v1.6.7

Upgrading

• Single sign-on is a new install-level switch, off by default
  (ESCALATED_SSO constant or environment variable, or the
  escalated_access_sso filter). The schema upgrade adds
  escalated_sso_message_ids. SAML needs pretty permalinks. See
  docs/access-control.md.
• Two-factor authentication is a new install-level switch, off by default
  (ESCALATED_TWO_FACTOR constant or environment variable, or the
  escalated_access_two_factor filter). While it is off, the
  token-authenticated admin/two-factor REST routes answer 404. TOTP secrets
  generated from now on are 32 characters. The schema upgrade adds
  two_factors.last_used_step. See docs/access-control.md.
• Roles & permissions is a new install-level switch, off by default
  (define('ESCALATED_ROLES_PERMISSIONS', true); in wp-config.php, the
  environment variable of the same name, or the
  escalated_access_roles_permissions filter). Off, nothing changes. Before
  turning it on, give every staff user an Escalated role (escalated_admin,
  escalated_agent, escalated_light_agent or a role of yours holding
  escalated_* capabilities): with it on, staff API tokens and the ticket
  screen's actions need the owner's own capabilities. See
  docs/access-control.md.

Added

• Single sign-on, enforced behind its switch (ADR
  2026-10-29-configurable-access-features, as escalated-laravel, on the same
  libraries): SAML through onelogin/php-saml in strict mode (signed assertion,
  Issuer, Audience, Destination, Recipient, windows, InResponseTo of a request
  issued here, no replay), OAuth 2 / OIDC through league/oauth2-client with a
  single-use state and PKCE, and JWT through firebase/php-jwt (pinned
  algorithm, required exp, aud and single-use jti), at escalated/v1/sso/*.
  Escalated > Single Sign-On picks the provider, masks the secrets and lists
  the endpoints. Unknown emails are refused unless
  ESCALATED_SSO_CREATE_USERS; ESCALATED_SSO_SYNC_ROLES maps the IdP role
  onto Escalated roles while roles & permissions is on.
• Two-factor authentication, enforced behind its switch (ADR
  2026-10-29-configurable-access-features, as escalated-laravel): TOTP
  through pragmarx/google2fa with one step of drift and no code reuse,
  Escalated > Two-Factor enrolment for every staff user, a challenge between
  the WordPress login and the Escalated screens (5 attempts a minute, kept in
  the WordPress login session, so every new login is challenged), single-use
  recovery codes, "require two-factor" (ESCALATED_TWO_FACTOR_REQUIRED or
  the two_factor_required setting) and wp escalated two-factor-reset.
  Staff REST requests made with the login cookie get 403 two_factor_required until the challenge is passed; API tokens are not
  challenged.
• Roles & permissions, enforced behind its switch (ADR
  2026-10-29-configurable-access-features, as escalated-laravel, with
  WordPress capabilities as the permissions and WordPress roles as the
  roles): every staff REST route needs its capability
  (Escalated\Support\RoutePermissions, fail closed), a status change to
  resolved/closed/reopened needs ticket.close, API tokens are checked as
  their owner, and the ticket screen's actions need their own capabilities.
  Escalated > Roles edits the Escalated capabilities of WordPress roles, and
  the Users screen assigns them, while the switch is on.

What's Changed

• Enforce roles & permissions behind an install-level switch by @mpge in #116
• Enforce two-factor authentication behind an install-level switch by @mpge in #117
• Enforce single sign-on behind an install-level switch by @mpge in #118
• chore(release): v1.6.7 by @mpge in #119

Full Changelog: v1.6.6...v1.6.7