v0.1.5 — docs correction

Docs-only release. No code changes.

• Corrected the SMTP retirement timeline to Microsoft's 2026-01-27 revision: SMTP AUTH basic auth stays fully available until end of December 2026, is disabled by default for existing tenants after that, unavailable to new tenants from 2027, with final removal announced in H2 2027.
• Made every docs link (installation guide, FAQ, SECURITY.md, PLAN.md, CHANGELOG.md, LICENSE, in-page anchors) absolute — the marketplace resolves relative links against its own root, causing 404s.
• Replaced the non-existent hello@solvetus.com with role-based missivus.com addresses (security@, support@).
• FAQ: WordPress is no longer "planned" — missivus-wordpress, missivus-nextcloud and missivus-ghost have shipped; noted Matomo-for-WordPress is untested rather than implying support.
• "Budget half an hour" → "about an hour"; Missivus-0.1.1.zip → Missivus-.zip in install snippets.

See CHANGELOG.md for details.

v0.1.4 — endpoint URLs never reach a log

A security fix for one issue, reported by @textagroup (Kirk Mayo) as #1. Thank you.

Endpoint override URLs are no longer repeated back into errors, logs, or the test-email response

Endpoint::normalise() refused an unsafe graph_base_url / login_base_url correctly, but ended its message with the rejected value verbatim — and that message was then logged by GraphTransport at error level and returned to the superuser by Missivus.sendTestEmail, neither with a final redaction pass.

So a base URL carrying credentials (https://user:password@host) or a token (?access_token=…), set through MISSIVUS_GRAPH_BASE_URL or MISSIVUS_LOGIN_BASE_URL, could reach a Matomo log file and the settings page. Rated Low — it needs a misconfiguration the operator authored themselves, and both readers are already trusted surfaces — but it is a credential crossing a boundary it never needed to cross.

Fixed in three independent layers:

• Endpoint no longer assembles what it must not print. Every message is built from one helper that emits scheme, host, port and path only; userinfo, query string and fragment never enter a message at all. A value too malformed to parse, or a host name that fails validation, is reported by reason rather than by value.
• Redactor learned URL shapes — credentials inside a URL (anchored on ://, so an ordinary mailbox address is left alone), any name=value on the new Redactor::SECRET_PARAMS list (access_token, client_secret, code, password, signature, sas, …), and URL fragments.
• GraphTransport::redact() is now the single final pass on every string the transport logs or rethrows, and Missivus.sendTestEmail applies the same pass to the message it returns.

Eleven new tests cover it: userinfo, access_token / client_secret / code query parameters and fragments, all asserted absent from the exception message, from the log, and from the string the API method returns. 75 tests pass; php -l clean.

Full write-up as finding 12 in docs/SECURITY.md. No configuration change is needed on upgrade.

Install

Unzip Missivus-0.1.4.zip into Matomo's plugins/ directory, or upload it through Administration → Plugins → Install a plugin with enable_plugin_upload temporarily on.

v0.1.3

Changed

• The test-email success message now reads "Test email sent to %s. Microsoft accepted it — check the inbox to confirm delivery.", clearer about what "sent" does and does not guarantee.
• plugin.json: homepage now points to https://missivus.com and support.docs to https://missivus.com/matomo/, moving both off the GitHub repository now that the plugin has a dedicated site. license stays GPL-3.0+.

Added

• screenshots/Settings_page.png, the plugin's settings page for the Marketplace listing.

v0.1.2 — Marketplace readiness and public-repo hygiene

Housekeeping for the Matomo Marketplace, and a tidy-up now that the repository is public. No
functional change to the plugin — if 0.1.1 works for you, this is optional.

