## Summary
Makes the database **self-healing** — every request auto-runs all
`*_schema_bootstrap::ensureSchema()` after `$db->connect()`. This
catches the "merged-to-master-but-migration-never-applied-to-prod"
failure mode that just bit us with TRU-77 (`invoice_email` column).
## Why
PR #383 added a pre-deploy schema step to `deploy.yml`. Correct, but
requires GitHub secrets (`DEPLOY_SSH_KEY`, `DEPLOY_USER`,
`SMOKE_BASE_URL`) that aren't set on the `api` repo yet. Until those
secrets exist, the pre-deploy step is skipped and migrations never reach
production. Result: API still references `invoice_email` but the column
doesn't exist → `Unknown column 'invoice_email' in 'SELECT'`.
## Fix
- New class `classes/schema_bootstrap_runtime.php`:
- Auto-discovers all `*_schema_bootstrap.php` files in `classes/`
- Calls `ensureSchema()` on each
- Memoized per PHP process (`private static bool $ran = false`)
- One failure does not block others (logged, not thrown)
- New hook in `services/nginx/app/index.php` right after
`$db->connect()`:
```php
try {
\classes\schema_bootstrap_runtime::runAll();
} catch (Throwable $e) {
error_log('[schema-bootstrap] runtime::runAll() failed: ' .
$e->getMessage());
}
```
- New test: `tests/Unit/SchemaBootstrapRuntimeTest.php` (3 cases)
## Safety
Each existing `*_schema_bootstrap` is **additive + idempotent**:
- `SHOW COLUMNS` check before any `ALTER`
- `ALTER TABLE ADD COLUMN` only if missing
- Per-class `private static bool $initialized = false` short-circuit
- Errors logged but never break the request
So: first request after deploy adds missing columns. Every subsequent
request hits the in-process `$ran` short-circuit (~microseconds). The
new column then exists, the API works, error goes away.
## Test plan
1. Wait for CI (PHP unit + integration)
2. Merge to master
3. Production auto-deploys (or manual re-deploy if secrets not set)
4. Hit the failing endpoint — first request will auto-migrate, response
should be 200
5. Verify with `GET /api/admin/schema-check` that all columns are
present
## Rollback
If anything goes wrong, revert the merge commit. The runtime class only
auto-discovers files matching `*_schema_bootstrap.php`; removing it
reverts the system to the pre-deploy-step-only behavior.
---
**Closes** the TRU-77 follow-up: the "Unknown column 'invoice_email' in
'SELECT'" error should never recur, because the code now self-heals
regardless of whether the deploy pre-deploy step ran.
---------
Co-authored-by: bugfix <bugfix@truckwash.local>
Resolve recommended-profile Critical and High findings, retain narrow analyzer exceptions, and update the edge-broker WebSocket dependency to a non-vulnerable release.
- Introduced `invoice_period_flag_schema_bootstrap` to initialize the schema for invoice period flags.
- Added `invoice_period_flag_service` to handle manual and automatic flag creation, updates, filtering, and context resolution.
- Implemented lifecycle methods such as `createManualFlag`, `updateAutomaticFlagStatus`, and `applyFlagsToPeriodTypes` for handling invoice period flags and their usage in processing periods.
- Included context-specific resolution methods for efficient flag management in invoicing workflows.
- Introduced Redis-backed caching for user and subuser permission evaluations in the `route_t` trait, reducing database queries.
- Enhanced `Redis` class with methods for permission caching: `cache_permission`, `get_permission`, and `clear_permission`.
- Added test coverage for the new caching logic in `PermissionRedisCacheTest.php`.
- Implemented Redis caching for authentication sessions with `cache_auth_session`, `get_auth_session`, and `clear_auth_session`.
- Improved CORS handling for preflight requests in `index.php`.
- Integrated Redis caching in the autoloading process to store and retrieve class and file paths dynamically.
- Added fallback mechanisms for Redis errors to ensure compatibility.
- Cached module directories and individual class paths with expiration to enhance performance and reduce filesystem scans.
- Replaced manual file inclusion with `spl_autoload_register` for dynamic loading of classes, interfaces, traits, and modules.
- Added support for autoloading across core folders (`classes`, `interfaces`, `traits`, etc.) and module directories.
