Changelog

The format is based on Keep a Changelog and this project adheres to Semantic Versioning. Instead of change type headers, we use module names.

All unreleased changes to this project will be documented in this file. Older changelogs can be found in folder changelogs.

5.2.0 - 2026-11-06

AdminModule

• Updated the admin Bootstrap from 3.3.0 to 3.4.1, the last release of the 3.x line. remp/crm#3846
• Added a shared clipboard-copy helper (window.crmAdmin.initClipboard) bundling ClipboardJS directly into admin.js. remp/crm#3856
  • Any element with the .clip class now gets copy-to-clipboard behavior and a translated “copied” tooltip automatically, with no per-page script needed.

ApiModule

• BREAKING: Changed AdminLoggedAuthorization to authorize API calls only by the session of a logged-in admin; a user access token sent as a bearer token is no longer accepted. remp/crm#3898
  • The admin login has to pass the same secure login check as the admin pages (SecuredAdminAccess, e.g. SSO login when admin_secure_login_check is enabled).
• DEPRECATED: Deprecated InternalToken. Admin pages should call APIs authorized by AdminLoggedAuthorization (or AdminLoggedOrBearerTokenAuthorization), external clients should use their own API token. remp/crm#3898
• Fixed an empty timestamped api_logs_* archive table being left behind on new installations. remp/crm#3830
• Added AdminLoggedOrBearerTokenAuthorization, which accepts either the session of a logged-in admin (calls from CRM admin pages) or an API token (server-to-server calls). remp/crm#3898
• Added TokenAuthorizationInterface (getAuthorizedToken()), through which an API authorization provides the token that authorized the request. ApiPresenter uses it to record the token in API logs and stats. remp/crm#3898
• Added TokenStatsTrackableInterface; API token stats are now updated only for calls authorized by an authorization implementing it. remp/crm#3898

AppleAppstoreModule

• Added audit logging for the apple_appstore_subscription_types table, so create, update and delete operations are recorded in the audit log. remp/crm#3725
• Added support for Apple introductory offers, which can now be paired with their own CRM subscription type. remp/dn-mofa#620
  • Added offer_discount_type and offer_period columns to the apple_appstore_subscription_types table.
  • The migration keeps the semantics of installs which relied on subscription_types.next_subscription_type_id: the existing pairing is copied into a FREE_TRIAL offer row and the base row is re-pointed to next_subscription_type_id. The rollback restores the schema only, not the re-pointed base rows.
  • Added OfferTypeEnum and OfferDiscountTypeEnum covering the values of Apple’s offerType and offerDiscountType fields, so seeders and other CRM code do not have to reach for the constants of the readdle/app-store-server-api library.
  • Added appleAppstoreSubscriptionTypeResolver service (SubscriptionTypeResolverInterface, SubscriptionTypeResolver) with resolve() for the product and the offer of Apple’s TransactionInfo and resolveForRenewal() for the upcoming renewal.
  • Changed VerifyPurchaseV2ApiHandler matching an already created payment by subscription type as well as by transaction ID. With more than one subscription type per product this could create a second payment.
• Deprecated AppleAppstoreSubscriptionTypesRepository::findSubscriptionTypeByAppleAppstoreProductId(), use findSubscriptionType() or findOfferSubscriptionType() instead. It is kept only for the legacy Apple App Store API v1 receipt handling and will be removed in the next major release.
• Deprecated ServerToServerNotificationV2Processor::getSubscriptionType(), now a thin delegate to SubscriptionTypeResolverInterface::resolve(). Instances overriding it have to override the appleAppstoreSubscriptionTypeResolver service instead. It will be removed in the next major release.
• Added appleAppstoreUserResolver service (UserResolverInterface, UserResolver) with resolve() matching the user of Apple’s TransactionInfo. The matching steps (appAccountToken, original transaction ID, unclaimed user creation) are separate protected methods, so an instance can replace just one of them.
• Deprecated ServerToServerNotificationV2Processor::getUser(), now a thin delegate to UserResolverInterface::resolve(). Instances overriding it have to override the appleAppstoreUserResolver service instead. It will be removed in the next major release.
  • ServerToServerNotificationV2WebhookHandler no longer depends on serverToServerNotificationV2Processor; it uses appleAppstoreSubscriptionTypeResolver and appleAppstoreUserResolver directly.
• Changed purchase verification (VerifyPurchaseApiHandler, VerifyPurchaseV2ApiHandler) unpairing the device from access tokens of other users logged in on the same device. Now only the purchase owner is paired, and other users logged in on the device stay paired with it. remp/helpdesk#5021
• Changed the Redis lock around Apple transaction processing (VerifyPurchaseApiHandler, VerifyPurchaseV2ApiHandler, both server-to-server notification webhook handlers) to expire after 30 seconds, so a lock left behind by a terminated process no longer blocks the transaction forever. remp/helpdesk#5156
  • Work inside the lock has to finish within 30 seconds; a longer run throws ExecutionOutsideLockException once it completes.

