version to 2.0.0

feat(core): bump version to 2.0.0 and update README with ecosystem ov…

v1.1.0 — Settings, 2FA TOTP, RBAC, Core ZIP Updater & Appearance Customizer

🚀 LCMS Core v1.1.0 — Settings, 2FA TOTP, RBAC, Core ZIP Updater & Appearance Customizer

We are thrilled to announce the release of LCMS Core v1.1.0! This milestone update consolidates administration capabilities, introduces enterprise-grade security (2FA TOTP), role-based access control (RBAC), a safe zero-SSH Core ZIP updater with automated backups, and real-time public appearance customization.

---

🌟 Key Features & Improvements

1. ⚙️ Settings Engine & Runtime Configuration (SettingManager)

• Encrypted Database Storage: New cms_settings table providing typed, secure persistence for system configurations.
• Dynamic Runtime Overrides: Immediate live application of settings (Site Name, SMTP, Timezone, Locale) without modifying .env.
• SMTP Gateway & Interactive Mail Tester: Direct mail delivery diagnostics with error capture via MailTesterService and SmtpTestMail.
• HTTP 503 Maintenance Mode: Instant toggle with custom visitor messages, automatic bypass for authenticated administrators, and static asset whitelisting (imgs/*, vendor/*, favicon.ico).
• System Diagnostics: Live dashboard monitoring PHP/Laravel/Database versions, upload/memory limits, and directory write permissions.

2. 🛡️ Security & Two-Factor Authentication (2FA TOTP)

• Native TOTP 2FA: Compatible with Google Authenticator, Microsoft Authenticator, 1Password, etc.
• Standalone Vector QR Code: Rendered with native inline SVG (bacon/bacon-qr-code) without any third-party external API calls.
• Encrypted Recovery Codes: Single-use emergency backup codes to prevent administrative lockouts.
• Bruteforce Protection: Dedicated 2FA challenge throttle using Laravel's RateLimiter.
• Emergency CLI Commands:
  • php artisan cms:security:enable-2fa {email}
  • php artisan cms:recovery:disable-2fa {email}
• Active Sessions Management: Inspect and remotely revoke concurrent sessions across different devices.

3. 👥 Role-Based Access Control (RBAC) & Accounts Management

• Full RBAC Schema: Granular permissions and roles architecture (roles, permissions, role_user, permission_role).
• Protected System Roles: Guarded super_admin role with universal authorization bypass (Gate::before).
• Permission Matrix UI: Categorized management interface covering Plugins, Themes, Pages, Media, Settings, Users, and Updates.
• Administrator Accounts Control: Status toggling (active/inactive), emergency admin 2FA reset, and visual SuperAdmin navbar badge.

4. 📦 Secure Core ZIP Updater (CoreZipUpdater)

• Zero-SSH Core Updates: Deploy core engine updates directly from the admin dashboard via uploaded ZIP archives.
• Strict Perimeter Isolation & Anti-Zip-Slip: Enforced directory traversal checks with absolute restriction preventing changes to platform/plugins/, platform/themes/, user uploads, or .env.
• Automated Pre-Update Backup (BackupService): Automatic timestamped ZIP archives of app/Core, platform/core, config/cms.php and SQL database dump stored in storage/app/cms-backups/.
• Disaster Recovery & Instant Rollback: Automatic rollback to previous safe state if any exception occurs during update or migrations.
• Audit History: Full update tracking in cms_updates_history.

5. 🎨 Appearance Customizer & Direct Theme Asset Publishing

• Unified Sidebar Treeview: AdminLTE 4 "Apparence" menu grouping Themes Management and Customize Appearance.
• Live Public Code Injector: Direct editor for custom CSS, JavaScript scripts, and <head> tags (meta tags, analytics, web fonts) hooked seamlessly to cms.head and cms.footer.
• Direct Asset Publishing: In-dashboard button to publish/force assets copy to public/vendor/themes/{id}, plus global --all capability.
• Auto-Publish on Boot: Safe check ensuring active theme assets exist in public/vendor/themes/ upon boot.
• Interactive Theme Details Modal: Inspect author, version, directory path, asset publication status, and manifest options.
• RBAC Permissions: themes.view, themes.manage, appearance.customize.

6. 🧹 Architecture Polishing

• Streamlined Navigation: Cleaned up NavigationRegistry to focus strictly on modular dynamic plugins.
• Cleaned Authentication Page: Removed development placeholders and credentials hints from the login interface.

---

📊 Quality & Verification Metrics

• Automated Tests: 291 tests passed (1,811 assertions, 0 failures).
• Static Analysis: PHPStan Level 8 with 0 errors.
• Code Style: Laravel Pint 100% compliant.
• Database: Full migration integrity across SQLite and MySQL.

---

🛠️ Upgrade Guide (v1.0.0 ➔ v1.1.0)

To upgrade an existing installation:

# 1. Pull latest changes
git pull origin main

# 2. Update Composer dependencies
composer install --no-dev --optimize-autoloader

# 3. Run new core migrations
php artisan migrate --force

# 4. Seed default roles and permissions
php artisan db:seed --class=RoleSeeder --force

# 5. Publish theme assets
php artisan cms:theme:publish-assets --all

# 6. Clear and warm up caches
php artisan config:cache
php artisan route:cache
php artisan view:cache

LCMS Core V1.0.0

LCMS Core V1.0.0