Security update and new distribution channels.

Security:

• Updated bundled guzzlehttp/guzzle to 7.15.1 and guzzlehttp/psr7 to 2.13.0, fixing several published advisories (cookie scope, Referer leaks, credential forwarding, URI host validation).

Added:

• The plugin can now be installed with Composer on Moodle 5.2+ (composer require sergiocomeron/moodle-mod_jitsi).


• Published on Packagist and on the CAMP community registry (camp-registry.org) with verified releases.

Changed:

• README: installation instructions (Marketplace ZIP, git, Composer), support and security reporting channels, license.

Added

• 'Record to Dropbox' button on 8x8 with Moodle-integrated recording


• recordingoption setting picks the record button location on 8x8


• move the record button to the Moodle toolbar on 8x8/JaaS servers


• visible progress feedback for AI generation


• enable AI features for external recording links (type 1)

Fixed

• harden AI prompts against hallucination on empty recordings


• queued AI messages no longer ask to refresh the page


• don't capture trailing brackets in unquoted player-page video URLs


• resolve 8x8 player pages to the direct video URL for Vertex AI


• replace removed core/modal_factory with core/modal_save_cancel


• quote bump-version job if-condition to keep YAML valid

Changed

• Merge feature/ai-external-links: AI for external recordings + progress feedback + 8x8 record button


• README covers AI for external recordings, recording button setting and Dropbox button


• update google/apiclient from v2.19.3 to v2.19.4 (#198)


• Fix: resolver config.php sin resolver symlinks en endpoints web


• migrate @covers annotations to PHPUnit 11 attributes


• add standalone phpcs.xml and pre-push hook scripts


• bump guzzlehttp/guzzle 7.12.1 + psr7 2.12.1 (vendor synced)


• Merge dependabot web-token/jwt-library 4.1.7 (vendor synced)


• sync api/vendor for web-token/jwt-library 4.1.7


• bump web-token/jwt-library from 4.1.4 to 4.1.7 in /api


• cover open/close date validation in the activity form


• seed recordings and cover student vs teacher visibility


• trigger release.yml via tag push, drop failing workflow_dispatch

Added

• report cron health (last run + failing tasks) in the ping


• fast first ping after registration + cron self-diagnosis


• modernize recordings tab CRUD to WS+AJAX and HTML to Mustache


• auto-refresh total user minutes without page reload

Fixed

• repair broken base64url call sites in OAuth flow


• suppress cron self-diagnosis for active sites that already ping


• repair broken GDPR delete paths; add provider test coverage


• rename delete_data_for_users_in_context to delete_data_for_users (#193)


• stop stale provisioning runs from trapping the page in a modal loop


• replace insecure check_sourcerecord.php with capability-checked WS


• preserve scroll position when reloading the recordings tab


• prevent launching stream/record while the other is preparing


• silence camelcase ESLint warning for WS arg in recording_tracker


• migrate orphaned isDeletable() call site in adminrecords_table


• load session_presence via js_call_amd, not a top-level require (Phase C4a)


• migrate missed getminutes() call site in view.php


• avoid space in example displayName so iframe src validates


• use canonical Example context (json) header in mobile templates


• handle missing or unauthorised streaming account in create_stream


• anchor vendor/ ignore to plugin root so api/vendor is deployable


• move documentation string to correct alphabetical position in lang file

Changed

• bump guzzlehttp/psr7 from 2.8.0 to 2.11.0


• cover recording hide/show toggle and edit-form rename


• add @javascript recordings tab CRUD coverage


• upgrade actions/checkout to v5 to drop the Node.js 20 deprecation warning


• rebuild PHPUnit job on moodle-plugin-ci for public/-dir compatibility


• bump CI PostgreSQL service to 16 for Moodle 5.1/5.2


• bump to PHP 8.3 and test Moodle 4.5 / 5.1 / 5.2


• add view.feature and a moodle-plugin-ci Behat job


• render usage stats and attendance report via Mustache


• render server table and addjibri page via Mustache (V4)


• move inline JS to AMD modules, fix updateStatuses (V3)


• move VM provisioning callbacks to vm_callback class (V2)


• extract GCP/GCS helpers into autoloaded classes (V1)


• remove deprecatedlib.php (dead since Moodle 3.11)


• drop dead Moodle 3.11 compatibility branches


• move recording CRUD logic out of view.php into recording class (V4)


• move tab navigation to Mustache (V3 complete)


• move access card + help + invite to Mustache (V3)


