geekcodev/max-php-client
A PHP client for the MAX messaging platform API, offering convenient methods to authenticate, send messages, and handle updates within Laravel or plain PHP applications. Simplifies integration with MAX bots and services.
ContactAttachmentPayload::fromArray() now treats a missing or null hash as an empty string instead of throwing InvalidResponseException, so a contact sent into a chat no longer aborts the whole update with 400 invalid_payload in the Laravel webhook controller. ContactVerifier::verify() still returns false for an empty hash, preserving the existing fail-closed posture — unsigned phone stays unconfirmed. Additive DTO work (Attachment::$filename, video/audio metadata, VideoUrls renditions, Callback::$timestamp/$user, Subscription::$time) reduces consumer-side derivation from URLs and payload guessing. ContactPhoneExtractor::fromVcf() is untouched, so the v1.1.8 extraction pattern remains valid.ChatStatus::Suspended is added to the enum, so any consumer with an exhaustive match (ChatStatus) will hit an unhandled-match fatal in production unless a default arm exists. Second planning item: hash-less contacts now reach application handlers instead of being rejected upstream, so the consuming Laravel app must explicitly treat hash === '' as unverified rather than as a parse failure. Third: v1.1.6's deprecation of addChatMembers()/AddChatMembersResult/FailedUserDetails is reversed, so any roadmap work to migrate off those APIs should be stood down.FailedUserDetails — missing user_id/error now yield 0/'' instead of throwing, and userId === 0 is an explicit sentinel for "absent," so a real ID of 0 is indistinguishable and is omitted from toArray(); this is acknowledged and deferred to v2.0.0. (3) Release state — the notes mark v1.1.11 as "in progress"; merge dev → main, tag, GitHub Release, and Packagist publication are pending explicit request. Prior assessment's tag/Packagist immutability question is now more acute, not less. Note also that v1.1.9 and v1.1.10 are not described here; the delta from the assessed v1.1.8 must be reconstructed from the changelog before upgrade.composer audit clean. Regression coverage is targeted at the actual defects: AttachmentTest (missing/null hash, wrong type, filename precedence, video/audio metadata precedence, rendition URLs), WebhookHandlerTest (full webhook with hash-less contact decodes and does not re-serialize empty hash), DtoCoverageTest (suspended status, Subscription::$time, callback user fallback, both FailedUserDetails shapes). Residual gap is unchanged in kind: integration smoke tests were not run (no MAX_API_TOKEN), so live MAX round-trips remain a manual gate.dev → main merge commit? What shipped in v1.1.9 and v1.1.10, and do any of those changes alter the contact or attachment paths assessed here? Which consumers have exhaustive match (ChatStatus) and need a default before upgrade? Does the Laravel app distinguish "contact arrived without a hash" from "contact failed verification," and does it alert on the former? Do any teams still have open work to migrate off addChatMembers() that should now be cancelled? Is FailedUserDetails::$userId === 0 acceptable for our admin/support tooling until v2.0.0? Has anyone confirmed a real hash-less contact event end-to-end, beyond fixtures?ContactVerifier remains the signature authority, and the fail-closed rule for empty hash means the verifier does not need modification to stay safe.default arm to every match (ChatStatus) (or convert to switch), and audit the contact handler so a contact with hash === '' is routed to the "unverified" branch rather than an error branch. Adopt Attachment::$filename in place of URL-segment filename derivation where the admin UI currently shows getfile. Remove or cancel any in-flight deprecation migration for addChatMembers()/AddChatMembersResult. Keep the v1.1.8 extraction fallback ($contact->vcfPhone ?? ContactPhoneExtractor::fromVcf((string) $contact->vcfInfo)) — it is unaffected.FailedUserDetails moves from throw-on-missing to default-on-missing, which silently changes error-handling behavior for consumers that relied on the exception. toArray() round-trips now omit empty hash, so any golden-file or payload-snapshot tests asserting on serialized contacts need updating. Legacy mp4/preview in VideoUrls and legacy file_size in FileAttachmentPayload remain supported, with mp4/preview slated for removal in v2.0.0.match (ChatStatus) sites and add default arms. 3) Upgrade in a non-production Laravel environment. 4) Update contact handling for hash-less payloads and add the unverified-vs-malformed distinction. 5) Update serialization tests for omitted empty hash. 6) Adopt Attachment::$filename in UI/media code and remove URL-derived fallbacks. 7) Cancel addChatMembers() deprecation work and refresh internal docs. 8) Run unit/integration suites plus examples/verify-contact.php manually. 9) Canary production webhook ingestion and watch for 400s on contacts and for unhandled-match errors. 10) Reaffirm phone canonicalization ownership at the CRM/dedupe boundary.addChatMembers() before v2.0.0. Track the v2.0.0 ledger (strict nullable fields, mp4/preview removal) so the next major does not arrive unplanned.hash — these used to be invisible (dropped as 400s) and are now accepted, so an increase in "unverified contact" volume is expected and should be explained to support staff rather than treated as regression. Keep the existing null-extraction metric (vcf_info present, no phone extracted). The filename field reduces a recurring "file shows as getfile" support class. Document the FailedUserDetails userId === 0 sentinel so support does not chase phantom user 0.vcf_info and extracted numbers as before; the new callback/user fields add a small amount of additional PII surface to logging policy review.MatchError at runtime on ChatStatus::Suspended if the exhaustive-match audit is skipped — this is the highest-severity upgrade risk. (2) Contacts without hash are now accepted with empty hash and verify() === false; if the app conflates "unverified" with "verified" or with "malformed," unsigned phone numbers could be treated as confirmed — the extractor and verifier are correct here, so this is purely consumer logic. (3) FailedUserDetails no longer throws on missing fields, so bulk-operation partial failures can pass silently with 0/'' unless the consumer checks. (4) userId === 0 collides with a hypothetical real ID 0 and is dropped from toArray() — accepted limitation until v2.0.0. (5) Live MAX contact events remain non-automatable; hash-less contacts specifically were validated via fixtures and a full webhook decode test, not against production traffic. (6) Unpublished release state is itself a failure mode — do not pin a tag that does not exist on Packagist or that may be moved.default to ChatStatus matches; toArray() omits empty hash so do not assert on it; filename is available and should replace URL-derived names; addChatMembers() is no longer deprecated; keep vcf_info and phone numbers out of logs and commits.How can I help you explore Laravel packages today?