v0.7.9

Upgrading

• Clients of POST widget/chat/start/ that checked for 200, or for 400 on
  bad input, should accept 201 and 422. The answer keeps every field it had
  (session_id included), so code reading those fields needs no change.
• Run python manage.py migrate escalated: migration 0035_chat_token_expiry
  adds a nullable ChatSession.customer_token_expires_at. Chats already in
  progress keep working: the next widget request with their token stores the
  token's hash in place of the plain value and gives it a full lifetime.
• Widget chat tokens now expire ESCALATED["GUEST_ACCESS"]["TTL_MINUTES"]
  after the chat starts (default 1440, clamped to 5 minutes .. 7 days), as in
  escalated-laravel. After that every chat route answers 404 and the visitor
  starts a new chat.
• ChatSession.customer_session_id now holds the token's SHA-256. Code that
  started a chat through ChatSessionService.start_chat reads the token once
  from session.visitor_token. Agent chat payloads no longer carry the
  visitor's token.

Added

• Mobile guest ticket routes. With API_ENABLED, the REST API now serves
  POST <API_PREFIX>/mobile/guest/tickets,
  GET <API_PREFIX>/mobile/guest/tickets/<grant> and
  POST <API_PREFIX>/mobile/guest/tickets/<grant>/replies beside the existing
  mobile verification and lookup, per the shared contract
  (escalated-developer-context domain-model/mobile-guest-api.md). They reuse
  the emailed codes, expiring grants, guest identity policy, attachment links
  and per-IP guest budgets of the browser and widget routes, so a grant from
  any surface opens the others; a bad or expired grant is a 404. See
  docs/guest-access.md.
• GUEST_RATE_LIMIT["REQUESTS_PER_MINUTE"] (default 60): every mobile
  guest request counts against it, on top of the ticket or reply bucket.

Changed

• The older POST widget/chat/start/ (trailing slash) now answers exactly
  like the widget's POST widget/chat/start, as escalated-laravel does: it
  is served by the same view and returns 201 with id and session_id
  (both the chat token), expires_at, ticket_reference, status,
  queue_position, agent_name, agent and messages. Validation failures
  and a bad verification code are now 422 with list-valued errors (were
  400 with string values).
• Guest answers now send Cache-Control: private, no-store (was
  no-store, private; same meaning). The five mobile guest routes send it and
  Referrer-Policy: no-referrer on every answer, errors included.

Security

• Widget chat tokens are stored hashed and expire. The token returned by
  chat/start (id, session_id) was stored in plain text and never expired.
  Only its SHA-256 is stored now, the start answers carry expires_at, and an
  unknown or expired token is a 404 on chat/<token>/... and on the older
  body-session_id routes. The guest's websocket chat check uses the same
  lookup.