- Refactored `department_daily_targets` logic to accept and process float values instead of integers.
- Adjusted relevant type declarations, validations, and calculations in `GoalsCriteria`.
- Updated OpenAPI schema to align with new data type for per-department daily targets.
- Added new enum values (`REVENUE`, `VISITS`, `NONE`) for `Criteria type` in `GoalsCriteria`.
- Introduced `GoalProgressDetails` schema for tracking progress metrics (count, target).
- Extended `DepartmentGoal` to include time-based progress tracking (`today`, `week`, `month`) and departmental distribution of progress.
- Introduced `department_daily_targets` field in criteria, renderer, and API to define daily target overrides for departments.
- Enhanced daily target logic to honor per-department overrides while maintaining backward compatibility.
- Updated SMS, email, and Slack renderers for consistent enforcement of text length limits with fallback to non-mbstring functions.
- Refactored order item update logic to improve database interaction safety by using setters.
- Integrate WebAuthn library for passkey authentication workflows, including assertion verification and improved error handling.
- Add support for reCAPTCHA token validation across multiple endpoints for enhanced security.
- Extend OpenAPI schema to document new fields and restructured payloads.
- Add unit tests for WebAuthn flows, permission initialization, and route validation to ensure robustness and accuracy.
- Refactor direct download URL generation to dynamically use `HTTP_HOST` and protocol.
- Add support for localhost `rpId` during WebAuthn passkey challenges.
- Extend test cases to validate `localhost` and `truckwash.io` scenarios.
- Update OpenAPI specifications to reflect new `rpId` logic and additional server configurations.
- Introduced endpoints for WebAuthn-based authentication flow (`/auth/passkey/challenge` and `/auth/passkey/verify`).
- Added support for generating and verifying WebAuthn PublicKeyCredentialRequestOptions and challenge tokens.
- Extended routing logic to expose matched route templates for improved parameter handling.
- Updated OpenAPI specifications to document passkey challenge and verification workflows.
- Included unit tests for validating both existing and non-existing user scenarios during passkey challenges.
- Extend `users_o` and `subusers_o` with `two_factor_enabled` and `two_factor_secret` properties.
- Implement methods for managing 2FA (`isTwoFactorEnabled`, `setTwoFactorSecret`, `verify_2fa_code`) in authentication logic.
- Add 2FA handling in login flows for both users and subusers, including token generation and validation.
- Introduce `totp` class for TOTP-based authentication, including QR code generation and code verification.
- Add test cases for 2FA functionality (`TwoFactorAuthTest.php`) and coverage for login scenarios with 2FA.
- Update OpenAPI specifications to include 2FA flows (`auth/2fa/setup`, `auth/2fa/enable`, `auth/2fa/verify`, `auth/2fa/disable`).
- Implement Bird API client (`bird.php`) for handling HTTP requests to Bird services.
- Add routes for voice and flash call management (`birdVoiceFlashCallsRoute.php`, `birdNumbersRoute.php`).
- Introduce test cases for voice calls, flash calls, and numbers (`VoiceCallsApiTest.php`, `NumbersAndFlashCallsApiTest.php`).
- Include configuration management classes and APIs for enabling the Bird module and managing API keys (`bird_c.php`).
- Provide OpenAPI specifications for flash call endpoints (`bird-flash-calls.md`).
- Implement emergency operations to forcibly enable or disable MACHINE relays (`forceTurnOnMachineRelay`).
- Add OpenAPI specifications for `/modules/self-serve/lane/force/machine/enable` and `/modules/self-serve/lane/force/machine/disable`.
- Update route definitions and introduce validation for input parameters.
- Implement `/department/lanes/dynamic-image` endpoint for machine UI dynamic image rendering.
- Add OpenAPI specification for the new endpoint with query parameters for buttons, current step, and vehicle type.
- Include `DepartmentLanesImageTest` for lightweight testing of image behavior and input normalization.
- Update `departmentLanesRoute.php` with logic for parameter handling and image composition based on lane configuration.
- Extend `department_selfserve_tasks_o` with `buttons` and `dynamic_images_vehicle_type` properties.
- Add normalization/validation methods for `buttons` and `dynamic_images_vehicle_type` parameters.
- Update `departmentSelfserveTasksRoute` to handle new fields in task creation and update.
- Add OpenAPI specifications for `buttons` and `dynamic_images_vehicle_type`.
- Include comprehensive tests for button normalization and vehicle type selection.
- Add `.junie/guidelines.md` with comprehensive development instructions.
- Include `.aiassistant/rules/Creating and maintaining tests.md` and `.aiassistant/rules/Creating and securing routes.md`.
- Introduce `CACHE_SELFSERVE_LANE_KEY_ALLOWED_SERVICES` for lane service validation.
- Update `selfserve_lane_relay_controller_t` to enforce service-specific permissions for machine relay.
- Add `/subusers/me` as a public registration endpoint, including CVR validation, phone lookup, and optional SMS setup link generation.
- Extend OpenAPI specification with `SubuserSelf` and `SubuserGrantSummary` schemas for returning authenticated subuser profiles and grants.
- Add `X-Customer-Number` header for subuser-specific customer targeting across endpoints.
- Update vehicle-related endpoints (`listVehicles`, `addVehicle`, `editVehicle`, etc.) to include subuser permission checks and customer context handling.
- Refactor request and response schemas for vehicle operations to reflect new requirements and improve clarity.
- Include detailed permission scoping and descriptions for subuser and broader access handling.
- Extend OpenAPI specification with enriched schema properties and additional responses for edge cases.
- Allow listing subusers with only non-enabled grants by introducing an optional `include_non_enabled` query parameter.
- Update SQL query logic to conditionally include non-enabled subuser grants.
- Extend OpenAPI documentation to reflect the new parameter with its description and schema.
- Implement routes to list and retrieve subusers based on grant visibility tied to the authenticated user's customer number.
- Extend OpenAPI documentation with detailed descriptions, parameters, and response schemas for the new endpoints.
- Add detailed API info, authentication methods, and permission requirements.
- Introduce comprehensive tags for endpoints covering key modules such as Users, Orders, Bookings, Payments, and more.
- Define `/subusers` endpoint for creating subuser registrations with CVR validation and SMS setup flow.
- Update schemas for user and subuser properties, including notifications and timestamps.
- Implement routes for managing subuser grants: listing, creating, updating, and deleting.
- Add endpoint to fetch available permission nodes grouped by type.
- Extend `subuser_grants_o` with new utility methods, including `asArray`.
- Update OpenAPI documentation to include new endpoints and schemas.
- Introduce `passkeysRoute` with operations to list, create, rename, and delete passkeys for authenticated users.
- Update OpenAPI with endpoints and request/response schemas for passkey management.
- Add `/subusers` route for subuser creation using CVR and phone validation.
- Introduce `/subusers/setup` with token validation and subuser setup completion.
- Define detailed request/response schemas for both endpoints.
Jeppe Bundgaard