ApplicationModule

• BREAKING: Rewrote phinx:dump-schema-for-tests to build the dump by running migrations of every module present in the project (registered or not) into a temporary database, instead of dumping the currently configured live database. The dump is now reproducible, covers modules of all environments and no longer depends on the state of anyone’s development database. remp/crm#3830
  • The configured database user now needs the CREATE DATABASE/DROP DATABASE privilege; the command works in a temporary <CRM_DB_NAME>_schema_dump database and drops it afterwards.
  • The dump is now written as tests/migrations/all_tables.sql (raw CREATE TABLE statements); tests/migrations/19700101010000_all_tables.php became a small static migration executing that file and is no longer generated.
  • Removed the command’s inherited CLI options (--name, --overwrite, --path, --environment); the command takes no options.
  • Removed the odan/phinx-migrations-generator and riimu/kit-phpencoder dependencies as unnecessary; the command no longer uses them. The tests/migrations/schema.php snapshot file is no longer generated.
• BREAKING: Changed schema:load (bin/tests.php) to drop and recreate the test database before loading the schema. remp/crm#3830
  • The command shows which database (and host) it is about to drop and asks for confirmation (y/N, defaults to N); --force skips the prompt. CI test jobs now run schema:load --force.
• Added MemoryUserDataStorage, an in-memory UserDataStorageInterface implementation resettable between tests; the test environment now uses it as the user_data storage instead of Redis. remp/crm#3765
• Added countries JE (Jersey), MQ (Martinique), AS (American Samoa), AI (Anguilla) and VI (Virgin Islands (U.S.)) to CountriesSeeder.
• Fixed an empty hermes_tasks_old archive table being left behind on new installations. remp/crm#3830
• Changed EventsStorage::register() to accept an optional $name parameter, letting modules set a custom human-readable label for a registered event instead of always auto-deriving it from $code. remp/novydenik#1593
• Added SensitiveTriggerParamsInterface, an optional interface for scenario trigger handlers to declare output params (e.g. passwords) that must not be stored or logged in cleartext. remp/crm#3371
• Fixed international phone number validation (FormPatterns::PHONE_NUMBER_INTERNATIONAL, PHONE_NUMBER_FLEXIBLE) rejecting valid 10-digit numbers, e.g. Norwegian +47 123 45 678. remp/helpdesk#5106
• Changed events/list and event-generators/list APIs to accept also the session of a logged-in admin (AdminLoggedOrBearerTokenAuthorization), so admin pages can call them without the internal API token. API tokens keep working. remp/crm#3898

[ChurnPredictionModule]

• Added ChurnPredictionModule module. remp/crm#3768
  • Main purpose is to export and prepare data for churn prediction model training in BigQuery (this is called training mode).
  • There is also scoring mode, which exports current subscription data and runs churn predictions on them using already trained model.
  • Main functionality is covered by churn:run_pipeline command (RunChurnPipelineCommand).
• Added the churn_predictions table (AddChurnPredictionsTable migration) storing the latest churn prediction per subscription in the CRM DB, with foreign keys to users and subscriptions. Accessed via ChurnPredictionsRepository. remp/crm#3768
• Added churn:download_churn_predictions command (DownloadChurnPredictionsCommand), which downloads the most recent predictions from BigQuery and upserts them into the churn_predictions table. remp/crm#3768

FamilyModule

• Added heading and contenty type information into the subscription widget. remp/novydenik#1580
• Changed the master family subscription info widget to hide irregular family subscription types (without entry in family_subscription_types table). remp/crm#3702
  • Same widget is used in user detail in admin zone, but admin sees all family subscription types.
• Changed the master family subscription info widget to list only active master subscriptions (end_time in the future). remp/crm#3806
  • Expired subscriptions are collapsed behind a new “load inactive” link and queried/rendered only on demand, both in admin and in the frontend user zone.
  • Signature of render() changed to render(?int $userId = null): void; subclasses overriding it have to update their signature.
• Fixed ExtendFamilyExtension chaining a new family subscription after a family subscription stopped before it started, which left the user without access until that date. remp/helpdesk#5154

[FilemanagerModule]

• Changed the file URL copy button on the file detail page to use the shared window.crmAdmin.initClipboard helper instead of loading ClipboardJS from a CDN itself. remp/crm#3856

GiftsModule

• Fixed gift coupon creation failing when the activation date was submitted without seconds or a timezone, as sent by a native date-time picker. remp/crm#3778
• Added optional custom amount input to the admin gift payment form; the entered total is spread proportionally across all payment items. remp/crm#3533
• Changed the admin gift payment form to offer only non-recurrent payment gateways. remp/crm#3533
• Fixed the admin gift payment form showing a raw translation key instead of the error message when One Stop Shop country resolution failed. remp/crm#3533
• Fixed gift subscription never activating when the gift payment was re-created from an earlier one (retry of a failed card payment, repeated bank transfer with the same variable symbol); gift coupons of the original payment are now copied to the new one. remp/helpdesk#5013

GooglePlayBillingModule

• Added created_at and updated_at columns to the google_play_billing_subscription_types table. remp/crm#3725
• Added audit logging for the google_play_billing_subscription_types table, so create, update and delete operations are recorded in the audit log. remp/crm#3725
• Changed purchase verification (VerifyPurchaseApiHandler) unpairing the device from access tokens of other users logged in on the same device. Now only the purchase owner is paired, and other users logged in on the device stay paired with it. remp/helpdesk#5021

