[v0.8.5] Bugfix issue with legacy session transitioning to TS on Candlepilot

What's Changed

• [v0.8.5] Bugfix issue with legacy session transitioning to TS on Candlepilot by @FelipeRamosDev in #297

Full Changelog: v0.8.4...v0.8.5

[v0.8.4] Add HTTPS agent and PATCH method support- #295

This pull request updates the 4Hands API to version 0.8.4 and introduces improvements to the AJAX service, focusing on enhanced HTTPS agent handling and expanded HTTP method support. The most important changes are summarized below.

Version Updates

• Updated the version in both README.md and package.json from 0.8.3 to 0.8.4 to reflect the new release. [1] [2]

AJAX Service Enhancements (client/services/AJAX.js)

HTTPS Agent Handling

• Improved the logic for setting the httpsAgent and httpAgent properties: now, if NODE_ENV is 'production', requests will always reject unauthorized SSL certificates, increasing security in production environments. [1] [2]
• Ensured that all HTTP methods (get, post, put, patch, delete, and file uploads) consistently use the correct agent settings by passing httpsAgent and httpAgent in every request. [1] [2] [3] [4] [5]

Expanded HTTP Method Support

• Added a new patch method to support HTTP PATCH requests, including authentication handling.
• Added a new authPatch method to perform authenticated PATCH requests, mirroring the pattern used for other HTTP verbs.

[v0.8.3] Adjustments - CandlePilot TS Migration

This pull request updates the 4Hands API from version 0.8.2 to 0.8.3 and refactors several utility and response patterns throughout the codebase. The main focus is on removing custom object prototype extensions (like getSafe, toSuccess, and oid) in favor of explicit utility function usage and plain object responses. This improves maintainability, safety, and clarity. Additionally, there are minor dependency and middleware updates.

API and Utility Refactoring:

• Removed custom Object.prototype methods (getSafe, toSuccess, oid) from src/global/index.js and replaced their usage with utility functions (e.g., getObjectPath, global.oid) throughout the codebase. This prevents prototype pollution and makes utility usage more explicit. [1] [2] [3] [4] [5] [6] [7]
• Standardized success responses to plain objects with { success: true, ... } instead of using .toSuccess() method, improving consistency and making the response structure clearer. [1] [2] [3]

Dependency and Middleware Updates:

• Removed the body-parser dependency and switched to using express.json({ limit }) directly in src/services/ServerAPI/index.js, simplifying middleware usage. [1] [2]

Versioning and Documentation:

• Bumped the API version from 0.8.2 to 0.8.3 in README.md and package.json to reflect these changes. [1] [2]

[v0.8.2] Enable TLS validation in production AJAX

What's Changed

• [v0.8.2] Enable TLS validation in production AJAX by @FelipeRamosDev in #291

Full Changelog: v0.8.1...v0.8.2

[v0.8.1] Redis Hotfix

What's Changed

• [v0.8.1] Redis Hotfix by @FelipeRamosDev in #289

Full Changelog: v0.8.0...v0.8.1

[v0.8.0] Improving Authentication + Upload Feature

Release Notes — v0.8.0

HAPI-246 Improving Authentication + Upload Feature

---

Bug Fixes

• Session not persisting after login — Session data is now explicitly saved before the request continues, preventing race conditions where the session was lost between requests.
• Session not persisting after register — Session is now built from the user model and saved before the response is sent.
• Email confirmation wiping session — Confirm-email now updates the session in place instead of destroying it, preserving auth state.
• Signout recreating session — Replaced sessionStore.destroy() with session.destroy() to properly prevent express-session from auto-saving a new session after signout.
• Ghost sessions accumulating in store — Auth middleware now destroys the temporary ghost session created during token-based session restoration, preventing store bloat.
• Subscription doc ID not resolving on nested snapshots — Document subscription lookup now falls back to _doc._id when the top-level _id is not available.
• Socket emitting non-serializable payloads — SubscriptionIO now calls .toObject() when available before emitting data over the socket.
• cookieStore unavailable in some environments — Client auth now falls back to document.cookie when cookieStore is not defined.

