153 Commits

Author	SHA1	Message	Date
gitea-actions[bot]	e310d7f390	chore(version): pre-release bump to 02.34.33-dev [skip ci]	2026-06-07 01:23:29 +00:00
Jonathan Miller	83009472b7	Merge branch 'dev' of https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS into dev	2026-06-06 20:22:25 -05:00
Jonathan Miller	c09cfdfcbf	fix: update install script heartbeat to use MokoWaaSBase with RSA ... Replaced old Grafana receiver endpoint with MokoWaaSBase heartbeat API. Includes RSA signature from monitor plugin's signing_key param.	2026-06-06 20:22:13 -05:00
gitea-actions[bot]	992b5a2c0d	chore(version): pre-release bump to 02.34.32-dev [skip ci]	2026-06-07 01:21:12 +00:00
Jonathan Miller	1f2913422e	Merge branch 'dev' of https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS into dev	2026-06-06 20:20:51 -05:00
Jonathan Miller	aa6d87462b	fix: add RSA signature to Send Heartbeat button request ... The manual heartbeat button was not sending the X-MokoWaaS-Signature header, causing Base to reject with 403 when RSA verification is enabled.	2026-06-06 20:20:40 -05:00
gitea-actions[bot]	a03eabc636	chore(version): pre-release bump to 02.34.31-dev [skip ci]	2026-06-07 01:00:27 +00:00
Jonathan Miller	6f690816d7	chore: remove PerfectPublisher webservices plugin ... No longer needed — removed plugin directory, package manifest entry, and protected extensions list reference.	2026-06-06 19:59:06 -05:00
Jonathan Miller	e1f01be1a9	Merge branch 'dev' of https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS into dev	2026-06-06 19:57:19 -05:00
Jonathan Miller	2a0e450c53	feat: RSA-signed heartbeat authentication ... Client signs domain|timestamp|token with private key (distributed via monitor plugin manifest). Base verifies with public key in component config. Replaces shared secret and key ring approaches — no rotation needed. Includes 5-minute timestamp window for replay protection.	2026-06-06 19:56:26 -05:00
gitea-actions[bot]	1eae4c88a6	chore(version): pre-release bump to 02.34.30-dev [skip ci]	2026-06-06 23:04:49 +00:00
Jonathan Miller	de78e66da1	feat: Send Heartbeat button next to token field ... Adds a heart icon button in the token field input group that triggers an AJAX heartbeat to MokoWaaSBase. Shows spinner while sending, green check on success, red X on failure. Uses the monitor plugin's configured base_url and the core plugin's health_api_token. Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 17:40:09 -05:00
gitea-actions[bot]	2ff323b920	chore(version): pre-release bump to 02.34.29-dev [skip ci]	2026-06-06 22:37:06 +00:00
Jonathan Miller	0ffafeb247	refactor: remove universal download key handler, use single-key pattern ... MokoWaaS now only saves/restores its own download key (pkg_mokowaas), matching the pattern used by all other Moko extensions. Removed the universal backupDownloadKeys/restoreDownloadKeys and the runtime preserveDownloadKeys no-op from the core plugin. Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 17:36:17 -05:00
gitea-actions[bot]	1a3a125b82	chore(version): pre-release bump to 02.34.28-dev [skip ci]	2026-06-06 21:26:39 +00:00
Jonathan Miller	77c160a64e	fix: rename migration to 02.34.28 so it runs on current dev version	2026-06-06 16:25:24 -05:00
Jonathan Miller	473d512e1c	refactor: remove database-backed download key table ... The #__mokowaas_download_keys table approach was over-engineered. Download key preservation is handled by the install script's preflight/postflight with element-name matching. Removed: - #__mokowaas_download_keys table from install SQL - syncKeysToTable/applyKeysFromTable from core plugin - saveDownloadKey/applyDownloadKey/reapplyAllDownloadKeys from model - ensureDownloadKeysTable/syncKeysToDatabase/reapplyKeysFromDatabase from install script Added: - Migration SQL (02.35.00) to DROP the table from existing installs - Uninstall SQL for all component tables - Install/uninstall SQL blocks in component manifest Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 16:24:20 -05:00
