Phase 3 infrastructure hardening: IP/UA binding, nginx getallheaders fallback, auth rate limiting, permission cache

Phase 2 session stability: refresh queue, Bearer fallback, proactive refresh

Phase 1 auth security hotfixes: cookie-based session, bearer checks, router guard sync ...

- Remove access_token from OAuth callback URL (token leak fix)
- Add sanitizeReturnTo() to prevent open redirect on login/callback
- Add Bearer token expiration check in resolve_user_by_bearer()
- Add user status check in load_user_by_id() (block inactive/banned)
- Cache authStore.init() promise to prevent race condition
- Await auth init in router beforeEach guard
- Remove URL token parsing from main.js and LoginPage
- Remove hasTokenInUrl workaround from client.js 401 handler

Fix OAuth callback URL: insert access_token query string BEFORE hash fragment so Vue can read it via window.location.search

Fix AppController and EventsHandlers to use __DIR__ instead of app()->root_folder() for prod compatibility

Integrate Vue webclient into server: serve SPA from /, remove proxy.php, update auth redirects

Add Bearer token persistence for cross-domain SPA auth ...

- api/auth.js: persist access token in localStorage so it survives
  page reloads and works across domains (panel vs server IP).
- LoginPage.vue: on mount, check for access_token in URL query
  params (from OAuth callback) and initialize auth store.
- AuthController::callback(): append access_token + expires_in to
  the redirect URL so the SPA can capture it.

Add IP roaming reconciliation for active devices during network scan ...

- Extract reconcile_scan_results() into Devices model: updates device_ip
  and restores connection_status='active' when a known device is found on
  a different IP address.
- Refactor CronController to use the shared method.
- Also call reconcile_scan_results() in DevicesRESTAPIController::scanning__all()
  so manual scans from the UI update roaming device IPs.
- Add DevicesTest with coverage for IP update + lost device restore.
- Fix test bootstrap: remove non-existent SHServ\Sessions reference.

Fix logout: session_start + destroy cookie + redirect to local /login instead of /auth/login

Make user card avatar/name clickable link to gnexus-auth profile

Add GnUserCard drawer footer; fix proxy.php cookie forwarding and /auth/ whitelist

Fix auth session persistence: add credentials:include to fetch and session_start to auth flow ...

- http.js: add credentials: 'include' to fetch() so cookies are sent
  with every API request (fixes /auth/me returning 401 after callback)
- AuthControllerTrait::resolve_user(): ensure session_start() before
  reading
- AuthController::callback(): ensure session_start() before writing

- AuthService::handleCallback(): defer DB token persistence until
  local user ID is resolved; store temp token data in session
- UserResolver: fix lastInsertId() method name, remove avatarUrl()
  call (use profile array instead)

This fixes the loop where user was redirected back to /login after
successful OAuth callback because PHP session cookie was not sent
with the /auth/me request.

Phase 2: Protect Areas, Scripts, Firmware REST API endpoints with permission checks ...

- AreasRESTAPIController: areas.view / areas.manage / devices.control / devices.view / scripts.view
- ScriptsRESTAPIController: scripts.view / scripts.edit / scripts.run
- FirmwareRESTAPIController: firmware.view / firmware.upload
- AuthControllerTrait added to all three controllers

Phase 2: Protect DevicesRESTAPIController endpoints with permission checks ...

- Add AuthControllerTrait
- devices.scan: scanning__ready_to_setup, scanning__all
- devices.setup: setup_new_device, resetup_device
- devices.delete: remove_device
- devices.control: reboot_device, do_device_action
- devices.view: device_info, device, device_status, devices_list
- devices.edit: place_in_area, unassign_from_area, update_name, update_description, update_alias, reset_device

Phase 0: gnexus-auth integration infrastructure ...

- Add gnexus/auth-client via Composer vcs
- Thin PSR-18/17 cURL adapter (zero extra deps)
- SessionStateStore, SessionPkceStore, DbTokenStore
- AuthService wrapper: login URL, callback, logout, refresh, me
- UserResolver + PermissionResolver
- AuthController (login, callback, logout, me, refresh)
- WebhookController + WebhookRouter + event handlers
- AuthControllerTrait for endpoint protection
- Migration: 9 tables (users, roles, permissions, overrides, groups, members, group_perms, sessions, audit) + seed data
- Remove old Example_AuthController
- Add GAUTH_* env variables to config and .env.example

Move scan debug log to sys temp dir as well

Move scan lock file to sys temp dir to avoid prod permission issues

Debug scan locking: add shutdown cleanup + connection_aborted checks + debug log

Fix abandoned scan overload: flock lock + connection abort detection + client timeout

Phase 1: Server-side firmware catalog, OTA API endpoints, and DeviceAPI::updateFirmware

Переписан механизм определения offline: last_contact-based вместо TCP ping + retry для сканера ...

