Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/Policies/UserPolicy.php

@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Policies;
+
+use App\Models\User;
+use Illuminate\Database\Eloquent\Model;
+
+class UserPolicy extends ResourcePolicy
+{
+    protected function resource(): string
+    {
+        return 'users';
+    }
+
+    /**
+     * Everyone may read their own record, regardless of permissions — the
+     * panel's profile screen depends on it.
+     *
+     * @param  User|Model  $model
+     */
+    public function view(User $user, Model $model): bool
+    {
+        return $user->id === $model->id || parent::view($user, $model);
+    }
+
+    /**
+     * Nobody may edit an account more privileged than their own, and only a
+     * super admin may edit another super admin. Without this, an `admin` could
+     * grant themselves `super_admin` through the user editor.
+     *
+     * @param  User|Model  $model
+     */
+    public function update(User $user, Model $model): bool
+    {
+        if ($model->hasRole('super_admin') && ! $user->hasRole('super_admin')) {
+            return false;
+        }
+
+        return parent::update($user, $model);
+    }
+
+    /**
+     * Deleting your own account from the panel would drop you out mid-session,
+     * and the last super admin must survive or the app locks itself out.
+     *
+     * @param  User|Model  $model
+     */
+    public function delete(User $user, Model $model): bool
+    {
+        if ($user->id === $model->id) {
+            return false;
+        }
+
+        if ($model->hasRole('super_admin') && ! $user->hasRole('super_admin')) {
+            return false;
+        }
+
+        if ($model->hasRole('super_admin') && $this->isLastSuperAdmin($model)) {
+            return false;
+        }
+
+        return parent::delete($user, $model);
+    }
+
+    protected function isLastSuperAdmin(User $model): bool
+    {
+        return User::query()
+            ->whereKeyNot($model->getKey())
+            ->whereHas('roles', fn ($q) => $q->where('name', 'super_admin'))
+            ->doesntExist();
+    }
+}