0.33.0

• BREAKING: Added signal method prefix handle into GenerateAccessCommand (user:generate_access) to generate ACL resources for presenter's signals within administration (presenters extending AdminPresenter). All signals are automatically allowed for all admin groups (to keep access for all admin users as before signals were introduced). This is one time seed. Please check & update admin group rights in administration (http://crm.press/users/admin-group-admin/). remp/crm#1661
• BREAKING: Renamed SsoRedirectValidator to SignInRedirectValidator. remp/crm#1941
• Changed SsoUserManager::getUser() method signature. remp/crm#1957
  • Added optional parameter registrationChannel to the end of parameter list. Change is backwards compatible.
• Added initial Apple Sign-In support using ID token and Authorization code flow. remp/crm#1924
• Merged Users:changePassword, Users:requestPassword and Users:settings pages together to Users:settings page. Users:settings is now available for all users, content of the page depends on whether user is logged in or not. remp/crm#1818
• Changed Users:changePassword and Users:requestPassword pages to deprecated and will be removed in the future. Requests are redirected to ``Users:settings`. remp/crm#1818
• Added level into admin_access table to indicate access level of resource (read / write). Annotation @admin-access-level above resource method is used for setting level. They are loaded and stored into DB by UsersModule's GenerateAccessCommand (user:generate_access). remp/crm#1661
• Added type into admin_access table to indicate type of resource (render / action / handle). These types are loaded from method prefix and stored into DB by UsersModule's GenerateAccessCommand (user:generate_access). remp/crm#1661
• Changed (improved) UI for setting resource access (granting permissions) to admin groups. Added access types and levels and global/per module toggles (eg. read only). remp/crm#1661
• Added the management of linked accounts into user's settings page. remp/crm#1922
• Added option --cleanup to GenerateAccessCommand (user:generate_access) command. When command is launched with this option, orphaned ACL resources and actions are removed. Can be used to remove remains after CRM module is uninstalled or presenter/method is (re)moved. remp/crm#1777
  • WARNING: This option doesn't fix ACL after resource is moved. That should be handled by module when resource is moved / renamed (eg. by migration).
• Changed users.note column from VARCHAR(255) to TEXT. More space is sometimes needed (eg. notes about company accounts). remp/crm#1953
  • Set note input field to nullable (stores NULL instead of empty string).
• Added option to set query parameter n_source when using Apple or Google Sign In to store user registration source. remp/crm#1957
• Added registration_channel column to users table. remp/crm#1957
  • This column refers to channel through which user was registered. Default value is crm. It's primarily designed to determine origin of the registration data and consent (e.g. Google sign in, Apple sign in).

0.32.0

• BREAKING: Added users.email_validated_at flag to track deliverability of emails. Flag resets on email change. Changed users.confirmed_at intention. remp/crm#1739 remp/crm#1028
  • The original intention in CRM was to use users.confirmed_at flag to determine both account confirmation and email deliverability. We're splitting this to two different fields.
    • users.confirmed_at now flags the actual account confirmation triggered by clicking on the confirmation link in an email, event-based confirmation, or admin confirmation. Any features dependent on account confirmation should still use this field. To maintain backwards compatibility, we recommend creating event handler listening to the UserCreatedEvent which confirms new users automatically.
    • users.email_validated_at now flags deliverability of email address. Its primary use case is to determine whether systems should attempt to deliver non-system messages to the email address.
  • The migration copies the value of confirmed_at to email_validated_at field to maintain originally stored values. This is a one-time operation.
• BREAKING: Signature of method Crm\UsersModule\Repository\UserEmailConfirmationsRepository::verify was changed and renamed. remp/crm#1739
  • Please change any use to the method to Crm\UsersModule\Repository\UserEmailConfirmationsRepository::confirm.
  • Method now returns instance of the email confirmation row that's being confirmed instead of boolean value.
• BREAKING: Previously, if user signed in with her username and password, she would be automatically confirmed. This has been removed. remp/crm#1739 remp/crm#1028
  • To maintain backwards compatibility, you can create internal event handler listening to the UserSignInEvent and confirm user yourself.
• Added API endpoints users/set-email-validated and users/set-email-invalidated for email address validation/invalidation by external services. remp/crm#1740 remp/crm#1028
• Fixed the issue with the disappearing/hiding buttons in the Basic info panel (UsersAdmin). (Causing problem, if the component is too narrow or the email address is too long.) remp/crm#1838
• Changed Google Sign in user creation flow. We're temporarily generating the user password (it was empty before) until the related trigger in the ScenarioModule supports this scenario and until CRM provides password-less login flow (i.e. magic login link via email). remp/crm#1913
• Fixed invalid use of site_name config option which could cause error if strict check is used by PhpOffice. Replaced with site_title. remp/crm#1921

