MokoWaaS/CHANGELOG.md

Changelog

[Unreleased]

Added

• RSA-signed heartbeat authentication — private key in monitor plugin manifest, public key on MokoWaaSHQ
• Monitor plugin base_url set via manifest (hidden from admin UI), propagated via update server
• Send Heartbeat button on health token field for manual heartbeat testing

Removed

• PerfectPublisher webservices plugin (no longer needed)

Fixed

• Download key lost on update: cleanupStaleUpdateSites used old /raw/branch/main/ URL format, deleting the manifest-registered update site that held the key

[02.35.00] - 2026-06-06

Added

• Core plugin stripped to heartbeat-only config (~5,500 lines removed)
• Extension catalog (catalog.xml) with update server discovery (#186)
• Download key preservation across Joomla updates (#187)
• Remote login endpoint for MokoWaaSHQ auto-login
• Provision reset API for new client setup (hits, versions, tokens)
• Setup required banner after provision reset
• Support verification PIN (MOKO-XXXX-XXXX)
• mod_mokowaas_categories — auto-category tree menu (#184)
• Cache/temp split button in status bar
• Dashboard version tiles for component and modules
• Monitor plugin sends full health payload to MokoWaaSHQ
• Firewall: block_frontend_superuser, own trusted_ip_entry.xml
• DevTools: reset download keys toggle

Changed

• Renamed src/ to source/ (#188)
• Service classes relocated to owning plugins
• API controller execute() signatures fixed (#183)
• Joomla 5/6 event compatibility in DevTools and Monitor
• Dead placeholder resolver removed from install script

Fixed

• Firewall subform paths after core cleanup
• Missing Security Headers language strings

[02.34.00] - 2026-06-04

Added

• Database Tools view — table status, optimize, repair, session purge (#127)
• Cache Cleanup view — directory size reporting and one-click cleanup (#128)
• mod_mokowaas_cache — one-click cache cleaner button in admin status bar (replaces Regular Labs Cache Cleaner)
• mod_mokowaas_menu — collapsible admin sidebar menu using native MetisMenu classes (like Community Builder)
• SSL certificate expiry monitoring in cpanel module (#148)
• MokoWaaS-specific update badge (blue) separate from other updates in cpanel module
• migrateUpdateServerUrls() — rewrites all Moko extension update server URLs to clean /updates.xml on install/update
• fixMenuIcons() — sets menu_icon params on submenu items (Joomla only renders img on level 1)
• setupCacheModule() — registers cache cleaner module in status bar position on install
• Component config.xml for Joomla Options modal (#149)
• preflight() ALTER for #__extensions.element default (MySQL strict mode fix)
• Retire MokoJoomTOS, MokoATS-Automation, MokoDPCalendarAPI, MokoGalleryCalendar on install
• MokoJoomTOS settings auto-migrate to mokowaas_offline before removal
• dev-release and pre-release workflows with changelog extraction into release notes
• RC pre-release consolidates dev patches into clean minor version bump

Changed

• Move security hardening methods (protectPlugin, ensureProtectedFlag, isOurExtension) from core plugin to firewall plugin (#155)
• Admin menu module uses native Joomla MetisMenu CSS classes
• Helpdesk icon changed to fa-handshake-angle, .htaccess to fa-solid fa-file-code
• clearCache purges all cache files recursively (replaces Regular Labs Cache Cleaner behavior)
• License key warning moved from every-page onAfterRoute to package postflight only
• Update server URL changed to dynamic MokoGitea feed
• Component manifest adds <languages> for global language dir deployment
• Privacy and WAF Log added to component manifest submenu
• MokoOnyx template removed from package manifest (separate repo/release)

Removed

• Static updates.xml — MokoGitea generates update feed dynamically from releases
• update-server.yml workflow — replaced by pre-release.yml

Fixed

• Tickets list showing raw <em>Unassigned</em> HTML instead of italic text
• Cache cleaner CSRF failure — token now sent as POST FormData
• Admin menu icons missing for Helpdesk and .htaccess Maker
• Firewall install error "Field 'element' doesn't have a default value" (MySQL strict mode)

[02.32] - 2026-06-02

Added

• Admin control panel dashboard in com_mokowaas with site info bar, feature plugin grid, and quick actions
• Feature plugin architecture — MokoWaaS features split into toggleable plugins managed from the dashboard
• plg_system_mokowaas_firewall — HTTPS enforcement, trusted IPs, session timeout, upload restrictions, password policy
• plg_system_mokowaas_tenant — Installer, sysinfo, config, template, and menu restrictions for non-master users
• plg_system_mokowaas_devtools — Dev mode, hit counter reset, content version cleanup
• plg_system_mokowaas_monitor — Grafana heartbeat integration and health monitoring
• MokoWaaSHelper utility class for shared master-user detection across feature plugins
• AJAX plugin toggle — enable/disable feature plugins directly from the dashboard
• Clear cache quick action on dashboard
• Static updates.xml for update server (licensing system deferred)
• Automatic param migration from core plugin to feature plugins on upgrade

