Admin Panel (Laravel)

The Laravel admin-panel handles auth issuance, admin dashboard, and content management.

Introduction

The admin-panel is a Laravel application that handles authentication issuance, the Filament admin dashboard, content management, and token lifecycle. It shares the same database as the Go api-backend and can also serve the shared /api/v1/app/* contract in compatibility mode.

Core Responsibilities

Auth Issuance: Email/password login, registration, and Google OAuth via Laravel Sanctum. Issues Personal Access Tokens consumed by both the admin-panel and the Go api-backend.
Token Management: Logout, session revocation, and password updates. Laravel remains the session and token authority.
Admin Dashboard: A Filament v4 panel at /admin for managing users, roles, permissions, content, and system settings.
RBAC: Granular permissions and roles managed through spatie/laravel-permission and filament-shield.
Content Management: Admin CRUD for FAQs, help center items, contacts, and operating hours. The shared /api/v1/app/* contract can be routed to Laravel compatibility mode or Go performance mode.
Email Workflows: Password reset, email verification, and welcome emails via Laravel's mail system.
Audit Logging: Shared audit_logs table that both services write to.

Directory Structure

admin-panel/
├── app/
│   ├── Filament/          # Admin panel resources and schemas
│   ├── Http/
│   │   ├── Controllers/   # Auth issuance and token management controllers
│   │   ├── Middleware/    # Role checks, spam prevention
│   │   └── Resources/     # Standardized JSON API responses
│   └── Models/            # Eloquent models (User, Faq, Feedback, etc.)
├── database/
│   ├── migrations/        # Database schema definitions (shared with api-backend)
│   └── seeders/           # Initial data (Admin user, Roles, FAQs)
├── routes/
│   ├── api.php            # Auth issuance and token management routes
│   └── web.php            # Admin panel access routes
└── tests/                 # Feature and Unit tests

Getting Started

1. Requirements

PHP 8.2+
Composer
Bun (or Node.js)
SQLite (default) or MySQL/PostgreSQL

2. Setup

Navigate to admin-panel/ and run:

cp .env.example .env
composer install
php artisan key:generate
php artisan migrate --seed
pnpm install && pnpm run build

The seeder creates a default super admin:

Email: admin@example.com
Password: password

3. Development Server

composer run dev

The admin panel is accessible at http://localhost:8000/admin.

Routes Owned by the Admin Panel

These routes are served by the Laravel admin-panel and must not be duplicated in the Go api-backend:

Route	Method	Purpose
`/api/v1/auth/login`	POST	Email/password login, issues Sanctum PAT
`/api/v1/auth/register`	POST	User registration, issues Sanctum PAT
`/api/v1/auth/google`	POST	Google OAuth, issues Sanctum PAT
`/api/v1/auth/apple`	POST	Apple OAuth, issues Sanctum PAT
`/api/v1/auth/register/google`	POST	Google social registration
`/api/v1/auth/register/apple`	POST	Apple social registration
`/api/v1/auth/forgot-password`	POST	Send password reset email
`/api/v1/auth/reset-password`	POST	Reset password with token
`/api/v1/auth/email/verify/{id}/{hash}`	GET	Email verification
`/api/v1/auth/email/verification-notification`	POST	Resend verification email
`/api/v1/auth/logout`	POST	Revoke current token
`/api/v1/auth/update-password`	PUT	Update password (authenticated)
`/api/v1/auth/connected-accounts`	GET	List connected accounts
`/api/v1/auth/connected-accounts/google`	POST	Link Google account
`/api/v1/auth/connected-accounts/apple`	POST	Link Apple account
`/api/v1/auth/connected-accounts/{provider}`	DELETE	Unlink social provider
`/api/v1/auth/security/sessions/{id}`	DELETE	Revoke specific session
`/api/v1/auth/security/sessions`	DELETE	Revoke all sessions
`/api/v1/auth/security/delete-account`	DELETE	Delete user account
`/api/v1/uploads`	POST	File upload, returns public URL
`/api/v1/webhooks/revenuecat`	POST	RevenueCat webhook

Both the admin-panel and the Go api-backend are designed to connect to the same MySQL/MariaDB database. The admin-panel owns the schema via Laravel migrations. The shared /api/v1/app/* contract can run in Laravel compatibility mode or Go performance mode, and both implementations read tables directly (especially personal_access_tokens for Sanctum token validation).

The audit_logs table is shared: both services will write audit entries.

Testing

php artisan test

Covers:

Authentication flows (Login/Register/Google)
User preference management
Notification delivery
Help center accessibility

Next Steps

Now that the admin-panel is ready, proceed to the API Backend guide to set up the Go mobile API server.

On this page