Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/Feature/Panel/ApplicationsInboxTest.php

@@ -0,0 +1,159 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Feature\Panel;
+
+use App\Enums\ApplicationStatus;
+use App\Filament\Resources\Applications\ApplicationResource;
+use App\Filament\Resources\Calls\CallResource;
+use App\Models\Application;
+use App\Models\Call;
+use Database\Seeders\RolePermissionSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use PHPUnit\Framework\Attributes\Test;
+use Tests\FakesPireon;
+use Tests\TestCase;
+
+/**
+ * The inbox is the one resource holding personal data belonging to people
+ * outside the collective, so who can open it is part of its contract.
+ */
+class ApplicationsInboxTest extends TestCase
+{
+    use FakesPireon, RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->seed(RolePermissionSeeder::class);
+    }
+
+    #[Test]
+    public function the_inbox_renders(): void
+    {
+        $call = Call::factory()->create(['project_id' => null]);
+
+        Application::factory()->count(2)->create();
+        Application::factory()->forCall($call->id)->create();
+        Application::factory()->request()->create();
+        Application::factory()->spam()->create();
+
+        $this->actingAs($this->userWithRoles('admin'));
+
+        $this->get(ApplicationResource::getUrl('index'))->assertSuccessful();
+    }
+
+    #[Test]
+    public function a_submission_can_be_opened(): void
+    {
+        $application = Application::factory()->create();
+
+        $this->actingAs($this->userWithRoles('admin'));
+
+        $this->get(ApplicationResource::getUrl('view', ['record' => $application]))
+            ->assertSuccessful()
+            ->assertSee($application->name);
+    }
+
+    #[Test]
+    public function the_replies_to_a_call_show_on_the_call_itself(): void
+    {
+        $call = Call::factory()->create(['project_id' => null]);
+
+        Application::factory()->forCall($call->id)->create();
+
+        $this->actingAs($this->userWithRoles('admin'));
+
+        // "Is anybody interested?" is a question you have while looking at the
+        // opening, not while working through the whole inbox.
+        $this->get(CallResource::getUrl('edit', ['record' => $call]))
+            ->assertSuccessful();
+    }
+
+    #[Test]
+    public function an_editor_runs_the_calls_so_an_editor_answers_them(): void
+    {
+        $editor = $this->userWithRoles('editor');
+
+        $this->assertTrue($editor->can('applications.view_any'));
+        $this->assertTrue($editor->can('applications.update'));
+    }
+
+    #[Test]
+    public function a_viewer_never_sees_a_strangers_contact_details(): void
+    {
+        $viewer = $this->userWithRoles('viewer');
+
+        $this->actingAs($viewer);
+
+        // Reading the site's content and reading the people who wrote in are
+        // deliberately different rights.
+        $this->assertFalse($viewer->can('applications.view_any'));
+        $this->assertFalse(ApplicationResource::canViewAny());
+
+        $this->get(ApplicationResource::getUrl('index'))->assertForbidden();
+    }
+
+    #[Test]
+    public function nobody_creates_a_submission_by_hand(): void
+    {
+        $admin = $this->userWithRoles('admin');
+
+        $this->actingAs($admin);
+
+        // They arrive from the public site. A hand-written one would be a
+        // record of a conversation that never happened.
+        $this->assertFalse(ApplicationResource::canCreate());
+        $this->assertFalse($admin->can('create', Application::class));
+    }
+
+    #[Test]
+    public function answering_records_who_answered(): void
+    {
+        $admin = $this->userWithRoles('admin');
+        $application = Application::factory()->create();
+
+        $application->markAs(ApplicationStatus::Contacted, $admin);
+
+        $application->refresh();
+
+        // An inbox worked by several people otherwise turns into two replies
+        // or none.
+        $this->assertSame(ApplicationStatus::Contacted, $application->status);
+        $this->assertSame($admin->id, $application->handled_by);
+        $this->assertNotNull($application->handled_at);
+    }
+
+    #[Test]
+    public function the_badge_counts_the_people_still_waiting(): void
+    {
+        Application::factory()->count(2)->create();
+        Application::factory()->handled()->create();
+        Application::factory()->spam()->create();
+
+        $this->actingAs($this->userWithRoles('admin'));
+
+        $this->assertSame('2', ApplicationResource::getNavigationBadge());
+    }
+
+    #[Test]
+    public function a_submission_survives_the_call_it_answered(): void
+    {
+        $call = Call::factory()->create([
+            'project_id' => null,
+            'title' => ['es' => 'Backend'],
+        ]);
+
+        $application = Application::factory()->forCall($call->id, 'Backend')->create();
+
+        $call->delete();
+
+        $application->refresh();
+
+        // The opening was tidied up; the person who wrote in was not.
+        $this->assertNull($application->call_id);
+        $this->assertSame('Backend', $application->subject());
+    }
+}