Jonathan Miller	670eda8d91	fix: download key lost on update — stale URL in cleanupStaleUpdateSites ... The cleanup method used the old /raw/branch/main/updates.xml URL as its keep target, but migrateUpdateServerUrls had already rewritten all URLs to /updates.xml. This caused the method to find no match and delete all MokoWaaS update sites — including the one with the download key. Fixed by updating the hardcoded URL to match the current manifest format: /MokoConsulting/MokoWaaS/updates.xml Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 16:10:48 -05:00
gitea-actions[bot]	d9b77d5017	chore(version): pre-release bump to 02.34.27-dev [skip ci]	2026-06-06 20:55:02 +00:00
Jonathan Miller	104251f800	fix: create download_keys table on update + element-based key matching ... Root cause: the #__mokowaas_download_keys table was only in install.mysql.sql (fresh installs). Existing sites never got it, so syncKeysToTable/applyKeysFromTable silently failed. - Add sql/updates/mysql/02.35.00.sql migration for existing installs - Register <update><schemas> in component manifest - Add ensureDownloadKeysTable() as belt-and-suspenders in postflight - backupDownloadKeys() now saves by element name (stable identifier) - restoreDownloadKeys() matches by element first, URL second, ID third Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 15:53:42 -05:00
Jonathan Miller	99398fde6b	Merge branch 'dev' of https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS into dev	2026-06-06 15:48:16 -05:00
Jonathan Miller	01c0bb8a32	fix: restore download keys by element name, not just URL/ID ... The URL migration in postflight changes update site URLs BEFORE restoreDownloadKeys runs, so URL-based matching fails. Element names are stable across updates. Now backs up keys as elem_ELEMENT and restores by matching the extension element name first, falling back to URL and ID. Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 15:47:38 -05:00
gitea-actions[bot]	4d6a53f6e7	chore(version): pre-release bump to 02.34.26-dev [skip ci]	2026-06-06 20:44:21 +00:00
Jonathan Miller	2656db9579	Merge branch 'dev' of https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS into dev	2026-06-06 15:40:43 -05:00
Jonathan Miller	2ede22282d	fix: extension manager cards fill full width when 1-2 items	2026-06-06 15:40:16 -05:00
gitea-actions[bot]	48905790f0	chore(version): pre-release bump to 02.34.25-dev [skip ci]	2026-06-06 20:32:32 +00:00
Jonathan Miller	3cf0773fd6	Merge branch 'dev' of https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS into dev	2026-06-06 15:31:23 -05:00
Jonathan Miller	fc068866d9	feat: database-backed download key preservation for all extensions ... Replace JSON file backup with #__mokowaas_download_keys table as the persistent single source of truth for download keys. - Core plugin: syncKeysToTable() copies keys from Joomla to our table, applyKeysFromTable() re-applies from our table to Joomla. Runs on every admin page load — Joomla can wipe keys all it wants. - Install script: preflight saves to table, postflight re-applies. - ExtensionsModel: saveDownloadKey(), applyDownloadKey(), reapplyAllDownloadKeys() static method for install/update hooks. - Extension manager: prompt for download key on install, skip extensions with no release, show missing key warning badge. - Catalog: expanded to 11 Joomla extensions. Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 15:31:04 -05:00
gitea-actions[bot]	dacf707165	chore(version): pre-release bump to 02.34.24-dev [skip ci]	2026-06-06 20:20:10 +00:00
Jonathan Miller	76f9da07a9	Merge branch 'dev' of https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS into dev	2026-06-06 15:18:51 -05:00
Jonathan Miller	38dd78fdab	fix: preserveDownloadKeys matches by URL when IDs change ... When Joomla deletes and recreates update site rows, they get new IDs. The backup was keyed only by ID, so restored keys couldn't match the new rows. Now stores keys by both ID and URL (url:https://...) and looks up by URL as fallback when the ID doesn't match. Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 15:18:36 -05:00
