Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer collective, backed by the Pireon OAuth identity server. The public site is a separate, server-rendered application consuming /api/public/v1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 17:55:27 +02:00
commit 3897113313
534 changed files with 64050 additions and 0 deletions
--- a/app/Notifications/ApplicationReceived.php
+++ b/app/Notifications/ApplicationReceived.php
@@ -0,0 +1,105 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Notifications;
+
+use App\Filament\Resources\Applications\ApplicationResource;
+use App\Models\Application;
+use App\Models\User;
+use Filament\Notifications\Actions\Action;
+use Filament\Notifications\Notification as FilamentNotification;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Notifications\Notification;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Cache;
+
+/**
+ * Somebody wrote in.
+ *
+ * Deliberately not queued. The database channel is one insert, and the whole
+ * point of the inbox is that a message does not sit unseen — which is exactly
+ * what would happen the first time a deployment forgot to run a queue worker.
+ * Mail is opt-in for the same reason: it puts the mailer in the path of a
+ * public request, so it is a choice rather than a default.
+ */
+class ApplicationReceived extends Notification
+{
+    public function __construct(public readonly Application $application) {}
+
+    /**
+     * @return array<int, string>
+     */
+    public function via(object $notifiable): array
+    {
+        return config('site.submissions.notify_by_mail', false)
+            ? ['database', 'mail']
+            : ['database'];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function toDatabase(object $notifiable): array
+    {
+        return FilamentNotification::make()
+            ->title($this->title())
+            ->body($this->application->subject())
+            ->icon('heroicon-o-inbox-arrow-down')
+            ->iconColor('success')
+            ->actions([
+                Action::make('view')
+                    ->label(__('panel.applications.actions.open'))
+                    ->url(ApplicationResource::getUrl('view', ['record' => $this->application]))
+                    ->markAsRead(),
+            ])
+            ->getDatabaseMessage();
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        return (new MailMessage)
+            ->subject($this->title())
+            ->greeting(__('panel.applications.mail.greeting'))
+            ->line($this->application->subject())
+            ->line(__('panel.applications.mail.from', [
+                'name' => $this->application->name,
+                'email' => $this->application->email,
+            ]))
+            ->action(
+                __('panel.applications.actions.open'),
+                ApplicationResource::getUrl('view', ['record' => $this->application]),
+            );
+    }
+
+    protected function title(): string
+    {
+        return __("panel.applications.notification.{$this->application->kind->value}", [
+            'name' => $this->application->name,
+        ]);
+    }
+
+    /**
+     * Everyone allowed to read the inbox.
+     *
+     * Resolved through `can()` rather than a permission scope so super admins
+     * are included: they hold no explicit permissions at all, only the
+     * Gate::before hook that grants them everything.
+     *
+     * @return Collection<int, User>
+     */
+    public static function recipients(): Collection
+    {
+        // Recomputed rarely: a submission arriving in a burst should not cost
+        // one query per message to answer a question whose answer only changes
+        // when somebody edits a role.
+        $ids = Cache::remember('applications:recipients', now()->addMinutes(5), fn () => User::query()
+            ->where('is_active', true)
+            ->get()
+            ->filter(fn (User $user) => $user->can('applications.view_any'))
+            ->pluck('id')
+            ->all());
+
+        return User::query()->whereKey($ids)->get();
+    }
+}