📜 История на версиите

## v1.0.6 - 2 юни 2026 Bug fix release. Bundle unchanged from v1.0.4. ### Fixed - FW-WHITELIST-CONFUSION-001: Admin self-lockout caused by confusing dual-whitelist UI. Two separate IP whitelist settings (login + firewall) required configuration in BOTH for full admin protection. UI did not communicate this. Migration auto-syncs both options on upgrade so existing admin IPs are preserved without manual intervention. ### Upgrade notes - Migration 004 runs automatically on plugin activation/upgrade - Idempotent: safe to run multiple times - No DB schema, REST, or bundle changes - Existing admin IPs preserved (merged, never overwritten) - Sites with neither whitelist configured: no-op (no behaviour change) ### Production impact - aluminieviparapeti.com: migration will sync Огняновия IP across both settings - zlatnitemomicheta.eu: no-op (both already set by manual fix earlier today) - Future installs: setting one whitelist via UI auto-populates the other

## v1.0.5 - 2 юни 2026 Bug fixes + cleanup hardening. Bundle unchanged from v1.0.4. ### Fixed - FW-METRICS-SCHEMA-001: Hourly DB errors ('Unknown column action/rule_id') from metrics aggregator and dashboard. firewall.rules.matches metric finally collects data. - FW-CRON-ORPHAN-001: Orphan cron 'invalid_schedule' errors after deactivation. Plugin now clears all 5 cron hooks via single source of truth helper. ### Other - readme.txt Stable tag bumped 1.0.2 -> 1.0.5 (was stale) ### Upgrade notes - No DB schema, REST, or bundle changes - Safe direct upgrade from any v1.0.x

v1.0.4 — 30 май 2026

Major release: Trusted Admin Protection — администраторите вече не могат да бъдат заключени от собствения си сайт от собствения си firewall.

Нова функционалност

• FW-TRUSTED-ADMIN-001 — Auto-learn на trusted (IP, User-Agent) при успешен админ login. Доверените устройства bypass-ват всички firewall блокировки. Не-доверените остават напълно защитени.
• Binding е IP+UA (sha256 fingerprint) — не само IP. Атакуващ на същия IP не може да piggyback върху доверена сесия.
• Auto-learn settings: firewall.trusted_admin_auto_learn (default ON), firewall.trusted_admin_ttl_days (default 30 days)
• Revoke API готов (UI идва в v1.0.5)

Firewall hardening (3 P0 fixes)

• FW-ESCALATE-ON-ACCESS-001 — TTL вече не се refresh-ва при повтарящи се hits на блокирано IP. "1 час блок" реално означава 1 час, дори при continuous атака. attempts counter продължава да расте за диагностика.
• FW-WHITELIST-MISSING-001 — Нов firewall.whitelist_ips setting за статични trusted IP-та (CI servers, monitoring). Bypass-ва blocklist в preflight.
• FW-EXPIRE-DISPLAY-DRIFT-001 — Поправен timezone drift между blocked_until (table) и transient TTL. Bundle UI вече показва точното време на изтичане без 3-часов offset.

License + System Preferences (carried from 28 май)

• LIC-005: License Invalid table вече не показва stale premium entitlements
• LIC-006: License Expired има отделен UI branch с renewal CTA, не се слива с Invalid
• LIC-009: Grace mode — network failure вече не downgrade-ва valid license
• System Preferences hybrid: debug logging е REAL (Logger ползва cssp_log_level), telemetry + performance persist + честно UI описание

Архитектура

• CSSP_Security_Kernel constructor разширен с nullable ?CSSP_Settings и ?CSSP_Trusted_Admin_Service params (backward-compatible)
• Нов service: CSSP_Trusted_Admin_Service в Login Security module. Reuses съществуващата cssp_trusted_devices table — no migration needed.
• Owner/consumer split: Login Security records trust, Firewall consumes trust. Cleaner module boundaries.

Известни ограничения (v1.0.5 backlog)

• Trusted Admin Settings UI (list/add/remove) идва в v1.0.5 — backend API е готов
• Login page recovery за нови администратори от непознато IP — отделен sprint
• Multi-factor (browser cookie + device fingerprint) — Ниво 2 от защитната система

v1.0.3 — 28 май 2026

• 🔧 FIX (production): "Metrics temporarily unavailable" на dashboard след upgrade — добавени липсващи capabilities (view_cssp_dashboard, view_cssp_activity, view_cssp_health, view_cssp_login, manage_cssp_health)
• 🔧 FIX: Capabilities се регистрират и при plugin upgrade, не само при първоначално активиране (upgrade-safe version sync в init)
• 📦 Версията е напълно backward-compatible — администраторите получават новите права автоматично след upgrade

v1.0.2 — Predecessor

• 📝 Initial public release: Dashboard widget metrics, activity log, health checks, security login, REST API foundation
• 🔐 License system: yearly activation + grace mode + Updater pipeline
• 📡 Updater: WP filters + manual "Check for updates" link