Merge pull request 'chore: cascade main → dev (9c9a1a7) [skip ci]' (#61) from main into dev

chore: cascade main → dev [skip ci]

.mokogitea/manifest.xml

@@ -8,6 +8,7 @@
     <name>MokoWaaS</name>
     <org>MokoConsulting</org>
     <description>White-label identity, security hardening, and tenant restriction layer for WaaS-managed Joomla environments</description>
+    <version>02.11.01</version>
     <license spdx="GPL-3.0-or-later">GNU General Public License v3</license>
   </identity>
   <governance>

.mokogitea/workflows/auto-bump.yml

@@ -0,0 +1,84 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: moko-platform.Release
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
+# PATH: /.mokogitea/workflows/auto-bump.yml
+# VERSION: 09.02.00
+# BRIEF: Auto patch-bump version on every push to dev (skips merge commits)
+
+name: "Universal: Auto Version Bump"
+
+on:
+  push:
+    branches:
+      - dev
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+
+permissions:
+  contents: write
+
+jobs:
+  bump:
+    name: Version Bump
+    runs-on: release
+    if: >-
+      !contains(github.event.head_commit.message, '[skip ci]') &&
+      !contains(github.event.head_commit.message, '[skip bump]') &&
+      !startsWith(github.event.head_commit.message, 'Merge pull request')
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          token: ${{ secrets.GA_TOKEN }}
+          fetch-depth: 1
+
+      - name: Setup moko-platform tools
+        run: |
+          if ! command -v composer &> /dev/null; then
+            sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
+          fi
+          if [ -d "/opt/moko-platform/cli" ]; then
+            echo "MOKO_CLI=/opt/moko-platform/cli" >> "$GITHUB_ENV"
+          else
+            git clone --depth 1 --branch main --quiet \
+              "https://x-access-token:${{ secrets.GA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/moko-platform.git" \
+              /tmp/moko-platform-api
+            cd /tmp/moko-platform-api && composer install --no-dev --no-interaction --quiet
+            echo "MOKO_CLI=/tmp/moko-platform-api/cli" >> "$GITHUB_ENV"
+          fi
+
+      - name: Bump version
+        run: |
+          BUMP=$(php ${MOKO_CLI}/version_bump.php --path . 2>&1) || true
+          echo "$BUMP"
+
+          VERSION=$(php ${MOKO_CLI}/version_read.php --path . 2>/dev/null) || true
+          [ -z "$VERSION" ] && { echo "No version found — skipping"; exit 0; }
+
+          # Propagate to platform manifests
+          php ${MOKO_CLI}/version_set_platform.php \
+            --path . --version "$VERSION" --branch dev 2>/dev/null || true
+          php ${MOKO_CLI}/version_check.php --path . --fix 2>/dev/null || true
+
+          # Commit if anything changed
+          if git diff --quiet && git diff --cached --quiet; then
+            echo "No version changes to commit"
+            exit 0
+          fi
+
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
+          git remote set-url origin "https://jmiller:${{ secrets.GA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git add -A
+          git commit -m "chore(version): patch bump to ${VERSION} [skip ci]" \
+            --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>"
+          git push origin dev
+          echo "Bumped to ${VERSION}" >> $GITHUB_STEP_SUMMARY

.mokogitea/workflows/issue-branch.yml

@@ -0,0 +1,73 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: moko-platform.Automation
+# VERSION: 01.00.00
+# BRIEF: Auto-create feature branch when an issue is opened
+
+name: "Universal: Issue Branch"
+
+on:
+  issues:
+    types: [opened]
+
+permissions:
+  contents: write
+  issues: write
+
+env:
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+
+jobs:
+  create-branch:
+    name: Create feature branch
+    runs-on: ubuntu-latest
+    steps:
+      - name: Create branch and comment
+        run: |
+          TOKEN="${{ secrets.GA_TOKEN }}"
+          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
+          ISSUE_NUM="${{ github.event.issue.number }}"
+          ISSUE_TITLE="${{ github.event.issue.title }}"
+
+          # Build slug from title: lowercase, replace non-alnum with dash, trim
+          SLUG=$(echo "${ISSUE_TITLE}" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | sed 's/--*/-/g' | sed 's/^-//;s/-$//' | cut -c1-40)
+          BRANCH="feature/${ISSUE_NUM}-${SLUG}"
+
+          # Check dev branch exists
+          DEV_EXISTS=$(curl -sf -o /dev/null -w '%{http_code}' \
+            -H "Authorization: token ${TOKEN}" \
+            "${API}/branches/dev" 2>/dev/null || echo "000")
+
+          if [ "${DEV_EXISTS}" != "200" ]; then
+            echo "No dev branch -- skipping"
+            exit 0
+          fi
+
+          # Create branch from dev
+          HTTP=$(curl -sf -o /dev/null -w '%{http_code}' -X POST \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${API}/branches" \
+            -d "{\"new_branch_name\":\"${BRANCH}\",\"old_branch_name\":\"dev\"}" 2>/dev/null || echo "000")
+
+          if [ "${HTTP}" = "201" ]; then
+            echo "Created branch: ${BRANCH}"
+
+            # Comment on issue with branch link
+            REPO_URL="${GITEA_URL}/${{ github.repository }}"
+            BODY="Branch created: [\`${BRANCH}\`](${REPO_URL}/src/branch/${BRANCH})\n\n\`\`\`bash\ngit fetch origin\ngit checkout ${BRANCH}\n\`\`\`"
+
+            curl -sf -X POST \
+              -H "Authorization: token ${TOKEN}" \
+              -H "Content-Type: application/json" \
+              "${API}/issues/${ISSUE_NUM}/comments" \
+              -d "{\"body\":\"${BODY}\"}" > /dev/null 2>&1
+
+            echo "Commented on issue #${ISSUE_NUM}"
+          else
+            echo "Failed to create branch (HTTP ${HTTP}) -- may already exist"
+          fi