• move session-header metrics + badges to Mustache (V3)


• move last two inline JS blocks to AMD modules (V2 complete)


• bypass minutes cache in get_user_minutes WS for live refresh


• batch per-user minutes in attendeesview (fix N+1)


• use composite index for connected-minutes queries


• move live header indicators to mod_jitsi/view_indicators AMD module (V2)


• move recording segment tracking to mod_jitsi/recording_tracker AMD module (V2)


• V1 cleanup — parametrize SQL, drop dead vars, unify $context (view.php refactor)


• dedup create()/create_priv() header + unify session controls (Phase C5)


• move recording/streaming controls to mod_jitsi/session_recording AMD module (Phase C4b)


• move password + finish-and-return to mod_jitsi/session_controls AMD module (Phase C4b)


• move toolbar-button audit to mod_jitsi/session_buttons AMD module (Phase C4b)


• move session presence tracking to mod_jitsi/session_presence AMD module (Phase C4a)


• extract JitsiMeetExternalAPI options builder from session (Phase C3)


• move session layout HTML to a Mustache template (Phase C2)


• extract JWT/roomName builder from session::create (Phase C1)


• move last two fragile helpers out of lib.php


• move createsessionpriv from lib.php to mod_jitsi\local\session::create_priv


• render watched-segments bar via Mustache template


• render heatmap via Mustache template instead of echoed HTML


• move createsession from lib.php to mod_jitsi\local\session::create


• cover createsession JWT/roomName for all 4 server types (createsession refactor, phase 1)


• extract notification helpers from lib.php to mod_jitsi\local
  otification


• extract recording lifecycle helpers from lib.php to mod_jitsi\local
  ecording


• extract YouTube recording ops from lib.php to mod_jitsi\local\youtube


• extract Google API client helpers from lib.php to mod_jitsi\local\google


• extract jibri-ready + completion helpers from lib.php


• extract jitsi_check_tutoring_availability to mod_jitsi\local utoring


• extract getminutes/getminutesdates to mod_jitsi\localttendance


• extract isdeletable to mod_jitsi\local
  ecording + remove dead isallvisible


• extract invitation-link helpers from lib.php to mod_jitsi\local\invitation


• extract base64url + video-segment helpers from lib.php


• extract room-name helpers from lib.php to mod_jitsi\local
  oom


• migrate streaming endpoints and remove the monolithic external class


• migrate view/minutes/AI-queue endpoints to per-class external API + tests


• migrate search/recording-link endpoints to per-class external API + tests


• migrate error endpoints + remove dead enter_session


• migrate jibri + recording-view endpoints to per-class external API + tests


• migrate session/participants endpoints + remove dead get_participants


• migrate presence endpoints to per-class external API + tests


• migrate audit button endpoints to per-class external API + tests


• migrate check_incoming_call to per-class external API


• migrate tutoring schedule endpoints to per-class external API


• migrate push subscription endpoints to per-class external API


• a11y: add aria-hidden to decorative icons, alt to thumbnail, aria-label to presence button


• add moodle.org plugin listing description (HTML)


• trigger viewed event in PHP instead of ws-on-load in template


• drop legacy Ionic 3 mobile templates


• exclude .gitignore from release ZIP


• add documentation site link to README and plugin settings

Added

• include next scheduled run time in registration payload


• include next scheduled run time in telemetry ping payload

Fixed

• fallback classname lookup in send_telemetry for Moodle 4.x compatibility


• resolve master jitsi ID in recordingstab.php for shared sessions


• pass resolved jitsiid from view.php to recordingstab.php for shared sessions


• trim tokeninvitacion before lookup in recordingstab for shared sessions


• resolve master jitsi ID in recordingstab.php for shared sessions


• add missing lang strings for capabilities on Capability overview page

Changed

• Merge pull request #192 from SergioComeron/chore/update-google-apiclient


• update google/apiclient from v2.19.2 to v2.19.3


• target dev branch in update-google-apiclient workflow


• use PAT_TOKEN in update-google-apiclient workflow to trigger CI on PRs


• undo all shared session recording fixes


• fix phpcs comment capitalisation in recordingstab


• extend lang string checks to tasks, events and required module strings


• fix phpcs in lang_strings_test


• verify every capability has a lang string in lang/en/jitsi.php


• Merge remote-tracking branch 'origin/master' into dev


• fix phpcs formatting in send_telemetry

Changed

• bump phpseclib/phpseclib from 3.0.51 to 3.0.52 in /api (#189)

v5.0.2

Fixed

• remove duplicate Content-Type and extra bracket in portal_action unregister curl call

v5.0.1

Fixed

• resolve moodle.org prechecker errors in v5.0.0


• enforce NOT NULL on jitsi_record.deleted for upgraded sites

v5.0.0

Added

• feat!: mod_jitsi Account portal, attendance report, recording view tracking, presence and security hardening


