Filament Sentinel Laravel Package

Fixed

• The Filament target is now looked up in the right panel. 1.2.0 searched the default panel, so in an application with more than one — an admin panel and a tenant panel, say — a denial inside the second one found no matching resource and fell silent. The panel id is taken from the route name (filament.{panel}.resources...), with the default panel as fallback.
• For the same reason, a permission is now classified against the panel the route names, so a resource in a non-default panel is no longer reported as a custom permission.

Added

• The 403 now names the permission behind a Filament denial too. 1.1.0 could only speak when the exception carried the detail, which Spatie's UnauthorizedException does — but a panel denial throws a bare AuthorizationException that says nothing, so the page kept falling back to listing roles precisely where it was needed most. Sentinel now reads the current Filament route instead: the route names the resource or page, the page segment names the ability (index -> ViewAny, create -> Create, edit -> Update, view -> View, delete -> Delete), and Shield — the only thing that knows how this application spells its permissions — turns the pair into the real key, e.g. ViewAny:PayrollRun.
• Sentinel::deniedTarget() and Sentinel::inferredPermission().

Notes

• The inferred permission is verified against the user before it is shown: if they already hold it, the denial was about something else and Sentinel stays quiet rather than pointing at the wrong thing.
• Shield is detected, never required — class_exists(), like the Spatie check. Without it the page behaves exactly as it did in 1.1.0.
• What the exception carries still wins over anything inferred.

Added

• The 403 now names the permission you are missing, not the roles you hold. A denied user already knows their own roles; what they need is the permission they are short of. Sentinel reads it off the exception when it carries one — Spatie's UnauthorizedException exposes getRequiredPermissions() and getRequiredRoles(), a bare AuthorizationException exposes nothing — and lists only the entries the user actually lacks, since a denial can name several while the user is short of just one.
• The page says what the permission guards: Resource, Page, Widget or Custom permission. Shield's page_ and widget_ prefixes name the kind outright; anything else has its subject matched against the panel's own registered resources, pages and widgets, so the answer stays correct as those come and go. Unclaimed subjects are reported as custom rather than guessed at.
• Sentinel::requiredPermissions(), requiredRoles(), missingPermissions(), missingRoles() and permissionKind() for reuse outside the error pages.

Changed

• The roles held are now a fallback, shown only when the denial cannot name what it wanted — otherwise they are noise on an otherwise actionable page.

Notes

• Detection is by method, not by class, so the package still has no dependency on spatie/laravel-permission; it simply uses the extra detail when the exception offers it.
• The ejected 403.blade.php carries its own inline copy of the logic to stay self-contained. Without a panel to ask, it classifies by prefix only.

First public release.

Added

• Branded error pages for 500, 403, 404, 419 and 503, built from native Filament Blade UI components (<x-filament::section>, badge, button, icon) on a light, theme-aware scaffold — they inherit the panel's colours, fonts, brand logo and dark mode automatically.
• A polished card layout (logo header, big status code, description, detail rows, primary + secondary actions and a contextual note callout) for 403/404/419/503, plus a dedicated docked message window for the 500 (timestamped, with the request-id).
• A "View more" panel on the 500 window that expands to consolidated technical detail (message number, request id, status) and — when exception details are enabled — the real exception laid out like a framework debugger: a red header with the class and message, then a numbered, structured stack trace (file:line split from the call, app frames highlighted apart from vendor). The window unwraps Laravel's generic HttpException(500) to the root cause, so the class, location, stack and message number all point at the exception that actually threw, not the framework handler.
• Live overlay for panel errors: when a Livewire (panel) action fails with a 500, Sentinel intercepts Livewire's default dark modal and shows the branded 500 as a small window over the real page — the page stays fully visible, dismissible by clicking outside or pressing Escape. Falls back cleanly to the debugger in local/debug mode. Toggle with ->livewireOverlay(false).
• Two 500 presentations, chosen with ->fullPage() / config('sentinel.window.style'): the docked window (default) or a full page like the other codes — on a Livewire error the full page then takes over the document, exactly like landing on a real error page.
• Window placement via ->windowPosition() / config('sentinel.window.position'): bottom-left (default), bottom-right, top-left, top-right, top-center, bottom-center, center, or a full-height slide-over drawer with slide-right / slide-left. Set the width with ->windowWidth().
• Publishing: sentinel-config, sentinel-translations and sentinel-views tags, plus a sentinel-errors "eject" tag that publishes a self-contained set of error pages into resources/views/errors/ — no dependency on the plugin or even on Filament, so the branded pages keep working after the plugin is removed.
• ->email() convenience for the "Contact support" action (wraps the address in a mailto: link).
• All pages read Filament's own colour variables (--gray-*, --danger-*, …) and the .fi-body background, so they match the panel's exact theme in light and dark — no bespoke palette.
• Drop-in: the pages register as the default for aborted requests by adding the package's views to Laravel's error resolver, so no publishing is required. Any app-level resources/views/errors/{code}.blade.php still wins.
• Real data, never invented: each page derives its content from the actual exception — validation-free authorization detail on 403 (guard, account, roles, reason), the missing path on 404, Retry-After on 503, and the real exception (class, location, message and stack) on 500. Exception exposure follows APP_DEBUG by default; set show_exception_details to true to reveal it in production (for a panel only trusted admins reach) or false to hide it even locally.
• SAP-style message numbers (e.g. SNT-500-087), derived deterministically from the error signature so the same failure always quotes the same number.
• Request ids assigned by middleware and echoed on the response header, so the id on the page matches what a developer sees in logs.
• Brand logo: pulls the panel's brandLogo / darkModeBrandLogo, falling back to the brand name and then the application name.
• Translations for English, European Portuguese and Brazilian Portuguese.
• Fluent plugin API (SentinelPlugin::make()): brand(), messagePrefix(), messageNumbers(), requestId(), showExceptionDetails(), supportUrl(), homeUrl(), codes() and enabled(). Anything left unset falls back to config/sentinel.php.
• Pest test suite (message-number determinism, debug gating, config, plugin API, end-to-end abort() rendering and the request-id middleware).