- Introduce preflight handling for `OPTIONS` method on `api.truckwash.io` with high priority routing and secure headers middleware.
- Extend CORS configuration to include `https://api.truckwash.io`.
- Refactor direct download URL generation to dynamically use `HTTP_HOST` and protocol.
- Add support for localhost `rpId` during WebAuthn passkey challenges.
- Extend test cases to validate `localhost` and `truckwash.io` scenarios.
- Update OpenAPI specifications to reflect new `rpId` logic and additional server configurations.
- Introduced endpoints for WebAuthn-based authentication flow (`/auth/passkey/challenge` and `/auth/passkey/verify`).
- Added support for generating and verifying WebAuthn PublicKeyCredentialRequestOptions and challenge tokens.
- Extended routing logic to expose matched route templates for improved parameter handling.
- Updated OpenAPI specifications to document passkey challenge and verification workflows.
- Included unit tests for validating both existing and non-existing user scenarios during passkey challenges.
- Update passkey data mapping to use associative arrays and handle JSON decoding for `transports`.
- Refactor token caching logic to validate database existence and clear stale entries.
- Improve 2FA handling by centralizing `token->type` and `user_id` processing for reuse.
- Add fallback logic to resolve subuser sessions via the tokens table when cache is missing or expired, with re-caching for future use.
- Refactor 2FA flow to prioritize subuser over user objects for better clarity and ensure compatibility with TOTP logic.
- Add safeguards to avoid operations on nonexistent users or subusers in 2FA and authentication flows.
- Extend `users_o` and `subusers_o` with `two_factor_enabled` and `two_factor_secret` properties.
- Implement methods for managing 2FA (`isTwoFactorEnabled`, `setTwoFactorSecret`, `verify_2fa_code`) in authentication logic.
- Add 2FA handling in login flows for both users and subusers, including token generation and validation.
- Introduce `totp` class for TOTP-based authentication, including QR code generation and code verification.
- Add test cases for 2FA functionality (`TwoFactorAuthTest.php`) and coverage for login scenarios with 2FA.
- Update OpenAPI specifications to include 2FA flows (`auth/2fa/setup`, `auth/2fa/enable`, `auth/2fa/verify`, `auth/2fa/disable`).
- Implement Bird API client (`bird.php`) for handling HTTP requests to Bird services.
- Add routes for voice and flash call management (`birdVoiceFlashCallsRoute.php`, `birdNumbersRoute.php`).
- Introduce test cases for voice calls, flash calls, and numbers (`VoiceCallsApiTest.php`, `NumbersAndFlashCallsApiTest.php`).
- Include configuration management classes and APIs for enabling the Bird module and managing API keys (`bird_c.php`).
- Provide OpenAPI specifications for flash call endpoints (`bird-flash-calls.md`).
- Introduce HTTP tests for `/modules/self-serve/lane/force/machine/enable` and `/disable`.
- Add `ForceMachineRelayBypassTest` to validate bypass behavior of manual gating restrictions.
- Implement emergency operations to forcibly enable or disable MACHINE relays (`forceTurnOnMachineRelay`).
- Add OpenAPI specifications for `/modules/self-serve/lane/force/machine/enable` and `/modules/self-serve/lane/force/machine/disable`.
- Update route definitions and introduce validation for input parameters.
- Implement `/department/lanes/dynamic-image` endpoint for machine UI dynamic image rendering.
- Add OpenAPI specification for the new endpoint with query parameters for buttons, current step, and vehicle type.
- Include `DepartmentLanesImageTest` for lightweight testing of image behavior and input normalization.
- Update `departmentLanesRoute.php` with logic for parameter handling and image composition based on lane configuration.
- Extend `department_selfserve_tasks_o` with `buttons` and `dynamic_images_vehicle_type` properties.
- Add normalization/validation methods for `buttons` and `dynamic_images_vehicle_type` parameters.
- Update `departmentSelfserveTasksRoute` to handle new fields in task creation and update.
