Josep Piguillem
3897113313
Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer collective, backed by the Pireon OAuth identity server. The public site is a separate, server-rendered application consuming /api/public/v1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
102 lines
3.6 KiB
PHP
102 lines
3.6 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
return [
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Pireon OAuth2 identity server
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| This application is an OAuth2 *client* of the Pireon identity server
|
|
| (Laravel Passport). The server owns identity only: it tells us who the
|
|
| user is. Authorisation (roles and permissions) is resolved locally by
|
|
| spatie/laravel-permission — see config/permission.php.
|
|
|
|
|
*/
|
|
|
|
'server' => rtrim((string) env('PIREON_SERVER', 'https://oauth.pireon.dev'), '/'),
|
|
|
|
/*
|
|
| Base path of the server's REST API, as declared in its OpenAPI document
|
|
| ("servers": [{"url": "/api"}]).
|
|
*/
|
|
'api_prefix' => '/api',
|
|
|
|
'client_id' => env('PIREON_CLIENT_ID'),
|
|
'client_secret' => env('PIREON_CLIENT_SECRET'),
|
|
|
|
/*
|
|
| Where the identity server sends the user back after they authorise us.
|
|
| Must match one of the redirect URIs registered for the client.
|
|
*/
|
|
'redirect_uri' => env('PIREON_REDIRECT_URI', env('APP_URL', 'http://localhost').'/auth/callback'),
|
|
|
|
/*
|
|
| Scopes requested for panel sessions. We only ever need to read the
|
|
| identity of the person logging in, so we stay minimal by default.
|
|
| Add "users:read"/"users:write" if you surface remote user management.
|
|
*/
|
|
'scopes' => array_values(array_filter(
|
|
explode(',', (string) env('PIREON_SCOPES', 'account:read'))
|
|
)),
|
|
|
|
'endpoints' => [
|
|
'authorize' => '/oauth/authorize',
|
|
'token' => '/oauth/token',
|
|
'user' => '/user',
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Grants
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| "authorization_code" (with PKCE) is the interactive flow used by the
|
|
| Filament panel. "password" is kept available for automated tests and
|
|
| first-party mobile clients that cannot open a browser; disable it in
|
|
| production if you do not need it.
|
|
|
|
|
*/
|
|
|
|
'password_grant_enabled' => (bool) env('PIREON_PASSWORD_GRANT', true),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Token introspection cache
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| The identity server exposes no introspection or JWKS endpoint, so an API
|
|
| bearer token is validated by calling GET /api/user upstream with it. That
|
|
| result is cached (keyed by a hash of the token, never the token itself)
|
|
| to keep per-request latency down. Keep this short: it bounds how long a
|
|
| token revoked upstream still works here.
|
|
|
|
|
*/
|
|
|
|
'introspection_ttl' => (int) env('PIREON_INTROSPECTION_TTL', 60),
|
|
|
|
'http_timeout' => (int) env('PIREON_HTTP_TIMEOUT', 10),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Provisioning
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Role granted to a user the first time they sign in. Because authorisation
|
|
| is local-only, a brand new identity gets the least-privileged role and an
|
|
| administrator promotes them from the panel.
|
|
|
|
|
*/
|
|
|
|
'default_role' => env('PIREON_DEFAULT_ROLE', 'viewer'),
|
|
|
|
/*
|
|
| Refuse the session when the identity server reports the account as
|
|
| inactive or still awaiting approval (approved_at === null).
|
|
*/
|
|
'require_active_account' => (bool) env('PIREON_REQUIRE_ACTIVE', true),
|
|
'require_approved_account' => (bool) env('PIREON_REQUIRE_APPROVED', true),
|
|
];
|