- Introduced a fallback mechanism for module-specific class loading with suffix-based file matching.
- Improved maintainability and scalability by eliminating extensive manual requires.
- Integrate WebAuthn library for passkey authentication workflows, including assertion verification and improved error handling.
- Add support for reCAPTCHA token validation across multiple endpoints for enhanced security.
- Extend OpenAPI schema to document new fields and restructured payloads.
- Add unit tests for WebAuthn flows, permission initialization, and route validation to ensure robustness and accuracy.
- Add fallback logic to resolve subuser sessions via the tokens table when cache is missing or expired, with re-caching for future use.
- Refactor 2FA flow to prioritize subuser over user objects for better clarity and ensure compatibility with TOTP logic.
- Add safeguards to avoid operations on nonexistent users or subusers in 2FA and authentication flows.
- Add `SelfserveLaneServicesEnumTest` to validate `selfserve_lane_services` cases.
- Update `index.php` to load self-serve module interfaces, traits, classes, helpers, and configs.
- Center Truck Wash logo in email header and adjust styling.
- Localize password reset error message in `authRoute.php` with Danish text.
- Use `__DIR__` for `vendor/autoload.php` in PHP autoload path.
- Add Composer dependency auto-installation at container startup with `docker-entrypoint.sh`.
- Extend Docker image to include `libssl-dev` and `ca-certificates` for TLS support.
- Enable dynamic installation of application dependencies during runtime via entrypoint.
- Update Composer dependencies, including AWS SDK, Guzzle, and OpenTelemetry libraries.
- Replace route method for updating grants (`PATCH` to `PUT`) and streamline grant updates by directly modifying object properties instead of using manual data arrays.
- Introduce parameter validation for consistency and permission checks for cross-customer grant management.
- Require autoloading for all subuser module components (interfaces, traits, helpers, classes, and permissions) to improve modularity and maintainability.
- Replace manual grant data processing with `listObjectsWithPaginationIfSet` for cleaner pagination and mapping logic.
- Include `subusers_permission_node_key` helper in dependencies.
- Update `dynamicimages_asset` constructor to prepend working directory to paths.
- Add helper methods (`getPath`, `getWidth`, `getHeight`) to `dynamicimages_asset`.
- Extend `dynamicimages_image_t` trait with debugging and path configuration utilities.
- Refactor asset path handling in `machine_1` with constants for image files.
- Load `dynamicimages` interfaces, traits, classes, helpers, and configurations in `index.php`.
- Implement `/goals/department/progress-alert/test` POST endpoint to send test progress alerts.
- Support email, SMS, and Slack as alert destinations with customizable parameters.
- Validate user permissions, goal existence, and alert configuration before dispatch.
- Extend alert rendering logic with destination-specific delivery methods.
- Include `goals_criteria_progress_alert_destination`, `goals_criteria_progress_alert_progress_type`, `goals_criteria_progress_alert_style`, and `goals_criteria_progress_alert_weekday` helpers in `index.php`.
- Implement `exportToJson` and `importFromJson` methods in `goals` for serialization and deserialization.
- Add `fromJson` method in `goals_criteria` to parse criteria from JSON input.
- Extend `exampleRoute` for debugging with sample JSON-based goal creation.
- Update `index.php` to autoload new `goals` module classes and dependencies.
- Added `selfserve_lane` class to handle self-serve lane operations.
- Implemented commands (START, STOP, RESET) and states (IDLE, IN_WASH, FAULT, etc.) for lane lifecycle.
- Introduced traits for managing lane status, mode, state, caching, and port control.
- Added enums for cohesive type definitions (`selfserve_lane_command`, `selfserve_lane_status`, `selfserve_lane_state`, etc.).
- Configured `/modules/self-serve/lane/status` route to expose lane state and status via API.
- Linked self-serve configuration via `selfserve_c` and `selfserve_enabled_c` for module toggling.
- Integrated lane caching logic with Redis for performance improvements.
- Updated `index.php` to include the self-serve module.
- Added `shelly` class to manage API operations, handle requests, and validate configurations.
- Introduced `shelly_i` interface and supporting helpers: `shelly_device_state`, `shelly_request_body_get_states`, and `shelly_response_body_get_states`.