- Add OpenAPI specifications for `buttons` and `dynamic_images_vehicle_type`.
- Include comprehensive tests for button normalization and vehicle type selection.
- Introduce a minimal, self-contained test to ensure the relay turns off when STOP is executed.
- Enhance `selfserve_lane_command_t` to handle relay shutdown based on department configuration.
- Include `isDepartmentSelfServeEnabled` method for testing override and I/O avoidance.
- Refactor header and footer to support Outlook Classic (MSO) rendering.
- Adjust logo sizing, alignment, and styles for improved consistency.
- Update inline styles for better cross-platform email rendering.
- Add `SelfserveLaneServicesEnumTest` to validate `selfserve_lane_services` cases.
- Update `index.php` to load self-serve module interfaces, traits, classes, helpers, and configs.
- Center Truck Wash logo in email header and adjust styling.
- Localize password reset error message in `authRoute.php` with Danish text.
- Add `.junie/guidelines.md` with comprehensive development instructions.
- Include `.aiassistant/rules/Creating and maintaining tests.md` and `.aiassistant/rules/Creating and securing routes.md`.
- Introduce `CACHE_SELFSERVE_LANE_KEY_ALLOWED_SERVICES` for lane service validation.
- Update `selfserve_lane_relay_controller_t` to enforce service-specific permissions for machine relay.
- Introduce `services` property to `department_selfserve_tasks_o` for task-specific functionalities.
- Add service validation and normalization via `selfserve_lane_services` enum.
- Extend `departmentSelfserveTasksRoute` to handle `services` input for add/edit operations.
- Create `selfserve_lane_services` enum to define and validate service types.
- Update welcome email template to conditionally include corporate ID.
- Remove unused base64 signature utility and clean up the email class.
- Comment out attachments array for potential future updates.
- Dynamically insert company name and corporate ID in welcome message.
- Replace signature image URLs with updated assets and ensure proper loading.
- Add utility for retrieving base64-encoded signatures to enhance flexibility.
- Introduce a temporary route to send deprecated responses for email testing.
- Use `sendWelcomeEmailToCustomer` from the `email` class to implement email-sending logic.
- Introduce `generatePasswordResetLink` method in `users_o` for creating secure password reset links.
- Add `sendWelcomeEmailToCustomer` method to `email` class with support for attachments.
- Update `authRoute.php` to send welcome emails when creating new customers.
- Extend `sendEmail` to handle optional attachments and references.
- Disable PHP entrypoint in Dockerfile for improved flexibility.
- Add preflight routers and attach `secure-headers` middleware in Traefik for `api.truckwash.dk` and `cloud.truckwash.dk`.
- Update `secure-headers` middleware with refined CORS headers and stricter origin/method/header configurations.
- Remove redundant CORS logic in Caddy, delegating CORS management entirely to Traefik.
- Add origin-specific CORS settings to Traefik for `truckwash.io` with credentials support.
- Simplify and standardize CORS headers in Caddy, removing upstream duplication and adjusting preflight logic.
- Introduce Redis healthchecks in `docker-compose.prod.yml` for better container monitoring.
- Extend PHP Dockerfile with `redis-tools` and enable Composer dependency auto-install.
- Update `docker-entrypoint.sh` to wait for Redis readiness before starting PHP-FPM.
- Remove local Nginx override and simplify development setup.
- Add new upstream PHP-FPM servers to Nginx configuration for enhanced load balancing.
- Introduce Elastic APM PHP agent in `php.ini` and update Dockerfile for better dependency management.
- Secure Kibana and Elasticsearch connections in Metricbeat/Filebeat configurations with credentials.
- Remove unused PHP dependencies from `composer.json` and `composer.lock`.
- Update the Monday message check to start at 07:00 instead of 06:00.
- Add `/tmp-washes-in-time` route to generate and download a CSV file of washes within a specific time range.
- Mark `/tmp-washes-in-time` route as deprecated.
Jeppe B