.mokogitea/workflows/pre-release.yml

@@ -1,260 +1,223 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
+#
-# SPDX-License-Identifier: GPL-3.0-or-later
+# SPDX-License-Identifier: GPL-3.0-or-later
-#
+#
-# FILE INFORMATION
+# FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: Gitea.Workflow
-# INGROUP: moko-platform.Release
+# INGROUP: moko-platform.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
-# PATH: /templates/workflows/universal/pre-release.yml.template
+# PATH: /templates/workflows/universal/pre-release.yml.template
-# VERSION: 05.00.00
+# VERSION: 05.01.00
-# BRIEF: Manual pre-release — builds dev/alpha/beta/rc packages from any branch
+# BRIEF: Manual pre-release -- builds dev/alpha/beta/rc packages from any branch
-
+
-name: "Universal: Pre-Release"
+name: "Universal: Pre-Release"
-
+
-on:
+on:
-  workflow_dispatch:
+  pull_request:
-    inputs:
+    types: [closed]
-      stability:
+    branches:
-        description: 'Pre-release channel'
+      - dev
-        required: true
+  workflow_dispatch:
-        type: choice
+    inputs:
-        options:
+      stability:
-          - development
+        description: 'Pre-release channel'
-          - alpha
+        required: true
-          - beta
+        type: choice
-          - release-candidate
+        options:
-
+          - development
-permissions:
+          - alpha
-  contents: write
+          - beta
-
+          - release-candidate
-env:
+
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+permissions:
-  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
+  contents: write
-  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+
-
+env:
-jobs:
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-  build:
+  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
-    name: "Build Pre-Release (${{ inputs.stability }})"
+  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
-    runs-on: release
+
-
+jobs:
-    steps:
+  build:
-      - name: Checkout
+    name: "Build Pre-Release (${{ inputs.stability || 'development' }})"
-        uses: actions/checkout@v4
+    runs-on: release
-        with:
+    if: >-
-          fetch-depth: 0
+      github.event_name == 'workflow_dispatch' ||
-          token: ${{ secrets.GA_TOKEN }}
+      (github.event.pull_request.merged == true && github.event.pull_request.base.ref == 'dev')
-
+
-      - name: Setup PHP
+    steps:
-        run: |
+      - name: Checkout
-          if ! command -v php &> /dev/null; then
+        uses: actions/checkout@v4
-            sudo apt-get update -qq
+        with:
-            sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl >/dev/null 2>&1
+          fetch-depth: 0
-          fi
+          token: ${{ secrets.GA_TOKEN }}
-
+
-      - name: Setup moko-platform tools
+      - name: Setup moko-platform tools
-        env:
+        env:
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN }}
+          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN }}
-          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
-        run: |
+        run: |
-          git clone --depth 1 --branch main --quiet             "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/moko-platform.git"             /tmp/moko-platform-api
+          if ! command -v composer &> /dev/null; then
-
+            sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
-      - name: Detect platform
+          fi
-        id: platform
+          git clone --depth 1 --branch main --quiet \
-        run: |
+            "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/moko-platform.git" \
-          php /tmp/moko-platform-api/cli/manifest_read.php --path . --github-output
+            /tmp/moko-platform-api
-
+          cd /tmp/moko-platform-api && composer install --no-dev --no-interaction --quiet
-      - name: Resolve metadata
+          echo "MOKO_CLI=/tmp/moko-platform-api/cli" >> "$GITHUB_ENV"
-        id: meta
+
-        run: |
+      - name: Detect platform
-          STABILITY="${{ inputs.stability }}"
+        id: platform
-          MOKO_API="/tmp/moko-platform-api/cli"
+        run: |
-
+          php ${MOKO_CLI}/manifest_read.php --path . --github-output
-          case "$STABILITY" in
+
-            development)        SUFFIX="-dev";   TAG="development" ;;
+      - name: Resolve metadata and bump version
-            alpha)              SUFFIX="-alpha"; TAG="alpha" ;;
+        id: meta
-            beta)               SUFFIX="-beta";  TAG="beta" ;;
+        run: |
-            release-candidate)  SUFFIX="-rc";    TAG="release-candidate" ;;
+          STABILITY="${{ inputs.stability || 'development' }}"
-          esac
+
-
+          case "$STABILITY" in
-          # Read current version from manifest (priority) or README — no bump yet
+            development)        SUFFIX="-dev";   TAG="development" ;;
-          VERSION=$(php ${MOKO_API}/version_read.php --path .)
+            alpha)              SUFFIX="-alpha"; TAG="alpha" ;;
-          echo "Version: ${VERSION}"
+            beta)               SUFFIX="-beta";  TAG="beta" ;;
-
+            release-candidate)  SUFFIX="-rc";    TAG="release-candidate" ;;
-          # Ensure platform-specific manifest matches
+          esac
-          php ${MOKO_API}/version_set_platform.php --path . --version "${VERSION}"
+
-
+          # Read current version (bump already handled by push workflow)
-          # Git setup for later commits
+          VERSION=$(php ${MOKO_CLI}/version_read.php --path . 2>/dev/null)
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          [ -z "$VERSION" ] && VERSION="00.00.01"
-          git config --local user.name "gitea-actions[bot]"
+
-          git remote set-url origin "https://jmiller:${{ secrets.GA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          php ${MOKO_CLI}/version_set_platform.php \
-
+            --path . --version "$VERSION" --branch "${{ github.ref_name }}" 2>/dev/null || true
-          # Detect element from Joomla/Dolibarr manifest
+
-          set +o pipefail
+          # Verify version consistency across all files
-          PLATFORM="${{ steps.platform.outputs.platform }}"
+          php ${MOKO_CLI}/version_check.php --path . --fix 2>/dev/null || true
-          EXT_ELEMENT=$(php ${MOKO_API}/manifest_read.php --path . --field name 2>/dev/null | tr -d ' ' | tr '[:upper:]' '[:lower:]' || true)
+
-          # For Joomla, prefer <element> tag
+          # Commit version bump
-          if [ "$PLATFORM" = "joomla" ]; then
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-            MANIFEST=$(find . -maxdepth 4 -name "*.xml" ! -path "./.git/*" -print0 2>/dev/null | xargs -0 grep -l '<extension' 2>/dev/null | head -1 || true)
+          git config --local user.name "gitea-actions[bot]"
-            if [ -n "$MANIFEST" ]; then
+          git remote set-url origin "https://jmiller:${{ secrets.GA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
-              ELEM=$(grep -oP "<element>\K[^<]+" "$MANIFEST" 2>/dev/null | head -1 || true)
+          git add -A
-              [ -n "$ELEM" ] && EXT_ELEMENT="$ELEM"
+          git diff --cached --quiet || {
-            fi
+            git commit -m "chore(version): pre-release bump to ${VERSION} [skip ci]"
-          fi
+            git push origin HEAD 2>&1
-          [ -z "$EXT_ELEMENT" ] && EXT_ELEMENT=$(echo "${GITEA_REPO}" | tr '[:upper:]' '[:lower:]' | tr -d ' -')
+          }
-          set -o pipefail
+
-
+          # Auto-detect element via manifest_element.php
-          ZIP_NAME="${EXT_ELEMENT}-${VERSION}${SUFFIX}.zip"
+          php ${MOKO_CLI}/manifest_element.php \
-
+            --path . --version "$VERSION" --stability "$STABILITY" \
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+            --repo "${GITEA_REPO}" --github-output
-          echo "stability=${STABILITY}" >> "$GITHUB_OUTPUT"
+
-          echo "suffix=${SUFFIX}" >> "$GITHUB_OUTPUT"
+          # Read back element outputs
-          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          EXT_ELEMENT=$(grep '^ext_element=' "$GITHUB_OUTPUT" | tail -1 | cut -d= -f2)
-          echo "zip_name=${ZIP_NAME}" >> "$GITHUB_OUTPUT"
+          ZIP_NAME=$(grep '^zip_name=' "$GITHUB_OUTPUT" | tail -1 | cut -d= -f2)
-          echo "ext_element=${EXT_ELEMENT}" >> "$GITHUB_OUTPUT"
+          [ -z "$EXT_ELEMENT" ] && EXT_ELEMENT=$(echo "${GITEA_REPO}" | tr '[:upper:]' '[:lower:]' | tr -d ' -')
-
+          [ -z "$ZIP_NAME" ] && ZIP_NAME="${EXT_ELEMENT}-${VERSION}${SUFFIX}.zip"
-          echo "=== Pre-Release: ${EXT_ELEMENT} ${VERSION}${SUFFIX} ==="
+
-
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-      - name: Build package
+          echo "stability=${STABILITY}" >> "$GITHUB_OUTPUT"
-        id: zip
+          echo "suffix=${SUFFIX}" >> "$GITHUB_OUTPUT"
-        run: |
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
-          VERSION="${{ steps.meta.outputs.version }}"
+          echo "zip_name=${ZIP_NAME}" >> "$GITHUB_OUTPUT"
-          SUFFIX="${{ steps.meta.outputs.suffix }}"
+          echo "ext_element=${EXT_ELEMENT}" >> "$GITHUB_OUTPUT"
-          PLATFORM="${{ steps.platform.outputs.platform }}"
+
-
+          echo "=== Pre-Release: ${EXT_ELEMENT} ${VERSION}${SUFFIX} ==="
-          if [ "$PLATFORM" = "joomla" ]; then
+
-            php /tmp/moko-platform-api/cli/joomla_build.php               --path . --version "${VERSION}" --suffix "${SUFFIX}"               --output build --github-output
+      - name: Create release
-          else
+        id: release
-            # Generic build: zip src/ directory
+        run: |
-            SOURCE_DIR="src"
+          TAG="${{ steps.meta.outputs.tag }}"
-            [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="htdocs"
+          VERSION="${{ steps.meta.outputs.version }}"
-            [ ! -d "$SOURCE_DIR" ] && { echo "::error::No src/ or htdocs/"; exit 1; }
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-            EXT_ELEMENT="${{ steps.meta.outputs.ext_element }}"
+          php ${MOKO_CLI}/release_create.php \
-            ZIP_NAME="${EXT_ELEMENT}-${VERSION}${SUFFIX}.zip"
+            --path . --version "$VERSION" --tag "$TAG" \
