Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/Http/Requests/Api/V1/CategoryRequest.php

@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use App\Models\Category;
+use App\Rules\Translatable;
+use App\Rules\UniqueTranslatedSlug;
+use Illuminate\Foundation\Http\FormRequest;
+
+class CategoryRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        $category = $this->route('category');
+        $creating = ! $category instanceof Category;
+        $sometimes = $creating ? 'required' : 'sometimes';
+
+        return [
+            'name' => [$sometimes, new Translatable(requireDefaultLocale: $creating, max: 255)],
+            'slug' => [
+                $sometimes,
+                new Translatable(requireDefaultLocale: $creating, max: 255),
+                new UniqueTranslatedSlug(Category::class, $category?->id),
+            ],
+            'description' => ['sometimes', 'nullable', new Translatable(max: 1000)],
+
+            'color' => ['sometimes', 'nullable', 'string', 'regex:/^#[0-9a-fA-F]{6}$/'],
+            'position' => ['sometimes', 'integer', 'min:0'],
+            'is_visible' => ['sometimes', 'boolean'],
+        ];
+    }
+}

app/Http/Requests/Api/V1/PageRequest.php

@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use App\Enums\PageStatus;
+use App\Models\Page;
+use App\Rules\Translatable;
+use App\Rules\UniqueTranslatedSlug;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\Validator;
+
+/**
+ * Shared validation for creating and updating pages. On update every field is
+ * optional (PATCH semantics) but keeps the same shape rules.
+ */
+class PageRequest extends FormRequest
+{
+    /**
+     * Authorisation is handled by the controller's policy calls, which produce
+     * clearer 403s than a boolean here would.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        $page = $this->route('page');
+        $creating = ! $page instanceof Page;
+        $sometimes = $creating ? 'required' : 'sometimes';
+
+        return [
+            'title' => [$sometimes, new Translatable(requireDefaultLocale: $creating, max: 255)],
+            'slug' => [
+                $sometimes,
+                new Translatable(requireDefaultLocale: $creating, max: 255),
+                new UniqueTranslatedSlug(Page::class, $page?->id),
+            ],
+            'excerpt' => ['sometimes', 'nullable', new Translatable(max: 500)],
+            'body' => ['sometimes', 'nullable', new Translatable],
+            'meta_title' => ['sometimes', 'nullable', new Translatable(max: 60)],
+            'meta_description' => ['sometimes', 'nullable', new Translatable(max: 160)],
+
+            'category_id' => ['sometimes', 'nullable', 'integer', Rule::exists('categories', 'id')->whereNull('deleted_at')],
+            'status' => ['sometimes', Rule::enum(PageStatus::class)],
+            'featured_image' => ['sometimes', 'nullable', 'string', 'max:2048'],
+            'featured_image_alt' => ['sometimes', 'nullable', new Translatable(max: 255)],
+            'is_featured' => ['sometimes', 'boolean'],
+            'published_at' => ['sometimes', 'nullable', 'date'],
+            'unpublish_at' => ['sometimes', 'nullable', 'date', 'after:published_at'],
+        ];
+    }
+
+    public function withValidator(Validator $validator): void
+    {
+        $validator->after(function (Validator $validator): void {
+            // Publishing is a distinct permission from editing, so a caller
+            // who may write content still cannot push it live on their own.
+            $status = $this->input('status');
+
+            if ($status === PageStatus::Published->value && $this->user()?->cannot('pages.publish')) {
+                $validator->errors()->add('status', __('rules.pages.cannot_publish'));
+            }
+        });
+    }
+}