14 Commits

Author	SHA1	Message	Date
jmiller	252ccdfa10	fix: heartbeat button shows proper errors instead of failing silently ... - CSRF check returns JSON instead of die() with raw text - JS parses non-JSON responses gracefully and shows server error - Visual feedback (check/cross icon) on success/failure - 3-second icon revert after result Claude-Session: https://claude.ai/code/session_01Jo2JpjCwfHAh2HHRSjczKq	2026-06-28 14:23:23 -05:00
jmiller	9417bb60cb	feat: add Conditions, Snippets, Replacements, Templates, Modules views ... Five new admin views with models, templates, and list UI: - Conditions: condition sets with group/rule counts and inline publish - Snippets: reusable text blocks with {snippet alias} syntax - Replacements: search/replace rules with regex and area badges - Templates: content templates with category and description - Modules: advanced module manager with position and client badges Also adds togglePublished endpoint to DisplayController. Claude-Session: https://claude.ai/code/session_01Jo2JpjCwfHAh2HHRSjczKq	2026-06-28 13:55:58 -05:00
jmiller	e563d08543	feat: SupportPinHelper, 4-button status bar, help buttons, PIN in heartbeat ... - Add shared SupportPinHelper for consistent PIN generation across dashboard, cpanel module, cache module, and AJAX controller - Cache module status bar now has 4 buttons: Site (frontend link), Support PIN, Clear Cache, Clear Temp - Add ToolbarHelper::help() to all 10 admin views pointing to Gitea wiki pages - Include support PIN in heartbeat payload to MokoSuiteHQ - Fix license plugin missing src/ and language/ directories - Refactor dashboard and cpanel module to use SupportPinHelper	2026-06-25 08:31:21 -05:00
Jonathan Miller	333966416b	feat: support PIN on-demand with 72-hour TTL + controller cleanup ... - PIN hidden by default — "Request PIN" button generates on click - PIN valid for 72 hours (stored as support_pin_requested_at in params) - HMAC uses 72h window instead of daily date for stability - requestPin() AJAX endpoint in controller stores timestamp + returns PIN - Applied to both dashboard info bar and cpanel module - Dashboard JS handles PIN request with badge replacement - Cpanel JS handles same with inline script - Fixed orphaned ticket code fragments in controller (syntax error) - Removed duplicate maintenance section	2026-06-23 17:09:36 -05:00
Jonathan Miller	0a374ac8d5	feat: fuzzy detection of all MokoSuite/MokoJoom ecosystem packages ... - DashboardModel.getMokoExtensions() now fuzzy-matches mokosuite*, mokosuiteclient*, mokosuitehq*, mokosuitecrm*, mokojoom* across packages, components, modules, plugins, and libraries - Each extension tagged with product family for grouping - Heartbeat payload includes moko_packages map (element → version) so HQ can see all installed MokoSuite products per site - Menu module already catches com_moko% (no change needed)	2026-06-23 14:26:52 -05:00
Jonathan Miller	8cc8cadda2	chore: remove all ticket/helpdesk code — migrated to MokoSuiteCRM ... - Controller: removed 20+ ticket methods (createTicket, addReply, updateStatus, saveCategory, saveCanned, uploadAttachment, etc.) - Controller: updated VIEW_ACL map — removed tickets/canned/categories, added snippets/templates/replacements/conditions - Controller: WAF log ACL changed from core.admin to security.waflog - Deleted: TicketsModel, AttachmentService, AutomationEngine, NotificationService, TicketsController (API) - Deleted: all Ticket/Tickets/Ticketsettings/Canned views and templates (admin and site) - Removed importAts method	2026-06-23 14:22:34 -05:00
Jonathan Miller	6f7549fa7a	fix: address PR review findings — security, performance, cleanup ... - togglePlugin: restrict scope to mokosuiteclient plugins only (was any plugin) - DevTools: replace full-table hits reset on every request with config toggle - CurrentIpField: prefer REMOTE_ADDR over spoofable X-Forwarded-For - SQL: explicit (int) cast on $days interpolation in chart queries - Heartbeat: enable SSL peer verification (was disabled) - script.php: remove orphaned docblock	2026-06-23 10:50:37 -05:00
Jonathan Miller	0e03837ec9	fix(heartbeat): align signature headers with HQ expectations ... Rename X-MokoSuiteClient-Signature/Timestamp to X-MokoSuite-Signature/ Timestamp to match what HeartbeatController reads as HTTP_X_MOKOSUITE_*.	2026-06-20 17:53:54 -05:00
Jonathan Miller	7510c9f018	fix(heartbeat): correct API route from mokosuiteclienthq to mokosuitehq ... The HQ component is com_mokosuitehq, not com_mokosuiteclienthq. The heartbeat endpoint was returning 404 because the route prefix was wrong.	2026-06-20 15:52:01 -05:00
Jonathan Miller	72134bba28	fix(install): enable ticket/offline plugins, consolidate monitor into core ... - enablePlugin() handles empty element columns with fallback match by name - Retire monitor plugin: migrate config (base_url, signing_key) to core - Runtime heartbeat moved from monitor plugin to core plugin - DisplayController heartbeat reads from core plugin params - ensureAdminModule() direct DB update for existing modules (fixes checked_out blocking, cpanel access level 6→3, menu ordering -1) - Add missing ticket automation language strings (IMAP, autoclose) - Remove monitor from cpanel plugin grid	2026-06-20 10:33:01 -05:00
Jonathan Miller	134b9b3693	fix(security+reliability): address PR review — ACL guards, error logging, path traversal ... Security: - Add return after all jsonForbidden() calls (13 methods) to prevent ACL bypass if $app->close() fails to terminate - Add throw after requireAuth() in REST API controller (same pattern) - Add path traversal guard to AttachmentService::getAbsolutePath() using realpath + prefix check Error handling: - Log install notification email failures instead of empty catch - Log DB errors in getUserEmail(), getNotificationConfig(), getComponentConfig() instead of silent fallbacks - Log PHP upload error codes in AttachmentService - Check Folder::create() return value before upload loop - Fix searchKb() missing return on short query + log DB errors - Fix ntfy push to capture curl_error() on connection failure - Upgrade AutomationEngine inner catch to LOG_ERROR with rule ID	2026-06-18 19:05:57 -05:00
Jonathan Miller	8fd50ea580	fix(security+data): address PR review — XSS, header injection, ACL, status sync ... 1. Remove SVG from allowed upload extensions (stored XSS vector) 2. Sanitize Content-Disposition filename (header injection prevention) 3. Add ACL check to rateTicket() (missing authorization) 4. Use server-side MIME detection instead of client-supplied type 5. Sync status_id/priority_id in AutomationEngine and API controller to keep ENUM and lookup-table columns consistent 6. Align auto-bump.yml to use mokoplatform (no hyphen) matching pre-release.yml convention	2026-06-18 09:49:27 -05:00
Jonathan Miller	27f50468a8	Merge main into dev — apply MokoSuite→MokoSuiteClient rename to dev features ... Merges the full element rename from main into dev, resolving conflicts across 53 files. Migrates new dev-only extensions (com_mokosuite ticketsettings, plg_system_mokosuite_dbip) to MokoSuiteClient naming.	2026-06-16 13:09:14 -05:00
Jonathan Miller	4b9a675d0f	Rename MokoSuite → MokoSuiteClient (full element rename) ... All Joomla element names, PHP classes, language files, folder structure, and manifest references renamed from mokosuite to mokosuiteclient. This repo is now the client-facing tracker for the MokoSuite platform.	2026-06-15 05:19:13 -05:00