/PublicApi/SubmitApplicationRequest.php

@@ -0,0 +1,115 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\PublicApi;
+
+use App\Enums\ApplicationKind;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * The only request in the application whose author is a stranger.
+ *
+ * Everything the sender may set is listed here; anything else about the
+ * submission — its locale, its status, which call it belongs to — is decided
+ * on our side, never taken from the payload.
+ */
+class SubmitApplicationRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'min:2', 'max:120'],
+            'email' => ['required', 'string', 'email:rfc', 'max:255'],
+
+            // A minimum length is worth more than it looks: it costs a real
+            // person nothing and rules out the one-word submissions that are
+            // never anything but noise.
+            'message' => ['required', 'string', 'min:20', 'max:5000'],
+
+            // Only the general form offers a choice; applying to a call is
+            // always an offer of time.
+            'kind' => [
+                $this->isCallApplication() ? 'prohibited' : 'sometimes',
+                Rule::enum(ApplicationKind::class),
+            ],
+
+            'organisation' => [
+                Rule::requiredIf(fn () => $this->input('kind') === ApplicationKind::Request->value),
+                'nullable', 'string', 'max:160',
+            ],
+
+            'hours_per_week' => ['sometimes', 'nullable', 'integer', 'min:1', 'max:40'],
+
+            'links' => ['sometimes', 'nullable', 'array', 'max:5'],
+            'links.*' => ['nullable', 'url:http,https', 'max:255'],
+
+            // Personal data given by someone who is not a user of this system,
+            // so the agreement to store it is part of the payload rather than
+            // something the frontend is trusted to have asked for.
+            'consent' => ['accepted'],
+
+            // The honeypot. Present in the rules so an unexpected type cannot
+            // slip past the check that reads it later.
+            $this->honeypotField() => ['nullable', 'string', 'max:255'],
+        ];
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    public function attributes(): array
+    {
+        return [
+            'name' => __('rules.applications.attributes.name'),
+            'email' => __('rules.applications.attributes.email'),
+            'message' => __('rules.applications.attributes.message'),
+            'organisation' => __('rules.applications.attributes.organisation'),
+            'hours_per_week' => __('rules.applications.attributes.hours_per_week'),
+            'consent' => __('rules.applications.attributes.consent'),
+        ];
+    }
+
+    /**
+     * Whether this request is answering a specific call.
+     */
+    public function isCallApplication(): bool
+    {
+        return $this->route('slug') !== null;
+    }
+
+    /**
+     * What the sender wants, with the call route pinned to "contribute".
+     */
+    public function kind(): ApplicationKind
+    {
+        if ($this->isCallApplication()) {
+            return ApplicationKind::Contribute;
+        }
+
+        return ApplicationKind::tryFrom((string) $this->input('kind'))
+            ?? ApplicationKind::Contribute;
+    }
+
+    /**
+     * A bot fills in every input it finds; a person never sees this one.
+     */
+    public function looksAutomated(): bool
+    {
+        return filled($this->input($this->honeypotField()));
+    }
+
+    public function honeypotField(): string
+    {
+        return (string) config('site.submissions.honeypot', 'website');
+    }
+}