• add session stats to weekly telemetry ping


• hide native Jitsi recording button on GCP servers (type 3)


• replace streaming switch with two toggle buttons (Streaming + Record)


• show recording badge for GCP/Jibri using recordingStatusChanged API


• make user names in presence dropdown link to Moodle profile


• add dropdown with connected user names in view.php


• decouple presence heartbeat to 30s interval, tighten staleness to 90s


• replace single-counter participant tracking with presence table


• add inviteemail setting to enable/disable email invitation feature


• add send invitation by email page


• add copy button to invitation URLs in activity settings


• add aria-label to session join button for screen readers


• reorganize view.php with Session tab (metrics+badges+card+help) and Recordings tab


• move metrics outside card, center card with avatar/name/button only


• add user avatar and name to session card in view.php


• redesign session status block in view.php with card layout


• redesign logged-in user view on guest join page with card and avatar


• redesign guest join page with card layout, fix SQL injection in token lookup


• store enter timestamps in jitsi_usage_daily.times, show in attendance report


• remove date filter from live sessions — show all-time data, move filter to recordings tab


• add dates attended column to live sessions table


• split attendance report into 3 tabs — live sessions, recordings, course overview


• format heatmap timestamps as MM:SS or H:MM:SS


• replace click panel with instant hover tooltip for heatmap viewers


• interactive heatmap — click segment to see which students watched it


• add tooltips to heatmap bars showing exact counts per bucket


• track replay counts per segment bucket in heatmap


• split attendance report into activity/course tabs


• recording analytics — heatmap and course dashboard


• include license_key in telemetry ping for migration resilience


• detect portal deactivation flag and clear local config


• declare mod_jitsi portal telemetry in privacy provider


• collect site name and URL at registration; update privacy texts


• gate recording views tracking and segment bars behind portal registration


• gate attendance report and usage stats behind portal registration


• auto-fetch license key on settings page load when pending


• replace telemetry checkbox with portal registration flow


• add nudge notice in settings to encourage telemetry opt-in


• opt-in usage telemetry system (#184)


• expand telemetry opt-in description to clearly state what is and is not collected


• opt-in weekly telemetry ping to developer stats endpoint (#184)


• move AI generation to dropdown above video; show GDPR modal on generate; accordion shows only generated content


• remove direct link button from GCS recordings to enforce in-Moodle playback tracking


• GCS recording view tracking with segment progress bar (#183)


• track and report link clicks for non-embeddable recordings (8x8, external, Jibri)


• show recording name in teacher view instead of generic numbering


• track real watched segments with progress bar for students and teachers


• track video milestones at 25/50/75/100% and show in report


• add recording views section to attendancereport.php


• track GCS recording views via play event (#183)


• fallback to live logstore query when precomputed data not available


• attendance report per activity (#182)


• validate start date is before end date in stats form


• functional improvements to session usage statistics


• show available date range on stats page


• precompute daily usage stats and add top-users section


• lazy-load recordings tab via AJAX


• extend XMLDB schema lint tests with additional validations (#178)

Fixed

• use MutationObserver for recordings tab to support Bootstrap 4 and 5


• use variable for referrerpolicy to avoid phpcs mangling


• phpcs style fix in view_table.php


• add referrerpolicy to YouTube iframes to prevent Error 153


• correctly enable YouTube embedding after stream ends


• replace SQL injection in recordun.php with parameterised query


• phpcs style fixes in portal_action and portal_register


• replace shared COLLECT_SECRET with per-install license_key auth


• declare global $PAGE in enter_session()


• change_field_notnull before UPDATE NULL in ai_transcription_status upgrade


• make ai_transcription_status nullable in existing installs


• fix phpcs warnings in provider (line length and comment capitalisation)


• apply phpcs style fixes to provider and lang file


• security hardening across plugin and portal


• extract user fields string to variable to satisfy phpcs line length


• include all name fields required by fullname() in presence user queries


• add missing embed NOT NULL fix in jitsi_source_record (#137)