-            mkdir -p build
+            --token "${{ secrets.GA_TOKEN }}" --api-base "$API_BASE" \
-            cd "$SOURCE_DIR" && zip -r "../build/${ZIP_NAME}" . && cd ..
+            --repo "${GITEA_REPO}" --branch dev --prerelease
-            SHA256=$(sha256sum "build/${ZIP_NAME}" | cut -d' ' -f1)
+
-            echo "zip_name=${ZIP_NAME}" >> "$GITHUB_OUTPUT"
+      - name: Build package and upload
-            echo "zip_path=build/${ZIP_NAME}" >> "$GITHUB_OUTPUT"
+        id: package
-            echo "sha256=${SHA256}" >> "$GITHUB_OUTPUT"
+        run: |
-          fi
+          VERSION="${{ steps.meta.outputs.version }}"
-
+          TAG="${{ steps.meta.outputs.tag }}"
-      - name: Create or replace Gitea release
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-        id: release
+          php ${MOKO_CLI}/release_package.php \
-        continue-on-error: true
+            --path . --version "$VERSION" --tag "$TAG" \
-        run: |
+            --token "${{ secrets.GA_TOKEN }}" --api-base "$API_BASE" \
-          TAG="${{ steps.meta.outputs.tag }}"
+            --repo "${GITEA_REPO}" --output /tmp || true
-          VERSION="${{ steps.meta.outputs.version }}"
+
-          STABILITY="${{ steps.meta.outputs.stability }}"
+      - name: Update updates.xml
-          SHA256="${{ steps.zip.outputs.sha256 }}"
+        if: steps.platform.outputs.platform == 'joomla'
-          ZIP_NAME="${{ steps.zip.outputs.zip_name }}"
+        run: |
-          EXT_ELEMENT="${{ steps.meta.outputs.ext_element }}"
+          VERSION="${{ steps.meta.outputs.version }}"
-          TOKEN="${{ secrets.GA_TOKEN }}"
+          STABILITY="${{ steps.meta.outputs.stability }}"
-          API="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          SHA256="${{ steps.package.outputs.sha256_zip }}"
-          BRANCH=$(git branch --show-current)
+
-
+          if [ ! -f "updates.xml" ]; then
-          BODY="## ${VERSION} ($(date +%Y-%m-%d))
+            echo "No updates.xml -- skipping"
-          **Channel:** ${STABILITY}
+            exit 0
-          **SHA-256:** \`${SHA256}\`"
+          fi
-
+
-          # Delete existing release
+          SHA_FLAG=""
-          EXISTING_ID=$(curl -sS -H "Authorization: token ${TOKEN}" \
+          [ -n "$SHA256" ] && SHA_FLAG="--sha ${SHA256}"
-            "${API}/releases/tags/${TAG}" | jq -r '.id // empty' 2>/dev/null)
+
-          if [ -n "$EXISTING_ID" ]; then
+          php ${MOKO_CLI}/updates_xml_build.php \
-            curl -sS -X DELETE -H "Authorization: token ${TOKEN}" \
+            --path . --version "${VERSION}" --stability "${STABILITY}" \
-              "${API}/releases/${EXISTING_ID}" 2>/dev/null || true
+            --gitea-url "${GITEA_URL}" --org "${GITEA_ORG}" --repo "${GITEA_REPO}" \
-            curl -sS -X DELETE -H "Authorization: token ${TOKEN}" \
+            ${SHA_FLAG}
-              "${API}/tags/${TAG}" 2>/dev/null || true
+
-          fi
+          # Commit and push
-
+          if ! git diff --quiet updates.xml 2>/dev/null; then
-          # Create release
+            git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          RELEASE_ID=$(curl -sS -X POST -H "Authorization: token ${TOKEN}" \
+            git config --local user.name "gitea-actions[bot]"
-            -H "Content-Type: application/json" \
+            git add updates.xml
-            "${API}/releases" \
+            git commit -m "chore: update ${STABILITY} channel ${VERSION} [skip ci]"
-            -d "$(jq -n \
+            git push origin HEAD 2>&1 || echo "WARNING: push failed"
-              --arg tag "$TAG" \
+          fi
-              --arg target "$BRANCH" \
+
-              --arg name "${EXT_ELEMENT} ${VERSION} (${STABILITY})" \
+      - name: "Sync updates.xml to all branches"
-              --arg body "$BODY" \
+        if: steps.platform.outputs.platform == 'joomla'
-              '{tag_name: $tag, target_commitish: $target, name: $name, body: $body, prerelease: true}'
+        run: |
-            )" | jq -r '.id')
+          CURRENT_BRANCH="${{ github.ref_name }}"
-
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          echo "release_id=${RELEASE_ID}" >> "$GITHUB_OUTPUT"
+          git config --local user.name "gitea-actions[bot]"
-
+
-          # Upload ZIP
+          for BRANCH in main dev; do
-          curl -sS -X POST -H "Authorization: token ${TOKEN}" \
+            [ "$BRANCH" = "$CURRENT_BRANCH" ] && continue
-            -H "Content-Type: application/octet-stream" \
+            echo "Syncing updates.xml -> ${BRANCH}"
-            "${API}/releases/${RELEASE_ID}/assets?name=${ZIP_NAME}" \
+            git fetch origin "${BRANCH}" 2>/dev/null || continue
-            --data-binary "@${{ steps.zip.outputs.zip_path }}"
+            git checkout "origin/${BRANCH}" -- updates.xml 2>/dev/null || continue
-
+            git checkout "${CURRENT_BRANCH}" -- updates.xml
-          echo "Released: ${EXT_ELEMENT} ${VERSION} (${STABILITY})"
+            if ! git diff --quiet updates.xml 2>/dev/null; then
-
+              git add updates.xml
-      - name: "Update updates.xml"
+              git commit -m "chore: sync updates.xml from ${CURRENT_BRANCH} [skip ci]"
-        if: steps.platform.outputs.platform == 'joomla'
+              git push origin HEAD:refs/heads/${BRANCH} 2>&1 || echo "WARNING: push to ${BRANCH} failed"
-        run: |
+            fi
-          VERSION="${{ steps.meta.outputs.version }}"
+            git checkout "${CURRENT_BRANCH}" 2>/dev/null
-          STABILITY="${{ steps.meta.outputs.stability }}"
+          done
-          SHA256="${{ steps.zip.outputs.sha256 }}"
+
-          php /tmp/moko-platform-api/cli/updates_xml_build.php             --path . --version "$VERSION" --stability "$STABILITY"             --sha "$SHA256"             --gitea-url "$GITEA_URL" --org "$GITEA_ORG" --repo "$GITEA_REPO"
+      - name: "Delete lesser pre-release channels (cascade)"
-          if ! git diff --quiet updates.xml 2>/dev/null; then
+        continue-on-error: true
-            git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+        run: |
-            git config --local user.name "gitea-actions[bot]"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-            git add updates.xml
+          TOKEN="${{ secrets.GA_TOKEN }}"
-            git commit -m "chore: update $STABILITY channel $VERSION [skip ci]"
+
-            git push origin HEAD 2>&1 || echo "WARNING: push failed"
+          php ${MOKO_CLI}/release_cascade.php \
-          fi
+            --stability "${{ steps.meta.outputs.stability }}" \
-
+            --token "${TOKEN}" \
-      - name: "Sync updates.xml to all branches"
+            --api-base "${API_BASE}"
-        if: steps.platform.outputs.platform == 'joomla'
+
-        run: |
+      - name: Summary
-          php /tmp/moko-platform-api/cli/updates_xml_sync.php             --path .             --current "${{ github.ref_name }}"             --branches main,dev             --version "${{ steps.meta.outputs.version }}"             --token "${{ secrets.GA_TOKEN }}"             --org "${GITEA_ORG}"             --repo "${GITEA_REPO}"             --gitea-url "${GITEA_URL}"
+        if: always()
-
+        run: |
-      - name: "Delete lesser pre-release channels (cascade)"
+          VERSION="${{ steps.meta.outputs.version }}"
-        continue-on-error: true
+          STABILITY="${{ steps.meta.outputs.stability }}"
-        run: |
+          ZIP_NAME="${{ steps.meta.outputs.zip_name }}"
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          SHA256="${{ steps.package.outputs.sha256_zip }}"
-          TOKEN="${{ secrets.GA_TOKEN }}"
+          echo "## Pre-Release Complete" >> $GITHUB_STEP_SUMMARY
-          STABILITY="${{ steps.meta.outputs.stability }}"
+          echo "" >> $GITHUB_STEP_SUMMARY
-
+          echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
-          # Cascade: rc → beta,alpha,dev | beta → alpha,dev | alpha → dev | dev → nothing
+          echo "|-------|-------|" >> $GITHUB_STEP_SUMMARY
-          case "$STABILITY" in
+          echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
-            release-candidate) TAGS_TO_DELETE="beta alpha development" ;;
+          echo "| Channel | ${STABILITY} |" >> $GITHUB_STEP_SUMMARY
-            beta)              TAGS_TO_DELETE="alpha development" ;;
+          echo "| Package | \`${ZIP_NAME}\` |" >> $GITHUB_STEP_SUMMARY
-            alpha)             TAGS_TO_DELETE="development" ;;
+          echo "| SHA-256 | \`${SHA256:-n/a}\` |" >> $GITHUB_STEP_SUMMARY
-            *)                 TAGS_TO_DELETE="" ;;
-          esac
-
-          [ -z "$TAGS_TO_DELETE" ] && exit 0
-
-          for TAG in $TAGS_TO_DELETE; do
-            RELEASE_ID=$(curl -sS -H "Authorization: token ${TOKEN}" \
-              "${API_BASE}/releases/tags/${TAG}" 2>/dev/null | \
-              python3 -c "import sys,json; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
-
-            if [ -n "$RELEASE_ID" ] && [ "$RELEASE_ID" != "None" ]; then
-              curl -sS -X DELETE -H "Authorization: token ${TOKEN}" \
-                "${API_BASE}/releases/${RELEASE_ID}" 2>/dev/null || true
-              curl -sS -X DELETE -H "Authorization: token ${TOKEN}" \
-                "${API_BASE}/tags/${TAG}" 2>/dev/null || true
-              echo "Deleted: ${TAG} (id: ${RELEASE_ID})"
-            fi
-          done
-
-      - name: "Post-release version bump"
-        run: |
-          MOKO_API="/tmp/moko-platform-api/cli"
-          VERSION="${{ steps.meta.outputs.version }}"
-
-          # Bump patch for next dev cycle
-          BUMP_OUTPUT=$(php ${MOKO_API}/version_bump.php --path .)
-          NEXT=$(echo "$BUMP_OUTPUT" | grep -oP '\d{2}\.\d{2}\.\d{2}$' || true)
-          [ -z "$NEXT" ] && exit 0
-
-          # Update platform-specific manifest to next version
-          php ${MOKO_API}/version_set_platform.php --path . --version "${NEXT}"
-
-          git add -A
-          git diff --cached --quiet || {
-            git commit -m "chore: update development channel ${VERSION} [skip ci]"
-            git push origin HEAD 2>&1
-          }

