Changelog

All notable changes to the Tutor-IA plugin (local_dttutor) will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[2.0.4] - 2026-02-02

Changed

Individual Chat History Implementation

• User-specific sessions: Chat sessions are now tied to individual users instead of being course-wide.


• Session cache keys: Changed from session_{courseid} to session_{courseid}_{userid} for proper isolation.


• API enhancement: Added user_id parameter to /chat/start API endpoint.


• Data privacy: Each user now has their own private chat history that cannot be accessed by other users.


• Breaking change: Sessions created before this update will be invalidated and new sessions will be created per user.


• Files modified:
  
  
  
  • classes/httpclient/tutoria_api.php - Enhanced start_session() with userid parameter.
  
  
  • classes/external/create_chat_message.php - Pass current user ID to session creation.
  
  
  • classes/external/get_chat_history.php - Pass current user ID to history retrieval.
  
  
  
  

Security Improvements

• Session isolation: Users can only access their own chat sessions.


• Privacy enhancement: Chat history is now private per user, not shared at course level.

[2.0.3] - 2026-02-02

Added

Course Synchronization Validation

• Validation before enabling tutor: Users cannot enable the AI Tutor until course content synchronization is completed


• Frontend validation: Toggle switch is disabled when indexing_status !== 'completed'


• Backend validation: save_course_config web service throws moodle_exception if enabling tutor without completed synchronization


• User feedback: Alert message shown explaining synchronization requirement


• Files modified:
  
  
  
  • classes/external/save_course_config.php - Added validation logic
  
  
  • manage.php - Added can_enable_tutor template variable
  
  
  • templates/manage_course.mustache - Added disabled state and info alert
  
  
  • lang/en/local_dttutor.php - Added new error string
  
  
  
  

Technical Details

• Validation checks indexing_status === 'completed' before allowing indexing_enabled = 1


• Exception type: moodle_exception('tutor_enable_requires_indexing', 'local_dttutor')


• UI state: Toggle disabled with {{^can_enable_tutor}}disabled{{/can_enable_tutor}}

[2.0.3] - 2026-02-02 (Continued)

Changed

API Compatibility Improvements - Metadata String Conversion

• Metadata string conversion: All metadata values are now converted to strings for API compatibility


• Boolean to string conversion: Boolean values (off_topic_detection_enabled) are now sent as "true"/"false" strings instead of native booleans


• Type safety: Added array_map() function to ensure all metadata values are strings before sending to API


• User ID conversion: userid metadata is now explicitly cast to string


• Module context support: Added optional cmid parameter to session management for module-specific chat contexts


• Session cache enhancement: Session cache keys now include cmid when in module context (session_{courseid}_{cmid})


• API request structure: cmid is sent as module_id string in API requests when present


• Files modified:
  
  
  
  • classes/external/create_chat_message.php - Added metadata string conversion and cmid support
  
  
  • classes/httpclient/tutoria_api.php - Enhanced session caching with cmid parameter
  
  
  
  

Technical Details

Metadata String Conversion:

• Previous: Mixed types (bool, int, string) sent directly


• Now: All values converted to strings using array_map() before API call


• Boolean conversion: value ? 'true' : 'false'


• Numeric conversion: (string)$value

Session Caching Enhancement:

• Previous cache key: session_{courseid}


• New cache key: session_{courseid}_{cmid} (when cmid present)


• Allows separate chat sessions for course-level and module-level contexts


• Improves context isolation and relevance of AI responses

API Compatibility:

• userid ' sent as string instead of integer


• cmid ' sent as module_id string in API requests


• off_topic_detection_enabled ' sent as "true"/"false" instead of boolean


• All other metadata values ' explicitly converted to strings

Version:

• Plugin version: 2026012900


• Release: 2.0.3


• Maturity: MATURITY_STABLE

Migration Notes

Upgrading from v2.0.2:

• No database changes required


• No configuration changes needed


• Simply replace plugin files


• Existing sessions will be regenerated with new cache key format


• All functionality remains backward compatible

[2.0.2] - 2026-01-23

Changed

Code Cleanup - Removed Redundant Permission Checks

• Removed redundant capability checks: Eliminated unnecessary require_capability('moodle/course:view') checks from external web services


• Reason: The local/dttutor:use capability check already validates course access in course context


• Impact: Cleaner, more maintainable code without functional changes


• Files modified:
  
  
  
  • classes/external/create_chat_message.php - Removed redundant moodle/course:view check
  
  
  • classes/external/delete_chat_session.php - Removed redundant moodle/course:view check
  
  
  • classes/external/get_chat_history.php - Removed redundant moodle/course:view check
  