InvoicesModule

• Added a download-invoice button to the admin payment detail page header, shown once the invoice is available. remp/crm#3859
• Added an invoice summary widget to the admin payment detail page’s right column. remp/crm#3859
• Changed the invoice availability check used by the invoice button and invoice downloads to a single shared PaymentInvoiceStatusResolver, replacing three separate implementations that could disagree with each other. remp/crm#3859
• Fixed the frontend invoice button showing “Generate invoice” instead of “Download invoice” for externally billed (e.g. Stripe) invoices. remp/crm#3859
• Fixed generating or downloading an invoice failing with an unhandled error instead of a clear message when the payer has no invoice address. remp/crm#3859
• Fixed paid payments left without an invoice number when the generate_invoice Hermes message failed once; it is now retried. remp/crm#3634
• Added a reverseCharge invoice template parameter and the invoices.invoice_template.note.reverse_charge translation, so instance templates can note that the customer accounts for the VAT of a B2B reverse-charge payment. remp/crm#3862
• Changed the Redis lock around invoice generation (InvoiceGenerator) to expire after 30 seconds, so a lock left behind by a terminated process no longer blocks invoice generation for the payment forever. remp/helpdesk#5156
  • Work inside the lock has to finish within 30 seconds; a longer run throws ExecutionOutsideLockException once it completes.

[NytModule]

• Added an optional assignedAfter filter to NytActivationCodesRepository::userActivationCode() and claimAvailableCode(), restricting the lookup to codes assigned since a given date, and made userActivationCode() return the most recently assigned code. remp/novydenik#1593
• Fixed nyt:import-activated-codes failing to import activation dates after NYT changed their export format. remp/novydenik#1593
• Added a nyt_activation_code_estimated_end scenario “before event” trigger, firing before the estimated end (of the NYT subscription). remp/novydenik#1593
  • Estimated end is calculated as activated_at (or assigned_at if activation date is missing) + NytActivationCodesRepository::SUBSCRIPTION_LENGTH_DAYS (364 days). We don’t have start time / end time dates for NYT subscriptions (and we don’t have an activation date for all codes).
  • Deactivated codes are ignored.
• Fixed NytActivationCodesRepository#add() to accept also external_id (mandatory column without default value). remp/novydenik#1593

OnboardingModule

• BREAKING: Changed OnboardingGoalCompletedCriteria to parse its timeframe with TimeframeScenarioTrait, so the module now requires ScenariosModule. A partially filled timeframe now fails the condition job with an error instead of being ignored, and invalid timeframe values mark the job as failed instead of leaving it in the started state. remp/crm#3650
• Changed onboarding-goals/list API to accept also the session of a logged-in admin (AdminLoggedOrBearerTokenAuthorization), so admin pages can call it without the internal API token. API tokens keep working. remp/crm#3898

[OneSignalModule]

• BREAKING: Changed OneSignal API host from https://onesignal.com/api/v1/ to https://api.onesignal.com/ and the authorization header from Basic <key> to Key <key>, as required by OneSignal’s App API keys (os_v2_app_...).
  • Generate an App API key in OneSignal’s Settings > Keys & IDs and store it in onesignal_applications.application_api_key before deploying, unless your legacy key works with the new host and header.
  • Allow outgoing requests to api.onesignal.com if you restrict egress traffic.
• Changed onesignal-templates/list and onesignal-applications/list APIs to accept also the session of a logged-in admin (AdminLoggedOrBearerTokenAuthorization), so admin pages can call them without the internal API token. API tokens keep working. remp/crm#3898
• Fixed every outbound message being marked as failed. OneSignal no longer returns recipients in the create-notification response, so a message is now sent when OneSignal returns a notification ID.
  • The recipients column of onesignal_outbound_messages is deprecated and no longer written.
• Added no_subscription status of outbound messages, used when OneSignal doesn’t create the notification because no subscription matches the filter (e.g. the user doesn’t use that OneSignal application).
• Changed handling of OneSignal API errors: client errors (4xx) mark the message as failed without being retried. Rate limiting (429), server and connection errors are thrown, so Hermes retries the message.
• Added idempotency_key to outbound messages and sent it to OneSignal, so Hermes retries can’t deliver the same notification twice. Already processed messages are skipped by OneSignalSendNotificationHandler.