gitea-actions[bot]	3b5b0c1a73	chore(version): pre-release bump to 02.34.23-dev [skip ci]	2026-06-06 20:15:22 +00:00
Jonathan Miller	5ab496b399	fix: backup download keys in preflight, not postflight ... Joomla's package installer deletes and recreates update site rows from the manifest BETWEEN preflight and postflight. By the time postflight ran backupDownloadKeys(), the extra_query values were already empty. Moved the backup to preflight() via a class property. The restore in postflight() now uses keys saved before Joomla touched them. Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 15:14:18 -05:00
gitea-actions[bot]	64a11706fd	chore(version): pre-release bump to 02.34.22-dev [skip ci]	2026-06-06 20:09:45 +00:00
Jonathan Miller	969f7fb615	feat: expanded catalog with all Joomla repos + download key warning ... - catalog.xml: added MokoWaaSBase, MokoJoomBackup, MokoJoomCommunity, MokoJoomCross, MokoJoomStoreLocator (11 total extensions) - ExtensionsModel: fetchFromUpdateServer() now returns has_stable, has_dev, needs_dlid flags from updates.xml parsing - ExtensionsModel: hasDownloadKey() checks if dlid is configured in update_sites for each extension - Template: red alert badge when download key is missing on installed extensions that require one for updates Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 15:08:46 -05:00
Jonathan Miller	3c28483faf	feat: Sprint 4 — Customer portal with orders, invoices, e-sign, license (#192) ... All net-new site-side files (19 files). No existing views modified. Portal Dashboard: - KPI cards: open orders, unpaid invoices, open tickets, pending signatures - Recent orders table, quick links to all portal sections - User matched to ERP contact by email address My Orders (list + detail): - Customer's order list with status/payment badges - Order detail with line items, subtotal/tax/total My Invoices (list + detail): - Invoice list with overdue highlighting, balance due - Invoice detail with line items and payment totals E-Signature Public Signing Page: - Token-based access (no Joomla login required) - Consent checkbox (must accept before signing) - HTML5 Canvas signature pad with touch/stylus/mouse support - High-DPI canvas rendering - Geolocation capture on submit - Decline with reason - signature-pad.js: full signing flow with consent → sign → success E-Signature Verification Page: - Hash-based public verification (no auth) - Document status, signer table, complete audit trail License Portal: - Current license package, status, active services - DLID entry/update form for self-service license management Assets: - portal.css: shared portal styles - signature-pad.js: Canvas drawing with touch events, DPI scaling 1 model: PortalModel (resolves user→contact, loads orders/invoices/dashboard)	2026-06-06 15:04:25 -05:00
Jonathan Miller	8a2df44865	fix: preserve download keys during install script update site cleanup ... backupDownloadKeys() saves all extra_query values before migration and cleanup operations. restoreDownloadKeys() re-applies them after, matching by URL first then by old ID. Also updates the file-based backup used by the runtime preserveDownloadKeys() guard. Root cause: cleanupStaleUpdateSites() deletes update site rows which destroys their extra_query (dlid) values. The rows get recreated by Joomla but without the download keys. Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 15:00:52 -05:00
gitea-actions[bot]	23ccbcbeae	chore(version): pre-release bump to 02.34.21-dev [skip ci]	2026-06-06 19:52:48 +00:00
gitea-actions[bot]	caa1a2a96e	chore(version): pre-release bump to 02.34.20-dev [skip ci]	2026-06-06 19:07:11 +00:00
gitea-actions[bot]	fa893e8713	chore(version): pre-release bump to 02.34.19-dev [skip ci]	2026-06-06 18:42:12 +00:00
gitea-actions[bot]	f586175be2	chore(version): pre-release bump to 02.34.18-dev [skip ci]	2026-06-06 18:00:43 +00:00
