Admin Panel (Laravel)

Configure the Laravel service that owns Account authentication, schema, admin resources, uploads, and webhooks.

Responsibilities

The generated admin-panel/ is the canonical Account backend. It owns:

Email/password, Google, and Apple auth plus Laravel Sanctum token issuance.
Email verification, password reset/change, connected accounts, session revocation, and account deletion.
Laravel migrations and the shared PostgreSQL schema.
Filament admin resources and role/permission management.
Help-center content, uploads, RevenueCat webhooks, and notification send/broadcast.

Go consumes the tokens/shared schema; it does not replace this ownership.

Requirements

PHP and Composer.
Node.js/npm for frontend assets.
PostgreSQL (the template .env.example uses DB_CONNECTION=pgsql).
Redis for queue/cache/rate-limit configuration.

MySQL, MariaDB, and SQLite are not the configured defaults in the shipped template. The Go API's queries are generated for PostgreSQL, so another database means porting the Laravel migrations and the Go queries (sqlc) before you switch the gateway.

Local setup

cd admin-panel
cp .env.example .env
composer install
npm install
php artisan key:generate
# Set DB_*, REDIS_*, mail, Firebase, and RevenueCat values in .env.
php artisan migrate --seed
php artisan serve

Open http://localhost:8000/admin. Local seed fixtures are:

Super admin: [email protected] / superapp
Test user: [email protected] / user

These are development-only credentials.

Laravel-owned routes

Method	Route	Purpose
`POST`	`/api/v1/auth/login`, `/register`	Issue Sanctum token
`POST`	`/api/v1/auth/google`, `/apple`	Social login
`POST`	`/api/v1/auth/register/google`, `/apple`	Social registration
`POST`	`/api/v1/auth/forgot-password`, `/reset-password`	Password broker flows
`GET/POST`	`/api/v1/auth/email/*`	Verify/resend verification
`POST/PUT`	`/api/v1/auth/logout`, `/update-password`	Session/password lifecycle
`GET/POST/DELETE`	`/api/v1/auth/connected-accounts*`	Connected providers
`DELETE`	`/api/v1/auth/security/sessions*`	Revoke sessions
`DELETE`	`/api/v1/auth/security/delete-account`	Delete account
`POST`	`/api/v1/uploads`	Authenticated file upload
`POST`	`/api/v1/webhooks/revenuecat`	RevenueCat webhook
`POST`	`/api/v1/app/notifications/send`	Super-admin notification send
`POST`	`/api/v1/app/notifications/broadcast`	Super-admin broadcast

Laravel also implements the shared /api/v1/app/* resources in compatibility mode.

Database boundary

Run migrations only from Laravel:

php artisan migrate

Go reads/writes supported resource data against the resulting schema but never runs migrations. Laravel owns audit_logs schema and audit writes.

Testing

php artisan test

Before production configure APP_URL, mail/Resend, Firebase credentials, RevenueCat secrets/API credentials, DB, Redis, trusted proxy CIDRs, and store URLs. Never keep seeded passwords or demo secrets.