Admin Panel (Laravel)
Configure the Laravel service that owns Account authentication, schema, admin resources, uploads, and webhooks.
Responsibilities
The generated admin-panel/ is the canonical Account backend. It owns:
- Email/password, Google, and Apple auth plus Laravel Sanctum token issuance.
- Email verification, password reset/change, connected accounts, session revocation, and account deletion.
- Laravel migrations and the shared PostgreSQL schema.
- Filament admin resources and role/permission management.
- Help-center content, uploads, RevenueCat webhooks, and notification send/broadcast.
The Go service consumes the tokens and shared schema; it does not replace this ownership.
Requirements
- PHP and Composer.
- Node.js/npm for the admin panel's frontend assets.
- PostgreSQL (the template
.env.exampleusesDB_CONNECTION=pgsql). - Redis for queue/cache/rate-limit configuration.
MySQL, MariaDB, and SQLite are not the configured defaults in the shipped template. The Go API's queries are generated for PostgreSQL, so another database means porting the Laravel migrations and the Go queries (sqlc) before you switch the gateway.
Local setup
From a generated Account project:
cd admin-panel
cp .env.example .env
composer install
npm install
php artisan key:generate
# Set DB_*, REDIS_*, mail, Firebase, and RevenueCat values in .env first.
php artisan migrate --seed
php artisan serveOpen the Filament panel at http://localhost:8000/admin. For local development, the seeder creates:
- Super admin:
[email protected]/superapp - Test user:
[email protected]/user
These credentials are development fixtures only. Change or remove them before exposing the service.
Routes owned by Laravel
| Method | Route | Purpose |
|---|---|---|
POST | /api/v1/auth/login, /register | Issue Sanctum token |
POST | /api/v1/auth/google, /apple | Social login |
POST | /api/v1/auth/register/google, /apple | Social registration |
POST | /api/v1/auth/forgot-password, /reset-password | Password broker flows |
GET/POST | /api/v1/auth/email/* | Verify/resend verification |
POST/PUT | /api/v1/auth/logout, /update-password | Session/password lifecycle |
GET/POST/DELETE | /api/v1/auth/connected-accounts* | Connected providers |
DELETE | /api/v1/auth/security/sessions* | Revoke sessions |
DELETE | /api/v1/auth/security/delete-account | Delete account |
POST | /api/v1/uploads | Store an authenticated upload |
POST | /api/v1/webhooks/revenuecat | Process RevenueCat events |
POST | /api/v1/app/notifications/send | Super-admin notification send |
POST | /api/v1/app/notifications/broadcast | Super-admin broadcast |
Laravel also implements the shared /api/v1/app/* resource routes for compatibility mode.
Database boundary
Run migrations only from Laravel:
php artisan migrateThe Go service uses the resulting shared schema and does not run migrations. Laravel owns the audit_logs schema and audit writes; Go's resource service reads the audit data for the Account security-history endpoint.
Testing
php artisan testBefore production, configure APP_URL, mail/Resend, Firebase credentials, RevenueCat webhook secrets/API credentials, database, Redis, trusted proxy CIDRs, and store URLs. Never use the seeded passwords or demo secrets in production.