Implementation Summary - May 6, 2026

Historical record. This file describes the May 6 implementation state and contains obsolete paths and schema references. Use docs/README.md, current source code, and database/init.sql for current instructions.

Changes Made

1. ✅ 2FA with TOTP + Authenticator App Support

Status: Already existed, enhanced with UX improvements

• TOTP-based 2FA already implemented using two_factor_auth.php
• Works with Google Authenticator, Authy, Microsoft Authenticator, 1Password, etc.
• Added “Remember Device” feature (30-day cookie)
• Added “Daily MFA” - only asks for MFA once per day per device
• Added “Trusted IPs” - admin can whitelist IPs that skip MFA entirely

New Files:

• src/controllers/auth/auth_handler.php - Updated with device trust logic
• src/controllers/auth/two_factor_verify.php - Updated with device trust cookie
• src/controllers/auth/two_factor_setup.php - Added trusted device/IP management
• src/views/pages/auth/two_factor_setup.php - Added UI for device/IP management

Database Changes (in 000_all.sql):

• Added user_2fa table
• Added login_2fa_attempts table
• Added trusted_devices table (new)
• Added trusted_ips table (new)

2. ✅ Dropbox OAuth Integration

Status: Implemented

• Replaced access token input with OAuth flow
• Supports refresh tokens for permanent connection
• Automatic token refresh when near expiration
• “Disconnect” button to revoke token

New Files:

• src/controllers/settings/dropbox_oauth.php - OAuth flow handler
• Updated src/link_resolvers/auto_resolver/dropbox_link_resolver.php - Auto-refresh tokens
• Updated src/views/pages/settings/links.php - OAuth UI
• Updated src/controllers/settings/links_handler.php - Preserve OAuth credentials

3. ✅ Beta Banners

Status: Implemented

Added beta banners to:

• Documents settings page (src/views/pages/settings/documents.php)
• Notifications page (src/views/pages/settings/notifications.php)
• Links page (src/views/pages/settings/links.php)
• API Keys page (src/views/pages/api-keys.php)

4. ✅ Cron Logging

Status: Implemented

• All cron jobs now log to unified log file: /var/www/config/logs/cron/cron.log
• Also writes to same daily log as app: logs/YYYY-MM-DD.log
• Created cron/src/utils/cron_logger.php with helper functions
• Updated cron/crontab to redirect all output to unified log
• Updated cron/entrypoint.sh to create log directory

New Files:

• cron/src/utils/cron_logger.php

Updated Files:

• cron/crontab - Unified logging
• cron/entrypoint.sh - Create log directory
• cron/src/cron/generate_recurring_invoices.php - Use cron_logger
• cron/src/cron/send_invoice_reminders.php - Use cron_logger
• cron/src/cron/auto_terminate_contracts.php - Use cron_logger
• cron/src/cron/link_expiration_checker.php - Use cron_logger
• cron/src/cron/stripe_reconciliation.php - Use cron_logger

5. ✅ Delete Migration File

Status: Completed

• Deleted database/migrations/001_2fa.sql (per user’s request)
• Tables added directly to database/migrations/000_all.sql

Security Improvements

1. Trusted Device Cookies: HttpOnly, Secure (when HTTPS), SameSite=Lax
2. Daily MFA Window: Reduces friction while maintaining security
3. Trusted IPs: Admin-controlled whitelist for known networks
4. OAuth over Access Tokens: More secure Dropbox integration with refresh tokens

Next Steps (Future)

1. Passkeys: Modern authentication without passwords (user requested)
2. Test OAuth Flow: Verify Dropbox OAuth works end-to-end
3. Add OAuth for Google Drive: Similar OAuth flow for GDrive
4. Device Fingerprinting: Better device identification (beyond user agent)
5. Trusted Device Notifications: Alert when new device is trusted

Configuration Required

Dropbox OAuth Setup

1. Create app at https://www.dropbox.com/developers/apps
2. Add dropbox_app_key and dropbox_app_secret to app_config table
3. Configure redirect URI: https://yourdomain.com/?page=settings/dropbox-oauth&action=callback

Trusted IPs

1. Go to Settings → 2FA → Trusted IPs (admin only)
2. Add office/home IP addresses
3. These IPs will skip 2FA entirely