24 Commits

Author	SHA1	Message	Date
jmiller	4e6edeef85	refactor: unify PIN UI into SupportPinHelper renderBadge/renderScript ... Replaces 3 separate inline PIN implementations (dashboard, cpanel module, cache module) with shared helper methods. Adds click-to-copy on all PIN badges.	2026-06-25 11:34:32 -05:00
jmiller	81a95e6e23	feat: HQ config sync, menu language fix, catalog cleanup ... Client stores HQ-configured support_pin_hours from heartbeat response. PIN TTL now configurable from HQ instead of hardcoded 72h. Admin sidebar menu loads component-local language files fixing untranslated keys for MokoSuiteCross. Removed MokoSuiteHQ from extension catalog.	2026-06-25 10:25:20 -05:00
jmiller	e563d08543	feat: SupportPinHelper, 4-button status bar, help buttons, PIN in heartbeat ... - Add shared SupportPinHelper for consistent PIN generation across dashboard, cpanel module, cache module, and AJAX controller - Cache module status bar now has 4 buttons: Site (frontend link), Support PIN, Clear Cache, Clear Temp - Add ToolbarHelper::help() to all 10 admin views pointing to Gitea wiki pages - Include support PIN in heartbeat payload to MokoSuiteHQ - Fix license plugin missing src/ and language/ directories - Refactor dashboard and cpanel module to use SupportPinHelper	2026-06-25 08:31:21 -05:00
Jonathan Miller	ee63f49657	fix: restore backup bridge, DB-IP, license plugins to package ... - Added plg_system_mokosuiteclient_backup, _dbip, _license to pkg_mokosuiteclient.xml (were missing from package manifest) - Install script enables backup + license plugins on install - Dashboard PLUGIN_META includes all three with icons/descriptions	2026-06-23 17:57:40 -05:00
Jonathan Miller	35a3d40c6a	fix: address all 9 PR review findings ... 1. Sourcerer: expanded forbidden function blocklist (+12 functions), added backtick, variable function, and string concat detection 2. Removed orphaned ticket API routes from webservices plugin 3. Removed orphaned tickets submenu from component manifest 4. Added mokosuiteclient.htaccess ACL action to access.xml + language 5. Removed dead AutomationEngine/NotificationService calls from plugin 6. SSL verify enabled in ExtensionsModel (install + update fetch) 7. ConditionsHelper: escape # delimiter in URL regex patterns 8. ReReplacer: escape / delimiter in user-supplied regex patterns 9. CLAUDE.md: removed ticket references, added content tools	2026-06-23 17:31:09 -05:00
Jonathan Miller	333966416b	feat: support PIN on-demand with 72-hour TTL + controller cleanup ... - PIN hidden by default — "Request PIN" button generates on click - PIN valid for 72 hours (stored as support_pin_requested_at in params) - HMAC uses 72h window instead of daily date for stability - requestPin() AJAX endpoint in controller stores timestamp + returns PIN - Applied to both dashboard info bar and cpanel module - Dashboard JS handles PIN request with badge replacement - Cpanel JS handles same with inline script - Fixed orphaned ticket code fragments in controller (syntax error) - Removed duplicate maintenance section	2026-06-23 17:09:36 -05:00
Jonathan Miller	37721cd061	feat: full extension catalog + channel gating by domain ... - catalog.xml: all 21 MokoSuite repos listed with proper categories (Platform, Business, Industry, Content, SEO, Modules, Templates) - Update server URLs point to main branch (stable releases) - Dev channel only available on *.mokoconsulting.tech domains - Non-Moko domains forced to stable regardless of Joomla config - ExtensionsModel respects Joomla's com_installer update_channel param on Moko domains, skips dev-tagged versions on stable channel	2026-06-23 14:31:07 -05:00
Jonathan Miller	0a374ac8d5	feat: fuzzy detection of all MokoSuite/MokoJoom ecosystem packages ... - DashboardModel.getMokoExtensions() now fuzzy-matches mokosuite*, mokosuiteclient*, mokosuitehq*, mokosuitecrm*, mokojoom* across packages, components, modules, plugins, and libraries - Each extension tagged with product family for grouping - Heartbeat payload includes moko_packages map (element → version) so HQ can see all installed MokoSuite products per site - Menu module already catches com_moko% (no change needed)	2026-06-23 14:26:52 -05:00