CHANGELOG.md

@@ -31,6 +31,55 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - License/subscription check
 - System email template branding (DB approach)
 
+### Added
+- Trusted IPs: configurable repeatable rows of IP addresses, CIDR ranges, and wildcards that bypass admin session timeout
+- Supports exact IPs (192.168.1.100), CIDR (10.0.0.0/24), and wildcards (192.168.1.*)
+- Each entry has a label and enabled toggle for easy management
+- Current IP display above trusted IPs table so admins can easily add their own IP
+
+### Fixed
+- Trusted IP session bypass: moved from `onAfterInitialise` to `boot()` so Joomla's session lifetime is extended before the session handler validates it (was too late, Joomla expired the session first)
+
+## [02.06.00] - 2026-05-25
+
+### Added
+- Alias offline bypass: aliases with offline=No override Joomla's global offline setting, allowing access via alias domain while main site is down
+- Block non-master users from viewing or editing MokoWaaS plugin settings
+- Master user bypasses ALL tenant restrictions (install from URL, global config, sysinfo, installer, templates)
+- Admin Help menu redirected to configured support URL (replaces help.joomla.org)
+
+### Fixed
+- Install API endpoint: extract ZIP to temp directory before passing to Joomla Installer (was passing ZIP path directly)
+- Clean up extracted temp directory on success or failure
+- Update site disabled by Joomla when protected=1 — ensureProtectedFlag() now re-enables it
+- CI: auto-release fetches updates.xml from main before building (preserves all channels)
+- CI: version_check.php --fix runs after version bump in both workflows
+- CI: checksums attached as `[filename].sha256` files instead of in release body
+- CI: auto-release cleaned up — removed duplicate asset loops, inline Python updater, dead code
+- CI: Step 8b uses `release_body_update.php` CLI instead of inline Python
+- CI: Step 6 tag creation no longer gated by `is_minor` (was never set)
+
+### Changed
+- CI: auto-release uses stream tag `stable` instead of version tag `vXX`
+- CI: pre-release package build uses absolute paths (fixes relative path zip error)
+
+## [02.05.00] - 2026-05-24
+
+### Added
+- Joomla `protected=1` flag on all MokoWaaS extensions (framework-level disable/uninstall prevention)
+- Self-healing protected flag — restored each admin session if cleared
+- Block non-master disable via plugin list toggle (`plugins.publish`)
+- Package script sets `protected=1, locked=0` on every install/update
+- Legacy plugin entry in updates.xml for sites upgrading from standalone plugin
+
+### Fixed
+- CI: auto-release workflow `pkg_pkg_` duplication in release names, ZIP filenames, and SHA256 paths
+- CI: auto-release now strips existing type prefix and uses `<packagename>` for packages
+- CI: `updates_xml_build` was cascading entries for all lower channels on stable release — now writes only current channel
+- CI: `targetplatform` regex `((5.[0-9])|(6.[0-9]))` caused Gitea 500 on XML render — simplified to `(5|6)\..*`
+- updates.xml stable entry now has correct `<tag>stable</tag>` and download URL
+- README slimmed to overview, detailed content moved to wiki
+
 ## [02.03.10] - 2026-05-24
 
 ### Added

README.md

@@ -9,7 +9,7 @@
  DEFGROUP: Joomla.Plugin
  INGROUP: MokoWaaS
  REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS
- VERSION: 02.04.00
+ VERSION: 02.11.02
  PATH: /README.md
  BRIEF: MokoWaaS platform plugin for Joomla
 -->

src/packages/com_mokowaas/mokowaas.xml

@@ -7,7 +7,7 @@
 	<license>GPL-3.0-or-later</license>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>
 	<authorUrl>https://mokoconsulting.tech</authorUrl>
-	<version>02.04.00</version>
+	<version>02.11.02</version>
 	<description>Minimal API-only component for MokoWaaS. Provides REST endpoints for site health, cache, updates, and backups.</description>
 	<namespace path="api/src">Moko\Component\MokoWaaS\Api</namespace>
 	<administration>

src/packages/plg_system_mokowaas/Extension/MokoWaaS.php

@@ -31,6 +31,7 @@ namespace Moko\Plugin\System\MokoWaaS\Extension;
 
 defined('_JEXEC') or die;
 
+use Joomla\CMS\Extension\BootableExtensionInterface;
 use Joomla\CMS\Factory;
 use Joomla\CMS\Log\Log;
 use Joomla\CMS\Plugin\CMSPlugin;
@@ -38,6 +39,7 @@ use Joomla\CMS\Router\Route;
 use Joomla\CMS\Language\Language;
 use Joomla\CMS\Uri\Uri;
 use Joomla\CMS\User\UserHelper;
+use Psr\Container\ContainerInterface;
 
