Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/Policies/ResourcePolicy.php

@@ -0,0 +1,72 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Policies;
+
+use App\Models\User;
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * Maps the standard resource abilities onto permission names of the form
+ * "<resource>.<ability>", so policies only have to declare their resource key
+ * and whatever extra rules they genuinely need.
+ *
+ * Both the Filament panel and the REST API authorise through these policies,
+ * which is what keeps the two surfaces from drifting apart.
+ */
+abstract class ResourcePolicy
+{
+    use HandlesAuthorization;
+
+    /**
+     * Permission prefix, e.g. "pages".
+     */
+    abstract protected function resource(): string;
+
+    public function viewAny(User $user): bool
+    {
+        return $user->can($this->ability('view_any'));
+    }
+
+    public function view(User $user, Model $model): bool
+    {
+        return $user->can($this->ability('view'));
+    }
+
+    public function create(User $user): bool
+    {
+        return $user->can($this->ability('create'));
+    }
+
+    public function update(User $user, Model $model): bool
+    {
+        return $user->can($this->ability('update'));
+    }
+
+    public function delete(User $user, Model $model): bool
+    {
+        return $user->can($this->ability('delete'));
+    }
+
+    public function deleteAny(User $user): bool
+    {
+        return $user->can($this->ability('delete'));
+    }
+
+    public function restore(User $user, Model $model): bool
+    {
+        return $user->can($this->ability('restore'));
+    }
+
+    public function forceDelete(User $user, Model $model): bool
+    {
+        return $user->can($this->ability('force_delete'));
+    }
+
+    protected function ability(string $ability): string
+    {
+        return "{$this->resource()}.{$ability}";
+    }
+}