  
  • classes/external/get_course_materials.php - Removed redundant moodle/course:view check
  
  
  
  

Technical Details

Permission Check Logic:

• Previous: require_capability('local/dttutor:use', $context) + require_capability('moodle/course:view', $context)


• Now: require_capability('local/dttutor:use', $context) only


• Rationale: Having local/dttutor:use capability in a course context already implies course access

Security:

• No security reduction - permission validation remains robust


• All web services still validate:
  
  
  
  1. User authentication via require_login()
  
  
  2. Context validation via self::validate_context()
  
  
  3. Plugin permission via require_capability('local/dttutor:use')
  
  
  
  

Version:

• Plugin version: 2026012300


• Release: 2.0.2


• Maturity: MATURITY_STABLE

Migration Notes

Upgrading from v2.0.1:

• No database changes required


• No configuration changes needed


• Simply replace plugin files


• Code refactoring only - no functional changes

[2.0.1] - 2026-01-22

Fixed

Security Vulnerability - Missing Authentication and Context Validation

• Critical fix: Added missing security validations in create_chat_message web service


• Issue: Users were receiving permission denied errors because security checks were incomplete


• Root cause: The web service was missing three critical validation steps:
  
  
  
  1. require_login() - User authentication check
  
  
  2. self::validate_context($context) - Course context validation
  
  
  3. require_capability('local/dttutor:use', $context) - Plugin permission check
  
  
  
  


• Solution: Added all three missing validations following Moodle's external service security checklist


• Impact: Fixes "Lo sentimos, pero no tiene los permisos para hacer esto (Ver cursos sin participación)" error


• Files modified: classes/external/create_chat_message.php

Changed

Permission System - Extended to All Authenticated Users

• Extended access: Added 'user' archetype to local/dttutor:use capability


• Reason: Allow all authenticated users to use the tutor, not just enrolled students


• Previous behavior: Only students, teachers, editing teachers, and managers could use the chat


• New behavior: All authenticated users with moodle/course:view permission can use the chat


• Automatic upgrade: Added upgrade script (db/upgrade.php) to automatically assign capability to 'user' role when updating from v2.0.0


• Files modified:
  
  
  
  • db/access.php - Added 'user' archetype to capability definition
  
  
  • db/upgrade.php - Added version 2026012201 upgrade step to assign capability
  
  
  
  

Technical Details

Security Validation Order (now properly implemented):

1. Parameter validation via self::validate_parameters()


2. Authentication check via require_login()


3. Plugin state check via get_config()


4. Webservice configuration check


5. Course context validation via self::validate_context()


6. Plugin capability check via require_capability('local/dttutor:use')


7. Course view capability check via require_capability('moodle/course:view')

Permission Archetypes (updated):

• user ' CAP_ALLOW (NEW - authenticated users)


• student ' CAP_ALLOW


• teacher ' CAP_ALLOW


• editingteacher ' CAP_ALLOW


• manager ' CAP_ALLOW

Upgrade Script:

• Version check: if ($oldversion < 2026012201)


• Uses get_archetype_roles() to find all 'user' roles


• Uses assign_capability() to grant permission at system context


• Checks for existing capability to avoid duplicate assignments


• Idempotent - safe to run multiple times

Migration Notes

Upgrading from v2.0.0:

1. Replace plugin files with new version


2. Access your Moodle site


3. Click "Update database" when prompted


4. Upgrade script will automatically assign capability to 'user' role


5. No manual configuration required

New Installations:

• 'user' archetype automatically included in capability definition


• No additional setup needed

[2.0.0] - 2025-12-30

Changed

User Interface Terminology

• Indexing ' Synchronization: Changed all user-facing terminology from "indexing/indexed" to "synchronization/synchronized" across all 7 supported languages


• Language updates: Updated 19 strings per language - 7 languages = 133 total string changes


• Terminology mapping:
  
  
  
  • "Course Indexing" ' "Course Synchronization"
  
  
  • "Indexed" ' "Synchronized"
  
  
  • "Indexing in progress" ' "Synchronization in progress"
  
  
  • "Start Indexing" ' "Start Synchronization"
  
  
  • "Re-index Course" ' "Re-synchronize Course"
  
  
  • "Last indexed" ' "Last synchronized"
  
  
  • "Indexing failed" ' "Synchronization failed"
  
  
  • "Not indexed" ' "Not synchronized"
  
  
  
  


• Code preservation: Internal code (variable names, functions, classes) maintains "indexing" terminology to avoid breaking changes


• All languages updated:
  
  
  
