README

Filament v4 admin panel for the Track Any Device platform. Provides the central admin surface — resources, pages, auth middleware, and domain gating — as a standalone Composer package consumed by the host Laravel application.

Requirements

Installation

composer require track-any-device/admin

The package is auto-discovered by Laravel. No manual provider registration is needed.

Configuration

Environment variables

Routes the host app must register

The package redirects unauthenticated requests and the SSO login page to a named route that the host application is responsible for registering:

// In your host app's routes/web.php or a dedicated routes file:
Route::get('/auth/sso/redirect', SsoRedirectController::class)->name('admin.sso.redirect');

The route must be named admin.sso.redirect. The package will throw a RouteNotFoundException at runtime if it is missing.

How it works

Domain gating

The EnsureAdminDomain middleware runs on every panel request.

• When ADMIN_DOMAIN is set: only requests whose Host header matches exactly are allowed through. All other hosts — including tenant subdomains — receive a 404.
• When ADMIN_DOMAIN is unset: any host listed in tenancy.central_domains is accepted. This covers local development and CI where a dedicated admin domain is not yet configured.

Authentication

The panel uses its own session-based auth rather than the tenant OAuth pipeline, making it usable as a break-glass surface if the identity provider is misconfigured.

1. An unauthenticated request hits the panel.
2. AdminAuthenticate redirects to route('admin.sso.redirect').
3. The host app's SSO controller exchanges the callback for a session and redirects back to the panel.
4. AdminUser::canAccessPanel() confirms the authenticated user holds a central-staff role. Non-staff users are rejected at this point regardless of session state.

AdminUser

AdminUser extends the core User model and implements Filament's FilamentUser contract. It reads from the same users table but restricts panel access to users whose role returns true from role->isCentralStaff().

// Defined in src/Models/AdminUser.php
public function canAccessPanel(Panel $panel): bool
{
    return $this->role?->isCentralStaff() ?? false;
}

To use this model as the Filament auth guard, configure the admin panel guard in the host app's config/auth.php to point at AdminUser.

Included resources

Administration

Devices

Operations

CMS

Pages

Release workflow

Releases are automated via GitHub Actions (.github/workflows/release.yml). On every push to main the workflow reads conventional commit messages since the last tag and bumps the version accordingly:

You can also trigger a release manually from the GitHub Actions tab and choose the bump type explicitly.

Licence

MIT