- Improve user verification in `authentication.php` by adding a check for user existence and throwing meaningful exceptions for missing users.
- Refactor `webauthn.php` to handle Base64URL decoding and COSE key normalization for consistent WebAuthn library compatibility.
- Extend error logging with additional context for debugging (e.g., public key hex representation).
- Add utility functions for Base64URL decoding and checking PEM/DER format.
- Update `passkeysRoute.php` to normalize public keys and handle errors gracefully during WebAuthn workflows.
- Extend `users_o` and `subusers_o` with `two_factor_enabled` and `two_factor_secret` properties.
- Implement methods for managing 2FA (`isTwoFactorEnabled`, `setTwoFactorSecret`, `verify_2fa_code`) in authentication logic.
- Add 2FA handling in login flows for both users and subusers, including token generation and validation.
- Introduce `totp` class for TOTP-based authentication, including QR code generation and code verification.
- Add test cases for 2FA functionality (`TwoFactorAuthTest.php`) and coverage for login scenarios with 2FA.
- Update OpenAPI specifications to include 2FA flows (`auth/2fa/setup`, `auth/2fa/enable`, `auth/2fa/verify`, `auth/2fa/disable`).
- Introduce `hasPermission` method in `subusers_o` for permission checks tied to customer context.
- Update `/subusers/me` route to return subuser grants with normalized permissions and metadata.
- Add `get_subuser_customer_number_target` in `authentication` to resolve customer context from request headers.
- Refactor route-level permission checks to handle subuser grants dynamically.
- Introduce CLI test scripts for subuser grants and permission node mappings.
- Add test coverage for subuser grants and permission nodes in new test classes.
- Add `permission_node` DTO to link classic permissions with subuser-specific nodes.
- Extend `authentication` to support subuser resolution via tokens.
- Introduce route traits for permission evaluation with subuser context.
- Update `requirePermission` and `hasPermission` to handle subuser grants dynamically.
- Implement fallback mechanisms for customer number context in subuser permissions.
- Added a check to ensure customers with group ID other than 0 cannot use default passwords.
- Implemented logic to auto-set passwords to the last 4 digits of the customer number if no password is set.
- Updated method documentation to include an `@throws Exception` annotation.
Added support for extracting the token from JSON-formatted request bodies (`php://input`). This ensures compatibility with clients sending tokens in the request payload alongside other existing methods.
Previously, only tokens from headers or GET parameters were accepted. This update adds support for tokens sent via POST parameters, ensuring compatibility with more request types and improving flexibility for clients.
This update introduces new endpoints for managing Stripe terminal readers, locations, and department-specific configurations. It also adds support for creating, updating, and retrieving department variables along with enhanced validation, logging, and permission checks. These updates improve integration and expand functionality for Stripe and department-related operations.
Jeppe Bundgaard