Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/Feature/Panel/PanelAccessTest.php

@@ -0,0 +1,140 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Feature\Panel;
+
+use App\Filament\Resources\Categories\CategoryResource;
+use App\Filament\Resources\Pages\PageResource;
+use App\Filament\Resources\Roles\RoleResource;
+use App\Filament\Resources\Users\UserResource;
+use App\Models\Category;
+use App\Models\Page;
+use Database\Seeders\RolePermissionSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use PHPUnit\Framework\Attributes\Test;
+use Tests\FakesPireon;
+use Tests\TestCase;
+
+class PanelAccessTest extends TestCase
+{
+    use FakesPireon, RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->seed(RolePermissionSeeder::class);
+    }
+
+    #[Test]
+    public function a_guest_is_sent_to_the_login_page(): void
+    {
+        $this->get('/admin')->assertRedirect();
+        $this->get('/admin/login')->assertOk()->assertSee(__('pireon.sign_in'));
+    }
+
+    #[Test]
+    public function the_login_page_asks_for_credentials_and_nothing_else(): void
+    {
+        $response = $this->get('/admin/login')->assertOk();
+
+        // The identity server is meant to be invisible: whoever signs in sees
+        // a form, not a hand-off to somewhere else.
+        $response->assertSee('data.email', escape: false);
+        $response->assertSee('data.password', escape: false);
+        $response->assertDontSee(route('auth.redirect'), escape: false);
+        $response->assertDontSee((string) config('pireon.server'), escape: false);
+    }
+
+    #[Test]
+    public function a_user_without_the_panel_access_permission_is_refused(): void
+    {
+        // A real identity, but no local role has been granted yet.
+        $user = $this->userWithRoles([]);
+
+        $this->actingAs($user)->get('/admin')->assertForbidden();
+    }
+
+    #[Test]
+    public function a_viewer_can_open_the_panel(): void
+    {
+        $user = $this->userWithRoles('viewer');
+
+        $this->actingAs($user)->get('/admin')->assertSuccessful();
+    }
+
+    #[Test]
+    public function a_deactivated_user_cannot_open_the_panel(): void
+    {
+        $user = $this->userWithRoles('viewer', ['is_active' => false]);
+
+        $this->actingAs($user)->get('/admin')->assertForbidden();
+    }
+
+    #[Test]
+    public function resource_visibility_follows_local_permissions(): void
+    {
+        $viewer = $this->userWithRoles('viewer');
+        $admin = $this->userWithRoles('admin');
+
+        $this->actingAs($viewer);
+        $this->assertTrue(PageResource::canViewAny());
+        $this->assertTrue(CategoryResource::canViewAny());
+        $this->assertFalse(UserResource::canViewAny());
+        $this->assertFalse(RoleResource::canViewAny());
+
+        $this->actingAs($admin);
+        $this->assertTrue(UserResource::canViewAny());
+        $this->assertTrue(RoleResource::canViewAny());
+    }
+
+    #[Test]
+    public function resource_index_pages_render(): void
+    {
+        Page::factory()->count(3)->create();
+        Category::factory()->count(2)->create();
+
+        $admin = $this->userWithRoles('admin');
+
+        $this->actingAs($admin);
+
+        $this->get(PageResource::getUrl('index'))->assertSuccessful();
+        $this->get(CategoryResource::getUrl('index'))->assertSuccessful();
+        $this->get(UserResource::getUrl('index'))->assertSuccessful();
+        $this->get(RoleResource::getUrl('index'))->assertSuccessful();
+    }
+
+    #[Test]
+    public function the_panel_renders_in_the_users_language(): void
+    {
+        $user = $this->userWithRoles('viewer', ['locale' => 'ca']);
+
+        $this->actingAs($user)
+            ->get(PageResource::getUrl('index'))
+            ->assertSuccessful()
+            ->assertSee('Pàgines');
+    }
+
+    #[Test]
+    public function the_language_switcher_persists_the_choice(): void
+    {
+        $user = $this->userWithRoles('viewer', ['locale' => 'es']);
+
+        $this->actingAs($user)
+            ->from(PageResource::getUrl('index'))
+            ->get(route('locale.switch', 'en'))
+            ->assertRedirect();
+
+        $this->assertSame('en', $user->fresh()->locale);
+        $this->assertSame('en', session(config('locales.session_key')));
+    }
+
+    #[Test]
+    public function an_unsupported_locale_is_rejected(): void
+    {
+        $user = $this->userWithRoles('viewer');
+
+        $this->actingAs($user)->get(route('locale.switch', 'de'))->assertNotFound();
+    }
+}