• remove blank line at start of control structure


• replace non-standard separators in upgrade comments


• correct schema inconsistencies reported in issue #137


• replace emoji icons with Font Awesome fa-rss and fa-circle


• use event flag to avoid timeout overriding API-set button states


• initialize stream/record button states on session load


• move recordbtn and streambtn strings to correct alphabetical positions


• split long line in recordingStatusChanged handler


• split long line in presence dropdown JS


• bump version to register mod_jitsi_get_presence_users web service


• correct alphabetical order of noconnectedusers string


• move noconnectedusers string to correct alphabetical position


• remove camera emoji from guest join page


• allow guest access to universal.php without requiring Moodle login


• use $SITE->fullname instead of $CFG->fullname in portal registration


• move $hasanydata definition before dates query — was always false


• use get_recordset_sql for dates query to avoid userid key deduplication


• correct alphabetical order for attendancedates string


• remove duplicate unit suffix in heatmap tooltip JS


• format heatmap timestamps with explicit units (min, h) instead of MM:SS


• restore missing docblock for jitsi_render_heatmap_bar


• set cursor:default on orange heatmap bar — not clickable


• bump version to register get_bucket_viewers external service


• pass strings from PHP to avoid async str loading in heatmap JS


• wrap long tracker init line to stay within 132 chars


• show course dashboard nav link regardless of portal registration


• add confirm dialog and portal notification on unregister


• handle portal unavailability gracefully in all curl calls


• alphabetical order for portal privacy strings


• show contact admin message to non-admins on gated features


• alphabetical order for portalrequired string


• remove duplicate heading in portal_register.php


• simplify portal_register.php form; move session stats link to top


• phpcs formatting


• replace embedded form with standalone portal_register.php page


• capitalize inline comment


• phpcs comment style


• phpcs settings.php


• move mod_jitsi Account section to top of settings page


• rename to mod_jitsi Account throughout


• remove duplicate telemetrynudge string


• update portal section title, description and button spacing


• phpcs formatting in settings.php and lang string order


• rename stats subdomain to portal.sergiocomeron.com


• move telemetrynudge strings to correct alphabetical position


• rotate telemetry secret key


• update telemetry endpoint URL in settings description


• update telemetry endpoint to stats.sergiocomeron.com


• detect active server via mod_jitsi/server config instead of inuse field


• remove blank line after opening brace


• remove stopPropagation from AI handler; re-init inplace_editable after AJAX content load


• monochrome FA icons in AI dropdown; remove accordion wrapper, show tabs directly


• register JS strings with mod_jitsi component to match M.util.get_string calls


• register click handler with only core/ajax+notification; load modal_factory lazily with native confirm fallback


• use core/modal_factory for GDPR confirmation instead of Bootstrap modal directly


• use monochrome FA icon in AI dropdown button to match accordion header


• use flex row for actions area so AI dropdown stays on same line as delete/hide icons


• use monochrome FA icon for AI Tools accordion header; reduce header size


• use loadedmetadata to capture duration and render seeded bar immediately on page load


• declare global $USER in col_id so segment bar loads on page entry


• seed JS tracker with existing DB segments so bar persists across sessions


• split long line for name fields query


• include all name fields in user queries to avoid fullname() debugging notice


• move recordingaccesslog string before recordingbloquedby alphabetically


• move recordingaccesslog string to correct alphabetical position


• detect seeks via timeupdate delta instead of seeking/seeked events to avoid timing race


• move watchprogress string to correct alphabetical position


• code style - space after function keyword, watchprogress string ordering


• track milestones via cumulative playback seconds instead of scrubber position


• default todate includes end of today instead of yesterday midnight


• prevent $cm overwrite in transcription parser; log milestone 0 directly from delegation handler


• use event delegation for recording view tracking to support lazy-loaded recordings


• correct jitsi_record column name from sourcerecord to source


• replace sql_like with PHP strpos for GCS filter; use get_recordset_sql for milestone events


• replace sql_like CASE WHEN with PHP aggregation for recording milestones


• use existing uniqueusers string instead of missing totaluniqueusers


• add attendance report to secondary navigation instead of header action


• move add_header_action before header() output


• use Moodle header action icon for attendance report link


• correct 3 bugs in sessionusagestats page


• phpcs lang string key order


• phpcs style fixes in lang file


• phpcs style fixes in sessionusagestats.php


• phpcs style fixes in aggregate_usage_stats task


• remove duplicate page heading in sessionusagestats


• improve sessionusagestats.php performance and remove dead code (#180)


• resolve moodle.org prechecker warnings


• bump version to 2026042102 for server compatibility [skip ci]


