Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/Feature/Panel/UserSessionsTest.php

@@ -0,0 +1,135 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Feature\Panel;
+
+use App\Filament\Resources\Users\Pages\EditUser;
+use App\Filament\Resources\Users\RelationManagers\SessionsRelationManager;
+use App\Models\User;
+use App\Models\UserSession;
+use Database\Seeders\RolePermissionSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+use PHPUnit\Framework\Attributes\Test;
+use Tests\FakesPireon;
+use Tests\TestCase;
+
+/**
+ * Where an account is signed in from, read straight from the table Laravel's
+ * own database session driver already writes to.
+ *
+ * Deactivating somebody here has always cut them off on their *next*
+ * request; what was missing was any way to see a session already in
+ * progress, or end one before that next request happened on its own. Nothing
+ * here writes to `sessions` except the revoke action deleting a row — the
+ * table itself is entirely Laravel's.
+ */
+class UserSessionsTest extends TestCase
+{
+    use FakesPireon, RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->seed(RolePermissionSeeder::class);
+    }
+
+    protected function plantSession(User $user, array $attributes = []): UserSession
+    {
+        return UserSession::create(array_merge([
+            'id' => Str::random(40),
+            'user_id' => $user->id,
+            'ip_address' => '203.0.113.10',
+            'user_agent' => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Safari/605.1.15',
+            'payload' => base64_encode(serialize([])),
+            'last_activity' => now()->subMinutes(5)->timestamp,
+        ], $attributes));
+    }
+
+    #[Test]
+    public function an_admin_sees_the_accounts_open_sessions(): void
+    {
+        $target = $this->userWithRoles('editor');
+        $this->plantSession($target);
+
+        $this->actingAs($this->userWithRoles('admin'));
+
+        Livewire::test(SessionsRelationManager::class, [
+            'ownerRecord' => $target,
+            'pageClass' => EditUser::class,
+        ])
+            ->assertSee('203.0.113.10')
+            ->assertSee('Safari · macOS');
+    }
+
+    #[Test]
+    public function revoking_a_session_deletes_the_row(): void
+    {
+        $target = $this->userWithRoles('editor');
+        $session = $this->plantSession($target);
+
+        $this->actingAs($this->userWithRoles('admin'));
+
+        Livewire::test(SessionsRelationManager::class, [
+            'ownerRecord' => $target,
+            'pageClass' => EditUser::class,
+        ])->callTableAction('revoke', $session);
+
+        $this->assertDatabaseMissing('sessions', ['id' => $session->id]);
+    }
+
+    /**
+     * The one row this screen must never offer to end: doing so would sign
+     * out whoever is looking at it, mid-click.
+     */
+    #[Test]
+    public function the_viewers_own_current_session_cannot_be_revoked_from_here(): void
+    {
+        $admin = $this->userWithRoles('admin');
+        $this->actingAs($admin);
+
+        // Force a request so Laravel actually starts a session and this test
+        // knows the real session id, then plant a row using that same id —
+        // exactly what the real session driver would have written.
+        $this->get(EditUser::getUrl(['record' => $admin]));
+        $currentId = session()->getId();
+
+        $currentSession = $this->plantSession($admin, ['id' => $currentId]);
+        $other = $this->plantSession($admin);
+
+        $manager = Livewire::test(SessionsRelationManager::class, [
+            'ownerRecord' => $admin,
+            'pageClass' => EditUser::class,
+        ]);
+
+        $manager->assertTableActionHidden('revoke', $currentSession);
+        $manager->assertTableActionVisible('revoke', $other);
+    }
+
+    #[Test]
+    public function somebody_without_users_update_cannot_see_the_tab(): void
+    {
+        $target = $this->userWithRoles('editor');
+
+        $this->actingAs($this->userWithRoles('viewer'));
+
+        $this->assertFalse(SessionsRelationManager::canViewForRecord($target, EditUser::class));
+    }
+
+    #[Test]
+    public function a_device_with_no_recognisable_browser_or_platform_says_so(): void
+    {
+        $target = $this->userWithRoles('editor');
+        $this->plantSession($target, ['user_agent' => 'curl/8.4.0']);
+
+        $this->actingAs($this->userWithRoles('admin'));
+
+        Livewire::test(SessionsRelationManager::class, [
+            'ownerRecord' => $target,
+            'pageClass' => EditUser::class,
+        ])->assertSee(__('panel.sessions.unknown_device'));
+    }
+}