# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [0.2.1] - 2026-10-17

### Fixed
- **Query String API Key Support (`?apikey=...`)**: Updated authentication middleware (`apiKeyOrRateLimit`, `requireApiKey`, `requireAdmin`) to accept API keys passed via URL query parameters (`?apikey=`, `?api_key=`, `?apiKey=`, `?key=`) as well as the `X-API-Key` and `Authorization: Bearer` headers, preventing batch requests using `?apikey=sq_live_...` from hitting the 10 req/min public IP rate limit.

## [0.2.0] - 2026-10-17

### Added
- **SquareComp `Striker` Brand Font & Global Header Compliance**: Added `/assets/Striker.woff2`, `/assets/Striker.woff`, and `/assets/img/favicon-32x32.png` assets and aligned all page headers with `SQUARECOMP_GLOBAL_HEADER.md`.
- **Dedicated `/login` Portal**: Added customer Email + Password registration and login (`users` table with `crypto.scrypt` password hashing) alongside Admin Pocket-ID OIDC SSO sign-in.
- **Dedicated `/dashboard` Application**: Added full multi-tab User & Admin Dashboard (`/dashboard`) that loads immediately after login or SSO callback without requiring any manual page refresh.
- **Named API Keys (No Email Prompt Required)**: Users and admins can now generate multiple named API keys (e.g. `"SQPDS.com"`, `"Production Server"`) with one-click copy and 2-step inline revocation.
- **Decoupled Web Sessions (`user_sessions`)**: Web dashboard logins now issue `sq_sess_...` session tokens so logging into the web UI never revokes existing active `sq_live_...` API keys.

## [0.1.9] - 2026-10-03

### Added
- Added official SquareComp SVG & ICO branding favicon assets (`favicon.svg` and `favicon.ico`) to `public/` web directory.
- Embedded favicon `<link>` declarations across web interface (`index.html`) and changelog viewer (`changelog.html`).

## [0.1.8] - 2026-10-03

### Fixed & Enhanced
- Added dynamic WHOIS server resolution via IANA query lookup for ccTLDs (`.co`, `.ai`, `.so`, `.ca`, `.ru`, `.it`, `.is`, `.in`, etc.).
- Expanded RDAP `eventAction` date matching (`expiration`, `registrar expiration`, `registry expiration`, `paid-till`, `reregistration`, `expires`).
- Enhanced Port 43 text parsing regexes supporting multiple date formats (`DD-MMM-YYYY`, `YYYY.MM.DD`, `MMM DD YYYY`) and extracting registrar organization names.

## [0.1.7] - 2026-09-23

### Fixed
- Expanded `api_keys.status` MySQL ENUM definition to include `'revoked'` alongside `'active'`, `'canceled'`, and `'suspended'`.
- Resolved `Data truncated for column 'status'` database error during SSO authentication callback.

## [0.1.6] - 2026-09-22

### Fixed
- Fixed Pocket-ID OIDC SSO redirect loop caused by returning an 8-character `key_prefix` truncation instead of a valid active API key.
- Ensured SSO callbacks and customer email logins issue full, valid `sq_live_...` API keys so session authentication passes clean on all API endpoints.

## [0.1.5] - 2026-09-20

### Fixed & Cleaned
- Sanitized `rawRdap` payload outputs by stripping multi-page legal notices and Terms of Service boilerplate text disclaimers from RDAP responses.
- Simplified available domain (HTTP 404) `rawRdap` payloads to concise `{ errorCode: 404, title: "Object not found" }`.

## [0.1.4] - 2026-09-20

### Added & Changed
- Added multi-proxy pool round-robin rotation (`PROXY_LIST`) with automatic failover across RDAP HTTP and WHOIS Port 43 TCP sockets.
- Enhanced domain cache manager to store available/unregistered domains (`status: ["AVAILABLE"]`) in MySQL with a 12-hour TTL.
- Enforced active cache serving for all non-expired cached domains (`cachedUntil > now`).

