# Changelog

All notable changes to HuxxConnect will be documented in this file.

## 1.2.4 — 2026-07-19

* **Added:** Additional hooks for API and endpoint configuration duplication.
* **Added:** get_id() alias on the Api and Endpoint hook-context objects.
* **Improved:** Moved the endpoint cache-flush button so the header buttons stay aligned across endpoints.

## 1.2.3 — 2026-07-13

* **Added:** WordPress multisite support — activate network-wide or per site. Each site manages its own APIs, endpoints, settings, and encryption keys.

## 1.2.2 — 2026-06-04

* **Added:** Per-endpoint authentication overrides (None, Bearer, API Key, Basic, or Custom).
* **Added:** Import API configurations from URL or pasted text. All import formats are supported.
* **Improved:** Import preview — edit the API ID before importing, review the authentication detected in the source, and selectively choose which endpoints to import.
* **Security:** Endpoint authentication-override credentials are encrypted at rest and masked in admin responses; any existing plaintext overrides are encrypted automatically on upgrade.
* **Security:** The endpoint test panel now masks credentials in the request body before returning it (request headers were already masked).

## 1.2.1 — 2026-05-27

* **Added:** Query strings included in an endpoint path field (e.g. `/search?q=test`) are now extracted into the Query Parameters editor automatically on save, with an inline prompt in the live editor.
* **Improved:** Structure improvements for endpoint features — new `huxx_connect/admin/endpoint_cloned` action lets extensions copy feature-specific config when an endpoint is cloned.
* **Improved:** `Ex.` prefix on example-value placeholders across the admin UI for clearer visual distinction from real values.
* **Improved:** Admin UI polish — tooltip and Logs column layout cleanup.
* **Fixed:** WPGetAPI compatibility bridge properly shapes runtime query, header, and body params as bridged filters expect.
* **Security:** Hardened migration result handling — extension callbacks running after a successful migration can no longer corrupt the reported outcome.

## 1.2.0 — 2026-05-20

* **Added:** Body parameter format toggle on endpoints — switch between the key/value repeater editor and a nested JSON editor.
* **Added:** WordPress 7 compatibility.
* **Improved:** Compatibility bridge components.
* **Improved:** Self-healing option schema migration — laying groundwork for future features.
* **Improved:** Admin placeholder styling is now consistent.
* **Fixed:** Importing endpoints with nested JSON body params now preserves key case (e.g., `fromAddress` is no longer flattened to `fromaddress`).
* **Fixed:** TypeError on the API detail page when adding a new endpoint — `stale_cache_ttl` wasn't initialized on the new endpoint object.

## 1.1.1 — 2026-05-02

* **Added:** Filter log viewer entries by trigger source — new dropdown next to the existing filters.
* **Improved:** Input placeholders are now visually distinguished from real values across the admin UI.

## 1.1.0 — 2026-04-18

* **Added:** Stale cache fallback — when an API call fails, the most recently cached response can be served for a configurable grace window instead of surfacing the error. Configure Stale Cache TTL per endpoint or set a site-wide default.
* **Added:** Log viewer status code range filter (2xx / 3xx / 4xx / 5xx) for quickly isolating error responses.
* **Added:** Log level column in the log viewer (debug, info, warning, error) for filtering and auditing.
* **Added:** CSV export of log entries from the log viewer.
* **Added:** Selective bulk delete of log entries.
* **Improved:** Shortcode attributes renamed to match the rest of the plugin — use `api_id` and `endpoint_id`. The original `api` and `endpoint` attributes continue to work for existing shortcodes.
* **Fixed:** Guided tour steps no longer show "undefined" in the header.
* **Fixed:** Log viewer and breadcrumb UI issues (checkbox column alignment, button spacing, current page bold weight).
* **Security:** Hardened encryption for stored API credentials — AES-256-GCM is now required, with stronger cryptographic randomness and no fallback key.
* **Security:** Favicon uploads are now validated by file content rather than declared type; SVG and Content-Type spoofing are rejected.
* **Security:** Shortcode file-part configuration can no longer be overridden by crafted shortcode attributes.
* **Security:** API keys, bearer tokens, passwords, and other credentials are now masked in request and response logs.
* **Security:** CSV log export neutralizes formula injection attempts (leading `=`, `+`, `-`, `@`) for safe import into spreadsheet applications.
* **Security:** Users demoted from the Administrator role no longer retain access to HuxxConnect settings.
* **Security:** Admin notice surfaces when the encryption key tier is downgraded, preventing silent key-rotation confusion.