Jonathan Miller	a51f04c841	feat: provision reset API for new client setup from Base ... ProvisionController: POST /api/v1/mokowaas/provision-reset - Resets article hits to zero - Deletes content version history - Regenerates heartbeat token (optional, for breach response) - Revokes all user API tokens with email notification (optional) - Sets setup-required flag for new client info collection Core plugin: checkSetupRequired() shows persistent admin banner until plugin settings are saved. Clears flag on save. Route registered in webservices plugin. Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 11:10:02 -05:00
Jonathan Miller	db2ed26e65	feat: heartbeat sends full health payload and client info ... Monitor plugin now includes live health data (16 checks) and client info (company name, email from Joomla config) in the heartbeat payload. Health data is fetched via local HTTP call to /?mokowaas=health to reuse existing auth and check logic without internal coupling. MokoWaaSBase can use client_info for auto-contact creation and the health payload for dashboard visualization without separate polling. Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 11:01:33 -05:00
Jonathan Miller	509470b20b	feat: remote login endpoint for MokoWaaSBase auto-login ... - RemoteLoginController: POST /api/v1/mokowaas/remote-login validates health token, generates a one-time login token (60s TTL), returns a URL that auto-authenticates the master user - Core plugin: handleOneTimeLogin() in onAfterInitialise checks for mokowaas_otl query param, validates and consumes the token, logs in the master user, logs the event, redirects to admin dashboard - Webservices plugin: register remote-login route Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 10:31:32 -05:00
Jonathan Miller	76254db28c	feat: show support verification PIN below heartbeat token ... Derives MOKO-XXXX-XXXX from health token for phone-based identity verification during support calls. Displayed below the token field in the core plugin config. Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 09:55:46 -05:00
Jonathan Miller	f176f424b5	feat: monitor plugin sends heartbeat to MokoWaaSBase REST API ... Replace ad-hoc Grafana receiver with MokoWaaSBase API integration. The heartbeat now posts to /api/index.php/v1/mokowaasbase/heartbeat with token, domain, site_name, versions. Configurable base URL (defaults to mokoconsulting.tech). Removed hardcoded HEARTBEAT_URL and HEARTBEAT_KEY constants. Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 09:33:16 -05:00
Jonathan Miller	d94909eb91	fix: relocate service classes to their owning plugins ... DemoResetService, ContentSyncService, and ContentSyncReceiver were deleted from the core plugin but still referenced by the demo task plugin and API controllers. Moved service classes into their owning packages with updated namespaces: - DemoResetService → plg_task_mokowaasdemo/src/Service/ - ContentSyncService → plg_task_mokowaassync/src/Service/ - ContentSyncReceiver → plg_task_mokowaassync/src/Service/ Updated all require_once paths and FQCN references in API controllers and DemoReset task plugin. Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 09:10:28 -05:00
Jonathan Miller	19590cef8c	refactor: remove dead placeholder resolver from install script ... Override values are now hardcoded in the .ini files. Removed getPlaceholders(), getPluginParams(), and resolvePlaceholders() methods that were doing no-op string replacements. Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 09:03:40 -05:00
Jonathan Miller	d353b1ee36	fix: Joomla 5/6 event compatibility in DevTools and Monitor plugins ... Both plugins used Joomla 6-only event->getArgument() pattern without fallback for Joomla 5 individual args. Added dual-compat pattern matching DemoReset plugin: check for event object, fallback to func_get_arg for Joomla 5. Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 08:28:23 -05:00
Jonathan Miller	d07eb89f66	feat: implement block_frontend_superuser in firewall plugin ... The config field existed but had no backing implementation. Super admin users are now redirected to the admin panel when accessing the frontend if the toggle is enabled. Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 08:25:54 -05:00