0.31.0

• BREAKING: Changed parameter in admin.user.detail.center widget placeholder. Now there is int $userId available instead of IRow $user. remp/crm#1357
• BREAKING: Removed first_name and last_name parameters from BasicUserDataProvider. This removal also removes the fields from user_data Redis cache key. If you used it, please pass these parameters through other channels (e.g. custom user data providers). remp/web#1486
• Fixed broken password reset for already logged user. remp/helpdesk#444
• Removed LOWER from UserBuilder->isValid(). MySQL is case insensitive. And when LOWER is used, MySQL will not use the email index. remp2020/crm-users-module!14
• Added initial Google Sign-In support using ID token and Authorization code flow. remp/crm#977
• Added created_at timestamp to BasicUserDataProvider to be cached in user_data Redis hash. remp/novydenik#774
• Fixed storing of empty ext_id value when editing user. Occasionally 0 or empty string would be stored which is not valid (expected) value. remp/helpdesk#561
• Changed size of users.referer column to VARCHAR(2000) to accommodate longer URLs. remp/crm#1890
• Added spam trap domain gmai.com to blocked domains used to validate email addresses by Crm\UsersModule\Email\StaticDomainFileValidator. remp/crm#1894
• Added UserHasAddressCriteria scenario builder condition. remp/crm#1317
• Added deletion of user connected accounts after user is anonymized. remp/crm#1897

0.29.0

• BREAKING: Bump minimal PHP version to 7.3.
• Fixed hardcoded DennikN support email in language constant displayed when deactivated account requests password reset. remp/helpdesk#258
• Optimized abusive users list loading speed in administration. remp/helpdesk#278
• Added migration to set deleted_at value (derived from updated_at value) for already deleted addresses (removed due to GDPR requests). remp/helpdesk#295

0.28.0

• BREAKING: Added filter() function to interface FilterUsersFormDataProviderInterface. Function is used to filter users based on fields added by dataprovider. remp/crm#1663
• Fixed values for user_meta flag confirmed_by_admin. Between version 0.17.0 and 0.21.0 we incorrectly stored true as value also for mail confirmations. remp/crm#1452
• Fixed user_meta flag confirmed_by_admin. Storing flag only if user was confirmed by admin. Default confirmation (via mail) doesn't need user_meta entry. remp/crm#1452
• Added NotificationContext parameter to NotificationEvent object, allowing to specify application's context in which the event was fired.
  This can be used by PreNotificationEvent handlers to manipulate NotificationEvent depending on the application context. remp/crm#1654

0.27.0

• BREAKING: Deprecated users first_name and last_name fields (in favor of using addresses and user_meta fields) are no longer automatically populated when address is added. If you need to maintain the behavior, we recommend to add your own listener to \Crm\UsersModule\Events\NewAddressEvent. remp/novydenik#462
• Fixed persistent parameters in abusive users form and login attempts form. remp/crm#1558
• Added AddressFormDataProviderInterface to create dataproviders for AddressForm. remp/crm#1630
• Added users.dataprovider.address_form dataprovider placeholder to AddressFormFactory. remp/crm#1630

0.24.0

• Fixed implementation of /api/v1/user-meta/list to only include public properties. API was accidentally leaking internal properties as well. remp/web#1167

0.23.0

• Changed user profile in admin to display also last modification date of addresses.

0.22.0

• Added user:reconstruct_user_data command to be able to refresh UserData (Redis) cache. #13

0.21.0

• BREAKING: Extracted getAccessTokens method from UsersApiAuthorizationInterface to its own interface AccessTokensApiAuthorizationInterface. remp/crm#1403
• BREAKING: Changed UserMetaListHandler (/api/v1/user-meta/list). It is now using GET parameters (user_id, key) instead of JSON request body and ServiceTokenAuthorization to allow more user authorization options. remp/crm#1403
• BREAKING: Changed /api/v1/users/autologin-token-login. It now returns error codes in error property instead of code to keep consistency. remp/dn-mofa#11
• BREAKING: Changed /api/v1/users/autologin-token-login. It is now expecting POST parameters instead of GET parameters. We did this as a breaking change to enforce security as having autologin tokens passed by GET parameters was not secure in the first place. remp/dn-mofa#152
• Fixed bug in user/info module which crashed if recently-added access token with source was used to access the API. remp/dn-mofa#97
• Fixed storing of user_meta flag confirmed_by_admin. It's not always true. remp/crm#1452
• Fixed duplicate user password reset after refresh of browser after password reset (in admin user detail).
• Added ServiceTokenAuthorization that uses BearerTokenAuthorization and UserTokenAuthorization to authorize request and user. remp/crm#1403
• Added BeforeRemoveAccessTokenEvent, PairDeviceAccessTokensEvent and UnpairDeviceAccessTokensEvent to manage events based on access-device token relation changes. remp/crm#1312
• Added user logout endpoint. remp/crm#1449
• Added ClaimUserDataProviderInterface to implement custom ClaimUserDataProviders in modules. remp/crm#1319
• Added UsersClaimUserDataProvider which is used to get data from user_meta and users.note and assign it to loggedUser when claiming unclaimed user. remp/crm#1319
• Fixed missing city field in AddressWidget. Display city even if zip field is missing. remp/crm#1461 remp/crm#1465
• Added AccessTokenDataProviderInterface to provide way for modules to pass additional (protection) information regarding access tokens. remp/crm#1494
• Fixed update user group creates new group instead of updating + add missing updated_at column to user groups table. remp/crm#1488
• Added AdminUserGroupsUserDataProvider to remove user from admin groups when anonymizing user. remp/crm#1391