- Added new enum values (`REVENUE`, `VISITS`, `NONE`) for `Criteria type` in `GoalsCriteria`.
- Introduced `GoalProgressDetails` schema for tracking progress metrics (count, target).
- Extended `DepartmentGoal` to include time-based progress tracking (`today`, `week`, `month`) and departmental distribution of progress.
- Introduced calculation of departmental progress for today, week, and month in `department_goals_o.php`.
- Removed unnecessary blank line in `object_property.php` for code clarity.
- Refactored department daily targets logic for optimization and better maintainability.
- Ensured department-specific targets are validated, sanitized, and consistently applied in updates.
- Improved database interaction safety by preventing unnecessary updates for unchanged object properties.
- Adjusted route and API behavior for criteria and department updates to handle validations comprehensively.
- Introduced `department_daily_targets` field in criteria, renderer, and API to define daily target overrides for departments.
- Enhanced daily target logic to honor per-department overrides while maintaining backward compatibility.
- Updated SMS, email, and Slack renderers for consistent enforcement of text length limits with fallback to non-mbstring functions.
- Refactored order item update logic to improve database interaction safety by using setters.
- Introduced Redis-backed caching for user and subuser permission evaluations in the `route_t` trait, reducing database queries.
- Enhanced `Redis` class with methods for permission caching: `cache_permission`, `get_permission`, and `clear_permission`.
- Added test coverage for the new caching logic in `PermissionRedisCacheTest.php`.
- Implemented Redis caching for authentication sessions with `cache_auth_session`, `get_auth_session`, and `clear_auth_session`.
- Improved CORS handling for preflight requests in `index.php`.
- Integrated Redis caching in the autoloading process to store and retrieve class and file paths dynamically.
- Added fallback mechanisms for Redis errors to ensure compatibility.
- Cached module directories and individual class paths with expiration to enhance performance and reduce filesystem scans.
- Replaced manual file inclusion with `spl_autoload_register` for dynamic loading of classes, interfaces, traits, and modules.
- Added support for autoloading across core folders (`classes`, `interfaces`, `traits`, etc.) and module directories.
- Introduced a fallback mechanism for module-specific class loading with suffix-based file matching.
- Improved maintainability and scalability by eliminating extensive manual requires.
- Added a private `getCacheKey()` method for consistent Redis key generation.
- Integrated Redis caching in `get`, `set`, and `delete` methods to improve performance.
- Ensured JSON values are correctly serialized/deserialized with caching.
- Implemented cache expiration and invalidation logic for updates and deletions.
- Introduced methods `cache_customer_number_from_user_id`, `get_customer_number_from_user_id`, and `clear_customer_number_from_user_id` to the `Redis` class.
- Updated the `Redis_i` interface to define these new methods.
- Enhances customer-user mapping logic by integrating Redis for efficient caching and retrieval.
- Removed all language pack-related files, traits, and classes.
- Enhanced `users_o.php` with Redis caching for mapping `customer_number` to `user_id` and vice versa.
- Added Redis checks and caching for improved performance in user retrieval methods.
- Introduced `CreateTokenUserNotFoundTest.php` to validate `create_token` behavior when users are missing.
- Added `WebAuthnLogicCheck.php` to test deserialization handling in `webauthn.php`.
- Created `WebAuthnReproLogic.php` for verifying credential ID and user handle matching.
- These tests aim to enhance coverage and ensure robust handling of edge cases in authentication processes.
- Introduced `PemToCoseConversionTest` for WebAuthn key testing.
- Added example Nginx config (`nginx-example.conf`) with CORS and PHP handling.
- Created HTTP test scripts for self-serve API endpoints.
- Provided `.env` example for Elastic Stack credentials.
- Updated `.gitignore` to include IntelliJ and Nginx logs.
- Improve user verification in `authentication.php` by adding a check for user existence and throwing meaningful exceptions for missing users.
- Refactor `webauthn.php` to handle Base64URL decoding and COSE key normalization for consistent WebAuthn library compatibility.
- Extend error logging with additional context for debugging (e.g., public key hex representation).
- Add utility functions for Base64URL decoding and checking PEM/DER format.
- Update `passkeysRoute.php` to normalize public keys and handle errors gracefully during WebAuthn workflows.
- Replace outdated TLS certificate setup with a detailed overview of the Copenhagen Truck Wash API.
- Add sections on architecture, stack components, local development, configuration, testing, monitoring, and API documentation.
- Include instructions for running tests, logs inspection, and utilizing tools like Traefik, Jaeger, and Portainer.
- Introduced Writerside topics for multiple endpoints in the Bookings module, including user, admin, and public time booking routes.
- Added `Bookings_OpenAPIv1.json` specification defining API paths, schemas, and security configurations.
- Included endpoint details for operations like booking retrieval, updates, deletion, syncing, and timebookings.
- Introduce `qodana.yaml` to configure Qodana analysis in PHP projects.
- Set up basic configuration including inspection profile and linter specification.
- Prepare for future CI/CD pipeline integration with commented bootstrap and plugin sections.
- Introduce `docker-compose.fleet-host.yml` allowing Elastic Agent to connect to a host-installed Fleet Server.
- Add `pingRoute` to provide a simple `/ping` endpoint returning "pong" with a timestamp.
- Integrate WebAuthn library for passkey authentication workflows, including assertion verification and improved error handling.
- Add support for reCAPTCHA token validation across multiple endpoints for enhanced security.
