# Changelog

All notable changes to **STRYKE WP** will be documented in this file.

## [1.0.0] — 2026-03-04

Initial release — all 4 individual STRYKE Marketing plugins merged into one modular master plugin.

### Modules

- **Hub Connector** — Secure REST API (11 endpoints) for remote WordPress management via STRYKE Hub Dashboard. API-key auth (SHA-256), HMAC support, audit logging, stealth mode, multisite support.
- **Branding** — White-label WordPress admin with custom dark theme, login page, sidebar shell, and support page. Full OOP rewrite of legacy procedural plugin.
- **Backup** — Full website backup to Google Drive with OAuth 2.0, resumable chunked uploads, chunked DB export, and scheduling (daily/weekly/monthly).
- **WIP Mode** — Maintenance / Coming-Soon page with page whitelist. OOP rewrite of legacy procedural plugin.

### Core Infrastructure

- **Plugin** — Central orchestrator with dependency injection (no singletons)
- **ModuleRegistry** — Register, enable/disable, and boot modules independently
- **Autoloader** — PSR-4 class loading (`StrykeWP\` → `src/`)
- **OptionManager** — Namespaced options (`stryke_wp_` prefix) with `sanitize_key()` validation
- **Logger** — Debug logging with capped buffer (max 500 entries)
- **AssetManager** — CSS/JS loaded only on STRYKE WP admin pages
- **CronManager** — Shared weekly/monthly schedules, centralized cleanup on deactivation
- **SchemaManager** — DB table creation/upgrade/drop with regex-validated table names
- **Installer** — Activation/deactivation hooks
- **Migrator** — Automatic detection and migration of data from individual STRYKE plugins

### Admin Dashboard

- Unified top-level admin menu with module overview grid
- One-click module enable/disable via AJAX
- Conflict detection with admin notice when individual plugins still active
- Migration notice showing which modules were auto-enabled from legacy data

### Security (Phase 6 Audit)

- Backup temp directory protection (.htaccess + index.php)
- Automatic temp file cleanup with try/finally + shutdown function fallback
- OAuth token encryption via `sodium_crypto_secretbox`
- Resumable chunked uploads to Google Drive (5 MB chunks)
- Chunked DB export (1000 rows/batch)
- REST API rate limiting (5 failed attempts / 15 min → HTTP 429)
- IP spoofing fix: REMOTE_ADDR prioritized over proxy headers
- Admin email redaction in API responses
- DISALLOW_FILE_MODS guard on plugin updates
- HMAC enforcement option for Connector API
- SVG sanitization via `wp_kses()` with SVG allowlist
- Capability checks on all AJAX handlers and module registry
- Download endpoint nonce verification
- SQL injection prevention in SchemaManager DROP statements
- Filesystem paths removed from API responses
- Batched `get_users()` queries (100/batch)
- Autoloader `realpath()` validation
- PHP version runtime guard

### DSGVO / Privacy

- Inter font loaded locally (no Google Fonts CDN)
- No custom cookies
- Audit log IP handling
- OAuth tokens encrypted at rest

### Testing

- 180 unit tests, 487 assertions (PHPUnit 10 + Brain\Monkey)
- Coverage across all 4 modules + core services + admin layer
- WordPress function stubs for isolated testing

### Compatibility

- PHP 8.0+
- WordPress 6.0+ (tested up to 6.7)
- Automatic migration from individual STRYKE plugins
- Backward-compatible option keys and DB tables for Connector and Backup

### Internationalization

- 206 translatable strings
- Text domain: `stryke-wp`
- German UI (translation-ready for other languages)