Jonathan Miller	8cc8cadda2	chore: remove all ticket/helpdesk code — migrated to MokoSuiteCRM ... - Controller: removed 20+ ticket methods (createTicket, addReply, updateStatus, saveCategory, saveCanned, uploadAttachment, etc.) - Controller: updated VIEW_ACL map — removed tickets/canned/categories, added snippets/templates/replacements/conditions - Controller: WAF log ACL changed from core.admin to security.waflog - Deleted: TicketsModel, AttachmentService, AutomationEngine, NotificationService, TicketsController (API) - Deleted: all Ticket/Tickets/Ticketsettings/Canned views and templates (admin and site) - Removed importAts method	2026-06-23 14:22:34 -05:00
Jonathan Miller	1fe7c77fbf	feat(conditional-content): {show}/{hide} tag processing with conditions engine ... - processConditionalTags() handles {show}, {hide}, {else} blocks - Supports condition="alias_or_id" for saved condition sets - Supports inline rules: access_level, user_group, menu_item, home_page, date, day, url - Multiple inline rules per tag use AND logic - Nested tag support (processes innermost first, up to 10 iterations) - Runs in onContentPrepare (articles) and onAfterRender (final HTML) - ConditionsHelper: added passByAlias(), resolveAlias(), evaluateInlineRule() - Implements #164	2026-06-23 12:37:31 -05:00
Jonathan Miller	ae6719049d	feat(conditions): add conditions engine DB schema and evaluation API ... - Four tables: conditions, conditions_groups, conditions_rules, conditions_map - ConditionsHelper with pass(), load(), shouldDisplay(), getConditionsForItem() - 7 rule types: menu_item, home_page, user_group, access_level, date, day, url - Hierarchical evaluation: condition → groups (AND/OR) → rules (AND/OR) - Runtime cache for repeated evaluations within same request - Foundation for Advanced Module Manager (#160) and Conditional Content (#164)	2026-06-23 12:32:00 -05:00
Jonathan Miller	6f7549fa7a	fix: address PR review findings — security, performance, cleanup ... - togglePlugin: restrict scope to mokosuiteclient plugins only (was any plugin) - DevTools: replace full-table hits reset on every request with config toggle - CurrentIpField: prefer REMOTE_ADDR over spoofable X-Forwarded-For - SQL: explicit (int) cast on $days interpolation in chart queries - Heartbeat: enable SSL peer verification (was disabled) - script.php: remove orphaned docblock	2026-06-23 10:50:37 -05:00
Jonathan Miller	0aeaea208f	feat(dashboard): show frontend/backend app badges on recent logins, full-width ext bar ... - Recent logins table now parses action log message JSON to display Admin/Site badge indicating where each login occurred - Login query uses exact match on LOGGED_IN key (excludes logout events) - Login limit increased from 5 to 10 - Info bar reverted from stacked column to horizontal row layout - Extension version bar uses flex: 1 1 0 for full-width auto-sized cells - Updated CHANGELOG	2026-06-23 07:47:43 -05:00
Jonathan Miller	b2d1e4ba23	chore: remove helpdesk/ticket system (migrating to MokoSuiteCRM #67) ... - Removed ticket views, models, controllers (ticket, tickets, ticketsettings) - Removed plg_task_mokosuiteclient_tickets plugin and source - Removed from package manifest, enablePlugin, protectExtensions - Removed Helpdesk entry from sidebar menu - Ticket tables kept in SQL for migration compatibility - See MokoSuiteClient#233, MokoSuiteCRM#67	2026-06-21 15:50:29 -05:00
Jonathan Miller	64a8504794	feat(support-pin): daily-rotating PIN via HMAC(token, date) ... PIN is derived from HMAC-SHA256(health_api_token, YYYY-MM-DD) so both client and HQ compute the same value independently. Rotates at UTC midnight. Shown on cpanel module header and component dashboard.	2026-06-20 20:38:51 -05:00
Jonathan Miller	0e03837ec9	fix(heartbeat): align signature headers with HQ expectations ... Rename X-MokoSuiteClient-Signature/Timestamp to X-MokoSuite-Signature/ Timestamp to match what HeartbeatController reads as HTTP_X_MOKOSUITE_*.	2026-06-20 17:53:54 -05:00
