Authentication

• Replaced username/password token authentication with Personal Access Token (PAT)


• PAT is now stored encrypted with AES-256-CBC and sent as X-Access-Token header


• PAT connection test now uses the public GET /user_detail/0 endpoint, removing the dependency on the advanced API


• PAT is automatically trimmed on save and test to prevent failures from accidental whitespace when copying tokens

Fixed

• Fixed race condition in test_connection() where config keys were mutated mid-request


• Fixed issue_badge_task to guard against a deleted course-badge mapping after the task was queued


• Fixed double audit record write that was corrupting the stored HTTP code on 5xx retries


• Fixed silent provider fetch failure caused by comparing cache miss (false) against null


• Fixed providers endpoint from /user_detail/0 to the dedicated /user_detail/0/providers endpoint


• Fixed misleading "no providers" warning shown when the API returns HTTP 200 with an unexpected non-list response body — now correctly shows the API configuration notice


• Removed environment name from the connection-failed error message

Removed

• Removed the course_restored observer and its associated backup/restore logic


• Removed dead event classes course_mapping_restored and course_mapping_skipped

Code Quality Improvements in 1.1.1

• Fixed all 44 PHP files by removing the blank line after <?php so the copyright header starts on line 2. This resolves ~70 prechecker errors.


• Fixed PHPDoc incomplete parameter lists.


• Fixed test directory structure by moving test files from tests/classes/* to tests/* directories to match Moodle's expected structure.


• Replaced error_log() with debugging() in badge_selection.php to comply with Moodle coding standards.


• Fixed MOODLE_INTERNAL checks. Added MOODLE_INTERNAL check to api_client.php (has require_once side effect). Removed unnecessary MOODLE_INTERNAL checks from class-only files


• Replaced elseif with else if (two words) in all files to comply with Moodle coding standards


• Fixed line length violations by breaking long lines to stay under Moodle's 132 character limit


• Fixed array trailing commas by adding trailing commas to all multi-line arrays to comply with Moodle coding standards


• Fixed minor code quality issues:
  
  
  
  • Replaced Perl-style comment with standard comment syntax
  
  
  • Removed commented-out code comments
  
  
  • Fixed comment capitalization
  
  
  • Removed duplicate empty lines
  
  
  • Removed trailing whitespace from strings
  
  
  • Replaced long list syntax with array destructuring
  
  
  • Sorted interfaces alphabetically
  
  
  
  


• Removed empty IF/CATCH statements.


• Sorted language file string keys alphabetically in lang/en/local_navigatr.php to comply with Moodle coding standards.


• Added missing @template section to templates/course/course_settings.mustache with template context variable documentation.


• Fixed test class issues: Added final keyword to all test classes, added : void return types to all test methods, and added @covers annotations for test coverage.


• Fixed inline comment formatting by adding punctuation (periods) to all inline comments that were missing it across 45 PHP files.


• Fixed opening brace placement by moving opening braces to the same line as their declarations across 35 PHP files.


• Added missing language strings.


• Added the correct header and copyright/author notes to the files which were missing.

Major Security & Quality Improvements

This release delivers a major security and code quality enhancement, systematically addressing identified vulnerabilities whilst modernising the code base to meet current Moodle development standards. The improvements span security hardening, performance optimisation, and user experience refinements.

Security Enhancements in 1.1.0

• Password encryption with AES-256-CBC


• Form validation improvements


• Capability system modernisation


• Event-based logging system


• GDPR compliance improvements

Code Quality Improvements in 1.1.0

• Template system modernisation


• Parameter handling standardisation


• Unused code removal


• Test infrastructure enhancement


• Audit logging integration

Fixes in 1.1.0

• Fixed password storage - password is now encrypted with AES-256-CBC before database storage. Replaced plain text password storage with secure encryption


• Removed the else block in data_submitted() processing that was saving settings without validation.


• Updated settings_page.php to use 'local/navigatr:managecredentials' instead of 'moodle/site:config'. Added missing language strings for capabilities and cache definitions.


• Access tokens now stored in cache with 4-minute TTL


• Replaced optional_param with required_param and removed unnecessary empty checks


• Privacy provider moved to the correct location and implemented delete_data_for_all_users_in_context


• Added proper context handling


• Removed unused AJAX handler


• Replaced manual require_login() and require_capability() calls with admin_externalpage_setup('local_navigatr_settings')


• Handle session timeout gracefully in plugin settings page


• Replaced html_writer with Mustache templates and Output API


• Moved hard-coded language strings to the language file


• Changed reauth() method from private to public


• Implemented Behat step definitions and simplified scenarios


• Improved observer tests with real behaviour validation


• Retrieve and store badge name and image and update cache


• Implement backup/restore API for course-badge mapping


• Replaced debugging/error_log calls with custom events by implementing event system to replace all debugging() and error_log() calls


• Fixed cancel redirect in settings page by correcting URL and moving form handling before page output to prevent redirect errors


• Removed redundant course mapping check from issue_badge_task.php as observer already validates mapping exists before queuing task


• Fixed course progress bug by passing course object instead of course ID to get_course_progress_percentage method


• Fixed capability check mismatch by adding explicit require_capability check in settings_page.php for consistent permission validation


• Fixed unused capability issue by making local/navigatr:managecredentials actively used in settings_page.php


• Fixed privacy provider issue by confirming all required GDPR compliance methods are already implemented


• Fixed form setDefaults usage by replacing setDefault() calls with proper set_data() method following Moodle best practices


• Remove unused plugin loglevel configuration that was never actually used for conditional logging


• Deleted unused XML fixture file


• Removed unused functions from cache.php and provider_selection_form.php


• Added core event triggers for audit logging integration with Moodle's logging system


• Simplified parameter handling by replacing optional_param with required_param


• Resolved deduplication key concern by confirming badge IDs are globally unique across providers