Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

config/pireon.php

@@ -0,0 +1,101 @@
+<?php
+
+declare(strict_types=1);
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Pireon OAuth2 identity server
+    |--------------------------------------------------------------------------
+    |
+    | This application is an OAuth2 *client* of the Pireon identity server
+    | (Laravel Passport). The server owns identity only: it tells us who the
+    | user is. Authorisation (roles and permissions) is resolved locally by
+    | spatie/laravel-permission — see config/permission.php.
+    |
+    */
+
+    'server' => rtrim((string) env('PIREON_SERVER', 'https://oauth.pireon.dev'), '/'),
+
+    /*
+    | Base path of the server's REST API, as declared in its OpenAPI document
+    | ("servers": [{"url": "/api"}]).
+    */
+    'api_prefix' => '/api',
+
+    'client_id' => env('PIREON_CLIENT_ID'),
+    'client_secret' => env('PIREON_CLIENT_SECRET'),
+
+    /*
+    | Where the identity server sends the user back after they authorise us.
+    | Must match one of the redirect URIs registered for the client.
+    */
+    'redirect_uri' => env('PIREON_REDIRECT_URI', env('APP_URL', 'http://localhost').'/auth/callback'),
+
+    /*
+    | Scopes requested for panel sessions. We only ever need to read the
+    | identity of the person logging in, so we stay minimal by default.
+    | Add "users:read"/"users:write" if you surface remote user management.
+    */
+    'scopes' => array_values(array_filter(
+        explode(',', (string) env('PIREON_SCOPES', 'account:read'))
+    )),
+
+    'endpoints' => [
+        'authorize' => '/oauth/authorize',
+        'token' => '/oauth/token',
+        'user' => '/user',
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Grants
+    |--------------------------------------------------------------------------
+    |
+    | "authorization_code" (with PKCE) is the interactive flow used by the
+    | Filament panel. "password" is kept available for automated tests and
+    | first-party mobile clients that cannot open a browser; disable it in
+    | production if you do not need it.
+    |
+    */
+
+    'password_grant_enabled' => (bool) env('PIREON_PASSWORD_GRANT', true),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Token introspection cache
+    |--------------------------------------------------------------------------
+    |
+    | The identity server exposes no introspection or JWKS endpoint, so an API
+    | bearer token is validated by calling GET /api/user upstream with it. That
+    | result is cached (keyed by a hash of the token, never the token itself)
+    | to keep per-request latency down. Keep this short: it bounds how long a
+    | token revoked upstream still works here.
+    |
+    */
+
+    'introspection_ttl' => (int) env('PIREON_INTROSPECTION_TTL', 60),
+
+    'http_timeout' => (int) env('PIREON_HTTP_TIMEOUT', 10),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Provisioning
+    |--------------------------------------------------------------------------
+    |
+    | Role granted to a user the first time they sign in. Because authorisation
+    | is local-only, a brand new identity gets the least-privileged role and an
+    | administrator promotes them from the panel.
+    |
+    */
+
+    'default_role' => env('PIREON_DEFAULT_ROLE', 'viewer'),
+
+    /*
+    | Refuse the session when the identity server reports the account as
+    | inactive or still awaiting approval (approved_at === null).
+    */
+    'require_active_account' => (bool) env('PIREON_REQUIRE_ACTIVE', true),
+    'require_approved_account' => (bool) env('PIREON_REQUIRE_APPROVED', true),
+];