Josep Piguillem
3897113313
Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer collective, backed by the Pireon OAuth identity server. The public site is a separate, server-rendered application consuming /api/public/v1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
94 lines
3.0 KiB
PHP
94 lines
3.0 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Services\Pireon;
|
|
|
|
use Carbon\CarbonImmutable;
|
|
use Illuminate\Contracts\Support\Arrayable;
|
|
|
|
/**
|
|
* The identity server's view of a person, as returned by GET /api/user.
|
|
*
|
|
* `roles` and `appRoles` are carried for display and support purposes only.
|
|
* They deliberately grant nothing: this application resolves authorisation
|
|
* from its own spatie roles (see App\Actions\Auth\SyncPireonUser).
|
|
*
|
|
* @implements Arrayable<string, mixed>
|
|
*/
|
|
final readonly class PireonIdentity implements Arrayable
|
|
{
|
|
public function __construct(
|
|
public int $id,
|
|
public string $name,
|
|
public string $email,
|
|
public bool $isActive,
|
|
/** @var array<int, string> */
|
|
public array $roles = [],
|
|
/** @var array<int, string> */
|
|
public array $appRoles = [],
|
|
public ?CarbonImmutable $approvedAt = null,
|
|
public ?CarbonImmutable $createdAt = null,
|
|
) {}
|
|
|
|
/**
|
|
* @param array<string, mixed> $payload
|
|
*/
|
|
public static function fromResponse(array $payload): self
|
|
{
|
|
// The server wraps some responses in a "data" envelope and returns
|
|
// others bare; accept either shape.
|
|
$payload = $payload['data'] ?? $payload;
|
|
|
|
return new self(
|
|
id: (int) $payload['id'],
|
|
name: (string) ($payload['name'] ?? ''),
|
|
email: (string) ($payload['email'] ?? ''),
|
|
isActive: (bool) ($payload['is_active'] ?? true),
|
|
roles: array_values(array_map('strval', $payload['roles'] ?? [])),
|
|
appRoles: array_values(array_map('strval', $payload['app_roles'] ?? [])),
|
|
approvedAt: isset($payload['approved_at']) ? CarbonImmutable::parse($payload['approved_at']) : null,
|
|
createdAt: isset($payload['created_at']) ? CarbonImmutable::parse($payload['created_at']) : null,
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Self-registered accounts stay unapproved until an administrator on the
|
|
* identity server approves them.
|
|
*/
|
|
public function isApproved(): bool
|
|
{
|
|
return $this->approvedAt !== null;
|
|
}
|
|
|
|
/**
|
|
* Whether this identity is allowed to open a session here at all, per the
|
|
* `require_active_account` / `require_approved_account` settings.
|
|
*/
|
|
public function isUsable(): bool
|
|
{
|
|
if (config('pireon.require_active_account') && ! $this->isActive) {
|
|
return false;
|
|
}
|
|
|
|
return ! (config('pireon.require_approved_account') && ! $this->isApproved());
|
|
}
|
|
|
|
/**
|
|
* @return array<string, mixed>
|
|
*/
|
|
public function toArray(): array
|
|
{
|
|
return [
|
|
'id' => $this->id,
|
|
'name' => $this->name,
|
|
'email' => $this->email,
|
|
'is_active' => $this->isActive,
|
|
'roles' => $this->roles,
|
|
'app_roles' => $this->appRoles,
|
|
'approved_at' => $this->approvedAt?->toIso8601String(),
|
|
'created_at' => $this->createdAt?->toIso8601String(),
|
|
];
|
|
}
|
|
}
|