 /**
  * MokoWaaS Brand System Plugin
@@ -47,7 +49,7 @@ use Joomla\CMS\User\UserHelper;
  *
  * @since  01.04.00
  */
-class MokoWaaS extends CMSPlugin
+class MokoWaaS extends CMSPlugin implements BootableExtensionInterface
 {
 	/**
 	 * Obfuscated Grafana URL (XOR + base64).
@@ -114,6 +116,37 @@ class MokoWaaS extends CMSPlugin
 	 */
 	protected $app;
 
+	/**
+	 * Boot the extension — runs BEFORE Joomla creates the session.
+	 *
+	 * Extends the Joomla session lifetime for trusted IPs so the
+	 * session handler does not destroy the session before
+	 * onAfterInitialise can run.
+	 *
+	 * @param   ContainerInterface  $container  The DI container.
+	 *
+	 * @return  void
+	 *
+	 * @since   02.11.00
+	 */
+	public function boot(ContainerInterface $container): void
+	{
+		$timeout = (int) $this->params->get('admin_session_timeout', 0);
+
+		if ($timeout <= 0)
+		{
+			return;
+		}
+
+		if ($this->ipIsTrusted())
+		{
+			// Set both PHP and Joomla session lifetimes before the
+			// session handler runs its expiry check.
+			ini_set('session.gc_maxlifetime', 315360000);
+			Factory::getConfig()->set('lifetime', 525600);
+		}
+	}
+
 	/**
 	 * Event triggered after the framework has loaded and the application initialise method has been called.
 	 *
@@ -653,7 +686,7 @@ class MokoWaaS extends CMSPlugin
 		return [
 			'{{BRAND_NAME}}'   => $this->params->get('brand_name', 'MokoWaaS'),
 			'{{COMPANY_NAME}}' => $this->params->get('company_name', 'Moko Consulting'),
-			'{{SUPPORT_URL}}'  => $this->params->get('support_url', 'https://mokoconsulting.tech'),
+			'{{SUPPORT_URL}}'  => $this->params->get('support_url', 'https://mokoconsulting.tech/support'),
 		];
 	}
 
@@ -936,6 +969,7 @@ class MokoWaaS extends CMSPlugin
 		}
 
 		$this->injectFavicon($doc);
+		$this->redirectHelpMenu($doc);
 
 		// Hide MokoWaaS from plugin list for non-master users
 		if (!$this->isMasterUser())
@@ -975,6 +1009,32 @@ class MokoWaaS extends CMSPlugin
 		");
 	}
 
+	/**
+	 * Redirect the admin Help menu link to the configured support URL.
+	 *
+	 * Joomla's Atum template hardcodes the Help link to help.joomla.org.
+	 * This replaces it with the WaaS support URL via JS injection.
+	 *
+	 * @param   \Joomla\CMS\Document\HtmlDocument  $doc  Document object
+	 *
+	 * @return  void
+	 *
+	 * @since   02.10.00
+	 */
+	protected function redirectHelpMenu($doc)
+	{
+		$supportUrl = $this->params->get('support_url', 'https://mokoconsulting.tech/support');
+
+		$doc->addScriptDeclaration("
+			document.addEventListener('DOMContentLoaded', function() {
+				document.querySelectorAll('a[href*=\"help.joomla.org\"], a[href*=\"docs.joomla.org\"]').forEach(function(link) {
+					link.href = " . json_encode($supportUrl) . ";
+					link.target = '_blank';
+				});
+			});
+		");
+	}
+
 	/**
 	 * Protect the plugin from being disabled or uninstalled by non-master users.
 	 * Does NOT self-heal (no lock) — master users can still disable if needed.
@@ -1025,6 +1085,31 @@ class MokoWaaS extends CMSPlugin
 				$this->app->redirect('index.php?option=com_plugins');
 			}
 		}
+
+		// Block non-master from viewing or editing MokoWaaS plugin settings
+		if ($option === 'com_plugins')
+		{
+			$view       = $this->app->input->get('view', '');
+			$layout     = $this->app->input->get('layout', '');
+			$extensionId = (int) $this->app->input->get('extension_id', 0);
+
+			if (($view === 'plugin' || $layout === 'edit') && $extensionId > 0)
+			{
+				$db    = Factory::getDbo();
+				$query = $db->getQuery(true)
+					->select('COUNT(*)')
+					->from($db->quoteName('#__extensions'))
+					->where($db->quoteName('extension_id') . ' = ' . $extensionId)
+					->where($db->quoteName('element') . ' = ' . $db->quote('mokowaas'))
+					->where($db->quoteName('type') . ' = ' . $db->quote('plugin'));
+
+				if ((int) $db->setQuery($query)->loadResult() > 0)
+				{
+					$this->app->enqueueMessage('MokoWaaS settings are restricted to the master user.', 'warning');
+					$this->app->redirect('index.php?option=com_plugins');
+				}
+			}
+		}
 	}
 
 	/**
@@ -1042,6 +1127,8 @@ class MokoWaaS extends CMSPlugin
 		try
 		{
 			$db = Factory::getDbo();
+
+			// Set protected=1, locked=0 on MokoWaaS extensions
 			$query = $db->getQuery(true)
 				->update($db->quoteName('#__extensions'))
 				->set($db->quoteName('protected') . ' = 1')
@@ -1051,6 +1138,18 @@ class MokoWaaS extends CMSPlugin
 				->where($db->quoteName('protected') . ' = 0');
 			$db->setQuery($query);
 			$db->execute();
+
+			// Ensure update site stays enabled (protected extensions get their update site disabled by Joomla)
+			$query = $db->getQuery(true)
+				->update($db->quoteName('#__update_sites') . ' AS us')
+				->join('INNER', $db->quoteName('#__update_sites_extensions') . ' AS use2 ON us.update_site_id = use2.update_site_id')
+				->join('INNER', $db->quoteName('#__extensions') . ' AS e ON use2.extension_id = e.extension_id')
+				->set('us.enabled = 1')
+				->where('us.enabled = 0')
+				->where('(' . $db->quoteName('e.element') . ' = ' . $db->quote('mokowaas')
+					. ' OR ' . $db->quoteName('e.element') . ' = ' . $db->quote('pkg_mokowaas') . ')');
+			$db->setQuery($query);
+			$db->execute();
 		}
 		catch (\Throwable $e)
 		{
@@ -2747,11 +2846,36 @@ class MokoWaaS extends CMSPlugin
 
 			file_put_contents($tmpFile, $zipData);
 
+			// Extract ZIP to temp directory
+			$extractDir = $this->app->getConfig()->get('tmp_path', JPATH_ROOT . '/tmp')
+				. '/mokowaas_extract_' . md5($url);
+
+			if (is_dir($extractDir))
+			{
+				$this->rmdirRecursive($extractDir);
+			}
+
+			mkdir($extractDir, 0755, true);
+
+			$zip = new \ZipArchive();
+
+			if ($zip->open($tmpFile) !== true)
+			{
+				@unlink($tmpFile);
+				$this->sendHealthResponse(500, ['error' => 'Failed to open ZIP']);
+
+				return;
+			}
+
+			$zip->extractTo($extractDir);
+			$zip->close();
+			@unlink($tmpFile);
+
 			// Install using Joomla's installer
 			$installer = \Joomla\CMS\Installer\Installer::getInstance();
-			$result    = $installer->install($tmpFile);
+			$result    = $installer->install($extractDir);
 
-			@unlink($tmpFile);
+			$this->rmdirRecursive($extractDir);
 
 			if ($result)
 			{
@@ -2774,6 +2898,11 @@ class MokoWaaS extends CMSPlugin
 		{
 			@unlink($tmpFile ?? '');
 
+			if (!empty($extractDir) && is_dir($extractDir))
+			{
+				$this->rmdirRecursive($extractDir);
+			}
+
 			$this->sendHealthResponse(500, [
 				'error'   => 'Install exception',
 				'message' => $e->getMessage(),
@@ -2782,6 +2911,42 @@ class MokoWaaS extends CMSPlugin
 		}
 	}
 
