TropaTT v0.2.0.9 — Installer fixes & documentation

TropaTT v0.2.0.9 — Installer fixes & documentation update

3 commits since v0.2.0.8 · 6 files changed · +60 / −11 lines

Highlights

• Fixed two installer bugs discovered during full QA audit on a fresh HestiaCP installation
• Clarified required API fields that were undocumented
• Added HestiaCP/VestaCP nginx configuration guide

Fixed

• Installer TypeError on db_port. PHP 8.1+ Fatal error when the installer form passed an integer port value to the e() HTML-escape function. Now cast to string before escaping.
• Installer open_basedir warning. Suppressed noisy PHP warnings on HestiaCP where storage_api/ sits outside open_basedir.

Changed

• API docs: required fields clarified. POST /roles requires code, POST /counterparties requires title, POST /worklogs requires activity_code.
• HestiaCP/VestaCP nginx guide. New section in Shared Hosting Guide covering the @opencart rewrite rule, PHP-FPM socket naming, and open_basedir considerations.

Update server

This release will be distributed to all installed copies via the update server at update.tropatt.com.

v0.2.0.8 — RBAC & API fixes

v0.2.0.8 — RBAC & API fixes

Fixed

• RBAC view-permissions. Routes for GET /projects, /tasks, /clients, /worklogs now accept view-level permissions (project.view, task.view, client.view, worklog.view) in addition to manage permissions. Standard users can now list and view entities they have access to via team membership.

• Permission evaluation logic. Route permission arrays now use OR logic: a user needs AT LEAST ONE of the listed permissions, not ALL of them. This fixes the impossible view+manage permission pair scenario.

• Team member IDs. POST /teams with member_user_ids now accepts public_id strings (e.g. "usr_XXX") in addition to integer IDs. Previously public_id strings were silently converted to 0.

• Task creation. POST /tasks now accepts both project_public_id and project_id fields, and assignee_user_id resolves public_id strings to integer IDs.

• Default role assignment. Creating a user without role_public_ids now automatically assigns the first non-system role that has permissions.

• Installer database.php. The installer now writes database.php configuration during installation.

Testing

• Full functional audit on fresh install (install-test.tropatt.com)
• 6 internal users with role-based access verified
• External user invite/accept/login flow verified
• RLS scoping: external users see only assigned projects/tasks

TropaTT v0.2.0.7 — Security hardening + custom rates

138 commits: 28 features, 96 fixes, 2 security, 2 docs, 10 other

Highlights

Major security hardening release with 56+ audit findings addressed across two audit passes, plus the full custom rates system (rate cards, snapshots, payout, period lock). Admin UI now correctly displays role permissions and KPI widgets.

Added

• Custom rates by counterparty and project (cost, bill, payout) with named price lists, per-task overrides, and snapshotted earnings
• Rate resolution and diagnostics (GET /api/v1/rates/preview)
• Rate-card management UI with counterparty/project/task integration
• Payout visibility for performers ("My earnings" page)
• Work-type dictionary for time entries
• Earnings report with client/work-type/ambiguous filters
• Period locking and auto-close
• Finance permissions and settings
• Knowledge base template ACL (space-scoped templates)
• Admin logs page (tabbed, filtered, paginated)
• Server error logging to database

Fixed

• Admin roles: permissions now display correctly in table and edit modal
• Admin roles: create form now saves selected permissions
• Admin KPI widgets now show real values from the database
• Password validation messages match actual 12-char + complexity requirement
• External user role change now cleans up stale project grants
• CSP: inline event handlers removed, connect-src narrowed
• Module code validator integrated into install flow
• Cron scheduler fixed (proper return values, handler allowlists)
• Profile/me no longer leaks financial fields
• Task activity sanitized for external users
• Rate card lines filtered by FinancialFieldPolicy
• Chat participant validation (counterparty + is_active check)
• Project identity hidden from external users
• Self-deroot prevention
• CSV formula injection protection
• EXIF metadata stripped from chat images
• LikeEscaper applied across 30+ repositories
• Password reset tokens invalidated on password change
• Installer locked after setup (HTTP 410)
• Time-analytics period lock form fix

Security

• 56+ audit findings addressed (4 CRITICAL, 12 HIGH, 22 MEDIUM, 18 LOW)
• Module sandbox classes integrated (ModuleCodeValidator, ModuleTableValidator)
• Root gate on module install/purge routes
• MODULE_SIGNING_KEY required (fail-closed)
• LikeEscaper across all 30+ repositories using LIKE queries
• FinancialFieldPolicy applied to all financial data endpoints
• External user RLS: task/project access properly scoped
• Chat: FileService integration, path traversal protection, EXIF stripping
• Knowledge: ACL enforcement for resolve/reopen, template scoping

---

Update server: Installed copies get updates from update.tropatt.com built from the latest main. This tag is for reference and release history.