PaymentsModule

• BREAKING: Removed the product-selection JavaScript and the unused price:update event trigger from admin payment templates (see ProductsModule). remp/crm#3679
• BREAKING: Added resumed_subscription_id column to subscription_pauses, a second foreign key to subscriptions (existing pauses are backfilled by the migration). $subscription->related('subscription_pauses') is now ambiguous and throws, use the new SubscriptionPausesRepository::subscriptionPauses() instead. remp/crm#3881
  • SubscriptionPausesRepository::add() now requires the resumed subscription ID as its fifth parameter.
• BREAKING: Changed RefundPaymentProcessor::processRefundedPayment() to store the refunded amount in the refund_amount payment meta (RefundPaymentProcessor::REFUND_AMOUNT_META_KEY) instead of each gateway storing its own. remp/helpdesk#5157
  • Call processRefundedPayment() after a successful RefundableInterface::refund(). InstantRefundWidget already does.
  • PaypalRefundTrait::REFUND_AMOUNT is removed, read RefundPaymentProcessor::REFUND_AMOUNT_META_KEY instead.
• BREAKING: Changed PaymentRefundFormFactory to run the PaymentRefundFormDataProviderInterface providers before it changes the payment status, subscription end and recurrent payment, so an instant gateway refund finishes before the status change triggers notifications. remp/helpdesk#5157
  • Providers can no longer rely on the payment already having the new status.
• Added RecurrentPaymentTokenMissingEvent, emitted when a payment on a recurrent gateway completes but the gateway doesn’t return a recurrent token (e.g. the bank failed to register the card). remp/crm#3848
  • The payment is also flagged with the recurrent_token_missing payment meta. Replaces the previous “missing recurrent token” error log, which produced unactionable Sentry noise.
• Added VAT to widget listing donation payment items (DonationPaymentItemsListWidget). Used on payment screens (list and show payment). remp/helpdesk#4731
• Changed ImapClient::fetch() to retry up to 3 times with a fresh connection when the IMAP server drops the connection mid-session (Gmail’s occasional “empty response”), instead of failing the whole mail-confirmation run. remp/crm#3845
• Changed SubscriptionPauser to own the pausability check by moving isSubscriptionPausable() out of PauseSubscriptionWidget, so the check can be reused outside the widget. remp/crm#3818
• Changed how subscription payment items are copied onto a new payment when copying an existing payment or charging an upcoming recurrent payment; the previously duplicated logic is now unified in the new CopyPaymentService. remp/crm#3252
  • Copied items are now rebuilt from the current subscription type also when the number of items changed (e.g. one item was split into two), not only on a VAT change.
  • Payments carrying extra items (e.g. a donation) now get current VAT rates on their subscription items too; previously they kept the outdated VAT of the original payment.
• Add status index to recurrent_payments table to speed up RecurrentPaymentStatusCriteria scenario criteria load. remp/crm#3371
• Changed the recurrent payment ID copy button in the user’s payments listing to use the shared window.crmAdmin.initClipboard helper instead of loading ClipboardJS from a CDN itself. remp/crm#3856
• Added RecurrentPaymentChargesDataProviderInterface, letting modules override the failed-charge retry schedule (the recurrent_payment_charges configuration option) per recurrent payment, e.g. to use a different schedule for each payment gateway. remp/crm#3841
  • RecurrentPaymentsProcessor::processFailedRecurrent() uses the intervals returned by the first provider that returns a non-empty list; otherwise it falls back to the configuration option.
• Added PaymentGatewayFormDataProviderInterface, letting modules add their own fields to the admin payment gateway form and process them on submit. remp/crm#3841
  • Providers run in PaymentGatewayFormFactory after the form defaults are set, and on submit before the payment gateway is updated, so a provider can adjust or strip the submitted values.
• Added PaymentMethodsRepository::findPaymentMethodByRecurrentPayment(), returning the payment method a payment was made with, no matter whether the payment is the parent of a recurrent payment, its charge, or a card change. remp/crm#3871
• Added PaymentCopiedEvent, emitted by PaymentsRepository::copyPayment() with the source and the new payment, so modules can carry their own payment-bound data over to the copy (only payment items are copied by default). remp/helpdesk#5013
• Fixed an error rendering the admin payment refund page when instant refund is available. remp/crm#3890
• Add additional checks when selecting existing card in RecurrentPresenter. remp/crm#3897
• Fixed refund of a paused subscription’s payment not stopping the resumed subscription (the part after the pause). remp/crm#3881
  • Added SubscriptionPauser::stopResumedSubscriptions(), called by the new PausedSubscriptionRefundHandler on PaymentChangeStatusEvent.
  • Added id of the resumed subscription to new_subscription in the result of SubscriptionPauser::pauseSubscription().
  • The resumed subscription is stopped with the expired_by_admin subscription meta set, the same as a subscription stopped by the refund form.
• Changed RecurrentPaymentsResolver::resolveAddress() to return null when the parent payment’s address is deleted, so a renewal no longer binds a deleted address to the new payment and subscription. remp/helpdesk#5055
• Changed the Slovak label of the stop recurrent payment action in the customer’s payments listing from “Zastaviť opakovanie” to “Zastaviť automatickú obnovu”. remp/web#3118
• Fixed an error opening the admin recurrent payment edit form when its next subscription type was deactivated. The deactivated type stays preselected in the form. remp/crm#3842
• Changed the Redis locks in PaymentsRepository::updateStatus() and RecurrentPaymentsRepository::createFromPayment() to expire after 30 seconds, so a lock left behind by a terminated process no longer blocks the payment forever. remp/helpdesk#5156
  • Work inside the lock has to finish within 30 seconds; a longer run throws ExecutionOutsideLockException once it completes.

PrintModule

• Changed ChangeAddressRequestFormFactory to save the submitted country if a data provider enables the country select. remp/crm#3868
  • The select stays disabled by default, so the default country is still used unless a data provider changes it.
• Fixed UserPrintAddressFormFactory using the payment’s address only when its type is print; it now compares with the address type the form was created for, so the magazine and reporter forms no longer prefill a bound print address. remp/helpdesk#5055
• Fixed issue with summer/winter time affecting export date. remp/helpdesk#5135
  • If export was created before time switch for date after switch, it would work with incorrect date.

