Josep Piguillem
3897113313
Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer collective, backed by the Pireon OAuth identity server. The public site is a separate, server-rendered application consuming /api/public/v1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
96 lines
4.1 KiB
PHP
96 lines
4.1 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Filament\Resources\Users\Schemas;
|
|
|
|
use Filament\Forms\Components\Select;
|
|
use Filament\Forms\Components\TextInput;
|
|
use Filament\Forms\Components\Toggle;
|
|
use Filament\Schemas\Components\Section;
|
|
use Filament\Schemas\Schema;
|
|
use Illuminate\Support\Facades\Auth;
|
|
use Spatie\Permission\Models\Role;
|
|
|
|
class UserForm
|
|
{
|
|
public static function configure(Schema $schema): Schema
|
|
{
|
|
return $schema->components([
|
|
// Everything the identity server owns. Shown for context, disabled
|
|
// because any edit here would be overwritten on the user's next
|
|
// sign-in — these fields are changed at oauth.pireon.dev.
|
|
Section::make(__('panel.users.sections.identity'))
|
|
->description(__('panel.users.sections.identity_hint'))
|
|
->columns(2)
|
|
->schema([
|
|
TextInput::make('name')
|
|
->label(__('panel.users.fields.name'))
|
|
->disabled(),
|
|
|
|
TextInput::make('email')
|
|
->label(__('panel.users.fields.email'))
|
|
->disabled(),
|
|
|
|
TextInput::make('oauth_id')
|
|
->label(__('panel.users.fields.oauth_id'))
|
|
->disabled(),
|
|
|
|
TextInput::make('remote_roles')
|
|
->label(__('panel.users.fields.remote_roles'))
|
|
->formatStateUsing(fn ($state) => implode(', ', (array) $state) ?: '—')
|
|
->helperText(__('pireon.account.remote_roles_hint'))
|
|
->disabled()
|
|
->dehydrated(false),
|
|
]),
|
|
|
|
// Everything this application owns.
|
|
Section::make(__('panel.users.sections.access'))
|
|
->description(__('panel.users.sections.access_hint'))
|
|
->columns(2)
|
|
->schema([
|
|
Select::make('roles')
|
|
->label(__('panel.users.fields.roles'))
|
|
->relationship('roles', 'name')
|
|
->multiple()
|
|
->preload()
|
|
->searchable()
|
|
// Only a super admin can hand out super_admin; without
|
|
// this, an admin could promote themselves.
|
|
->options(fn () => Role::query()
|
|
->when(
|
|
! Auth::user()?->hasRole('super_admin'),
|
|
fn ($q) => $q->where('name', '!=', 'super_admin')
|
|
)
|
|
->pluck('name', 'name')
|
|
->all())
|
|
->saveRelationshipsUsing(function ($record, ?array $state): void {
|
|
$roles = $state ?? [];
|
|
|
|
// Preserve a super_admin assignment the current
|
|
// editor was not allowed to see in the list.
|
|
if ($record->hasRole('super_admin') && ! Auth::user()?->hasRole('super_admin')) {
|
|
$roles[] = 'super_admin';
|
|
}
|
|
|
|
$record->syncRoles(array_unique($roles));
|
|
})
|
|
->columnSpanFull(),
|
|
|
|
Select::make('locale')
|
|
->label(__('panel.users.fields.locale'))
|
|
->options(fn () => collect(config('locales.supported'))
|
|
->map(fn (array $meta, string $code) => $meta['native'] ?? $code)
|
|
->all())
|
|
->native(false),
|
|
|
|
Toggle::make('is_active')
|
|
->label(__('panel.users.fields.is_active'))
|
|
// Deactivating locally cuts off both the panel and the
|
|
// API immediately, without touching the OAuth server.
|
|
->disabled(fn ($record) => $record?->id === Auth::id()),
|
|
]),
|
|
]);
|
|
}
|
|
}
|