- Extend OpenAPI schema to document new fields and restructured payloads.
- Add unit tests for WebAuthn flows, permission initialization, and route validation to ensure robustness and accuracy.
- Introduce preflight handling for `OPTIONS` method on `api.truckwash.io` with high priority routing and secure headers middleware.
- Extend CORS configuration to include `https://api.truckwash.io`.
- Refactor direct download URL generation to dynamically use `HTTP_HOST` and protocol.
- Add support for localhost `rpId` during WebAuthn passkey challenges.
- Extend test cases to validate `localhost` and `truckwash.io` scenarios.
- Update OpenAPI specifications to reflect new `rpId` logic and additional server configurations.
- Introduced endpoints for WebAuthn-based authentication flow (`/auth/passkey/challenge` and `/auth/passkey/verify`).
- Added support for generating and verifying WebAuthn PublicKeyCredentialRequestOptions and challenge tokens.
- Extended routing logic to expose matched route templates for improved parameter handling.
- Updated OpenAPI specifications to document passkey challenge and verification workflows.
- Included unit tests for validating both existing and non-existing user scenarios during passkey challenges.
- Update passkey data mapping to use associative arrays and handle JSON decoding for `transports`.
- Refactor token caching logic to validate database existence and clear stale entries.
- Improve 2FA handling by centralizing `token->type` and `user_id` processing for reuse.
- Add fallback logic to resolve subuser sessions via the tokens table when cache is missing or expired, with re-caching for future use.
- Refactor 2FA flow to prioritize subuser over user objects for better clarity and ensure compatibility with TOTP logic.
- Add safeguards to avoid operations on nonexistent users or subusers in 2FA and authentication flows.
- Extend `users_o` and `subusers_o` with `two_factor_enabled` and `two_factor_secret` properties.
- Implement methods for managing 2FA (`isTwoFactorEnabled`, `setTwoFactorSecret`, `verify_2fa_code`) in authentication logic.
- Add 2FA handling in login flows for both users and subusers, including token generation and validation.
- Introduce `totp` class for TOTP-based authentication, including QR code generation and code verification.
- Add test cases for 2FA functionality (`TwoFactorAuthTest.php`) and coverage for login scenarios with 2FA.
- Update OpenAPI specifications to include 2FA flows (`auth/2fa/setup`, `auth/2fa/enable`, `auth/2fa/verify`, `auth/2fa/disable`).
- Implement Bird API client (`bird.php`) for handling HTTP requests to Bird services.
- Add routes for voice and flash call management (`birdVoiceFlashCallsRoute.php`, `birdNumbersRoute.php`).
- Introduce test cases for voice calls, flash calls, and numbers (`VoiceCallsApiTest.php`, `NumbersAndFlashCallsApiTest.php`).
- Include configuration management classes and APIs for enabling the Bird module and managing API keys (`bird_c.php`).
- Provide OpenAPI specifications for flash call endpoints (`bird-flash-calls.md`).
- Introduce HTTP tests for `/modules/self-serve/lane/force/machine/enable` and `/disable`.
- Add `ForceMachineRelayBypassTest` to validate bypass behavior of manual gating restrictions.
- Implement emergency operations to forcibly enable or disable MACHINE relays (`forceTurnOnMachineRelay`).
- Add OpenAPI specifications for `/modules/self-serve/lane/force/machine/enable` and `/modules/self-serve/lane/force/machine/disable`.
- Update route definitions and introduce validation for input parameters.
- Implement `/department/lanes/dynamic-image` endpoint for machine UI dynamic image rendering.
- Add OpenAPI specification for the new endpoint with query parameters for buttons, current step, and vehicle type.
- Include `DepartmentLanesImageTest` for lightweight testing of image behavior and input normalization.
- Update `departmentLanesRoute.php` with logic for parameter handling and image composition based on lane configuration.
- Extend `department_selfserve_tasks_o` with `buttons` and `dynamic_images_vehicle_type` properties.
- Add normalization/validation methods for `buttons` and `dynamic_images_vehicle_type` parameters.
- Update `departmentSelfserveTasksRoute` to handle new fields in task creation and update.
- Add OpenAPI specifications for `buttons` and `dynamic_images_vehicle_type`.
- Include comprehensive tests for button normalization and vehicle type selection.
- Introduce a minimal, self-contained test to ensure the relay turns off when STOP is executed.
- Enhance `selfserve_lane_command_t` to handle relay shutdown based on department configuration.
- Include `isDepartmentSelfServeEnabled` method for testing override and I/O avoidance.
- Refactor header and footer to support Outlook Classic (MSO) rendering.
- Adjust logo sizing, alignment, and styles for improved consistency.
- Update inline styles for better cross-platform email rendering.
- Add `SelfserveLaneServicesEnumTest` to validate `selfserve_lane_services` cases.
- Update `index.php` to load self-serve module interfaces, traits, classes, helpers, and configs.
- Center Truck Wash logo in email header and adjust styling.
- Localize password reset error message in `authRoute.php` with Danish text.
- Add `.junie/guidelines.md` with comprehensive development instructions.
- Include `.aiassistant/rules/Creating and maintaining tests.md` and `.aiassistant/rules/Creating and securing routes.md`.
- Introduce `CACHE_SELFSERVE_LANE_KEY_ALLOWED_SERVICES` for lane service validation.
- Update `selfserve_lane_relay_controller_t` to enforce service-specific permissions for machine relay.
Jeppe Bundgaard