ProductsModule

• BREAKING: Removed the e-shop products field from the admin payment form. If you relied on it, implement your own separate form. remp/crm#3679
  • PaymentFormDataProvider no longer creates product or postal fee payment items.
• BREAKING: Typed the CartTrait signal methods and the onSave, onLogin and onAuth callbacks of CheckoutFormFactory. remp/crm#3901
  • Subclasses of a presenter using CartTrait that override handleAddCart, handleRemoveCart or handleRemoveProductCart must declare the : void return type.
  • A class using CartTrait must not declare its own $cartSession, $cartProducts or $cartProductSum; the trait now types them.
  • The callbacks are Closure properties; assign a closure.
• Fixed the tag edit page failing with an error for tags positioned after a deleted tag. remp/helpdesk#4788
• Added product tag filter to the shop stats dashboard, so the graphs can be narrowed to selected product types. remp/crm#3815
• Fixed the checkout form sometimes not resolving the correct B2B/B2C mode when a new billing address was submitted. remp/helpdesk#4888
• Fixed an error when changing the country or postal fee in the shop checkout form. remp/crm#3890
• Fixed the shop checkout creating the payment from the submitted cart form value. The payment is now built from the cart stored in the session; a submission whose cart no longer matches it (for example a checkout page left open in another tab) is rejected with a message and has to be confirmed again. remp/crm#3901
  • CheckoutFormDataProviderInterface::formSucceeded() receives the session cart as $params['cart']; data providers should read the cart from there instead of $values['cart'].
• Fixed the shop accepting a product count below 1 in the add-to-cart signal; such a request is now answered with HTTP 400. remp/crm#3901
• Fixed the shop checkout form resetting the selected payment gateway to the first one after a failed submission. remp/crm#3901

RempCampaignModule

• Changed remp/list-banners API to accept also the session of a logged-in admin (AdminLoggedOrBearerTokenAuthorization), so admin pages can call it without the internal API token. API tokens keep working. remp/crm#3898

RempMailerModule

• BREAKING: Changed MailUserSubscriptionsRepository::subscribeUserAll() and unsubscribeUserAll() to operate only on publicly-listed mail types; previously they affected all mail types regardless of visibility, including hidden ones. remp/helpdesk#4726
• BREAKING: Changed the MailReceivedCriteria scenario condition to check the whole delivery history when its timeframe is left empty; previously it never matched. A partially filled timeframe now fails the condition job with an error instead of being ignored. remp/crm#3650
• Added MailTypeSubscriptionCriteria for scenarios to check whether user is subscribed to the newsletter or not. remp/crm#3829
• Removed hard bounce tracking from the mail logs widget and user data export, as Mailer no longer provides the hard_bounced_at value. remp/remp#1481
• Added newsletter and public preview columns to the user’s mail logs widget in admin. The newsletter links to its detail in Mailer, the preview opens in a popup window. remp/crm#3904
  • Requires a Mailer v5.3 (returning mail_type and mail_template.public_preview_url in the users/logs API); with older Mailer versions the columns stay empty.
  • Added MailTypesAdminPresenter redirecting to the mail type detail in Mailer.
• Fixed MailTemplatesAdmin and MailSettings presenters failing with “not found in DI container” since the module stopped using Composer classmap autoloading. The presenters are now registered in the module’s config. remp/crm#3904
• Added recording of a login_type_disabled_for_admin login attempt when an admin account tries to log in with a Mailer autologin token. remp/crm#3869
• Changed mail-template/list API to accept also the session of a logged-in admin (AdminLoggedOrBearerTokenAuthorization), so admin pages can call it without the internal API token. API tokens keep working. remp/crm#3898

RempPythiaModule

• DEPRECATED: Marked the module as deprecated in favour of [ChurnPredictionModule]. remp/crm#3768

SalesFunnelModule

• BREAKING: Removed support for the custom body parameter of SalesFunnelFrontendPresenter::renderShow(); the rendered body is now always the stored sales funnel body. remp/crm#3176
  • The POST funnel fallback of renderShow() was removed together with it; the funnel url key is now read only from the URL.
• Added SalesFunnelRenderer service with the funnel Twig rendering extracted from SalesFunnelFrontendPresenter. remp/crm#3176
• Changed sales funnel shows displayed through a valid admin preview link (preview parameter) to no longer count into show statistics. remp/crm#3176
  • The show SalesFunnelEvent is not emitted at all for such previews, so sales_funnel scenario triggers also stop firing for them.
• Added limit_per_user_for_period to sales funnels, limiting the per-user purchase count only within the last N days before the purchase; when empty, the limit keeps applying to all payments ever made. remp/crm#3742
  • The period selectbox shows up next to limit_per_user in the funnel form and offers configurable day presets (see README).
  • SalesFunnelsRepository::add() and getAllUserSalesFunnelPurchases() accept new optional arguments ($limitPerUserForPeriod, $paidFrom).
• Added a copy-to-clipboard button next to the funnel URL and the redirect funnel URL on the sales funnel admin detail page. remp/crm#3856

• Added custom access-denial destinations through SalesFunnelAccessDeniedException, which salesfunnel.dataprovider.validate_funnel providers can throw instead of redirecting directly. The presenter respects allow_redirect and records the no-access event. remp/crm#3867

• Added admin.sales_funnel.show.middle widget slot to the sales funnel detail page, rendered below the subscription types and payment gateways row. remp/crm#3828
• Added SalesFunnelAccessValidator service with the sales funnel access checks extracted from SalesFunnelFrontendPresenter, so other code can check whether a user can access a funnel without being redirected. remp/crm#3872
  • evaluate() follows redirect funnels and returns SalesFunnelAccessResult with the reason of a denial.
  • SalesFunnelFrontendPresenter now uses the same checks; its redirects and no-access statistics are unchanged.

