- Refactored `department_daily_targets` logic to accept and process float values instead of integers.
- Adjusted relevant type declarations, validations, and calculations in `GoalsCriteria`.
- Updated OpenAPI schema to align with new data type for per-department daily targets.
- Added support for `today`, `week`, and `month` progress tracking in `GoalsCriteria`.
- Introduced `setTimeframeByName` method to manage time-based progress criteria.
- Enhanced `calculateProgressFromArray` and `calculateProgressDetailsFromArray` to include customizable timeframes.
- Updated departmental progress calculations with detailed breakdowns for multiple time periods.
- Replaced obsolete single-value progress tracking with comprehensive progress details.
- Introduced calculation of departmental progress for today, week, and month in `department_goals_o.php`.
- Removed unnecessary blank line in `object_property.php` for code clarity.
- Refactored department daily targets logic for optimization and better maintainability.
- Ensured department-specific targets are validated, sanitized, and consistently applied in updates.
- Improved database interaction safety by preventing unnecessary updates for unchanged object properties.
- Adjusted route and API behavior for criteria and department updates to handle validations comprehensively.
- Introduced `department_daily_targets` field in criteria, renderer, and API to define daily target overrides for departments.
- Enhanced daily target logic to honor per-department overrides while maintaining backward compatibility.
- Updated SMS, email, and Slack renderers for consistent enforcement of text length limits with fallback to non-mbstring functions.
- Refactored order item update logic to improve database interaction safety by using setters.
- Introduced Redis-backed caching for user and subuser permission evaluations in the `route_t` trait, reducing database queries.
- Enhanced `Redis` class with methods for permission caching: `cache_permission`, `get_permission`, and `clear_permission`.
- Added test coverage for the new caching logic in `PermissionRedisCacheTest.php`.
- Implemented Redis caching for authentication sessions with `cache_auth_session`, `get_auth_session`, and `clear_auth_session`.
- Improved CORS handling for preflight requests in `index.php`.
- Integrated Redis caching in the autoloading process to store and retrieve class and file paths dynamically.
- Added fallback mechanisms for Redis errors to ensure compatibility.
- Cached module directories and individual class paths with expiration to enhance performance and reduce filesystem scans.
- Replaced manual file inclusion with `spl_autoload_register` for dynamic loading of classes, interfaces, traits, and modules.
- Added support for autoloading across core folders (`classes`, `interfaces`, `traits`, etc.) and module directories.
- Introduced a fallback mechanism for module-specific class loading with suffix-based file matching.
- Improved maintainability and scalability by eliminating extensive manual requires.
- Added a private `getCacheKey()` method for consistent Redis key generation.
- Integrated Redis caching in `get`, `set`, and `delete` methods to improve performance.
- Ensured JSON values are correctly serialized/deserialized with caching.
- Implemented cache expiration and invalidation logic for updates and deletions.
- Introduced methods `cache_customer_number_from_user_id`, `get_customer_number_from_user_id`, and `clear_customer_number_from_user_id` to the `Redis` class.
- Updated the `Redis_i` interface to define these new methods.
- Enhances customer-user mapping logic by integrating Redis for efficient caching and retrieval.
- Removed all language pack-related files, traits, and classes.
- Enhanced `users_o.php` with Redis caching for mapping `customer_number` to `user_id` and vice versa.
- Added Redis checks and caching for improved performance in user retrieval methods.
- Introduced `CreateTokenUserNotFoundTest.php` to validate `create_token` behavior when users are missing.
- Added `WebAuthnLogicCheck.php` to test deserialization handling in `webauthn.php`.
- Created `WebAuthnReproLogic.php` for verifying credential ID and user handle matching.
- These tests aim to enhance coverage and ensure robust handling of edge cases in authentication processes.
- Introduced `PemToCoseConversionTest` for WebAuthn key testing.
- Added example Nginx config (`nginx-example.conf`) with CORS and PHP handling.
- Created HTTP test scripts for self-serve API endpoints.
- Provided `.env` example for Elastic Stack credentials.
- Updated `.gitignore` to include IntelliJ and Nginx logs.
- Improve user verification in `authentication.php` by adding a check for user existence and throwing meaningful exceptions for missing users.
- Refactor `webauthn.php` to handle Base64URL decoding and COSE key normalization for consistent WebAuthn library compatibility.
- Extend error logging with additional context for debugging (e.g., public key hex representation).
- Add utility functions for Base64URL decoding and checking PEM/DER format.
- Update `passkeysRoute.php` to normalize public keys and handle errors gracefully during WebAuthn workflows.
- Introduced Writerside topics for multiple endpoints in the Bookings module, including user, admin, and public time booking routes.
- Added `Bookings_OpenAPIv1.json` specification defining API paths, schemas, and security configurations.
- Included endpoint details for operations like booking retrieval, updates, deletion, syncing, and timebookings.
- Introduce `docker-compose.fleet-host.yml` allowing Elastic Agent to connect to a host-installed Fleet Server.
- Add `pingRoute` to provide a simple `/ping` endpoint returning "pong" with a timestamp.
- Integrate WebAuthn library for passkey authentication workflows, including assertion verification and improved error handling.
- Add support for reCAPTCHA token validation across multiple endpoints for enhanced security.
- Extend OpenAPI schema to document new fields and restructured payloads.
- Add unit tests for WebAuthn flows, permission initialization, and route validation to ensure robustness and accuracy.
- Introduce preflight handling for `OPTIONS` method on `api.truckwash.io` with high priority routing and secure headers middleware.
- Extend CORS configuration to include `https://api.truckwash.io`.
- Refactor direct download URL generation to dynamically use `HTTP_HOST` and protocol.
- Add support for localhost `rpId` during WebAuthn passkey challenges.
- Extend test cases to validate `localhost` and `truckwash.io` scenarios.
- Update OpenAPI specifications to reflect new `rpId` logic and additional server configurations.
- Introduced endpoints for WebAuthn-based authentication flow (`/auth/passkey/challenge` and `/auth/passkey/verify`).
- Added support for generating and verifying WebAuthn PublicKeyCredentialRequestOptions and challenge tokens.
- Extended routing logic to expose matched route templates for improved parameter handling.
- Updated OpenAPI specifications to document passkey challenge and verification workflows.
- Included unit tests for validating both existing and non-existing user scenarios during passkey challenges.
- Update passkey data mapping to use associative arrays and handle JSON decoding for `transports`.
- Refactor token caching logic to validate database existence and clear stale entries.
- Improve 2FA handling by centralizing `token->type` and `user_id` processing for reuse.
- Add fallback logic to resolve subuser sessions via the tokens table when cache is missing or expired, with re-caching for future use.
- Refactor 2FA flow to prioritize subuser over user objects for better clarity and ensure compatibility with TOTP logic.
- Add safeguards to avoid operations on nonexistent users or subusers in 2FA and authentication flows.
- Extend `users_o` and `subusers_o` with `two_factor_enabled` and `two_factor_secret` properties.
- Implement methods for managing 2FA (`isTwoFactorEnabled`, `setTwoFactorSecret`, `verify_2fa_code`) in authentication logic.
- Add 2FA handling in login flows for both users and subusers, including token generation and validation.
- Introduce `totp` class for TOTP-based authentication, including QR code generation and code verification.
- Add test cases for 2FA functionality (`TwoFactorAuthTest.php`) and coverage for login scenarios with 2FA.
- Update OpenAPI specifications to include 2FA flows (`auth/2fa/setup`, `auth/2fa/enable`, `auth/2fa/verify`, `auth/2fa/disable`).
Jeppe Bundgaard