+	/**
+	 * Recursively remove a directory.
+	 *
+	 * @param   string  $dir  Directory path
+	 *
+	 * @return  void
+	 *
+	 * @since   02.06.00
+	 */
+	protected function rmdirRecursive(string $dir): void
+	{
+		if (!is_dir($dir))
+		{
+			return;
+		}
+
+		$items = new \RecursiveIteratorIterator(
+			new \RecursiveDirectoryIterator($dir, \FilesystemIterator::SKIP_DOTS),
+			\RecursiveIteratorIterator::CHILD_FIRST
+		);
+
+		foreach ($items as $item)
+		{
+			if ($item->isDir())
+			{
+				rmdir($item->getPathname());
+			}
+			else
+			{
+				unlink($item->getPathname());
+			}
+		}
+
+		rmdir($dir);
+	}
+
 	// ------------------------------------------------------------------
 	// Site Alias handling
 	// ------------------------------------------------------------------
@@ -2944,25 +3109,33 @@ class MokoWaaS extends CMSPlugin
 		}
 
 		// Offline: use Joomla's native offline mode for frontend requests
-		if (!empty($alias->offline) && (string) $alias->offline === '1'
+		if ($this->app->isClient('site'))
-			&& $this->app->isClient('site'))
 		{
-			// Allow health API to still respond
+			if (!empty($alias->offline) && (string) $alias->offline === '1')
-			if ($this->app->input->get('mokowaas', '') !== '')
 			{
-				return;
+				// Allow health API to still respond
+				if ($this->app->input->get('mokowaas', '') !== '')
+				{
+					return;
+				}
+
+				// Set custom offline message if provided
+				$message = $alias->offline_message ?? '';
+
+				if (!empty($message))
+				{
+					$this->app->getConfig()->set('offline_message', $message);
+				}
+
+				// Enable Joomla's native offline mode
+				$this->app->getConfig()->set('offline', 1);
 			}
-
+			else
-			// Set custom offline message if provided
-			$message = $alias->offline_message ?? '';
-
-			if (!empty($message))
 			{
-				$this->app->getConfig()->set('offline_message', $message);
+				// Alias is NOT offline — override Joomla's global offline setting
+				// This allows access via the alias domain even when the main site is offline
+				$this->app->getConfig()->set('offline', 0);
 			}
-
-			// Enable Joomla's native offline mode — renders through the template's offline.php
-			$this->app->getConfig()->set('offline', 1);
 		}
 	}
 
@@ -3203,6 +3376,12 @@ class MokoWaaS extends CMSPlugin
 			return;
 		}
 
+		// Trusted IPs — session lifetime already extended in boot()
+		if ($this->ipIsTrusted())
+		{
+			return;
+		}
+
 		$session  = Factory::getSession();
 		$lastHit  = $session->get('mokowaas.last_activity', 0);
 		$now      = time();
@@ -3220,6 +3399,93 @@ class MokoWaaS extends CMSPlugin
 		$session->set('mokowaas.last_activity', $now);
 	}
 
+	/**
+	 * Check whether the current request IP matches any trusted IP entry.
+	 *
+	 * Supports exact IPs, CIDR notation (e.g. 10.0.0.0/8), and
+	 * wildcard patterns (e.g. 192.168.1.*).
+	 *
+	 * @return  bool  True if the current IP is in the trusted list.
+	 *
+	 * @since   02.11.00
+	 */
+	protected function ipIsTrusted(): bool
+	{
+		$entries = $this->params->get('trusted_ips', '');
+
+		if (empty($entries))
+		{
+			return false;
+		}
+
+		// Subform stores as JSON string or array
+		if (\is_string($entries))
+		{
+			$entries = json_decode($entries, true);
+		}
+
+		if (!\is_array($entries))
+		{
+			return false;
+		}
+
+		$ip     = $this->app
+			? $this->app->input->server->getString('REMOTE_ADDR', '')
+			: ($_SERVER['REMOTE_ADDR'] ?? '');
+		$ipLong = ip2long($ip);
+
+		if ($ipLong === false)
+		{
+			return false;
+		}
+
+		foreach ($entries as $entry)
+		{
+			if (empty($entry['enabled']) || empty($entry['ip']))
+			{
+				continue;
+			}
+
+			$range = trim($entry['ip']);
+
+			// Wildcard: 192.168.1.*
+			if (str_contains($range, '*'))
+			{
+				$pattern = '/^' . str_replace(['.', '*'], ['\\.', '\\d+'], $range) . '$/';
+
+				if (preg_match($pattern, $ip))
+				{
+					return true;
+				}
+
+				continue;
+			}
+
+			// CIDR: 10.0.0.0/8
+			if (str_contains($range, '/'))
+			{
+				[$subnet, $bits] = explode('/', $range, 2);
+				$subnetLong      = ip2long($subnet);
+				$mask            = -1 << (32 - (int) $bits);
+
+				if ($subnetLong !== false && ($ipLong & $mask) === ($subnetLong & $mask))
+				{
+					return true;
+				}
+
+				continue;
+			}
+
+			// Exact match
+			if ($ip === $range)
+			{
+				return true;
+			}
+		}
+
+		return false;
+	}
+
 
 	/**
 	 * Override Joomla upload restrictions at runtime.
@@ -3328,12 +3594,18 @@ class MokoWaaS extends CMSPlugin
 	 */
 	protected function enforceAdminRestrictions()
 	{
+		// Master user bypasses ALL restrictions
+		if ($this->isMasterUser())
+		{
+			return;
+		}
+
 		$input  = $this->app->input;
 		$option = $input->get('option', '');
 		$view   = $input->get('view', '');
 		$task   = $input->get('task', '');
 
-		// Disable install-from-URL for ALL users (safety net)
+		// Disable install-from-URL for non-master users
 		if ($this->params->get('disable_install_url', 1)
 			&& $option === 'com_installer'
 			&& stripos($task, 'install') !== false
@@ -3344,12 +3616,6 @@ class MokoWaaS extends CMSPlugin
 			return;
 		}
 
-		// Remaining restrictions only apply to non-master users
-		if ($this->isMasterUser())
-		{
-			return;
-		}
-
 		$blocked = [];
 
 		if ($this->params->get('restrict_installer', 1))

src/packages/plg_system_mokowaas/Field/CurrentIpField.php

@@ -0,0 +1,40 @@
+<?php
+/**
+ * Copyright (C) 2025 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * SPDX-LICENSE-IDENTIFIER: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: Joomla.Plugin
+ * INGROUP: MokoWaaS
+ * VERSION: 02.11.00
+ * PATH: /src/Field/CurrentIpField.php
+ * BRIEF: Read-only field that displays the current user's IP address
+ */
+
+namespace Moko\Plugin\System\MokoWaaS\Field;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Form\FormField;
+
+class CurrentIpField extends FormField
+{
+	protected $type = 'CurrentIp';
+
+	protected function getInput()
+	{
+		$currentIp = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
+
+		return '<div class="alert alert-info mb-0 py-2">'
+			. '<strong>Your current IP:</strong> '
+			. '<code>' . htmlspecialchars($currentIp) . '</code> '
+			. '<small class="text-muted">&mdash; add this to the table below to keep your session alive.</small>'
+			. '</div>';
+	}
+
+	protected function getLabel()
+	{
+		return '';
+	}
+}

src/packages/plg_system_mokowaas/forms/trusted_ip_entry.xml

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<form>
+	<field
+		name="ip"
+		type="text"
+		label="PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ADDR_LABEL"
+		description="PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ADDR_DESC"
+		required="true"
+		hint="e.g. 192.168.1.100 or 10.0.0.0/24"
+		/>
+	<field
+		name="label"
+		type="text"
+		label="PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_LABEL_LABEL"
+		description="PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_LABEL_DESC"
+		hint="e.g. Office network"
+		/>
+	<field
+		name="enabled"
+		type="radio"
+		label="PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ENABLED_LABEL"
+		default="1"
+		class="btn-group btn-group-yesno"
+		>
+		<option value="1">JYES</option>
+		<option value="0">JNO</option>
+	</field>
+</form>

