Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/Unit/PermissionCatalogueTest.php

@@ -0,0 +1,87 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit;
+
+use App\Support\Permissions;
+use App\Support\TranslatablePayload;
+use PHPUnit\Framework\Attributes\Test;
+use Tests\TestCase;
+
+class PermissionCatalogueTest extends TestCase
+{
+    #[Test]
+    public function every_role_definition_only_uses_permissions_from_the_catalogue(): void
+    {
+        $catalogue = Permissions::all();
+
+        foreach (Permissions::roleDefinitions() as $role => $permissions) {
+            $unknown = array_diff($permissions, $catalogue);
+
+            $this->assertSame(
+                [],
+                array_values($unknown),
+                "Role [{$role}] references permissions that do not exist: ".implode(', ', $unknown)
+            );
+        }
+    }
+
+    #[Test]
+    public function the_grouped_view_covers_the_whole_catalogue(): void
+    {
+        $flattened = array_merge(...array_values(Permissions::grouped()));
+
+        $this->assertEqualsCanonicalizing(Permissions::all(), $flattened);
+    }
+
+    #[Test]
+    public function super_admin_holds_no_explicit_permissions(): void
+    {
+        // Its power comes from the Gate::before hook, so the definition stays
+        // empty and can never fall behind the catalogue.
+        $this->assertSame([], Permissions::roleDefinitions()['super_admin']);
+    }
+
+    #[Test]
+    public function every_role_that_can_use_the_panel_can_reach_it(): void
+    {
+        foreach (Permissions::roleDefinitions() as $role => $permissions) {
+            if ($role === 'super_admin' || $permissions === []) {
+                continue;
+            }
+
+            $this->assertContains(
+                Permissions::PANEL_ACCESS,
+                $permissions,
+                "Role [{$role}] has permissions but cannot open the panel."
+            );
+        }
+    }
+
+    #[Test]
+    public function the_default_role_for_new_logins_exists(): void
+    {
+        $this->assertArrayHasKey(
+            (string) config('pireon.default_role'),
+            Permissions::roleDefinitions(),
+        );
+    }
+
+    #[Test]
+    public function a_translatable_value_can_be_submitted_as_a_plain_string(): void
+    {
+        app()->setLocale('ca');
+
+        $this->assertSame(['ca' => 'Hola'], TranslatablePayload::normalise('Hola'));
+    }
+
+    #[Test]
+    public function unsupported_locales_are_stripped_from_incoming_payloads(): void
+    {
+        $this->assertSame(
+            ['es' => 'Hola', 'en' => 'Hi'],
+            TranslatablePayload::normalise(['es' => 'Hola', 'en' => 'Hi', 'de' => 'Hallo']),
+        );
+    }
+}