Jonathan Miller	7510c9f018	fix(heartbeat): correct API route from mokosuiteclienthq to mokosuitehq ... The HQ component is com_mokosuitehq, not com_mokosuiteclienthq. The heartbeat endpoint was returning 404 because the route prefix was wrong.	2026-06-20 15:52:01 -05:00
Jonathan Miller	72134bba28	fix(install): enable ticket/offline plugins, consolidate monitor into core ... - enablePlugin() handles empty element columns with fallback match by name - Retire monitor plugin: migrate config (base_url, signing_key) to core - Runtime heartbeat moved from monitor plugin to core plugin - DisplayController heartbeat reads from core plugin params - ensureAdminModule() direct DB update for existing modules (fixes checked_out blocking, cpanel access level 6→3, menu ordering -1) - Add missing ticket automation language strings (IMAP, autoclose) - Remove monitor from cpanel plugin grid	2026-06-20 10:33:01 -05:00
Jonathan Miller	bf30c3db5b	fix(api): type-safe update, filtered pagination, status sync, int cast assign ... - API update() now uses getInt/getString instead of raw input - API update() syncs status/status_id and priority/priority_id - API update() returns 404 if ticket not found - Pagination total count now uses filtered query (was unfiltered) - AutomationEngine assign action casts value to int	2026-06-18 19:09:42 -05:00
Jonathan Miller	134b9b3693	fix(security+reliability): address PR review — ACL guards, error logging, path traversal ... Security: - Add return after all jsonForbidden() calls (13 methods) to prevent ACL bypass if $app->close() fails to terminate - Add throw after requireAuth() in REST API controller (same pattern) - Add path traversal guard to AttachmentService::getAbsolutePath() using realpath + prefix check Error handling: - Log install notification email failures instead of empty catch - Log DB errors in getUserEmail(), getNotificationConfig(), getComponentConfig() instead of silent fallbacks - Log PHP upload error codes in AttachmentService - Check Folder::create() return value before upload loop - Fix searchKb() missing return on short query + log DB errors - Fix ntfy push to capture curl_error() on connection failure - Upgrade AutomationEngine inner catch to LOG_ERROR with rule ID	2026-06-18 19:05:57 -05:00
Jonathan Miller	2e00512741	fix: rename all language keys MOKOSUITE→MOKOSUITECLIENT, auto-enable monitor plugin ... - XML manifests used old PLG_SYSTEM_MOKOSUITE_ / MOD_MOKOSUITE_ / COM_MOKOSUITE_ prefixes that didn't match the INI files (PLG_SYSTEM_MOKOSUITECLIENT_ etc.), causing untranslated labels in admin UI - Also fixed PLG_TASK_MOKOSUITEDEMO/SYNC and DBIP language keys - Added mokosuiteclient_monitor to auto-enable list in package install script so heartbeat registration works on fresh install	2026-06-18 12:47:50 -05:00
Jonathan Miller	8fd50ea580	fix(security+data): address PR review — XSS, header injection, ACL, status sync ... 1. Remove SVG from allowed upload extensions (stored XSS vector) 2. Sanitize Content-Disposition filename (header injection prevention) 3. Add ACL check to rateTicket() (missing authorization) 4. Use server-side MIME detection instead of client-supplied type 5. Sync status_id/priority_id in AutomationEngine and API controller to keep ENUM and lookup-table columns consistent 6. Align auto-bump.yml to use mokoplatform (no hyphen) matching pre-release.yml convention	2026-06-18 09:49:27 -05:00
Jonathan Miller	27f50468a8	Merge main into dev — apply MokoSuite→MokoSuiteClient rename to dev features ... Merges the full element rename from main into dev, resolving conflicts across 53 files. Migrates new dev-only extensions (com_mokosuite ticketsettings, plg_system_mokosuite_dbip) to MokoSuiteClient naming.	2026-06-16 13:09:14 -05:00
Jonathan Miller	4b9a675d0f	Rename MokoSuite → MokoSuiteClient (full element rename) ... All Joomla element names, PHP classes, language files, folder structure, and manifest references renamed from mokosuite to mokosuiteclient. This repo is now the client-facing tracker for the MokoSuite platform.	2026-06-15 05:19:13 -05:00