👁️ Heimdall

v5.1 - 14 Aug 2026

Added

• Subscriptions grew a full lifecycle: cancelled subscriptions keep access through the paid-for grace period, resumeSubscription() lets users change their mind while it lasts, and isSubscribedTo() checks for a specific plan
• subscription() returns the newest subscription, so a resubscribed user sees their current plan instead of an old cancelled row
• Trial and past-due states are reported properly, so you can build dunning flows on top
• Signed-in user context is attached to Leaf Crash reports, so error reports tell you who hit the crash
• Role and permission middleware error pages render through Crash's design language
• Google sign-in works without leafs/leaf installed, and resolves its redirect URI from the live environment (thanks @fadrian06
• Much larger test suite: roles, subscriptions and Google flows are fully covered, running on in-memory SQLite with no database service needed

Fixed

• Fixed "Provided key too short" during token generation
• Adding columns to an existing users table works during migration
• Fixed JSON column handling on MySQL
• Validation keeps all errors instead of only the first one
• Types tightened across the module from a full PHPStan pass @fadrian06

Changed

• Roles and permissions are out of beta. assign() now fails loudly with an error when given a role that was never registered with createRoles(), instead of quietly granting nothing
• hasActiveSubscription() returns true during the cancellation grace period, matching how users expect access to work
• cancelSubscription() cancels at the end of the billing period by default; pass false to revoke immediately
• Auth requires PHP 8.2+