v1.6.6

Upgrading

• POST widget/chat/start now answers exactly as escalated-laravel: 201 { id, session_id, expires_at, ticket_reference, status, agent_name }, where
  id and session_id are both the chat token (plus guest_token,
  visitor_name, messages, agent and created_at). The numeric
  session_id and ticket_id are no longer returned: use id with the
  widget/chat/{id}/... routes and ticket_reference to name the ticket. The
  older numeric widget/chat/{n}/messages|end|poll routes still work for
  clients that already hold a numeric id.
• The plugin's schema upgrade (run automatically on load, as for every
  release) adds visitor_token_hash and visitor_token_expires_at to the
  chat sessions table. Chats already in progress keep working: the next
  widget request with their token (still the chat ticket's guest_token)
  moves the token's hash to the session with a full lifetime and clears the
  ticket's copy.
• Widget chat tokens now expire guest_access_ttl_minutes after the chat
  starts (default 1440, clamped to 5 minutes .. 7 days; filter
  escalated_guest_access_ttl_minutes), as in escalated-laravel. After that
  every /widget/chat/{id}/... route answers 404, the older numeric routes
  answer 403, and the visitor starts a new chat.
• ChatSessionService::start() returns the token once as
  $session->visitor_token; new chat tickets no longer carry it as their
  guest_token.

Added

• Mobile guest API under /wp-json/escalated/v1/mobile/guest/:
  POST verification, POST lookup, POST tickets,
  GET tickets/{token} and POST tickets/{token}/replies, following
  escalated-developer-context domain-model/mobile-guest-api.md. The routes
  use the existing email codes, guest access grants and per-IP guest budgets,
  so grants work across the widget, the guest pages and the mobile routes.
  Anything other than an active grant (including chat tokens and legacy
  links) answers 404, and every answer is Cache-Control: private, no-store.
  The routes are also limited per client IP by the api_rate_limit setting,
  with X-RateLimit-* headers. See docs/guest-access.md.
• Attachment downloads accept a signed guest link
  (AttachmentService::guest_download_url()), which the mobile ticket
  object uses for reply attachments. It works only while the ticket's grant
  is active and never for internal-note files.

Security

• Widget chat tokens are stored hashed and expire. The token returned by
  POST /widget/chat/start (id, guest_token) was the chat ticket's plain
  guest_token, never expired, and (with legacy tokens on) also opened the
  ticket's guest routes. It is now kept only as a SHA-256 on the chat
  session, the start answer carries expires_at, and an unknown or expired
  token is refused on every chat route.

What's Changed

• Hash widget chat tokens and expire them like guest grants by @mpge in #112
• Answer widget chat start like escalated-laravel by @mpge in #113
• Add the mobile guest API by @mpge in #114
• chore(release): v1.6.6 by @mpge in #115

Full Changelog: v1.6.5...v1.6.6