  • English: Indexing ' Synchronization
  
  
  • Spanish: Indexación ' Sincronización
  
  
  • German: Indexierung ' Synchronisierung
  
  
  • French: Indexation ' Synchronisation
  
  
  • Portuguese: Indexação ' Sincronização
  
  
  • Russian: Индексация ' Синхронизация
  
  
  • Indonesian: Pengindeksan ' Sinkronisasi
  
  
  
  

Removed

Markdown Formatting Feature

• Removed markdown rendering: Eliminated markdown-to-HTML conversion feature that was causing display issues


• Simplified message display: Chat messages now display as plain text without formatting


• Code cleanup:
  
  
  
  • Removed markdownToHtml() function from tutor_ia_chat.js
  
  
  • Reverted appendToAIMessage() to use textContent instead of innerHTML
  
  
  • Reverted addMessage() to use .text() for all messages
  
  
  • Reverted createMessageElement() to use .text() for history messages
  
  
  • Removed CSS styles for markdown formatting (lists, bold, italic)
  
  
  
  


• Reason: Markdown rendering was not working reliably and causing inconsistent message display

Debug Mode

• Removed debug mode feature: Completely removed debug mode and force reindex functionality


• Removed from settings: Deleted debug mode checkbox from admin settings page


• Removed from UI: Deleted debug controls section from chat drawer template


• Removed from hook: Cleaned up debug-related variables from chat_hook.php


• Language cleanup: Removed debug-related strings from all 7 language files
  
  
  
  • Removed: debug_mode, debug_mode_desc, debug_force_reindex
  
  
  
  

Technical Details

Terminology Change Impact:

• User-facing strings only (no code changes)


• No database migrations required


• No breaking changes to API or functionality


• Maintains backwards compatibility

Files Modified:

• lang/en/local_dttutor.php (English)


• lang/es/local_dttutor.php (Spanish)


• lang/de/local_dttutor.php (German)


• lang/fr/local_dttutor.php (French)


• lang/pt/local_dttutor.php (Portuguese)


• lang/ru/local_dttutor.php (Russian)


• lang/id/local_dttutor.php (Indonesian)


• amd/src/tutor_ia_chat.js (Markdown removal)


• styles.css (Markdown styles removal)


• settings.php (Debug mode removal)


• templates/tutor_ia_drawer.mustache (Debug controls removal)


• classes/hook/chat_hook.php (Debug variables removal)

[1.9.0] - 2025-12-01

Added

Debug Mode Feature

• Debug mode setting: New admin setting to enable debug options in the chat interface


• Force reindex checkbox: When debug mode is enabled, shows a checkbox to force context reindexing (only visible to site administrators)


• Admin-only access: Debug controls require both debug mode enabled AND site:config capability


• Metadata transmission: Checkbox state sent as force_reindex=true in message metadata


• Visual design: Debug controls styled with warning colors (yellow background) to clearly indicate debug functionality


• Language support: Debug strings added to all 7 supported languages

Error Handling Improvements

• Stream error detection: Enhanced SSE stream error handling to detect and parse JSON error responses


• License error modal: User-friendly modal for license validation errors with clear explanation


• Insufficient credits modal: User-friendly modal for insufficient AI tokens/credits errors


• Language support: Added error strings for license and credits errors in all 7 languages

Technical Details

Debug Mode:

• Admin setting: local_dttutor/debug_mode (default: disabled)


• Template variables: debug_mode and is_debug_admin passed to drawer template


• Capability check: Requires moodle/site:config capability to see debug controls


• Visibility: Debug checkbox only shown when BOTH conditions are met (debug_mode=true AND user is admin)


• JavaScript: Checks checkbox state and includes in metadata when checked


• CSS: Warning-styled debug controls with yellow background and amber border

Error Handling:

• Enhanced EventSource error listener to parse JSON error data from SSE stream


• Added handleStreamError() method to detect and categorize API errors


• Detects errors with structure: {detail: {status: "error", detail: "message"}}


• Shows appropriate error modal based on error type (license vs. credits)


• Graceful fallback for unexpected error structures

[1.8.2] - 2025-12-01

Changed

Code Quality Improvements

• JavaScript code cleanup: Reduced tutor_ia_chat.js from 1387 to 1330 lines by removing redundant comments and consolidating documentation


• Improved JSDoc: Added proper class and constructor documentation with @class and @param tags


• Comment standardization: Replaced verbose inline comments with concise, meaningful ones following Moodle coding standards


• Removed unused variable: Eliminated highlightedRange variable that was no longer used

CSS Cleanup

• Removed unused styles: Eliminated .tutor-ia-text-highlight CSS rules (19 l