ScenariosModule

• BREAKING: Changed TimeframeScenarioTrait::getTimeframe() to throw ConditionCheckException when only some of the timeframe fields (operator, amount, unit) are filled; previously it returned null, the same as for an empty timeframe. remp/crm#3650
• BREAKING: Changed all scenarios/* APIs (info, create, criteria, generics, stats, list-triggers, users, journeys, journey-jobs) to accept only the session of a logged-in admin (AdminLoggedAuthorization). remp/crm#3898
  • API tokens are no longer accepted, all requests are authorized by the admin’s session.
• Added scenarios job history logging: every job is now snapshotted into the new scenarios_job_history table, preserving its final state. remp/crm#3371
  • Added JobHistoryRepository, which records the snapshot from JobsRepository::softDelete().
  • Added the scenarios_job_history table partitioned by month of created_at, so retention can be enforced with cheap partition truncation.
  • Added the scenarios:remove_old_job_history command, which truncates the partitions whose month is outside the retention window.
• Fixed scenario jobs being finished without ever being marked as started, leaving them with no started_at timestamp. remp/crm#3371
  • The e-mail and banner elements skipped this step when the target user was unreachable; the push notification element never marked its jobs as started at all.
• Changed the scenario builder to render directly in the admin page instead of inside a resized iframe. remp/crm#3371
  • Removed the embed action of ScenariosAdminPresenter together with embed.latte.
• Added journey tracking to scenario jobs, so it is possible to tell which jobs belong to the same pass through a scenario. remp/crm#3371
  • Added journey_id and parent_job_id columns to both scenarios_jobs and scenarios_job_history.
• Fixed saving a scenario failing with a duplicate key error once it contained a node that had been deleted earlier. remp/crm#3371
  • This can happen when deleting a node, saving, and undoing the deletion with Ctrl+Z in Scenario builder.
  • Node is restored as the same node instead of being recreated. Users who were waiting inside it continue their journey, and its recorded history and statistics stay attached to it.
• Added the “Repeating” scenario trigger, which enrolls every user of a chosen segment into the scenario on a configured schedule - daily (time only), weekly (day of week + time) or monthly (day of month + time).
  • Added the repeating value to the scenarios_triggers.type enum. The segment code is stored in event_code and the schedule in options as {"frequency":"weekly","day":4,"time":"09:00"}; the segment has to be based on the users table.
  • Added the scenarios_repeating_trigger_schedule table and RepeatingTriggerScheduleRepository. A unique index on (trigger_id, occurred_at) claims each occurrence before any job is created, so overlapping runs of the generator cannot enroll a segment twice.
  • Added RepeatingTriggerGenerator and the scenarios:repeating_trigger_generator command (recommended cron interval 10 minutes), with --now, --scan-minutes (how long after its scheduled time an occurrence may still be fired, default 20) and --catch-up-minutes (how far back a due occurrence is still looked up, default 60) options. An occurrence found within the catch-up window but older than the scan window is recorded as skipped and never replayed.
  • Repeating triggers only expose user_id to their descendants, so conditions requiring an event entity (subscription, payment, recurrent payment, address, order, and the has_payment trigger criterion) are rejected when the scenario is saved.
• Added versioning of scenarios. remp/crm#3371
  • Versions are saved in scenarios_versions table. Every save records the whole definition of the scenario.
  • Added a migration recording the initial version of existing scenarios. Scenarios that fail to load are skipped and get their first version on the next save.
  • Added scenario_version_id to scenarios_jobs and scenarios_job_history, recording which version of the scenario each job ran on.
• Changed ScenariosRepository::createOrUpdate() to accept the ID of the user saving the scenario. remp/crm#3371
• Added user journey debugging to the scenario builder. remp/crm#3371
  • Added APIs /v1/scenarios/users (users who passed through the scenario), /v1/scenarios/journeys (journeys of a user) and /v1/scenarios/journey-jobs.
  • Added a (scenario_id, user_id, journey_id) index to the scenarios_job_history table.
• Added the “Subscription upgraded” scenario trigger, fired when a subscription is upgraded. remp/novydenik#1637
  • Triggered by the subscription-upgraded Hermes message; outputs user_id, subscription_id (the new, upgraded subscription) and upgrade_type.

SegmentModule

• Added ValidatableSegmentInterface and ValidatableQueryInterface; SegmentQuery now validates that a segment’s query contains the %where% placeholder. remp/crm#3809
• Added a default query template (SELECT %fields% FROM %table% WHERE %where% GROUP BY %group_by%) pre-filled into the SQL field when creating a new segment. remp/crm#3809
• Changed the segment builder to authorize its API requests by the admin’s session instead of the admin’s access token passed to the page. remp/crm#3898
• Changed segments/list API to accept also the session of a logged-in admin (AdminLoggedOrBearerTokenAuthorization), so admin pages can call it without the internal API token. API tokens keep working. remp/crm#3898

