Client signs domain|timestamp|token with private key (distributed via
monitor plugin manifest). Base verifies with public key in component
config. Replaces shared secret and key ring approaches — no rotation
needed. Includes 5-minute timestamp window for replay protection.
Adds a heart icon button in the token field input group that triggers
an AJAX heartbeat to MokoWaaSBase. Shows spinner while sending,
green check on success, red X on failure. Uses the monitor plugin's
configured base_url and the core plugin's health_api_token.
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
MokoWaaS now only saves/restores its own download key (pkg_mokowaas),
matching the pattern used by all other Moko extensions. Removed the
universal backupDownloadKeys/restoreDownloadKeys and the runtime
preserveDownloadKeys no-op from the core plugin.
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The #__mokowaas_download_keys table approach was over-engineered.
Download key preservation is handled by the install script's
preflight/postflight with element-name matching.
Removed:
- #__mokowaas_download_keys table from install SQL
- syncKeysToTable/applyKeysFromTable from core plugin
- saveDownloadKey/applyDownloadKey/reapplyAllDownloadKeys from model
- ensureDownloadKeysTable/syncKeysToDatabase/reapplyKeysFromDatabase
from install script
Added:
- Migration SQL (02.35.00) to DROP the table from existing installs
- Uninstall SQL for all component tables
- Install/uninstall SQL blocks in component manifest
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Root cause: the #__mokowaas_download_keys table was only in
install.mysql.sql (fresh installs). Existing sites never got it,
so syncKeysToTable/applyKeysFromTable silently failed.
- Add sql/updates/mysql/02.35.00.sql migration for existing installs
- Register <update><schemas> in component manifest
- Add ensureDownloadKeysTable() as belt-and-suspenders in postflight
- backupDownloadKeys() now saves by element name (stable identifier)
- restoreDownloadKeys() matches by element first, URL second, ID third
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace JSON file backup with #__mokowaas_download_keys table as
the persistent single source of truth for download keys.
- Core plugin: syncKeysToTable() copies keys from Joomla to our table,
applyKeysFromTable() re-applies from our table to Joomla. Runs on
every admin page load — Joomla can wipe keys all it wants.
- Install script: preflight saves to table, postflight re-applies.
- ExtensionsModel: saveDownloadKey(), applyDownloadKey(),
reapplyAllDownloadKeys() static method for install/update hooks.
- Extension manager: prompt for download key on install, skip
extensions with no release, show missing key warning badge.
- Catalog: expanded to 11 Joomla extensions.
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When Joomla deletes and recreates update site rows, they get new IDs.
The backup was keyed only by ID, so restored keys couldn't match the
new rows. Now stores keys by both ID and URL (url:https://...) and
looks up by URL as fallback when the ID doesn't match.
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- catalog.xml: added MokoWaaSBase, MokoJoomBackup, MokoJoomCommunity,
MokoJoomCross, MokoJoomStoreLocator (11 total extensions)
- ExtensionsModel: fetchFromUpdateServer() now returns has_stable,
has_dev, needs_dlid flags from updates.xml parsing
- ExtensionsModel: hasDownloadKey() checks if dlid is configured
in update_sites for each extension
- Template: red alert badge when download key is missing on installed
extensions that require one for updates
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
All net-new site-side files (19 files). No existing views modified.
Portal Dashboard:
- KPI cards: open orders, unpaid invoices, open tickets, pending signatures
- Recent orders table, quick links to all portal sections
- User matched to ERP contact by email address
My Orders (list + detail):
- Customer's order list with status/payment badges
- Order detail with line items, subtotal/tax/total
My Invoices (list + detail):
- Invoice list with overdue highlighting, balance due
- Invoice detail with line items and payment totals
E-Signature Public Signing Page:
- Token-based access (no Joomla login required)
- Consent checkbox (must accept before signing)
- HTML5 Canvas signature pad with touch/stylus/mouse support
- High-DPI canvas rendering
- Geolocation capture on submit
- Decline with reason
- signature-pad.js: full signing flow with consent → sign → success
E-Signature Verification Page:
- Hash-based public verification (no auth)
- Document status, signer table, complete audit trail
License Portal:
- Current license package, status, active services
- DLID entry/update form for self-service license management
Assets:
- portal.css: shared portal styles
- signature-pad.js: Canvas drawing with touch events, DPI scaling
1 model: PortalModel (resolves user→contact, loads orders/invoices/dashboard)
ProvisionController: POST /api/v1/mokowaas/provision-reset
- Resets article hits to zero
- Deletes content version history
- Regenerates heartbeat token (optional, for breach response)
- Revokes all user API tokens with email notification (optional)
- Sets setup-required flag for new client info collection
Core plugin: checkSetupRequired() shows persistent admin banner
until plugin settings are saved. Clears flag on save.
Route registered in webservices plugin.
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Monitor plugin now includes live health data (16 checks) and client
info (company name, email from Joomla config) in the heartbeat payload.
Health data is fetched via local HTTP call to /?mokowaas=health to
reuse existing auth and check logic without internal coupling.
MokoWaaSBase can use client_info for auto-contact creation and the
health payload for dashboard visualization without separate polling.
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- RemoteLoginController: POST /api/v1/mokowaas/remote-login validates
health token, generates a one-time login token (60s TTL), returns
a URL that auto-authenticates the master user
- Core plugin: handleOneTimeLogin() in onAfterInitialise checks for
mokowaas_otl query param, validates and consumes the token, logs in
the master user, logs the event, redirects to admin dashboard
- Webservices plugin: register remote-login route
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Derives MOKO-XXXX-XXXX from health token for phone-based identity
verification during support calls. Displayed below the token field
in the core plugin config.
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace ad-hoc Grafana receiver with MokoWaaSBase API integration.
The heartbeat now posts to /api/index.php/v1/mokowaasbase/heartbeat
with token, domain, site_name, versions. Configurable base URL
(defaults to mokoconsulting.tech). Removed hardcoded HEARTBEAT_URL
and HEARTBEAT_KEY constants.
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
DemoResetService, ContentSyncService, and ContentSyncReceiver were
deleted from the core plugin but still referenced by the demo task
plugin and API controllers. Moved service classes into their owning
packages with updated namespaces:
- DemoResetService → plg_task_mokowaasdemo/src/Service/
- ContentSyncService → plg_task_mokowaassync/src/Service/
- ContentSyncReceiver → plg_task_mokowaassync/src/Service/
Updated all require_once paths and FQCN references in API controllers
and DemoReset task plugin.
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Override values are now hardcoded in the .ini files. Removed
getPlaceholders(), getPluginParams(), and resolvePlaceholders() methods
that were doing no-op string replacements.
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Both plugins used Joomla 6-only event->getArgument() pattern without
fallback for Joomla 5 individual args. Added dual-compat pattern
matching DemoReset plugin: check for event object, fallback to
func_get_arg for Joomla 5.
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The config field existed but had no backing implementation. Super admin
users are now redirected to the admin panel when accessing the frontend
if the toggle is enabled.
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add getMokoExtensions() to DashboardModel to fetch installed MokoWaaS
component and modules with versions. Renders version badges below the
info bar for com_mokowaas, mod_mokowaas_cpanel, mod_mokowaas_menu,
mod_mokowaas_cache, and mod_mokowaas_categories.
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Rename top-level src/ directory to source/ and update all references
in .gitignore, CLAUDE.md, manifest.xml, docs, and PATH comments.
Internal namespace path="src" attributes within extension packages
are unchanged (they refer to the package-internal src/ folder).
Closes#188
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Jonathan Miller