Api Access Filament Laravel Package

Getting Started

This is a presentation adapter, not a standalone API system. It wires an existing API-access domain package (token/key issuing, scopes, revocation) into Filament panel UI. Treat it as a thin UI layer you may need to fork rather than a batteries-included product.

1. Confirm the domain dependency first. Open composer.json and read require. The adapter is useless without whatever package actually owns API tokens (likely a sibling liberusoftware/api-access or a Sanctum/Passport-backed module). Install and configure that before touching the panel.
2. Install with an explicit constraint. With 0 stars, 0 dependents, and a release date of 2026-10-26, do not use ^ blindly. Pin the exact version you audit:

   composer require liberusoftware/api-access-filament:1.x.y
   

3. Register the plugin in your panel provider. Look in src/ for a class implementing Filament\Contracts\Plugin (typically ApiAccessFilamentPlugin):

   public function panel(Panel $panel): Panel
   {
       return $panel
           ->plugins([
               \Liberu\ApiAccessFilament\ApiAccessFilamentPlugin::make(),
           ]);
   }
   

4. Publish anything publishable before first boot:

   php artisan vendor:publish --provider="Liberu\ApiAccessFilament\ApiAccessFilamentServiceProvider"
   php artisan migrate
   php artisan filament:optimize-clear
   

5. Look first at: the service provider (config keys, bindings, policy registration), src/Filament/Resources (the token/key resource and its form schema), and config/ (navigation group, tenancy toggle, model bindings).
6. First real use case: give an authenticated admin a screen to issue a token, see it once in plaintext, list active tokens with last-used timestamps, and revoke. That single flow exercises the resource, the policy, and the domain service binding — if any of the three are missing, stop and reassess.

Implementation Patterns

Bind models to your app's models, not theirs. Adapters usually hardcode a token model. Check for a config key and override it in config/api-access-filament.php so the resource operates on your ApiToken model with your user_id/tenant_id columns. This is the single highest-value customization.

Token issuance: show-once pattern. The plaintext token must be displayed exactly once — typically via a Notification or a modal action after create. Verify the adapter does this; if it renders the token in the table, replace the table column with a masked value and move plaintext to an action modal.

Scoping and tenancy. If you use Filament tenancy, confirm the resource implements getEloquentQuery() with tenant scoping. Pattern:

public static function getEloquentQuery(): Builder
{
    return parent::getEloquentQuery()
        ->where('tenant_id', Filament::getTenant()?->getKey());
}

Without this, an adapter resource leaks tokens across tenants.

Authorization via policies, not the UI. Register a policy for the token model in your AuthServiceProvider. The adapter's resource should defer to viewAny, create, delete. If it doesn't, add ->authorize() / canDelete() guards on the table actions yourself.

Keep domain logic out of the resource. Wrap issuance/revocation in your own action or service class and call it from the Filament action closure. This keeps the flow testable and lets you swap the adapter out later:

Action::make('revoke')
    ->requiresConfirmation()
    ->action(fn (ApiToken $record) => app(RevokeToken::class)->handle($record));

Extend, don't edit vendor. Subclass the resource (class ApiTokenResource extends \Liberu\...\ApiTokenResource) and re-register it in the plugin/config. Override form(), table(), and getNavigationGroup() rather than patching files under vendor/.

Test with Filament's Livewire helpers. livewire(ListApiTokens::class)->assertCanSeeTableRecords(...) and ->callTableAction('revoke', $token) are the fastest way to catch a broken adapter upgrade.

Gotchas and Tips

• License is NOASSERTION. Treat this as unlicensed until legal review. Do not ship it into a commercial product without checking the repo's LICENSE file directly — NOASSERTION from composer.json metadata often means the file is missing or non-standard.
• The 2026 release date is a red flag for the metadata pipeline. Verify the actual tag dates on Packagist/GitHub before assuming active maintenance. A future-dated "release" frequently means a stale tag, a mistyped changelog, or an unmaintained repo.
• Zero dependents means zero field-testing. Budget for reading the source rather than the docs. Expect missing edge cases around token expiry display, soft-deleted users, and revoked-token filtering.
• Filament major-version mismatch is the most likely failure mode. Check composer.json for filament/filament: ^3 vs ^4. Installing an adapter built for v3 into a v4 panel produces confusing Method not found errors inside Livewire components, not a clean composer conflict.
• Assets and views need publishing or the UI silently degrades. If tables render unstyled or modals are empty, run php artisan vendor:publish --tag=filament-assets and re-check filament:optimize-clear.
• Cache masking after edits. Filament caches component discovery. After subclassing resources or changing the plugin, always run php artisan filament:optimize-clear — otherwise your overrides appear ignored.
• Extension points to look for, in priority order: (1) config for model/navigation, (2) subclassable resource, (3) a Plugin::make()->using(...)-style fluent setter, (4) published views. If only (4) exists, plan on forking.
• Debugging flow when the page 404s or is blank: confirm the plugin is in ->plugins([...]), confirm the service provider is auto-discovered (php artisan about), check canAccess() on the resource/page, then check the policy. Nine times out of ten it is authorization, not registration.