StripeModule

• BREAKING: Changed the one-time stripe gateway to no longer store the customer’s payment method for future use. setup_future_usage is now omitted from the payment intent instead of being sent as on_session. remp/euobserver#272
  • None of the funnels using this gateway asked the customer for consent to keep their card on file, which storing a payment method requires.
  • Set the new enable_future_usage: true extension option to restore the previous behavior.
  • The recurrent gateways are unaffected: stripe_recurrent still requests off_session, as charging a stored payment method later is its purpose.
• Added an enable_future_usage extension option (default false) controlling whether the one-time stripe gateway stores the customer’s payment method (setup_future_usage: on_session). remp/euobserver#272
• BREAKING: Changed the one-time stripe gateway to offer every payment method enabled in the Stripe Dashboard (Bancontact, iDEAL, SEPA Direct Debit, …) instead of card only. payment_method_types is now omitted from the checkout session instead of being sent as [card]. remp/euobserver#272
  • Set the new payment_method_types: [card] extension option to restore the previous behavior.
  • Some of the newly offered methods are delayed notification ones, whose payments are confirmed only once the bank decides. List the methods explicitly if your funnel needs an immediate result.
  • The recurrent gateways are unaffected: stripe_recurrent still offers card only, as it charges the stored card later.
• BREAKING: Removed RefundTrait::REFUND_AMOUNT and the Stripe gateways’ own refund_amount payment meta write. The amount is now stored by RefundPaymentProcessor (PaymentsModule) under RefundPaymentProcessor::REFUND_AMOUNT_META_KEY. remp/helpdesk#5157
• Added a payment_method_types extension option listing the payment method types offered on the one-time stripe gateway’s checkout page. Unset by default, which offers everything enabled in the Stripe Dashboard. remp/euobserver#272
• Added the first payment item’s name as the payment intent’s description, so the Stripe Dashboard payment row names what was bought. remp/euobserver#272
• Changed AbstractStripe to be an actual abstract class and removed its begin(), which duplicated the Stripe gateway’s flow and was never reachable — the gateway factory binds every gateway code to a concrete subclass. remp/euobserver#272
• Added optional Stripe coupon support to StripeService::createSubscriptionCheckoutSession(), applying a subscription type’s configured coupon (SubscriptionTypeMeta::COUPON_ID) to the checkout session. remp/euobserver#247
• Changed renewal processing (InvoicePaidWebhookHandler) to match the applied coupon when resolving the subscription type. remp/euobserver#247
• Fixed payments made with a delayed notification payment method (e.g. SEPA Direct Debit) being marked as failed immediately after checkout, even though the bank hadn’t confirmed or declined the payment yet. remp/euobserver#271
  • Customers paying with such a method are now shown a page explaining that the payment is being processed and confirmation may take a few days.
• Added handling for the checkout.session.async_payment_succeeded and checkout.session.async_payment_failed webhook events, confirming or failing payments made with a delayed notification payment method once Stripe reports the bank’s decision. remp/euobserver#271

SubscriptionsModule

• Changed the create path of SubscriptionTypesFormFactory. remp/crm#3828
  • After a successful save, subscription_type_id is set into $values before the form data providers run, so providers resolve the subscription type by ID on both create and edit.
  • Providers are no longer invoked when the creation fails.
  • Providers that used the presence of subscription_type_id to detect editing now also run on create — e.g. Mobiletech’s short_name is now saved also when creating a subscription type; previously its value was silently dropped on create.
• Fixed the subscription type detail page crashing with a translation error when recurrent_charge_before was set to a negative value (charge after expiration). remp/helpdesk#4769
• Added SubscriptionGapsFilterInterface and SubscriptionGapsRepository::setSubscriptionsFilter(), limiting which subscriptions cover the user when subscription gaps are calculated. remp/crm#3875
• Fixed subscription gaps only slightly longer than 28 days (e.g. 28.5 days) not being recorded and not being found by SubscriptionGapsRepository. remp/crm#3875
• Added SubscriptionsRepository::futureEndingUserSubscriptions() and futureEndingUserSubscriptionsWithContentAccess(), selections of a user’s subscriptions that still grant access now or later, excluding subscriptions stopped before they started (end_time equal to start_time). remp/helpdesk#5154
• Fixed ExtendSameTypeExtension and ExtendSameContentAccess chaining a new subscription after a subscription stopped before it started, which left the user without access until that date. remp/helpdesk#5154