CronController::status_update_scanning():
- Устройства помечаются lost по таймауту last_contact (device_offline_threshold, default 300s)
- TCP ping fallback удалён — больше не даёт ложных active
- Сканер теперь нужен только для восстановления lost и обновления IP при роуминге
- Добавлен createDeviceScanner() для тестируемости

DeviceScanner:
- BATCH_SIZE 32 -> 8 (меньше коллизий на WiFi)
- Таймаут 1s -> 2s
- Пауза 200мс между батчами
- Retry с 500мс backoff для failed IPs

EventsController::new_event():
- Восстанавливает connection_status = active при входящем событии

DevicesRESTAPIController::device_status():
- Больше не помечает lost при временном сетевом сбое

Config:
- Добавлен device_offline_threshold (env DEVICE_OFFLINE_THRESHOLD)

Тесты: 6 новых тестов CronController, 145 tests/345 assertions — все green

Обновлять last_contact при каждом контакте с устройством

Add virtual device emulator (Flask) for relay and button types ...

- New tools/virtual_devices/ with Flask emulator, CLI, and web UI
- Supports relay (4 ch, set_state) and button (4 ch, click events)
- CLI: create, start, stop, list, status, click, remove, register
- Emulates full device REST contract: /about, /status, /action, /set_token, /reset, /channels_schema
- Web UI for visual control and monitoring
- Integrate with server registration via /api/v1/devices/setup/new-device
- Allow IP:port in setup_new_device validation for virtual devs

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Phase 7: Separate ControlScripts from server core + CLI isolation + manifest ...

- Moved server/ControlScripts/ → automation/ in repo root.
  Updated composer.json autoload classmap (../automation/).
  Common.php keeps correct sync-map.json path via __DIR__.

- Removed RequiredControlScriptsScope; 'app:online' handler moved
  directly into EventsHandlers.php as core system behaviour.

- Replaced scandir() with scopes-manifest.json in App::control_scripts_init().
  New scopes require explicit manifest entry; no auto-discovery.

- Removed /api/v1/scripts/scopes/update route and scope_update() method.
  Remote scope editing via API is no longer available.

- Added ControlScripts::run_regular_script(alias) — unified entry point
  with state check and try/catch.

- CronController::run_regular_cron_scripts() now runs each script via
  CLI process (php console.php run-regular-script <alias>).
  Added 'run-regular-script' command to console.php.

- Updated tests:
  + CronControllerTest — verifies CLI dispatch and disabled skip.
  + ControlScriptsRegularTest — tests run_regular_script():
    missing alias, disabled state, exception catch, success path.

Server: 141 tests, 339 assertions — all pass.
Client: 167 tests — all pass.

Fix Model layer & API robustness batch (7 items) ...

- Entity::update() now checks rowCount; returns false when no rows affected.
- Entity::update() preserves modified_fields on PDOException (try/catch).
- Device::set_device_token() caches auth() call instead of 3 repeated invocations.
- User::__construct() removed eager profile query; profile() now lazy-loads via get_pet_instance().
- alias_is_uniq() in Areas and Devices models accepts optional exclude_id to skip self on update.
- Controllers updated to pass entity id to alias_is_uniq() so updating alias to current value succeeds.
- CronController::run_regular_cron_scripts() wraps each script in try/catch; logs failure and continues.
- App::api_auth_guard() replaced exit() with return false; EventsHandlers stops routing on auth rejection.
- Tests added: EntityCrud (missing-record + preserved-fields), UserEntity (lazy-loading),
  CronController (failure-continuation), AppAuthGuard (structured 401 output),
  Areas/Devices validation (same-alias update allowed).
- Test bootstrap: added logs_enable/logs_folder to FCONF to suppress PHP warnings in Cron tests.

All 136 server tests pass, 334 assertions.
All 167 Vue client tests pass.

Fix critical issues: router method enforcement, cron localhost guard, rate limiter file-based, entity update_at optional, device race condition, area remove transaction, control scripts static flush

Phase 5: Code quality and tech debt (side effects, dedup, dead code, config extraction, log security)

Phase 4: Device communication resilience (batch scanning, retry, configurable timeouts, non-blocking events, reset check)

Phase 3: API hardening (validation, JSON wrappers, path traversal, rate limiting)

Add area_id and update_at to device detail API response ...

Include missing fields in GET /api/v1/devices/id/{id} so client-side area assignment state survives page reloads.