## [0.1.3] - 2026-09-20

### Added & Changed
- Replaced all native browser `alert()` and `confirm()` popup dialogs across the web application with a glassmorphic toast notification system (`showToast`).
- Completely removed homepage hero section SSO button, keeping header navigation button styled as a high-contrast cyan call-to-action button.
- Customer account email authentication & key reset endpoints (`POST /api/auth/customer-login`, `POST /api/auth/reset-key`) with inline UI integration.

## [0.1.2] - 2026-09-20

### Added
- Interactive Login Modal (`#loginModal`) providing Customer Dashboard Access via API Key entry and explicit Admin SSO via Pocket-ID.

### Fixed
- Fixed OIDC OAuth `invalid_state` error by sending a cryptographically secure 32-character `state` parameter in Pocket-ID authorization URLs.
- Added user-friendly HTML error page on `/api/auth/callback` for handling OAuth error responses.

## [0.1.1] - 2026-09-20

### Added
- SOCKS5 proxy failover (`SocksProxyAgent` / `SocksClient`) for RDAP & WHOIS queries when primary direct connections encounter Cloudflare Error 1015 / rate-limiting.
- Explicit detection and parsing for HTTP 404 / unavailable domains (`craves.pizza`, etc.) returning `status: ["AVAILABLE"]` and UI badge **AVAILABLE FOR REGISTRATION**.
- Pre-fetching background sync daemon (`npm run sync:sqpds`) connecting to `sqhome_pds.tracked_domains` with read-only MySQL permissions handling.

### Fixed
- Fixed Pocket-ID OIDC SSO client ID configuration resolution from environment variables (`OIDC_CLIENT_ID`).
- Prevented available/unregistered domains from serving stale `N/A` records from MySQL cache.
- Updated UI header authentication navigation label to "Log In".

## [0.1.0] - 2026-09-20

### Added
- Pocket-ID OIDC SSO integration (`https://sso.squarecomp.uk`) for single sign-on authentication.
- Admin Management Control Panel (`/api/admin/keys`, `/api/admin/keys/create`, `/api/admin/keys/revoke`) for system API key administration.
- Customer API Account Dashboard displaying masked key prefix, account status, query volume (`/api/user/key-info`), and registration timestamp.
- Self-service API Key Rotation endpoint (`POST /api/auth/rotate-key`) and UI button.
- Developer API Integration Guide section on homepage with cURL, Node.js, Linux CLI, and Python code examples.

### Security
- User privacy scoping on `/api/logs` endpoint so API key holders only see their own query logs while admins retain full visibility.
- Rejection of invalid or inactive `X-API-Key` headers with HTTP 401 Unauthorized status.
- Added strict `.gitignore` rules ensuring `.env` files are never tracked in Git.

### Changed
- Updated Stripe Checkout pricing to £15.00 GBP (`currency: 'gbp'`).
- Streamlined navigation layout by removing redundant header links and focusing on top-level application sections.

## [0.0.1] - 2026-09-20

### Added
- Initial Release of SquareComp WHOIS & RDAP Engine (`v0.0.1`).
- IANA RDAP Bootstrap DNS resolution supporting gTLDs (`.pizza`, `.monster`, `.fyi`, `.technology`, `.ing`, `.flights`, `.food`, `.love`, `.com`, `.co.uk`, etc.).
- Port 43 TCP WHOIS fallback socket client.
- Strict 7-Day Expiry Cache Rule in MySQL (`squarecomp_whois`).
- REST API listener (Port 3027) with `X-API-Key` authentication and IP rate limiting.
- TCP WHOIS Daemon (Port 43) formatting RFC 3912 responses.
- Stripe subscription integration for API Key generation.
- SquareComp-branded HTML5 web interface (`SQUARECOMP_GLOBAL_HEADER.md`).
- Raw `.md` and styled `.html` Changelog endpoints.