Marketplace readiness

• plugin.json: license is now GPL-3.0+, the spelling the Marketplace accepts —
  GPL-3.0-or-later is correct SPDX but is not on their list, and would have been rejected at
  submission. Added "category": "integration", a docs link, and an archive.exclude so the zip
  the Marketplace builds drops /dist, /tools, PLAN.md and the internal brief.
• README.md now leads with a ## Description section, because the Marketplace renders everything
  between that heading and the next ## as the plugin's page.
• The install guide moved to docs/index.md — the path that becomes the Documentation tab.
• New docs/faq.md (the FAQ tab): twelve questions taken from what actually gets asked —
  whether the shared mailbox needs a licence (it does not), why not SMTP, client secret versus
  certificate, how to rotate a secret without an outage, attachments over 3 MB, why
  Mail.ReadWrite is needed, why the application access policy is not optional, the greyed-out
  test button, the Docker plugin-upload flag, what happens if you install and do nothing, and the
  Microsoft error codes.
• New screenshots/README.md describing the captures the plugin page still needs.

Public-repository hygiene

Deployment topology is out of the public tree: host names, orchestration, the private network and
local paths are gone from docs/BRIEF.md and PLAN.md in favour of generic wording. That detail
belongs in an operator's own runbook. It remains in the git history of the two releases before this
one.

Verified

60 unit tests passing and php -l clean on both PHP 7.2.34 (the supported floor) and PHP 8.5.9.

Install

Download Missivus-0.1.2.zip below and unzip it into plugins/, or upload it through
Administration → Platform → Plugins → Install a new plugin, then
./console plugin:activate Missivus. The Microsoft-side setup is in
docs/index.md;
common questions are answered in
docs/faq.md.

Requires Matomo 5.x and PHP 7.2.5+.

v0.1.1 — first-deployment fixes and a security review

Missivus sends all Matomo email — password resets, scheduled report PDFs, alerts — through the
Microsoft Graph API, using OAuth2 client credentials, the Mail.Send application permission, and
one shared mailbox. No user login, no delegated OAuth, no SMTP.

This release is the first round of fixes after a real deployment, plus a security review.

Fixed

• The "Send test email" button no longer lies about being ready. The test sends with the
  saved settings, so filling the form in and clicking the button used to report that Missivus was
  switched off. The button now stays disabled until the stored configuration can actually send,
  names what is missing, and re-checks itself when a save completes — no page reload.
• The result box is readable in the dark theme. It set a background colour but not a foreground
  one, so the Graph error — the one thing worth reading — was light text on a light panel. It now
  uses Matomo's own notification / notification-success / notification-error /
  notification-info classes.
• A network failure while uploading a large attachment escaped as an unhandled exception, skipping
  the fallback setting and writing a pre-authenticated upload URL to the log. It is now a normal,
  redacted transport failure.

Security

A full audit of the transport, settings, API method and Vue component is published as
docs/SECURITY.md
— including the three risks that were accepted rather than eliminated, with the reasoning.

• A graph_base_url / login_base_url override is refused unless it is a bare https origin, so a
  mis-set or hostile value can no longer send a client secret or a bearer token in clear text
  somewhere else.
• uploadUrl values are redacted, because a pre-authenticated URL is itself a credential.
• Every setting is validated on entry.
• Missivus.sendTestEmail validates the recipient and refuses anything but an HTTP POST; the
  recipient now travels in the request body rather than the query string.
• Verified clean: secrets never reach the page source, the API response or the browser console;
  both API methods are superuser-gated; Graph error bodies are shown to superusers only; and a
  cross-site call cannot authenticate, because Matomo does not accept the session cookie for
  module=API requests.

Docs

docs/INSTALL.md Part 6 gains Upload via the Matomo UI (Docker or locked-down installs): why
enable_plugin_upload ships off, how to turn it on from the console or inside a container, the
upload and activate steps, and the command to close it again afterwards. The shell route remains
the recommended one.

Install

Download Missivus-0.1.1.zip below and unzip it into plugins/, or upload it through
Administration → Platform → Plugins → Install a new plugin, then
./console plugin:activate Missivus. The Microsoft-side setup — app registration, Mail.Send
application permission, shared mailbox, and the Exchange application access policy that scopes the
app to that one mailbox — is written for a non-expert in
docs/INSTALL.md.

Requires Matomo 5.x and PHP 7.2.5+. Lint clean and 60 unit tests passing on both PHP 7.2.34 and
PHP 8.5.9.