Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/FakesPireon.php

@@ -0,0 +1,94 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests;
+
+use App\Models\User;
+use Illuminate\Support\Facades\Http;
+
+/**
+ * Fakes the Pireon identity server so tests exercise the real OAuth code paths
+ * without any network access.
+ */
+trait FakesPireon
+{
+    protected string $pireonServer = 'https://oauth.pireon.test';
+
+    /**
+     * @param  array<string, mixed>  $identity  Overrides for the GET /api/user payload.
+     * @param  array<string, mixed>  $token  Overrides for the POST /oauth/token payload.
+     */
+    protected function fakePireon(array $identity = [], array $token = []): void
+    {
+        Http::fake([
+            "{$this->pireonServer}/oauth/token" => Http::response([
+                'access_token' => 'fake-access-token',
+                'refresh_token' => 'fake-refresh-token',
+                'token_type' => 'Bearer',
+                'expires_in' => 3600,
+                'scope' => 'account:read',
+                ...$token,
+            ]),
+
+            "{$this->pireonServer}/api/user" => Http::response([
+                'id' => 4242,
+                'name' => 'Ada Lovelace',
+                'email' => 'ada@example.com',
+                'is_active' => true,
+                'roles' => ['user'],
+                'app_roles' => ['admin'],
+                'approved_at' => '2026-01-01T00:00:00+00:00',
+                'created_at' => '2025-12-01T00:00:00+00:00',
+                ...$identity,
+            ]),
+        ]);
+    }
+
+    /**
+     * Make the identity server reject whatever token it is handed.
+     */
+    protected function fakePireonRejectingTokens(): void
+    {
+        Http::fake([
+            "{$this->pireonServer}/api/user" => Http::response(['message' => 'Unauthenticated.'], 401),
+        ]);
+    }
+
+    /**
+     * A local user holding the given roles, as if they had already signed in.
+     *
+     * @param  array<int, string>|string  $roles
+     */
+    protected function userWithRoles(array|string $roles, array $attributes = []): User
+    {
+        $user = User::factory()->create($attributes);
+        $user->syncRoles((array) $roles);
+
+        return $user->fresh();
+    }
+
+    /**
+     * Authenticate API requests as $user by faking the upstream introspection
+     * call that the "api" guard performs.
+     */
+    protected function apiHeadersFor(User $user): array
+    {
+        Http::fake([
+            "{$this->pireonServer}/api/user" => Http::response([
+                'id' => $user->oauth_id,
+                'name' => $user->name,
+                'email' => $user->email,
+                'is_active' => true,
+                'roles' => ['user'],
+                'app_roles' => [],
+                'approved_at' => '2026-01-01T00:00:00+00:00',
+            ]),
+        ]);
+
+        return [
+            'Authorization' => 'Bearer token-for-'.$user->oauth_id,
+            'Accept' => 'application/json',
+        ];
+    }
+}