14 Commits

Author	SHA1	Message	Date
johnnyq	a5a43e37ac	Audit logs stage 3: failed sign-ins say why and are logged against the account they were for - wrong password, no account with that email, disabled, archived or invited account, client archived, portal turned off, a wrong MFA or two-step code after the right password - with failed Microsoft 365 portal sign-ins logged too and marked Their account in the audit log; the IP lockout counts portal failures as well; the first sign-in from an IP address is badged New IP in the audit lists and quick look; new Admin > Sign-ins under Access with People and IP addresses views, search, date filter, sortable columns and paging; admins get a notification and an email on a run of failed sign-ins or turned-away API calls from one address or against one account, set in Settings > Security (10 to start, 5, 20, 50 or never), each in the audit log Security view and in Mail > Previews; API calls counted per key, day and endpoint, with a 30-day calls column and last IP on API Keys and a usage window, expired-key calls logged against the key, and usage deleted with the key and after the log retention; database 3.3.2 drops the unused auth_logs table and adds settings.config_login_alert_failures and api_key_usage; new functions/sign_in.php, admin/sign_ins.php and admin/modals/api/api_key_usage.php; the license template page no longer warns when view is missing	2026-10-19 00:56:52 -04:00
johnnyq	2a5533ea2b	Roles stage 3: roles and agents in the API and Admin > API Keys rebuilt; new api/v1/roles/read.php where an admin key reads every role with its level per module and agent count, archived on request, and any other key reads only its own user's role, and new api/v1/technicians/read.php listing agents with their role under Support at Read; API role refusals now say what the call needs and what the key's user has, naming the module, level and role, and technicians/time.php needs Read instead of Modify; Admin > API Keys shows each key's agent and role, what it can open and for which clients, whether it works (works until, expires in N days, expired, or won't work with the reason when its agent is disabled, archived, has no role or is missing) and when it was last used, with search by key or agent name; New and Edit windows show the picked agent's access as they are picked and offer only active agents, Create before ticking the copied box opens the Key tab, new keys default to a year and must end after today, and an expired key can be renamed and stay expired; handlers moved to functions/api_keys.php with validation, escaped messages and audit entries naming the agent and what an edit changed, fixing empty names on revoke, delete and bulk delete, a backslash shown for apostrophes in names, the bulk count of keys ticked rather than deleted, keys created already expired and expired keys that could not be renamed; database 3.1.7 adds api_keys.api_key_last_used_at, set at most once a minute in the configured timezone; changelog updated	2026-10-17 21:10:48 -04:00
johnnyq	c509b7f693	Add user-based RBAC for API keys ... API keys now run as a user and inherit that user's module, operation, and client permissions. Drops per-key client scoping and removes existing keys (must be recreated). Adds an edit modal to change a key's user.	2026-07-25 16:50:58 -04:00
johnnyq	28f1a965b8	Remove dead code	2026-07-24 17:33:09 -04:00
johnnyq	af51c4316f	Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present	2026-07-24 13:40:37 -04:00
johnnyq	b8873039a4	Rename Functions: flash_alert, sanitizeFilename and display_folder_options using camelCase instead to match other custom php functions	2026-07-14 17:41:41 -04:00
johnnyq	f1836c70cd	Replace Function logAction() with logAudit()	2026-07-14 17:35:23 -04:00
johnnyq	b57ddc0e5c	Replace Function sanitizeInput() with just escapeSql() and update all instances throughout	2026-07-14 17:17:50 -04:00
wrongecho	41df4c4b9f	API Keys - Revoke then Delete	2026-01-15 11:37:17 +00:00
johnnyq	0a30300bde	replace all instances of mysqli_fetch_array with mysqli_fetch_assoc for better performance and memory usage	2026-01-14 17:30:23 -05:00
johnnyq	fae7e76721	Remove logging comments as its implied in admin also if returning 1 field for logging use getFieldById Function	2025-08-01 18:08:02 -04:00
johnnyq	012b0f1a77	Update Admin posts to use new functions flash_alert and getFieldById which greatly cleans up and reduces the code also removed logging comments as implied by the function logAction	2025-08-01 17:21:35 -04:00
johnnyq	d2dac1915d	Update admin, user, guest and client post to use new redirect function	2025-08-01 15:25:52 -04:00
johnnyq	2333d81276	Update more broken links from file dirextory consolidation	2025-07-29 18:34:51 -04:00