Filament Max Users Laravel Package

Product Decisions This Supports

• Build vs. buy for the MAX messenger admin surface. This package is a Filament 5 plugin that renders "Max users" and "Max chats" resources — lists, view pages, navigation, translations, and a "Refresh from MAX" action. Adopting it removes the need to hand-build CRUD + API sync screens for MAX, which is the single largest chunk of a messenger-integration admin panel. The v1.1.1 patch confirms the package is actively maintained at a cadence where even cosmetic debt (column order, dead duplicate lang keys) gets closed with tests.
• Feature scoping for the operator experience. The release makes every list column toggleable and pins an explicit default order (user_id → is_bot badge → avatar → name → surname → phone w/ verified icon → chat count; chat_id → type badge → status badge → display name → participant count → last activity). That is a deliberate answer to "who looks at this screen and what do they need first" — support agents get identity and contactability up front, chat rows lead with classification and recency. Column-level toggling lets one deployment serve multiple personas (support vs. analyst vs. moderation) without forking the resource, which is a real product lever: it defers the "do we need role-specific views?" decision.
• Roadmap signal on data fidelity. Two fixes are roadmap-relevant rather than cosmetic: (1) the "Refresh from MAX" action no longer breaks on groups/channels whose GET /chats/{id} returns participants as a {user_id: activity} map — previously a functional hole on exactly the object types most likely to have many members; (2) chat link now goes through ChatPresenter::safeUrl() and only renders href for http/https, closing a javascript:/data: injection path (A03). Both mean the product can be trusted on real, messy MAX data instead of only on well-formed dialogs.
• Localization and terminology decisions. username in Russian becomes «Никнейм» while English stays "Username"; chats.view.title (the duplicate "Name from MAX") is removed from the chat detail page because it duplicated displayName in groups/channels and was empty in dialogs. If your users are Russian-speaking operators, this is the release that makes the UI read like a Russian product rather than a translated one — worth calling out in a UX review rather than treating as noise.
• Risk/compliance posture. filament/filament is bumped 5.7.8 → 5.9.0 for advisory CVE-2026-104181 without changing the ^5.0 constraint, and composer security-audit reports zero vulnerabilities. For a package that sits in an admin panel with PII (phone numbers, emails, MAX profile data), that is a "we can keep this in the dependency tree" datapoint.

When to Consider This Package

Adopt when:

• You are on Laravel + Filament 5.x (^5.0) and want MAX users/chats inside the same panel as the rest of your admin, with Filament-native tables, infolists, badges, column-toggle toolbar, and per-user persisted column state.
• The need is read/observe-heavy: browse users, browse chats, inspect a profile, inspect participants, and pull fresh metadata on demand. That is exactly the shape of this package.
• You want localized (ru/en) screens out of the box with synchronized lang files, and you are fine with Russian-first terminology («Никнейм», «Бот»/«Пользователь»).
• You value verifiable quality gates over feature breadth: PSR-12 clean across 22 files, PHPStan level max with 0 errors, 54 tests / 187 assertions, 97.47% line coverage against a 95% gate, plus dedicated feature tests that lock column order, toggleable column completeness, and infolist field order per section.
• You are integrating via geekcodev/max-php-client — v1.1.1 pins/updates to client 1.1.9 for the group-participants-map parsing fix.

Look elsewhere / postpone when:

• You are not on Filament 5, or you are on a Filament major that the ^5.0 constraint excludes. The release explicitly did not widen the constraint.
• You need write-heavy or automation-first MAX behavior — bot command authoring, message pipelines, broadcast orchestration, webhook ingestion. This package is a browsing/administration surface, not a messaging SDK; pair it with (or replace it by) the client library for that.
• You need a stable, versioned extension API. 1.1.1 is explicitly patch-level with "public API untouched," which is good discipline, but it also means the extension points you'd hook into (config keys, signatures, lang keys) are treated as frozen contracts — if your roadmap requires deep customization of these resources, expect to subclass/override rather than configure.
• Default column visibility matters to your existing users. This is the one behavioral change worth a release note to operators: surnames are now visible by default on the users list, and previously-visible columns beyond the new default set are now hidden until re-enabled via the column toolbar. Nothing breaks, but screenshots, runbooks, and support scripts referencing "the columns we always see" will drift.
• You depend on the removed chats.view.title key in your own translations or overrides — it was a dead duplicate (the second array entry always won), so behavior is unchanged, but any code poking that key directly should be checked.
• You need multi-tenant or fine-grained per-record authorization beyond what Filament policies (users.*, chats.*, unchanged here) give you.

How to Pitch It (Stakeholders)

For executives: This is a patch release on an internal-facing admin plugin — no breaking changes to the public API, config keys, or method signatures. It ships three things that matter commercially: a security hardening (chat links from the MAX API are now sanitized so javascript:/data: payloads can't become clickable hrefs), a dependency security bump that clears a published Filament advisory (CVE-2026-104181) without changing our version constraint, and a fix for a real functional bug — "Refresh from MAX" no longer fails on group chats and channels, which are the highest-value conversation types. The rest is UI polish: predictable column order, all columns toggleable per user, and better Russian labels. Quality gates are strong and unchanged in rigor: 54 tests green, ~97.5% line coverage, static analysis at max level, zero audit findings. Recommendation: take the upgrade on the normal maintenance train; no migration, no user retraining, no config edits.

For engineering: Low-risk upgrade, but three things to know. (1) Security: ChatPresenter::safeUrl() now gates href rendering to http/https — unit-tested, addresses A03; if you had your own link rendering, mirror the guard. (2) Correctness: the group-participants issue was actually in geekcodev/max-php-client (fixed in 1.1.9, vendored here) — GET /chats/{id} returns participants as a map, not a list; there's a regression test (test_refresh_metadata_action_parses_group_participants_map) so it won't silently regress. (3) Behavioral surface: default column visibility changed (surname now visible on users; several fields now hidden-by-default but toggleable) and lang/ru username is now «Никнейм» — if you snapshot UI or assert on labels, update fixtures. Also note .gitattributes now excludes dev configs (phpunit.xml, Dockerfile, docker/**, .php-cs-fixer.cache) from dist, so don't rely on those shipping in vendored installs. Filament moves 5.7.8 → 5.9.0 within ^5.0; smoke-test the panel after the bump. Everything else — permissions, config defaults, deletion flows, profile refresh — is untouched, and the new feature tests lock column order, full toggleable composition, and infolist field order so future churn is caught in CI rather than by users.