• avoid loading all recordings into memory on view.php


• resolve ESLint warnings in call.js and remaining prechecker leftovers

Changed

• Merge branch 'origin/master' into master — keep version 4.6.8 from dev


• Merge branch 'dev' into master


• update README to reflect GCP recording support and simplicity


• update telemetry strings to list new session stats fields


• add table of contents to README


• update README with heatmap, course overview and 3-tab attendance report


• Merge pull request #185 from SergioComeron/feat/recording-analytics


• merge course dashboard into attendance report, remove standalone page


• clarify why Dropbox links cannot be captured automatically


• clarify OAuth Testing mode and test users terminology


• clarify OAuth test users are Google accounts, not YouTube accounts


• rewrite streaming/recording section with GCP/Jibri as recommended method


• clarify telemetry is automatic on registration, no separate toggle


• fix registration flow description


• remove basic attendees report from features list


• clarify GCP only requires a Google Cloud account with billing


• rewrite intro to focus on server options instead of meet.jit.si


• restructure README — move mod_jitsi Account to top, fix grammar, remove outdated announcement


• remove outdated ansible playbook reference


• remove outdated permissions screenshot and moderator icon reference


• add missing capabilities to permissions section; fix viewusersonsession typo


• update README with mod_jitsi Account, attendance report and recording views


• restore original telemetry secret (rotation not viable in open-source plugin)


• hardcode telemetry endpoint/key; show URL in setting description instead of editable fields


• remove old attendees tab, replaced by attendancereport.php


• Merge master into dev


• Merge branch 'master' into dev

Fixed

• resolve moodle.org prechecker errors in v5.0.0


• enforce NOT NULL on jitsi_record.deleted for upgraded sites

Added

• feat!: mod_jitsi Account portal, attendance report, recording view tracking, presence and security hardening


• add session stats to weekly telemetry ping


• hide native Jitsi recording button on GCP servers (type 3)


• replace streaming switch with two toggle buttons (Streaming + Record)


• show recording badge for GCP/Jibri using recordingStatusChanged API


• make user names in presence dropdown link to Moodle profile


• add dropdown with connected user names in view.php


• decouple presence heartbeat to 30s interval, tighten staleness to 90s


• replace single-counter participant tracking with presence table


• add inviteemail setting to enable/disable email invitation feature


• add send invitation by email page


• add copy button to invitation URLs in activity settings


• add aria-label to session join button for screen readers


• reorganize view.php with Session tab (metrics+badges+card+help) and Recordings tab


• move metrics outside card, center card with avatar/name/button only


• add user avatar and name to session card in view.php


• redesign session status block in view.php with card layout


• redesign logged-in user view on guest join page with card and avatar


• redesign guest join page with card layout, fix SQL injection in token lookup


• store enter timestamps in jitsi_usage_daily.times, show in attendance report


• remove date filter from live sessions — show all-time data, move filter to recordings tab


• add dates attended column to live sessions table


• split attendance report into 3 tabs — live sessions, recordings, course overview


• format heatmap timestamps as MM:SS or H:MM:SS


• replace click panel with instant hover tooltip for heatmap viewers


• interactive heatmap — click segment to see which students watched it


• add tooltips to heatmap bars showing exact counts per bucket


• track replay counts per segment bucket in heatmap


• split attendance report into activity/course tabs


• recording analytics — heatmap and course dashboard


• include license_key in telemetry ping for migration resilience


• detect portal deactivation flag and clear local config


• declare mod_jitsi portal telemetry in privacy provider


• collect site name and URL at registration; update privacy texts


• gate recording views tracking and segment bars behind portal registration


• gate attendance report and usage stats behind portal registration


• auto-fetch license key on settings page load when pending


• replace telemetry checkbox with portal registration flow


• add nudge notice in settings to encourage telemetry opt-in


• opt-in usage telemetry system (#184)


• expand telemetry opt-in description to clearly state what is and is not collected


• opt-in weekly telemetry ping to developer stats endpoint (#184)


• move AI generation to dropdown above video; show GDPR modal on generate; accordion shows only generated content


• remove direct link button from GCS recordings to enforce in-Moodle playback tracking


• GCS recording view tracking with segment progress bar (#183)


• track and report link clicks for non-embeddable recordings (8x8, external, Jibri)


• show recording name in teacher view instead of generic numbering


• track real watched segments with progress bar for students and teachers


• track video milestones at 25/50/75/100% and show in report


• add recording views section to attendancereport.php


• track GCS recording views via play event (#183)