Requirements: PHP 8.1+, MySQL, HTTPS recommended.
Demo: https://demo.tropatt.com/ (admin / adminadmin)

v0.2.0.6

v0.2.0.6 (2026-08-21)

Added

• Client portal (external users). Full client portal with invite/accept/RLS isolation for contacts linked to counterparties. Invited guests set their own password and see only their company's projects and tasks.

• Client portal: route allowlist. External guest sessions restricted to explicit endpoints enforced centrally. Any unauthorized endpoint returns 403.

• Client portal: pages show only what a client can use. Task and project pages show only client-relevant sections; internal blocks hidden.

• Client portal: interface isolation. Navigation limited to Projects/Tasks/Notifications for external accounts.

• Client portal: security contract test. Database-free CI check that fails if destructive/admin endpoints gain portal access.

• Client portal: observer and executor roles. Invited guests are observers (read/comment) or executors (can also log time). Role chosen at invite time.

• Client portal: executors can start task timer. Worklog creation/listing reachable for executor role only.

• Client portal: multi-project access for executors. Staff can grant/revoke access to individual projects across counterparties.

• Client portal: invite login = email. Portal accounts log in with their email address.

• Client portal: invite UI on counterparty page. Same invite flow as Contacts page, with role selection and project-access panel.

• Client portal: chat integration. External users participate in project-level chat from the project card.

• Client portal: knowledge base integration. Articles marked client_visible readable by portal guests.

• Installer: regenerate MySQL schema snapshot. Fresh installs start with all 151 core tables.

• Installer: check both lock files. checks both lock files consistently.

• Updater: harden migration runner. Individual migrations wrapped in try-catch; raised max_migrations_per_request to 5.

Fixed

• Security: PII leak on task update. Staff names no longer leak in task-update responses for external users.

• Security: SQLite-safe migrations. uses PRAGMA on SQLite.

• Security: LIKE search rewritten. Counterparty/contact/project search safe across MySQL versions.

• Client portal: external flag never applied. now read during session loading.

• Client portal: guest role received no permissions. Correct permission codes seeded.

• Client portal: internal comments visible to clients. SQL-level filtering ensures internal comments stay internal.

• Client portal: attachments unreachable. File access granted through company scoping.

• Client portal: lists could come back unfiltered. Missing contact link returns empty list instead of unrestricted.

• Client portal: internal comments leaked via notifications. Portal users no longer receive internal comment notifications.

• Client portal: own profile returned 403. Profile route added to portal page allowlist.

• Client portal: project card broken layout. Summary/milestones endpoints reachable for guest's own project.

• Client portal: staff replies invisible to guests. Comment visibility toggle for staff.

• Counterparty search ESCAPE syntax error. MySQL LIKE search rewritten without ESCAPE clause.

Removed

• MySQL Integration CI workflow. Removed from GitHub Actions; was failing independently of changes.

TropaTT v0.2.0.5 — visual editor enhancements, UI consistency

Statistics

5 commits since v0.2.0.4: 1 feature, 4 fixes

Highlights

• Visual editor enhancements: improved todo lists, table controls, slash menu, @mentions with knowledge pages
• UI consistency: unified icon styles (solid→regular), danger button classes, gantt cursor behavior

Added

• Visual editor: enhanced todo lists (custom checkbox, Enter/Backspace/Tab)
• Visual editor: table controls (add/remove row/col, Tab navigation)
• Visual editor: enhanced slash menu (groups, descriptions)
• Visual editor: knowledge page @mentions
• Visual editor: sanitizer updates for new elements

Fixed

• Gantt: removed grab cursor on bar hover
• Counterparties: removed JSON references from labels, modal scroll fix
• Buttons: icon-only danger buttons unified to crm-btn-danger-icon
• Icons: unified solid/regular styles across all pages

---

Note: This update is delivered automatically via the update server (update.tropatt.com). If you installed TropaTT manually, run the updater from Admin → Updates.