## 1.0.1 — 2026-04-11

* **Added:** API-wide default headers, query parameters, and body parameters — configure once at the API level, applied to all endpoint requests.
  * *Dev:* API-level params merge before endpoint params (endpoint overrides on key collision). Body params only merge for POST/PUT/PATCH.
* **Added:** Warning indicator when endpoint headers would override the API's authorization header.
* **Added:** Patchstack Vulnerability Disclosure Program (VDP) for security bug reporting.
* **Improved:** Export excludes encrypted credentials when the environment lock is active, preventing unusable ciphertext from being included.
* **Fixed:** Error responses could be silently dropped when WPGetAPI compatibility filters modified the HTTP response format.
* **Fixed:** Test variable overrides not applying type coercion — arrays and booleans were sent as strings.

## 1.0.0 — 2026-04-01

* Initial public release on WordPress.org.

## 0.9.6 — 2026-03-28

* **Improved:** Build script produces wp.org-compatible ZIP filename.

## 0.9.5 — 2026-03-14

* **Improved:** WordPress.org Plugin Check compliance — replaced short PHP echo tags, removed deprecated `load_plugin_textdomain()` call, fixed WP 5.8 compatibility in uninstall cleanup.
  * *Dev:* All `<?=` short echo tags replaced with `<?php echo` in view files. `%i` placeholder (WP 6.2+) replaced with backtick-quoted interpolation in `uninstall.php`. `composer.json` included in distribution ZIP.

## 0.9.4 — 2026-03-14

* **Added:** Extensibility hooks for custom authentication types — Pro and third-party plugins can register new auth methods via the centralized auth type dropdown.
  * *Dev:* New `huxx_connect/auth/types` filter and `huxx_connect/auth/fields/{type}` action for registering custom auth UI.
* **Added:** Wildcard array syntax (`[]`) for extracting data from nested arrays in API responses.
  * *Dev:* `[]` in dot-notation paths (e.g., `data.[].name`) traverses array elements.
* **Improved:** Redesigned admin interface with design tokens, Phosphor icons, and consistent styling across all views.
* **Improved:** Styled confirmation modal replaces browser-native confirm dialogs.
* **Improved:** WPGetAPI compatibility bridge documented in readme files.
* **Improved:** Tested up to WordPress 6.9.4.
* **Fixed:** Boolean and integer values in authentication configuration are preserved correctly during import.
* **Fixed:** OAuth 2.0 capitalization corrected on API card auth badges.

## 0.9.3 — 2026-03-10

* **Fixed:** WPGetAPI compatibility no longer causes fatal errors when WPGetAPI is activated or reactivated.
  * *Dev:* Activation detection now uses request parameters instead of hook timing to avoid race conditions with function stubs.
* **Fixed:** Empty API credential fields display correctly instead of showing masked placeholder asterisks.
* **Fixed:** Postman import handles empty collection variables and warns about values that need manual attention.

## 0.9.2 — 2026-03-09

* **Added:** Brace syntax for the `keys` shortcode attribute — extract multiple fields from a response using `keys="{id},{name}"`.
  * *Dev:* Pipe-delimited paths also supported for WPGetAPI compatibility. Both dot-notation and brace/pipe formats work.
* **Added:** Shortcode output filter hook for extensions to customize response rendering.
  * *Dev:* `huxx_connect/shortcode/format_output` filter receives the output string, response data, and shortcode attributes.
* **Added:** Export data filter hook for extensions to modify exported configurations.
  * *Dev:* `huxx_connect/export/data` filter.
* **Improved:** API favicons automatically sync when importing API configurations.
* **Improved:** Request preview headers now show masked credential values instead of raw secrets.
* **Improved:** API key values in request URLs are masked in the request log before storage.
  * *Dev:* Query string parameters matching known credential keys are replaced with `***` before the log entry is written.

## 0.9.1 — 2026-03-04

* **Added:** API favicons are automatically fetched from base URLs and displayed on API cards and detail pages.
* **Added:** Interactive guided tour walks new users through creating their first API connection.
* **Added:** Contextual tooltips on admin form fields with a developer reference section.
* **Added:** Quick-test button in the endpoint Testing accordion header for faster API testing.
* **Added:** Extension hooks for Pro plugin features (Post Creator, pagination, Postman import/export).
  * *Dev:* New hooks include `huxx_connect/endpoint/settings`, `huxx_connect/endpoint/indicators`, and the `huxxConnectSettingsExtend` Alpine.js registry.
* **Improved:** All admin interface strings are now translatable — full i18n support with a translation template (.pot file).
* **Improved:** Tested up to WordPress 6.9.1.
* **Security:** Prepared statements used in `uninstall.php` for all database queries.

## 0.9.0 — 2026-03-04

* **Added:** Translation template (.pot file) for localizing the plugin into other languages.
* **Improved:** Plugin structure updated for WordPress.org directory compliance.

## 0.8.0 — 2026-02-22

* **Added:** One-click debug info export copies environment details and plugin configuration for faster support diagnostics.
  * *Dev:* New `DebugExporter` class. Output includes WordPress version, PHP version, active plugins, encryption tier, and API configuration summary.
* **Improved:** Credential health indicators show clear warnings when API keys cannot be decrypted.