Changed

• com_mokowaas upgraded from API-only to full admin component with dashboard views
• Package manifest updated with 4 new feature plugin entries (10 extensions total)
• Update server URL changed to static raw file endpoint
• Core plugin slimmed — security, tenant, devtools, and monitor features extracted to dedicated plugins

Removed

• License key validation (licensing system not ready — will return in future release)
• Dynamic MokoGitea update feed dependency (replaced with static updates.xml)

[02.31] - 2026-06-01

Added

• License key support via Joomla's native Update Sites download key system (dlid)
• Update server URL migrated from static XML to MokoGitea's dynamic update feed endpoint
• Legacy static update site URLs auto-migrated to dynamic endpoint on install/update
• Persistent admin warning when no license key is configured in Update Sites
• Daily heartbeat validation of license key against MokoGitea — warns if key is invalid or expired
• Stale/duplicate update site cleanup on install/update (removes old static URL entries and orphaned records)
• Content sync rewritten — bulk MokoWaaS API endpoints (syncclear + syncpush) replace per-item Joomla API calls
• Sync task per-instance config: target URL, health token, content type checkboxes (articles, categories, menus, modules)
• Bulk sync completes in under 5 seconds (clear + push in 2-3 HTTP requests)
• Asset table and nested set tree repair after sync push on target site
• Enhanced dev mode: disables caching, enables Joomla + MokoOnyx debug, suppresses hit recording, shows offline on primary domain
• Dev mode off: clears content versions, resets hits, disables debug, takes site online
• Hardcoded dev alias (dev.{primary_domain}) with noindex/nofollow — bypasses offline mode for development
• Primary domain auto-detected on first config save

Changed

• Branding, master user, support URL, and admin colors are now hardcoded (no longer configurable)
• Master user enforcement is always active (toggle removed)
• Diagnostics + maintenance merged into default config tab
• Emergency access moved to Security tab
• Content sync configuration moved from system plugin to individual scheduled task instances

Removed

• Static updates.xml — update feed is now generated dynamically by MokoGitea from git releases
• Basic branding config tab (brand name, company name, support URL)
• Visual branding config tab (colors, icon, custom CSS)
• WaaS Access config tab (master user toggle, master email)
• Content Sync config tab (targets now in scheduled tasks)
• Site Aliases config tab (hardcoded to dev.{primary_domain})
• File sync (images/, files/, media/) — sync is API/DB content only

[02.29] - 2026-05-31

Added

• allow_extension_updates param — separate update rights from installer restrictions; tenants can update extensions by default even when the installer is restricted
• Hardcoded master usernames — multiple privileged users supported with identical access

Fixed

• Emergency access IP whitelist: empty allowed_ips now permits all IPs (was blocking everyone)

• Emergency access reads allowed_ips from plugin params instead of global config

• plg_task_mokowaassync — Joomla Scheduled Task plugin for automatic content sync to remote sites

• Community Builder tables added to demo reset safe table list

• API endpoint POST /api/index.php/v1/mokowaas/install — install extensions from a remote ZIP URL

• Demo Mode with configurable warning banner on frontend when enabled

• Demo banner countdown now shows weeks/days/months for longer intervals instead of raw hours

• DemoResetService — baseline snapshot and restore for DB tables + media files

• API endpoints POST /?mokowaas=reset and POST /?mokowaas=snapshot (query-string)

• REST endpoints POST /api/v1/mokowaas/reset and GET/POST /api/v1/mokowaas/snapshot

• plg_task_mokowaasdemo — Joomla Scheduled Task plugin for automatic demo site reset

• Admin toggles: Take Snapshot Now and Restore Baseline Now in plugin config

• Content Sync: one-way push of articles, categories, menus, and modules to remote MokoWaaS sites

• Content Sync: API endpoints POST /?mokowaas=sync (sender) and POST /?mokowaas=sync-receive (receiver)

• Content Sync: REST endpoints POST /api/v1/mokowaas/sync and POST /api/v1/mokowaas/sync-receive

• Content Sync: configurable sync targets with URL + API token in plugin settings

• Package installer: protect all MokoWaaS extensions (not just system plugin) and ensure update server stays enabled

• Package installer: clean up legacy mokowaasbrand extension entries and files on install/update

• API endpoint GET /?mokowaas=extensions and GET /api/v1/mokowaas/extensions — list installed extensions with version, status, and update server info

[02.20] --- 2026-05-28