UpgradesModule

• BREAKING: Changed SubscriptionTypeUpgradeSchemasRepository; update any raw queries against subscription_type_upgrade_schemas. remp/crm#3828
  • Schema assignments are soft-deleted (new deleted_at column): remove() sets deleted_at, schema lookups exclude soft-deleted rows.
  • add() does not revive a soft-deleted assignment (seeder reruns don’t re-add assignments removed in admin) and now declares an ActiveRow return type.
• Added upgrade schema assignment to the subscription type detail page. remp/crm#3828
  • The upgrades widget lists assigned schemas above the possible upgrade targets; the “Assign upgrade schema” modal assigns the selected schema to the type, unassigning asks for confirmation. Re-assigning a removed schema revives it.
  • Added UpgradeSchemaAssigner model handling assignment and unassignment.
• Added an upgrade schemas panel to the sales funnel detail page. remp/crm#3828
  • Lists each of the funnel’s subscription types with its assigned schemas; unassigning asks for confirmation.
  • The “Assign upgrade schema” modal assigns the selected schema to all the funnel’s subscription types at once.
• Fixed upgrade possibly offering a target subscription type that didn’t include all the content access required by the upgrade option. remp/helpdesk#4891
• Fixed admin widget listing available upgraders which included subscription types that weren’t actually available for the end user. remp/crm#3888
• Fixed trial upgrade finalization for users who had already upgraded manually during the trial; such trials were never marked as finalized and, for DennikN legacy trials, the already-upgraded subscription could be upgraded again. remp/helpdesk#4980
  • Trials are now marked with trial_early_converted subscription meta without running the upgrade when the user’s active subscription already includes all content access of the trial.
  • Trial finalization now throws an explicit exception if no active eligible subscription is found.
• Fixed paid extend upgrade returning a server error for a subscription whose earlier paid extend attempt had already redirected to the payment gateway. remp/helpdesk#5156
• Fixed paid upgrade attempts submitted while another upgrade of the same subscription was still running returning a server error instead of the upgrade error page. remp/helpdesk#5156
• Changed the Redis locks of the paid extend and paid recurrent upgrade widgets to expire after 30 seconds, so a lock left behind by a terminated request no longer blocks further upgrades of the subscription forever. remp/helpdesk#5156
  • Work inside the lock has to finish within 30 seconds; a longer run throws ExecutionOutsideLockException once it completes.
• Added SubscriptionUpgradedEvent, emitted when an upgrade is completed and recorded in subscription_upgrades. remp/novydenik#1637
  • Emitted by SubscriptionUpgradesRepository::add(), so it covers all upgrade types; carries the base subscription, the upgraded subscription and the upgrade type.
  • Registered in the events storage as subscription_upgraded and forwarded as the subscription-upgraded Hermes message, which drives the new ScenariosModule trigger.

UsersModule

• BREAKING: Moved account deletion section of the user settings page to AccountDeleteWidget, rendered in the frontend.user.settings.account_delete widget placeholder. remp/euobserver#253
• BREAKING: Changed the UserCreatedAtCriteria scenario condition to apply no time restriction when its timeframe is left empty, so it matches every user; previously it never matched. A partially filled timeframe now fails the condition job with an error instead of being ignored. remp/crm#3650
• Added soft-delete for user-group memberships. UserGroupsRepository::removeFromGroup() now sets deleted_at instead of hard-deleting the row. remp/crm#3774
  • Re-adding a user to the same group restores the existing row and resets created_at.
  • Added UNIQUE(user_id, group_id) index on user_groups to prevent duplicate active rows under concurrent addToGroup() calls; migration dedupes any pre-existing duplicates by keeping the highest-id row per pair.
• Added soft-delete for groups. Deleting a group in admin now sets deleted_at instead of hard-deleting the row. remp/crm#3774
  • GroupsRepository::all(), exists() and findByName() exclude soft-deleted groups.
  • Groups whose only remaining memberships are soft-deleted can now be deleted in admin.
• Added removal of a user from all their user groups when the user is deleted. remp/crm#3774
  • UserGroupsUserDataProvider hard-deletes the user’s user_groups rows during anonymization.
  • Added a migration removing already-deleted users still left in groups.
• Fixed the UserGroupsCriteria scenario criterion not matching the groups selected in the scenario builder. Selecting one or more user groups filtered users by unrelated group IDs, so the criterion let through the wrong users (or nobody at all). remp/crm#3774
  • RespektCzModule’s ParentUserGroupsCriteria, which delegates to it, was affected the same way and is fixed too.
• Added named registration for IpRateLimit service so we can override defaults. remp/helpdesk#4835
• Add locale index to users table to speed up LocaleCriteria scenario criteria load. remp/crm#3371
• Fixed address change requests being created for company ID, tax ID or VAT ID changes that only differed by whitespace. remp/helpdesk#4888
• Fixed Google Sign-In reporting replayed authorization callbacks as invalid state / invalid user state warnings. remp/crm#2114
• Added the users.sso.google.prompt configuration option, passed to Google’s authorization request. The default is select_account - a re-run authorization request renders the account chooser instead of silently redirecting back to the callback. remp/crm#2114
• Added the login_type_disabled_for_admin login attempt status to LoginAttemptsRepository, recording an attempt to use a login type that is not available for admin accounts. AutoLoginTokenAuthenticator and AccessTokenAuthenticator record it when an admin account tries to log in with a token. remp/euobserver#248 remp/crm#3869
• Fixed the UserCreatedAtCriteria scenario condition never matching when its timeframe was left empty. An empty timeframe now applies no time restriction, so the condition matches every user. remp/crm#3650
• Added optional $unpairOtherUsers parameter to AccessTokensRepository::pairWithDeviceToken(). Set it to false to pair an access token with a device token without unpairing the device from other users’ access tokens. The default (true) keeps the existing behaviour. remp/helpdesk#5021
• Changed AddressesRepository::softDelete() to emit AddressRemovedEvent, so every deletion (including forced ones from frontend pages) unbinds the address from subscriptions via AddressRemovedHandler. UsersAdminPresenter::handleRemoveAddress() no longer emits the event itself. remp/helpdesk#5055
• Added an option to define period (days) for count of IP addresses and browsers in the user’s login attempts widget (UserLoginAttempts). remp/helpdesk#5139
  • Set it with the setStatsDays(int $days) setup call on userLoginAttempts service. If it is not set (default state), all login attempts are counted as before.
• Changed DefaultUserTokenAuthorization, DeviceTokenAuthorization and UserTokenAuthorization to implement TokenAuthorizationInterface, so API logs record the token that authorized the request (newly also for calls authorized by a device token). remp/crm#3898

---