Ti Ext User Laravel Package

This release includes bug fixes for guest order claiming and user form validation, along with model and permission improvements.

Added

• Defined searchable fields (first_name, last_name, email, telephone) on the Customer model to enable search filtering via the query modifier

Fixed

• Guest order claiming now correctly scopes by email for legacy rows where customer_id is zero, preventing unintended order matches
• Added missing sale_permission validation rule to ensure the value is properly stored when saving a user form

This release improves security across several areas, including password reset timing, mass-assignment protection, and a new permission for staff role management.

Added

• Introduced a dedicated Admin.StaffRoles permission for managing staff roles, so that general staff access no longer grants the ability to edit roles.

Fixed

• Wrapped the forgot-password handler in Laravel's Timebox to prevent email enumeration attacks by equalizing response timing between existing and non-existing account paths.
• Used hash_equals for password reset code comparison to ensure timing-safe string comparison.
• Prevented super_user from being mass-assigned on staff accounts.
• Prevented authenticated customers from mass-assigning customer_group_id or status fields via the API; access tokens are now revoked when an account is disabled.

This release improves PostgreSQL compatibility, enhances the setup flow, and adds test utilities.

Added

• Site settings are now applied on the complete setup page after finishing initial configuration

Fixed

• Single-quoted string literals are now used in Customer::getDropdownOptions, resolving a PostgreSQL compatibility issue

🐛 Bug Fixes

• Update slug parameter and email uniqueness validation rule format in tests (f399007)
• Update model class references to use short names and improve type check (7d410f3)
• CustomerRequest unique email now correctly ignored on API update (#41, 9313fc3)

📖 Documentation

• Removed obsolete changelog section from README (ff38594)
• Updated issue tracker link to point to the core repo (9b4bfe3)

Added

• Added indexes for tables to improve query performance

Changed

• Updated callback functions to specify return types in AuthServiceProvider and Extension files

Added

• Database indexes to multiple tables to improve query performance.

Added

• model: Eager load relationships to improve performance.

Fixed

Issue where first DB address record is updated instead of adding a new address record

• Fixed issue where customer password is set to null after registration

Fixed

• Schedule commands for assignables allocation and user state clearing.
• customers: Use primary color on activation button to increase visibility.
• user: Remove unnecessary locale setting in afterLogin method.

Fixed issue where login as admin does not work when already logged in as customer

Fixed

• Update extension icon background color.

Added

• Add status field to Customer and User models as boolean.
• user: Add telephone field to User model and related validation rules.
• Enhance customer registration to support specific and default groups.

Fixed

• assignable: Replace save() with saveQuietly() for silent saves.

Docs

• Update wording in Usage sections for clarity.
• Fix broken links.

Added

• Add Authenticate middleware test for no database scenario.
• Allow requests to proceed when no database is detected.

Changed

• Enhance customer and user creation tests for send invite logic.
• Update UserRequestTest to include password validation scenarios.

Fixed

• Retain old input values in initial setup form fields.
• Avoid clearing existing password when user is updated.

Release v4.0.10

Release v4.0.9

Release v4.0.8

Release v4.0.7

Release v4.0.6

Release v4.0.5

Release v4.0.4

Release v4.0.3

Release v4.0.2

• Minor improvements

• Minor improvements and bug fixes

Minor improvements

• Minor improvements and bug fixes

• Minor improvements and bug fixes

• Now using Laravel blade syntax on all mail templates
• Added country code picker to telephone field on registration and account page

• Consistent password requirement on customer and admin side
• Make agreeRegistrationTermsPage property on Account component optional
• Minor improvements and bug fixes

• Minor improvements and bug fixes

• Minor improvements and bug fixes

• Minor improvements and bug fixes