The production stack hands the containers only the variables it lists,
and PIREON_REDIRECT_CLIENT_ID, its secret, PIREON_REDIRECT_LOGIN and the
two webhook secrets were not among them: set in Dokploy, they never
reached the application, so «Entrar con Pireon» never showed up.
Compose also passes an unset variable as an empty one, so an empty
PIREON_REDIRECT_URI now falls back to APP_URL/auth/callback (the redirect
flow had none otherwise), and an empty PIREON_REDIRECT_LOGIN no longer
hides the button.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Until now, an account switched off or a token revoked at the identity
server kept working here: bearer tokens until the introspection cache
ran out, panel sessions until they ended, and machine tokens for good,
as they only look at the local account.
POST /api/v1/webhooks/pireon takes user.deactivated (the account goes
inactive, which stops its machine tokens and the panel; its sessions
end and its cached tokens are forgotten) and token.revoked (sessions
and cached tokens go). Pireon signs each delivery with the secret of
the client that registered the webhook, so either PIREON_WEBHOOK_SECRET
(password client) or PIREON_REDIRECT_WEBHOOK_SECRET («Entrar con
Pireon») verifies it; with neither, the endpoint refuses everything.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Under the e-mail and password form, a button takes the redirect flow
(Authorization Code + PKCE), so the password is only ever typed at the
identity server. The routes for it were already there; the page had no
way to reach them.
A Pireon client allows one grant type and the panel's is a password
client, so the redirect flow can use its own: PIREON_REDIRECT_CLIENT_ID
and PIREON_REDIRECT_CLIENT_SECRET (the main client when they are empty).
The button shows up once that client is set, or with
PIREON_REDIRECT_LOGIN=true. Each session renews its token with the
client that issued it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
