Version 1.4.0 - Granular Webhooks.

New Feature: Granular Webhooks

This major update introduces a much-requested feature: the ability to subscribe to webhooks for specific data tables, giving you fine-grained control over your automations.

• Per-Table Events: You can now create webhooks that trigger only for events on a specific table (e.g., Books: Item Created) instead of just global "catch-all" events.
• Dynamic UI: The "Add New Webhook" form on the Settings page now dynamically populates the Event dropdown with options for each of your custom tables.
• Flexible Logic: The system is backward-compatible and still supports global webhooks that trigger for any table.

IMPORTANT: Due to a database schema change, you must deactivate and then reactivate the Ahoi API plugin after updating to ensure the new functionality works correctly.

Version 1.3.0 - User Creation Webhooks.

New Feature: user.created Webhook

This release activates the user.created webhook, a powerful tool for automating actions when a new user joins.

• Functionality: Whenever a user is successfully created via the /register or POST /users endpoints, the API will now send a POST request to any subscribed Target URLs.
• Payload: The webhook payload includes the complete user data object, allowing for rich integrations with external services like CRMs, marketing platforms, or notification systems.
• The "(Future Implementation)" label has been removed from the Settings page to reflect this change.

Version 1.2.5 - Documentation Update.

Documentation Overhaul

This is a documentation-only release. No code functionality has been changed.

The README.md and readme.txt files have been completely rewritten to provide a much clearer and more comprehensive guide for new users.

Key improvements include:

• A detailed, step-by-step installation guide.
• An in-depth explanation of the new role-based permission system and custom capabilities.
• A new FAQ section to address common questions.
• Clearer examples and better overall structure.

Version 1.2.4 - Security Patch.

Security Fix

This is a critical security update that hardens the user management endpoints.

• Enforced Role Hierarchy: Implemented strict checks to prevent users with lower-level roles (e.g., 'Manager') from viewing, creating, or editing users with the 'Administrator' role. The API now correctly respects the WordPress role hierarchy.
• The get_users endpoint now filters out administrator accounts for any non-admin user making a request, preventing data leakage.

Version 1.2.3 - Granular User Permissions.

Enhancements & Security Refinements

This release introduces a more refined and secure permission system for the user management endpoints, establishing a clear hierarchy between 'Manager' and 'Administrator' roles.

• New manage_api_users Capability: A new capability has been added to explicitly grant user management permissions via the API, decoupling it from WordPress's default role hierarchy.
• Role-Based Restrictions:
  • Managers can now create, view, and edit other users (excluding administrators).
  • User Deletion is now restricted to Administrators only for enhanced security.
• Filtered Roles List: The /roles endpoint now intelligently filters the list of roles. Managers will only see custom-defined roles, while Administrators can see all roles, preventing accidental assignment of high-level permissions.

Version 1.2.2 - Full Management Permissions.

Enhancements

This release completes the permission model for power-users (Administrators & Managers), giving them full control over all data entries within the system.

• Full CRUD Permissions for Managers: Users with the manage_ahoi_api_all_data capability can now perform GET, UPDATE, and DELETE operations on any entry from any custom table, regardless of the original owner.
• Security Logic Refined: The get_item, update_item, and delete_item methods in the dynamic CRUD controller now correctly bypass ownership checks for these power-users, while maintaining strict security for regular users. This allows administrators to moderate content effectively from a client application.

Version 1.2.1 - User Deletion Endpoint.

API Enhancements

This release adds a crucial feature for user management, allowing administrators and managers to delete users directly through the API.

• New DELETE /users/{id} Endpoint: A new REST API endpoint has been registered. Authenticated users with the delete_users capability can now programmatically delete other users. This completes the user management CRUD cycle and enables more powerful client-side applications.
• The endpoint includes a security check to prevent a user from deleting their own account.

Version 1.2.0 - Headless Permission Model.

This is a significant update that reworks the plugin's permission model to better suit modern, headless applications. API permissions are now decoupled from standard WordPress roles, giving developers full control over their application's business logic.

New Features & Enhancements

• Flexible Permission Model: Introduced a new use_ahoi_api capability that allows any user role (including 'Subscriber') to perform basic API actions like file uploads and email sending.
• Manager & Admin Views: Added a powerful manage_ahoi_api_all_data capability that allows 'Manager' and 'Administrator' roles to view and manage data entries created by all users.

Bug Fixes

• Login Response: The authentication endpoint (/token) now correctly includes the user's roles in the response, enabling role-based features in client applications.
• Windows Compatibility: Resolved a critical activation error that occurred on Windows-based servers due to incorrect file path construction.

Note: After updating, it is recommended to deactivate and reactivate the plugin to ensure the new capabilities are correctly assigned to all user roles.