---

New Features

• File Upload (AJAX.upload) — New upload(endpoint, file, fields, options) method on the client AJAX service for sending multipart/form-data requests with optional extra fields and upload progress tracking.
• Authenticated File Upload (AJAX.authUpload) — Convenience wrapper around upload that automatically attaches the auth token to the request.
• Custom auth routes — Auth.login() and Auth.register() now accept an optional customRoute parameter, enabling projects to override the default auth endpoints.
• bodyValidation middleware exported — bodyValidation is now accessible from the main middleware index.

---

Improvements

• User model initialization — firstName, lastName, email, and phone are now mapped explicitly in the User constructor.
• Public user payload — toPublic() now includes derived fields fullName and avatarUrl in the output object.
• Session update helper — New User.updateSession(session) method refreshes the session user data from the latest persisted state.

---

Related

• HAPI-246

[HAPI-245] Adding authentication to the DatabaseService

HAPI-245 Description

This pull request introduces several updates, including a version bump for the 4Hands API framework and significant enhancements to the DBService class to provide more flexibility and configuration options for MongoDB connections. Below is a summary of the most important changes:

Version Updates:

• Updated the version of the 4Hands API framework from 0.7.14 to 0.7.15 in README.md and package.json. [1] [2]

Enhancements to DBService:

• Added new configuration options to the DBService constructor, including username, password, useNewUrlParser, useUnifiedTopology, serverSelectionTimeoutMS, socketTimeoutMS, and authSource. These parameters improve MongoDB connection flexibility. [1] [2]
• Introduced getters for sensitive properties like password to encapsulate and safely access sensitive data.
• Updated the init method to use the newly added MongoDB connection options, allowing for more robust and customizable database initialization.

[HAPI-244] Issue with password has creating

HAPI-244 Description

This pull request includes version updates and a bug fix in the AuthService class. The version updates reflect the new release of the framework, while the bug fix ensures proper handling of the password parameter during hashing.

Version Updates:

• README.md: Updated the version number in the title from v0.7.12 to v0.7.14 to reflect the latest release.
• package.json: Updated the version field from 0.7.13 to 0.7.14.

Bug Fix:

• src/services/Auth/index.js: Fixed an issue in the createHash method by ensuring the password parameter is converted to a string before hashing to prevent potential type-related errors.

[HAPI-243] Installing bcrypt and removing bcryptjs

This pull request replaces the bcrypt library with bcryptjs across the codebase to address compatibility issues and ensure consistent functionality. Additionally, the package.json file has been updated to reflect this change and increment the version number.

Library Replacement: bcrypt to bcryptjs

• src/services/Auth/index.js: Replaced all instances of bcrypt with bcryptjs in the AuthService class, including methods like genSalt, createHash, and validateCredentials. [1] [2] [3] [4]
• docs/services_Auth_index.js.html: Updated the documentation to reflect the library change from bcrypt to bcryptjs.

Dependency Updates

• package.json: Updated the bcrypt dependency to bcryptjs (version ^3.0.2) and incremented the application version from 0.7.12 to 0.7.13. [1] [2]

[v0.7.12] [HAPI-242] Redis URL flexibility

[v0.7.12] HAPI-242 Redis URL flexibility

This pull request includes version updates and a change to the Redis initialization in the 4Hands API project. The most notable updates are the version bump to v0.7.12 and the improved configuration for connecting to Redis.

Version Updates:

• Updated the version number in README.md and package.json to v0.7.12 to reflect the new release. [1] [2]

Redis Configuration:

• Modified the initialization of IORedis in src/models/settings/EventEndpoint.js to use the default export and configure it with process.env.REDIS_URL for better environment-specific setup.