- Created new routes for fetching and updating Shelly configurations (`/shelly/config`).
- Added Shelly module configurations: `enabled`, `secret_key`, and `server_url`.
- Implemented `shelly_c` for module setup and configuration handling.
- Integrated Shelly initialization in `index.php`.
- Added `virkdata` class to handle API operations for company information retrieval and config validation.
- Introduced `virkdata_i` interface and supporting helpers: `virkdata_request_parameters`, `virkdata_response`, and enums for formats, countries, and error codes.
- Implemented new routes: `/worker/debug`, `/worker/licenseplates`, `/cvr/lookup`, and `/economic/doesCustomerExist`.
- Added module `Virkdata` route for searching company data and fetching/updating configurations (`moduleVirkDataRoute`).
- Created `virkdata` module configurations: `enabled`, `secret_key`, and `monthly_limit`.
- Integrated virkdata initialization in `index.php`.
- Updated `file_server.php` to mark files with `temp_file_` in their name as attachments.
- Enhanced routing logic in `index.php` to load `file_server.php` for `/files/` requests.
- Added `attachments` module for creating, reading, updating, and deleting attachments.
- Introduced new classes such as `attachments`, `attachment_store`, `attachment_content`, and `attachment_relation` to handle attachment operations and their relationships.
- Integrated `attachments` features into `db_object_t` for seamless object-attachment interactions.
- Added `attachments_i` interface for standardized attachments module operations.
- Created `attachmentsRoute` for defining endpoints related to attachments.
- Enabled module configuration through `attachments_enabled_c` for attachment management control.
- Implemented `licensePlateRecognizer` module with configuration classes (`enabled`, `api_key`) and API handling.
- Introduced `moduleConfigRoute` endpoints for fetching and updating `licensePlateRecognizer` configurations.
- Added `vehicleProductSuggestionRoute` with logic to fetch product suggestions based on vehicle plates.
- Extended `moduleScannerRoute` with license plate recognition test and exception handling.
- Updated `index.php` to include `licensePlateRecognizer` class.
- Introduced `uploadRoute` to handle image uploads with MIME type validation and size restrictions.
- Added `upload_store` class for managing file storage and generating presigned URLs for upload/download.
- Enhanced file server to differentiate between PDFs and uploaded files, supporting dynamic content delivery.
- Integrated OpenAI module for License Plate Recognition (LPR), including API configuration and schema validation.
- Updated core structure with new interfaces (`minio_uploads_i`, `openai_i`) and classes (`openai`, `upload_store`).
- Adjusted `index.php` and file routes to support dynamic MIME checks and direct link generation.
- Introduced `ocrSpace` module with classes: `ocr_space`, `ocrSpace_c`, and configuration objects for `enabled` and `api_key`.
- Added routes for fetching and updating OCR Space configuration.
- Created `image_processor` class and interface for handling and processing base64-encoded images.
- Integrated new traits and classes for image validation and processing.
- Updated `index.php` to include `ocr_space` and `image_processor`.
This commit introduces the Entra module, enabling configuration management and handling callbacks for Microsoft's authorization. It includes new classes, routes, and configuration variables to support integration, ensuring flexibility and logging support for related operations.
Introduce the xlvask module, including classes for configuration variables (enabled, username, password) and main functionality. Integrated xlvask into the app by adding GET/POST API routes for managing its configuration.
Introduced a new GatewayAPI module to handle SMS messaging integration. This includes interfaces, core classes for API interaction, configuration management, and routing for config retrieval and update. Added necessary initializations in `index.php` to integrate the module seamlessly.
Integrated a new fxratesapi module to handle currency conversions, including API configurations, rate conversion actions, and request logging. Added support for module settings such as enablement status, API key, and daily request limits. New routes, database interactions, and object handling were implemented to facilitate the module's operations.
This commit introduces a new PDF generation module leveraging the HTML2PDF library. The module generates PDFs from HTML templates, supports customization through styles and templates, and integrates with Minio for storage and retrieval. A test route is added for generating and serving PDFs dynamically.
Implemented a robust form management system with validation, sanitization, and database integration. Added reusable traits, classes, and methods to define, submit, and process forms. Introduced a "Book a Wash" form as an example implementation.
