Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer collective, backed by the Pireon OAuth identity server. The public site is a separate, server-rendered application consuming /api/public/v1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 17:55:27 +02:00
commit 3897113313
534 changed files with 64050 additions and 0 deletions
--- a/app/Http/Requests/PublicApi/SubmitApplicationRequest.php
+++ b/app/Http/Requests/PublicApi/SubmitApplicationRequest.php
@@ -0,0 +1,115 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\PublicApi;
+
+use App\Enums\ApplicationKind;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * The only request in the application whose author is a stranger.
+ *
+ * Everything the sender may set is listed here; anything else about the
+ * submission — its locale, its status, which call it belongs to — is decided
+ * on our side, never taken from the payload.
+ */
+class SubmitApplicationRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'min:2', 'max:120'],
+            'email' => ['required', 'string', 'email:rfc', 'max:255'],
+
+            // A minimum length is worth more than it looks: it costs a real
+            // person nothing and rules out the one-word submissions that are
+            // never anything but noise.
+            'message' => ['required', 'string', 'min:20', 'max:5000'],
+
+            // Only the general form offers a choice; applying to a call is
+            // always an offer of time.
+            'kind' => [
+                $this->isCallApplication() ? 'prohibited' : 'sometimes',
+                Rule::enum(ApplicationKind::class),
+            ],
+
+            'organisation' => [
+                Rule::requiredIf(fn () => $this->input('kind') === ApplicationKind::Request->value),
+                'nullable', 'string', 'max:160',
+            ],
+
+            'hours_per_week' => ['sometimes', 'nullable', 'integer', 'min:1', 'max:40'],
+
+            'links' => ['sometimes', 'nullable', 'array', 'max:5'],
+            'links.*' => ['nullable', 'url:http,https', 'max:255'],
+
+            // Personal data given by someone who is not a user of this system,
+            // so the agreement to store it is part of the payload rather than
+            // something the frontend is trusted to have asked for.
+            'consent' => ['accepted'],
+
+            // The honeypot. Present in the rules so an unexpected type cannot
+            // slip past the check that reads it later.
+            $this->honeypotField() => ['nullable', 'string', 'max:255'],
+        ];
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    public function attributes(): array
+    {
+        return [
+            'name' => __('rules.applications.attributes.name'),
+            'email' => __('rules.applications.attributes.email'),
+            'message' => __('rules.applications.attributes.message'),
+            'organisation' => __('rules.applications.attributes.organisation'),
+            'hours_per_week' => __('rules.applications.attributes.hours_per_week'),
+            'consent' => __('rules.applications.attributes.consent'),
+        ];
+    }
+
+    /**
+     * Whether this request is answering a specific call.
+     */
+    public function isCallApplication(): bool
+    {
+        return $this->route('slug') !== null;
+    }
+
+    /**
+     * What the sender wants, with the call route pinned to "contribute".
+     */
+    public function kind(): ApplicationKind
+    {
+        if ($this->isCallApplication()) {
+            return ApplicationKind::Contribute;
+        }
+
+        return ApplicationKind::tryFrom((string) $this->input('kind'))
+            ?? ApplicationKind::Contribute;
+    }
+
+    /**
+     * A bot fills in every input it finds; a person never sees this one.
+     */
+    public function looksAutomated(): bool
+    {
+        return filled($this->input($this->honeypotField()));
+    }
+
+    public function honeypotField(): string
+    {
+        return (string) config('site.submissions.honeypot', 'website');
+    }
+}