TropaTT v0.2.0.4 — Visual editor enhancements, key-value editor, UI unification

Highlights

Major visual editor upgrade with 4 new features, plus UI unification and quality-of-life improvements.

Added

• Visual editor: todo lists — toolbar button + [] shortcut, checkbox toggle, persistent state
• Visual editor: tables — 3×3 insert via toolbar, responsive wrapper
• Visual editor: slash menu (/) — 9 commands, fuzzy filtering, keyboard navigation
• Visual editor: @mentions — user search from API, styled mention chips
• Counterparties: interactive extra fields — dynamic key-value editor replaces JSON textarea
• Worklog time rounding — configurable rounding in admin settings
• Docs page — expanded with Feature Overview, MCP, Usage Examples, Tech Stack (7 locales)

Fixed

• Sanitizer: todo list and table persistence — <input> no longer stripped on save
• Visual editor: code block styles inside editor
• Counterparties: status field → select dropdown
• Updates page: auto-load changes after check
• Gantt: removed resize cursor on hover
• Admin settings: breadcrumb + improved grid layout
• Icons: standardized book icons, 930× aria-hidden added
• Buttons: unified subtask open/edit styles
• Docs: HTML rendering in i18n values

Changed

• 28 commits since v0.2.0.3.1
• Visual editor: +1,500 lines (todo, tables, slash menu, mentions, sanitizer)
• CSS: +200 lines for new components

---

Update server: update.tropatt.com serves the latest main build automatically.

TropaTT v0.2.0.3.1 — i18n parity and planner column fix

4 commits since v0.2.0.3 (1 feature, 1 fix, 2 docs)

Highlights

• All hardcoded ->t() fallback strings across the API moved into language files, with the missing cycle, estimate and task_relations domains created — every referenced key now resolves in all 7 locales (ru/en/de/fr/es/pt/zh).
• The planner «Действие» column no longer overflows the visible area on My Day / My Week.

Added

• i18n: cycle, estimate and task_relations API language domains (all 7 locales).
• Web gantt.blocked_marker in the top-level namespace (all 7 locales).

Fixed

• i18n: remaining hardcoded ->t() fallbacks converted to language variables.
• i18n: key-format bugs fixed (domain/name → domain/messages.name, ai_suggestion.messages.* → ai_suggestion/messages.*).
• i18n: full web + API key parity across all 7 locales.
• Planning: planner task-table column widths capped so «Действие» stays visible.

update.tropatt.com serves installations from the latest main build, not from release tags.

TropaTT v0.2.0.3 — unified planning, sprints, WIP limits, module extension system

TropaTT v0.2.0.3

Self-hosted PHP/MySQL CRM and work platform — patch release. 69 commits since v0.2.0.2: 31 features, 23 fixes, 9 docs and 6 other.

Highlights

• Unified planning workspace (My Day / My Week) — one consistent 4-column task-table layout, overdue tasks as regular sections with live counts, AI day/week plan cards in the right column, priority stripes for all 4 levels, scroll-hint gating and done-confirmation.
• Per-user task sidebar blocks — hide, re-add and reorder the task card's right-column blocks (estimates, timer, AI assistant, summary, module blocks).
• Cycles become sprints — burndown chart (tasks and story points), scope tracking, velocity incl. story points, per-assignee capacity planning, one-active-cycle guard and daily snapshots via cron.
• WIP limits for teams, projects and assignees — live counting, exceed notifications, inline limit editor in the task sidebar.
• Module extension system — lifecycle events, route-scoped CSS/JS, named content positions (task detail, tasks list, kanban, dashboard, project detail, profile, gantt, calendar, counterparties), web hooks, plus a reference position-example module.
• GitHub / GitLab two-way sync — comments and status changes push back to the linked issue/MR for imported tasks (idempotent).
• Slack notifications from core events — task/project/user/comment/file events automatically enqueue notifications for matching rules.
• Chat — history pagination, unread divider, copy-to-clipboard per message.
• Counterparty and project detail redesigns — tabs, accordions, progress ring, quick status/priority pills, archive action.
• Intake bulk triage — status tabs with live counts, sorting, pagination, bulk accept/reject/assign/snooze/reopen/delete.
• i18n parity across all 7 locales — web and API catalogs fully aligned with the ru-ru reference.