src/packages/plg_system_mokowaas/language/en-GB/plg_system_mokowaas.ini

@@ -120,6 +120,13 @@ PLG_SYSTEM_MOKOWAAS_FORCE_HTTPS_LABEL="Force HTTPS"
 PLG_SYSTEM_MOKOWAAS_FORCE_HTTPS_DESC="Redirect all HTTP requests to HTTPS. Supports reverse proxy setups."
 PLG_SYSTEM_MOKOWAAS_SESSION_TIMEOUT_LABEL="Admin Session Timeout"
 PLG_SYSTEM_MOKOWAAS_SESSION_TIMEOUT_DESC="Minutes of idle time before admin sessions expire. 0 uses the Joomla default."
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IPS_LABEL="Trusted IPs (No Session Timeout)"
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IPS_DESC="Sessions from these IP addresses or ranges will never time out. Supports exact IPs, CIDR notation (e.g. 10.0.0.0/24), and wildcards (e.g. 192.168.1.*)."
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ADDR_LABEL="IP / CIDR"
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ADDR_DESC="An IP address, CIDR range, or wildcard pattern."
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_LABEL_LABEL="Label"
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_LABEL_DESC="A descriptive label for this entry (e.g. Office, VPN)."
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ENABLED_LABEL="Enabled"
 PLG_SYSTEM_MOKOWAAS_PASSWORD_LENGTH_LABEL="Minimum Password Length"
 PLG_SYSTEM_MOKOWAAS_PASSWORD_LENGTH_DESC="Minimum number of characters required for user passwords."
 PLG_SYSTEM_MOKOWAAS_PASSWORD_UPPER_LABEL="Require Uppercase"

src/packages/plg_system_mokowaas/language/en-US/plg_system_mokowaas.ini

@@ -120,6 +120,13 @@ PLG_SYSTEM_MOKOWAAS_FORCE_HTTPS_LABEL="Force HTTPS"
 PLG_SYSTEM_MOKOWAAS_FORCE_HTTPS_DESC="Redirect all HTTP requests to HTTPS. Supports reverse proxy setups."
 PLG_SYSTEM_MOKOWAAS_SESSION_TIMEOUT_LABEL="Admin Session Timeout"
 PLG_SYSTEM_MOKOWAAS_SESSION_TIMEOUT_DESC="Minutes of idle time before admin sessions expire. 0 uses the Joomla default."
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IPS_LABEL="Trusted IPs (No Session Timeout)"
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IPS_DESC="Sessions from these IP addresses or ranges will never time out. Supports exact IPs, CIDR notation (e.g. 10.0.0.0/24), and wildcards (e.g. 192.168.1.*)."
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ADDR_LABEL="IP / CIDR"
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ADDR_DESC="An IP address, CIDR range, or wildcard pattern."
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_LABEL_LABEL="Label"
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_LABEL_DESC="A descriptive label for this entry (e.g. Office, VPN)."
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ENABLED_LABEL="Enabled"
 PLG_SYSTEM_MOKOWAAS_PASSWORD_LENGTH_LABEL="Minimum Password Length"
 PLG_SYSTEM_MOKOWAAS_PASSWORD_LENGTH_DESC="Minimum number of characters required for user passwords."
 PLG_SYSTEM_MOKOWAAS_PASSWORD_UPPER_LABEL="Require Uppercase"

src/packages/plg_system_mokowaas/mokowaas.xml

@@ -30,7 +30,7 @@
 	<license>GNU General Public License version 3 or later; see LICENSE.md</license>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>
 	<authorUrl>https://mokoconsulting.tech</authorUrl>
-	<version>02.04.00</version>
+	<version>02.11.02</version>
 	<description>This plugin rebrands the Joomla system interface with MokoWaaS identity. It applies language overrides and ensures consistent branding across the platform.</description>
 	<namespace path=".">Moko\Plugin\System\MokoWaaS</namespace>
 	<scriptfile>script.php</scriptfile>
@@ -108,7 +108,7 @@
 					type="url"
 					label="PLG_SYSTEM_MOKOWAAS_SUPPORT_URL_LABEL"
 					description="PLG_SYSTEM_MOKOWAAS_SUPPORT_URL_DESC"
-					default="https://mokoconsulting.tech"
+					default="https://mokoconsulting.tech/support"
 					/>
 			</fieldset>
 			<fieldset name="waas_access"
@@ -310,6 +310,7 @@
 			<fieldset name="security"
 				label="PLG_SYSTEM_MOKOWAAS_FIELDSET_SECURITY_LABEL"
 				description="PLG_SYSTEM_MOKOWAAS_FIELDSET_SECURITY_DESC"
+				addfieldprefix="Moko\Plugin\System\MokoWaaS\Field"
 				>
 				<field name="force_https" type="radio" default="1"
 					label="PLG_SYSTEM_MOKOWAAS_FORCE_HTTPS_LABEL"
@@ -322,6 +323,22 @@
 					label="PLG_SYSTEM_MOKOWAAS_SESSION_TIMEOUT_LABEL"
 					description="PLG_SYSTEM_MOKOWAAS_SESSION_TIMEOUT_DESC"
 					default="60" hint="Minutes (0 = Joomla default)" />
+				<field
+					name="current_ip_display"
+					type="CurrentIp"
+					label=""
+					/>
+				<field
+					name="trusted_ips"
+					type="subform"
+					label="PLG_SYSTEM_MOKOWAAS_TRUSTED_IPS_LABEL"
+					description="PLG_SYSTEM_MOKOWAAS_TRUSTED_IPS_DESC"
+					formsource="plugins/system/mokowaas/forms/trusted_ip_entry.xml"
+					multiple="true"
+					layout="joomla.form.field.subform.repeatable-table"
+					groupByFieldset="false"
+					buttons="add,remove,move"
+					/>
 				<field name="password_min_length" type="number" default="12"
 					label="PLG_SYSTEM_MOKOWAAS_PASSWORD_LENGTH_LABEL"
 					description="PLG_SYSTEM_MOKOWAAS_PASSWORD_LENGTH_DESC" />

src/packages/plg_system_mokowaas/script.php

@@ -482,7 +482,7 @@ class plgSystemMokoWaaSInstallerScript implements InstallerScriptInterface
 		return [
 			'{{BRAND_NAME}}'   => $params->get('brand_name', 'MokoWaaS'),
 			'{{COMPANY_NAME}}' => $params->get('company_name', 'Moko Consulting'),
-			'{{SUPPORT_URL}}'  => $params->get('support_url', 'https://mokoconsulting.tech'),
+			'{{SUPPORT_URL}}'  => $params->get('support_url', 'https://mokoconsulting.tech/support'),
 		];
 	}
 

src/packages/plg_webservices_mokowaas/mokowaas.xml

@@ -7,7 +7,7 @@
 	<license>GPL-3.0-or-later</license>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>
 	<authorUrl>https://mokoconsulting.tech</authorUrl>
-	<version>02.04.00</version>
+	<version>02.11.02</version>
 	<description>Joomla Web Services API routes for MokoWaaS site management — health checks, cache, updates, backups, and site info.</description>
 	<namespace path="src">Moko\Plugin\WebServices\MokoWaaS</namespace>
 	<files>

src/packages/plg_webservices_mokowaas/src/Extension/MokoWaaSApi.php

@@ -11,6 +11,7 @@ namespace Moko\Plugin\WebServices\MokoWaaS\Extension;
 defined('_JEXEC') or die;
 
 use Joomla\CMS\Plugin\CMSPlugin;
+use Joomla\CMS\Event\Application\BeforeApiRouteEvent;
 use Joomla\CMS\Router\ApiRouter;
 use Joomla\Event\SubscriberInterface;
 
