Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer collective, backed by the Pireon OAuth identity server. The public site is a separate, server-rendered application consuming /api/public/v1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 17:55:27 +02:00
commit 3897113313
534 changed files with 64050 additions and 0 deletions
--- a/app/Services/Pireon/PireonIdentity.php
+++ b/app/Services/Pireon/PireonIdentity.php
@@ -0,0 +1,93 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Pireon;
+
+use Carbon\CarbonImmutable;
+use Illuminate\Contracts\Support\Arrayable;
+
+/**
+ * The identity server's view of a person, as returned by GET /api/user.
+ *
+ * `roles` and `appRoles` are carried for display and support purposes only.
+ * They deliberately grant nothing: this application resolves authorisation
+ * from its own spatie roles (see App\Actions\Auth\SyncPireonUser).
+ *
+ * @implements Arrayable<string, mixed>
+ */
+final readonly class PireonIdentity implements Arrayable
+{
+    public function __construct(
+        public int $id,
+        public string $name,
+        public string $email,
+        public bool $isActive,
+        /** @var array<int, string> */
+        public array $roles = [],
+        /** @var array<int, string> */
+        public array $appRoles = [],
+        public ?CarbonImmutable $approvedAt = null,
+        public ?CarbonImmutable $createdAt = null,
+    ) {}
+
+    /**
+     * @param  array<string, mixed>  $payload
+     */
+    public static function fromResponse(array $payload): self
+    {
+        // The server wraps some responses in a "data" envelope and returns
+        // others bare; accept either shape.
+        $payload = $payload['data'] ?? $payload;
+
+        return new self(
+            id: (int) $payload['id'],
+            name: (string) ($payload['name'] ?? ''),
+            email: (string) ($payload['email'] ?? ''),
+            isActive: (bool) ($payload['is_active'] ?? true),
+            roles: array_values(array_map('strval', $payload['roles'] ?? [])),
+            appRoles: array_values(array_map('strval', $payload['app_roles'] ?? [])),
+            approvedAt: isset($payload['approved_at']) ? CarbonImmutable::parse($payload['approved_at']) : null,
+            createdAt: isset($payload['created_at']) ? CarbonImmutable::parse($payload['created_at']) : null,
+        );
+    }
+
+    /**
+     * Self-registered accounts stay unapproved until an administrator on the
+     * identity server approves them.
+     */
+    public function isApproved(): bool
+    {
+        return $this->approvedAt !== null;
+    }
+
+    /**
+     * Whether this identity is allowed to open a session here at all, per the
+     * `require_active_account` / `require_approved_account` settings.
+     */
+    public function isUsable(): bool
+    {
+        if (config('pireon.require_active_account') && ! $this->isActive) {
+            return false;
+        }
+
+        return ! (config('pireon.require_approved_account') && ! $this->isApproved());
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function toArray(): array
+    {
+        return [
+            'id' => $this->id,
+            'name' => $this->name,
+            'email' => $this->email,
+            'is_active' => $this->isActive,
+            'roles' => $this->roles,
+            'app_roles' => $this->appRoles,
+            'approved_at' => $this->approvedAt?->toIso8601String(),
+            'created_at' => $this->createdAt?->toIso8601String(),
+        ];
+    }
+}