Added

• My Day / My Week: unified 4-column task tables, «Сегодня» badge, initials avatars, status badges with time, priority stripes (urgent/high/normal/low), localized day labels; overdue sections converted from spoilers to regular blocks.
• Task detail: per-user show/hide/reorder of sidebar blocks (GET/PUT /api/v1/tasks/sidebar).
• Cycles: burndown (tasks/points), scope tracking, velocity + story-points velocity, capacity planning, sprint guard, daily burndown snapshots via cron, cycle lifecycle module events.
• WIP limits: team/project limits, live WIP load, exceed notifications, inline assignee limit editing, configurable WIP statuses and role exclusions.
• Modules: extension system (events, scoped assets, positions, web hooks), dashboard/project/profile/gantt/calendar/counterparties content positions, position-example module.
• GitHub/GitLab two-way sync via core events; Slack notifications from core events.
• Chat history pagination, unread divider, copy action; read marker last_read_seq.
• Projects list: real progress and managers; intake: status tabs, sorting, pagination, bulk triage.
• i18n: complete key parity across 7 locales (web + API), new API domain catalogs (intake, project_module, project_modules, saved_views).
• Docs: MODULE_DEVELOPMENT.md, README module links and release badge.

Changed

• Planning: «Моя неделя» hidden from the menu by default; strict grid restored; UI emoji → Font Awesome; planner CSS cleanup and data-i18n audit.
• Burndown metric switch and WIP scope tabs styled as segmented controls.
• Docs: dropped references to local-only test files and real server paths; bootstrap assets cleaned of missing source-map references.

Fixed

• Task detail: saved sidebar block order now applies on page reload.
• Chat: read marker survives the response sanitizer (last_read_seq, distinct bind).
• Kanban: search box and cycle-filter input sync with URL/filters on board open.
• Cycles: 7-locale burndown/statistics localization, reopen-label ambiguity, points-burndown float noise, estimate-set selection for points velocity.
• CSS: two stray media queries closed (kanban/knowledge/workspace and project-detail mobile styles), primary button text stays white on hover.
• My Week: «Задачи недели» table now uses the same fixed layout and boxed max-height+scroll treatment as «Просроченные задачи».

The update server (update.tropatt.com) keeps serving installs with the latest build from GitHub; this release tag is for reference and release history.

TropaTT v0.2.0.2 — 7 new modules, module management, time-tracking automations

TropaTT v0.2.0.2

Self-hosted PHP/MySQL CRM and work platform — patch release. 286 commits since v0.2.0.1: 68 features, 171 fixes, 23 docs, 9 refactors, 4 tests and 11 other.

Highlights

• 7 new integration modules — Notion, Linear, GitHub, GitLab, Slack, Draw.io and Raycast join the catalog (22 modules total). Each ships a full manifest, REST endpoints and, where applicable, MCP tools.
• Module management (Admin → Modules) — select one or many modules and apply bulk actions (install, uninstall, activate, deactivate), fully delete a module together with its files (purge), filter by category, and see each module's author «Anton Barinov» as a link to the GitHub profile.
• Time-tracking automations — a new worklog_logged trigger and notify_manager action with period/threshold/scope conditions and {user} {task} {minutes} {total} {threshold} {day} placeholders.
• Parallel timers no longer double-count — exact [started_at, ended_at] intervals and an overlap-free «unique» time in analytics and earnings.
• Modules now ship with core updates — installations that update through update.tropatt.com receive new modules automatically; older installations transition via a signed bridge package with no manual steps.
• MCP server — fixed 10 unreachable tools and added 9 tools for previously uncovered endpoints.

Added

• Modules: Notion, Linear, GitHub, GitLab, Slack, Draw.io, Raycast (migrations + integrations).
• Module author fields (author / author_url) across the manifest, REST, MCP, CLI (module.php info) and the web UI.
• Time-tracking workflow automation and overlap-aware time analytics.
• Tasks created from chat discussions (with source metadata and deep links).
• PWA: installable app with a localized manifest, app-shell precache and install-location independence.
• Kanban/Gantt settings kanban_max_cards / gantt_max_tasks (0 = unlimited, chunked loading).
• Due-date filters follow the user's timezone; server-side filters cover the full dataset.
• API resilience: automatic retries, idempotent create endpoints, TLS 1.3 0-RTT handling.
• Frontend API error histogram (Admin → Logs).