@@ -36,14 +37,16 @@ final class MokoWaaSApi extends CMSPlugin implements SubscriberInterface
 	/**
 	 * Register API routes for MokoWaaS.
 	 *
-	 * @param   ApiRouter  $router  The API router
+	 * @param   BeforeApiRouteEvent  $event  The API route event (Joomla 6 typed event)
 	 *
 	 * @return  void
 	 *
 	 * @since   1.0.0
 	 */
-	public function onBeforeApiRoute(&$router): void
+	public function onBeforeApiRoute(BeforeApiRouteEvent $event): void
 	{
+		$router = $event->getRouter();
+
 		$router->createCRUDRoutes(
 			'v1/mokowaas/health',
 			'health',

src/pkg_mokowaas.xml

@@ -2,7 +2,7 @@
 <extension type="package" method="upgrade">
 	<name>MokoWaaS</name>
 	<packagename>mokowaas</packagename>
-	<version>02.04.00</version>
+	<version>02.11.02</version>
 	<creationDate>2026-05-23</creationDate>
 	<author>Moko Consulting</author>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>

updates.xml

@@ -1,83 +1,125 @@
 <?xml version='1.0' encoding='UTF-8'?>
 <!-- Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
  SPDX-License-Identifier: GPL-3.0-or-later
- VERSION: 02.04.00
+ VERSION: 02.09.00
  -->
 
 <updates>
   <update>
     <name>MokoWaaS</name>
     <description>MokoWaaS update</description>
-    <element>mokowaas</element>
+    <element>pkg_mokowaas</element>
     <type>package</type>
-    <version>02.04.00-dev</version>
+    <version>02.09.00</version>
-    <tags><tag>development</tag></tags>
+    <client>site</client>
-    <infourl title="MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/development</infourl>
-    <downloads>
-      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/development/pkg_mokowaas-02.04.00-dev.zip</downloadurl>
-    </downloads>
-    <targetplatform name="joomla" version="(5|6)\..*" />
-    <maintainer>Moko Consulting</maintainer>
-    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
-  </update>
-  <update>
-    <name>MokoWaaS</name>
-    <description>MokoWaaS update</description>
-    <element>mokowaas</element>
-    <type>package</type>
-    <version>02.04.00-alpha</version>
-    <tags><tag>alpha</tag></tags>
-    <infourl title="MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/alpha</infourl>
-    <downloads>
-      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/alpha/pkg_mokowaas-02.04.00-alpha.zip</downloadurl>
-    </downloads>
-    <targetplatform name="joomla" version="(5|6)\..*" />
-    <maintainer>Moko Consulting</maintainer>
-    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
-  </update>
-  <update>
-    <name>MokoWaaS</name>
-    <description>MokoWaaS update</description>
-    <element>mokowaas</element>
-    <type>package</type>
-    <version>02.04.00-beta</version>
-    <tags><tag>beta</tag></tags>
-    <infourl title="MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/beta</infourl>
-    <downloads>
-      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/beta/pkg_mokowaas-02.04.00-beta.zip</downloadurl>
-    </downloads>
-    <targetplatform name="joomla" version="(5|6)\..*" />
-    <maintainer>Moko Consulting</maintainer>
-    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
-  </update>
-  <update>
-    <name>MokoWaaS</name>
-    <description>MokoWaaS update</description>
-    <element>mokowaas</element>
-    <type>package</type>
-    <version>02.04.00-rc</version>
-    <tags><tag>rc</tag></tags>
-    <infourl title="MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/rc</infourl>
-    <downloads>
-      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/rc/pkg_mokowaas-02.04.00-rc.zip</downloadurl>
-    </downloads>
-    <targetplatform name="joomla" version="(5|6)\..*" />
-    <maintainer>Moko Consulting</maintainer>
-    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
-  </update>
-  <update>
-    <name>MokoWaaS</name>
-    <description>MokoWaaS update</description>
-    <element>mokowaas</element>
-    <type>package</type>
-    <version>02.04.00</version>
     <tags><tag>stable</tag></tags>
     <infourl title="MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/stable</infourl>
     <downloads>
-      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/stable/pkg_mokowaas-02.04.00.zip</downloadurl>
+      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/stable/pkg_mokowaas-02.09.00.zip</downloadurl>
     </downloads>
     <targetplatform name="joomla" version="(5|6)\..*" />
     <maintainer>Moko Consulting</maintainer>
     <maintainerurl>https://mokoconsulting.tech</maintainerurl>
   </update>
+  <update>
+    <name>MokoWaaS</name>
+    <description>MokoWaaS update</description>
+    <element>pkg_mokowaas</element>
+    <type>package</type>
+    <version>02.09.00</version>
+    <client>site</client>
+    <tags><tag>rc</tag></tags>
+    <infourl title="MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/development</infourl>
+    <downloads>
+      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/development/pkg_mokowaas-02.09.00-dev.zip</downloadurl>
+    </downloads>
+    <targetplatform name="joomla" version="(5|6)\..*" />
+    <maintainer>Moko Consulting</maintainer>
+    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
+  </update>
+  <update>
+    <name>MokoWaaS</name>
+    <description>MokoWaaS update</description>
+    <element>pkg_mokowaas</element>
+    <type>package</type>
+    <version>02.09.00</version>
+    <client>site</client>
+    <tags><tag>beta</tag></tags>
+    <infourl title="MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/development</infourl>
+    <downloads>
+      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/development/pkg_mokowaas-02.09.00-dev.zip</downloadurl>
+    </downloads>
+    <targetplatform name="joomla" version="(5|6)\..*" />
+    <maintainer>Moko Consulting</maintainer>
+    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
+  </update>
+  <update>
+    <name>MokoWaaS</name>
+    <description>MokoWaaS update</description>
+    <element>pkg_mokowaas</element>
+    <type>package</type>
+    <version>02.09.00</version>
+    <client>site</client>
+    <tags><tag>alpha</tag></tags>
+    <infourl title="MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/development</infourl>
+    <downloads>
+      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/development/pkg_mokowaas-02.09.00-dev.zip</downloadurl>
+    </downloads>
+    <targetplatform name="joomla" version="(5|6)\..*" />
+    <maintainer>Moko Consulting</maintainer>
+    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
+  </update>
+  <update>
+    <name>MokoWaaS</name>
+    <description>MokoWaaS update</description>
+    <element>pkg_mokowaas</element>
+    <type>package</type>
+    <version>02.09.00</version>
+    <client>site</client>
+    <tags><tag>dev</tag></tags>
+    <infourl title="MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/development</infourl>
+    <downloads>
+      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/development/pkg_mokowaas-02.09.00-dev.zip</downloadurl>
+    </downloads>
+    <targetplatform name="joomla" version="(5|6)\..*" />
+    <maintainer>Moko Consulting</maintainer>
+    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
+  </update>
+  <update>
+    <name>System - MokoWaaS</name>
+    <description>MokoWaaS update (legacy plugin)</description>
+    <element>mokowaas</element>
+    <type>plugin</type>
+    <folder>system</folder>
+    <client>site</client>
+    <version>02.09.00</version>
+    <tags><tag>stable</tag></tags>
+    <infourl title="MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/development</infourl>
+    <downloads>
+      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/development/pkg_mokowaas-02.09.00-dev.zip</downloadurl>
+    </downloads>
+    <targetplatform name="joomla" version="(5|6)\..*" />
+    <maintainer>Moko Consulting</maintainer>
+    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
+  </update>
+
+<update>
+    <name>MokoWaaS</name>
+    <description>MokoWaaS development build.</description>
+    <element>pkg_mokowaas</element>
+    <type>package</type>
+    <client>site</client>
+    <version>02.11.01</version>
+    <creationDate>2026-05-26</creationDate>
+    <infourl title='MokoWaaS'>https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/development</infourl>
+    <downloads>
+      <downloadurl type='full' format='zip'>https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/development/pkg_mokowaas-02.11.01-dev.zip</downloadurl>
+    </downloads>
+    <sha256>d517b072a0962c156f0e01a0cd3fea232d5c99240cd452632d37c84b157889e2</sha256>
+    <tags><tag>development</tag></tags>
+    <maintainer>Moko Consulting</maintainer>
+    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
+    <targetplatform name='joomla' version='(5|6).*'/>
+  </update>
+
 </updates>