Implements **TRU-71 (DRIFT 10)** for the api repo: rewrites the
customer-facing Stripe invoice email body so it no longer exposes the
payment-processor name 'Stripe' to the customer. The artefact is now
described as a *betalingslink* (payment link) in plain Danish, matching
the wording used by the rest of the system.
## Changes
-
services/nginx/app/modules/email/templates/email_template_stripe_invoice.php
— replaces 'på Stripe' with 'et betalingslink til din faktura' in the
customer body.
- services/nginx/app/tests/auth/StripeInvoiceEmailTemplateTest.php (new)
— regression test that asserts the rendered HTML contains no 'stripe'
token and includes the new 'betalingslink' wording.
## Tests
- php8.4
services/nginx/app/tests/auth/StripeInvoiceEmailTemplateTest.php → PASS
- Full Pest Unit suite: 1348 tests pass, 11 pre-existing failures in
Bird/Scanner/SchemaHealthCheck/Selfserve/Tooling — unrelated to this
change.
Refs: TRU-71. Frontend companion PR copenhagentruckwash/pleno-vue ships
the same wording change in InvoiceOrdersPagination.vue.
---------
Co-authored-by: perf-investigator <[email protected]>
Complete and secure public customer/driver registration, authoritative limited-backoffice department scope, one-time employee QR login, and pricing concurrency for the Sæby demo.
Resolve recommended-profile Critical and High findings, retain narrow analyzer exceptions, and update the edge-broker WebSocket dependency to a non-vulnerable release.
- Introduced `CreateTokenUserNotFoundTest.php` to validate `create_token` behavior when users are missing.
- Added `WebAuthnLogicCheck.php` to test deserialization handling in `webauthn.php`.
- Created `WebAuthnReproLogic.php` for verifying credential ID and user handle matching.
- These tests aim to enhance coverage and ensure robust handling of edge cases in authentication processes.
- Introduced `PemToCoseConversionTest` for WebAuthn key testing.
- Added example Nginx config (`nginx-example.conf`) with CORS and PHP handling.
- Created HTTP test scripts for self-serve API endpoints.
- Provided `.env` example for Elastic Stack credentials.
- Updated `.gitignore` to include IntelliJ and Nginx logs.
- Integrate WebAuthn library for passkey authentication workflows, including assertion verification and improved error handling.
- Add support for reCAPTCHA token validation across multiple endpoints for enhanced security.
- Extend OpenAPI schema to document new fields and restructured payloads.
- Add unit tests for WebAuthn flows, permission initialization, and route validation to ensure robustness and accuracy.
- Refactor direct download URL generation to dynamically use `HTTP_HOST` and protocol.
- Add support for localhost `rpId` during WebAuthn passkey challenges.
- Extend test cases to validate `localhost` and `truckwash.io` scenarios.
- Update OpenAPI specifications to reflect new `rpId` logic and additional server configurations.
- Introduced endpoints for WebAuthn-based authentication flow (`/auth/passkey/challenge` and `/auth/passkey/verify`).
- Added support for generating and verifying WebAuthn PublicKeyCredentialRequestOptions and challenge tokens.
- Extended routing logic to expose matched route templates for improved parameter handling.
- Updated OpenAPI specifications to document passkey challenge and verification workflows.
- Included unit tests for validating both existing and non-existing user scenarios during passkey challenges.
- Extend `users_o` and `subusers_o` with `two_factor_enabled` and `two_factor_secret` properties.
- Implement methods for managing 2FA (`isTwoFactorEnabled`, `setTwoFactorSecret`, `verify_2fa_code`) in authentication logic.
- Add 2FA handling in login flows for both users and subusers, including token generation and validation.
- Introduce `totp` class for TOTP-based authentication, including QR code generation and code verification.
- Add test cases for 2FA functionality (`TwoFactorAuthTest.php`) and coverage for login scenarios with 2FA.
- Update OpenAPI specifications to include 2FA flows (`auth/2fa/setup`, `auth/2fa/enable`, `auth/2fa/verify`, `auth/2fa/disable`).