Changed

• Tasks list / My Day tables: merged columns, multi-level sorting, clickable people filters, hover tooltips.
• Counterparties / projects / clients tables made compact (fewer columns, no horizontal scroll).
• Modules delivered with core updates; the update page shows forbidden package paths and a modules note.
• High-contrast theme audited to WCAG and made fully flat; theme options renamed.

Fixed

• Network layer survives TLS 1.3 0-RTT anti-replay and transient 5xx without server configuration.
• Dashboard «Active Cycles» widget rendering, API file-cache TTL, page-cache invalidation on task mutations.
• PWA: transparent icon corners, skipWaiting() on deploy, offline retry budget.
• Subdirectory installs now talk to their own API (cross-install data leak fixed); PWA caches scoped to the install path.
• Module scheduler / feature flags / AI intent seeding idempotency (no duplicate rows).
• Various table layout and i18n fixes across all 7 locales.

The update server (update.tropatt.com) keeps serving installs with the latest build from GitHub; this release tag is for reference and release history.

TropaTT v0.2.0.1 — Sepia theme, Kanban scroll navigation, theme token unification

TropaTT v0.2.0.1

Self-hosted PHP/MySQL CRM and work platform — patch release. 43 commits since v0.2.0: 5 features, 34 fixes, 4 refactors/docs.

Highlights

• Sepia theme (warm parchment) — added as a pure CSS token block in themes.css without touching a single component style. This proves the theme architecture: the whole UI now reads colors exclusively from CSS variables, so any new theme is just a set of variables.
• All colors unified into CSS variables — zero hardcoded colors in base CSS, JS or PHP templates; themes only swap token sets. All var(--token, #hex) fallbacks removed — no raw hex colors remain outside token definitions.
• Kanban horizontal scroll navigation — always-visible scrollbar, floating left/right scroll buttons with fade-in on board edge hover, and keyboard arrows (Left/Right scroll the board by one column, ignoring typing contexts and open modals).
• Dark theme cleanup — remaining light artifacts and unreadable dark-on-dark text eliminated across modals, tables, calendar, gantt, chat, dashboard builder and badges.
• Visual editor spoiler fix — <details class="crm-ve-spoiler"> in saved content (comments, descriptions, ideas) now renders styled and collapsible in every theme.

Added

• Sepia (warm parchment) theme as a pure token block; registered in the header allowlist, api.js THEMES, profile select and all 7 locales.
• Kanban: horizontal scroll navigation (visible scrollbar, floating scroll buttons, Left/Right keyboard scrolling).
• Kanban: scroll buttons fade-in animation on board edge hover (reduced-motion safe).
• Theme architecture: all colors moved into CSS variables — themes only swap token sets.

Changed

• Profile theme select order: light, sepia, dark, contrast.
• Footer is no longer sticky — flows naturally at the page bottom.
• .crm-metric-tile gets explicit padding and matches the system card style; my-day/my-week tiles use box-shadow: none !important and min-width: 105px.
• Status/error toast tokens are now per-theme (sepia loading popup uses warm brown instead of fixed green).
• Switches: enabled toggles no longer show the hover/focus glow ring.
• Visual-editor tokens (--crm-ve-*) moved to :root/theme scope so rendered content keeps spoiler styling outside the editor.

Fixed

• Dark theme: light artifacts and unreadable dark-on-dark text eliminated — modal/offcanvas/drawer/popover surfaces, buttons, tables, calendar, gantt, chat, knowledge, dashboard builder, badges and bootstrap box-shadow glows now follow theme tokens.
• Contrast theme: no blue accents remain — links/checks/avatars/gantt/calendar/buttons use brand dark green, button surfaces are white with black borders (WCAG AA).
• Sepia theme: gantt uses warm brown tints instead of blue accents.
• Visual editor spoiler in saved content now renders styled and collapsible in every theme.
• Projects page: missing project status translations for Russian (and all 7 locales) — statuses no longer fall back to English.
• pages.css: restored the missing @media wrapper around automation mobile rules (orphan closing brace; braces balanced again).

The update server (update.tropatt.com) keeps serving installs with the latest build from GitHub; this release tag is for reference and release history.