## 0.7.0 — 2026-02-22

* **Added:** HuxxConnect menu now has its own sidebar icon in the WordPress admin.
* **Improved:** Admin notices redesigned with consistent branded styling.

## 0.6.3 — 2026-02-21

* **Improved:** Endpoint testing panel reorganized — test variables, request preview, and response viewer grouped into a collapsible section.
* **Improved:** API configuration section is now collapsible for a cleaner editing experience.
* **Improved:** Auth fields now show help text explaining how to use wp-config constants and environment variables.

## 0.6.2 — 2026-02-21

* **Fixed:** Server-locked encryption tier no longer causes errors during site migration.
  * *Dev:* Lock is auto-cleared with `salts_reset` status instead of showing an irrecoverable error.
* **Fixed:** Removing your own domain from the authorized domains list is now blocked to prevent accidental lockout.
* **Improved:** API status indicator clearly shows when credentials cannot be decrypted (red dot), distinct from the "needs setup" state.
* **Fixed:** Plugin settings link on the Plugins page now points to the correct page.

## 0.6.1 — 2026-02-21

* **Fixed:** Encryption tier switching now works reliably on fresh installs.
  * *Dev:* `encryption_mode` is now set to `stored` on first install, preventing auto-detection fallback conflicts.
* **Fixed:** Environment lock status updates correctly after unlocking.
  * *Dev:* `get_status()` now uses the per-request cache set by `establish_lock()`.
* **Improved:** Credential health notices show clearer messaging with links to the relevant settings.
* **Improved:** Broken credential fields show an empty input with a red border and help text instead of masked ciphertext.

## 0.6.0 — 2026-02-19

* **Improved:** Redesigned admin interface with new brand styling.
* **Added:** Full WCAG AA accessibility — keyboard navigation, screen reader support, focus management, and reduced motion support.
  * *Dev:* Includes ARIA attributes, focus trapping in modals, `focus-visible` CSS, and `prefers-reduced-motion` media queries.
* **Added:** Mobile-responsive admin interface with tablet and phone breakpoints.

## 0.5.0 — 2026-02-19

* **Added:** File upload support — send files to APIs using multipart/form-data encoding.
* **Added:** WordPress Media Library integration for selecting files to upload.
* **Added:** `body_json` shortcode attribute for passing raw JSON data to API calls.
  * *Dev:* Takes precedence over `body_variables` when both are provided.

## 0.4.1 — 2026-02-18

* **Fixed:** Postman import no longer corrupts URLs containing special characters.
  * *Dev:* Colons in URL paths were being percent-encoded during import.
* **Fixed:** WPGetAPI migration now correctly transfers encrypted credentials.
  * *Dev:* Credentials are decrypted before re-encryption during migration.

## 0.4.0 — 2026-02-18

* **Added:** Postman Collection importer — export from Postman (v2.1) and import directly into HuxxConnect.
  * *Dev:* Supports auth mapping, body encoding, path variable conversion (`:var` → `{var}`), and collection variable resolution.
* **Added:** WPGetAPI migration tool — automatically converts existing WPGetAPI configuration to HuxxConnect format.
* **Added:** Import format auto-detection for HuxxConnect, Postman, and WPGetAPI files.

## 0.3.1 — 2026-02-18

* **Improved:** WPGetAPI compatibility bridge redesigned with return-value validation to prevent corrupted API responses from legacy filter hooks.
  * *Dev:* Bridge now captures the original value before running the WPGetAPI filter, validates the return against per-hook rules, and reverts to the original if invalid.

## 0.3.0 — 2026-02-18

* **Added:** 25+ filter and action hooks for developers to extend and customize behavior.
  * *Dev:* See [Hooks Reference](https://huxx.dev/docs/huxxconnect/hooks/) for the full list.
* **Added:** WPGetAPI compatibility layer — existing WPGetAPI hooks, functions, and shortcodes continue to work after migration.
  * *Dev:* 10 WPGetAPI filter hooks bridged to HuxxConnect equivalents. Enable in Settings > WPGetAPI Compatibility.

## 0.2.1 — 2026-02-18

* **Fixed:** Import results now show separate counts for APIs and endpoints created instead of confusing combined totals.
* **Improved:** Delete confirmation modal uses the item's unique ID instead of display name for clarity.

## 0.2.0 — 2026-02-18

* **Fixed:** API credentials no longer exposed in page source on initial load.
  * *Dev:* `mask_auth_config()` now runs before template rendering, not only in REST responses.
* **Fixed:** APIs requiring Referer headers (e.g., YouTube Data API) now work correctly.
  * *Dev:* HTTP client now deep-merges headers so defaults (Referer) coexist with caller-supplied headers.
* **Improved:** Import feedback shows separate counts for APIs and endpoints created.
* **Improved:** Unsaved change indicators, cleaner icons, and collapsible test viewer.

## 0.1.0 — 2026-02-18

* Initial pre-release.