• fallback to live logstore query when precomputed data not available


• attendance report per activity (#182)


• validate start date is before end date in stats form


• functional improvements to session usage statistics


• show available date range on stats page


• precompute daily usage stats and add top-users section


• lazy-load recordings tab via AJAX


• extend XMLDB schema lint tests with additional validations (#178)

Fixed

• use MutationObserver for recordings tab to support Bootstrap 4 and 5


• use variable for referrerpolicy to avoid phpcs mangling


• phpcs style fix in view_table.php


• add referrerpolicy to YouTube iframes to prevent Error 153


• correctly enable YouTube embedding after stream ends


• replace SQL injection in recordun.php with parameterised query


• phpcs style fixes in portal_action and portal_register


• replace shared COLLECT_SECRET with per-install license_key auth


• declare global $PAGE in enter_session()


• change_field_notnull before UPDATE NULL in ai_transcription_status upgrade


• make ai_transcription_status nullable in existing installs


• fix phpcs warnings in provider (line length and comment capitalisation)


• apply phpcs style fixes to provider and lang file


• security hardening across plugin and portal


• extract user fields string to variable to satisfy phpcs line length


• include all name fields required by fullname() in presence user queries


• add missing embed NOT NULL fix in jitsi_source_record (#137)


• remove blank line at start of control structure


• replace non-standard separators in upgrade comments


• correct schema inconsistencies reported in issue #137


• replace emoji icons with Font Awesome fa-rss and fa-circle


• use event flag to avoid timeout overriding API-set button states


• initialize stream/record button states on session load


• move recordbtn and streambtn strings to correct alphabetical positions


• split long line in recordingStatusChanged handler


• split long line in presence dropdown JS


• bump version to register mod_jitsi_get_presence_users web service


• correct alphabetical order of noconnectedusers string


• move noconnectedusers string to correct alphabetical position


• remove camera emoji from guest join page


• allow guest access to universal.php without requiring Moodle login


• use $SITE->fullname instead of $CFG->fullname in portal registration


• move $hasanydata definition before dates query — was always false


• use get_recordset_sql for dates query to avoid userid key deduplication


• correct alphabetical order for attendancedates string


• remove duplicate unit suffix in heatmap tooltip JS


• format heatmap timestamps with explicit units (min, h) instead of MM:SS


• restore missing docblock for jitsi_render_heatmap_bar


• set cursor:default on orange heatmap bar — not clickable


• bump version to register get_bucket_viewers external service


• pass strings from PHP to avoid async str loading in heatmap JS


• wrap long tracker init line to stay within 132 chars


• show course dashboard nav link regardless of portal registration


• add confirm dialog and portal notification on unregister


• handle portal unavailability gracefully in all curl calls


• alphabetical order for portal privacy strings


• show contact admin message to non-admins on gated features


• alphabetical order for portalrequired string


• remove duplicate heading in portal_register.php


• simplify portal_register.php form; move session stats link to top


• phpcs formatting


• replace embedded form with standalone portal_register.php page


• capitalize inline comment


• phpcs comment style


• phpcs settings.php


• move mod_jitsi Account section to top of settings page


• rename to mod_jitsi Account throughout


• remove duplicate telemetrynudge string


• update portal section title, description and button spacing


• phpcs formatting in settings.php and lang string order


• rename stats subdomain to portal.sergiocomeron.com


• move telemetrynudge strings to correct alphabetical position


• rotate telemetry secret key


• update telemetry endpoint URL in settings description


• update telemetry endpoint to stats.sergiocomeron.com


• detect active server via mod_jitsi/server config instead of inuse field


• remove blank line after opening brace


• remove stopPropagation from AI handler; re-init inplace_editable after AJAX content load


• monochrome FA icons in AI dropdown; remove accordion wrapper, show tabs directly


• register JS strings with mod_jitsi component to match M.util.get_string calls


• register click handler with only core/ajax+notification; load modal_factory lazily with native confirm fallback


• use core/modal_factory for GDPR confirmation instead of Bootstrap modal directly


• use monochrome FA icon in AI dropdown button to match accordion header


• use flex row for actions area so AI dropdown stays on same line as delete/hide icons


• use monochrome FA icon for AI Tools accordion header; reduce header size


• use loadedmetadata to capture duration and render seeded bar immediately on page load


• declare global $USER in col_id so segment bar loads on page entry


• seed JS tracker with existing DB segments so bar persists across sessions


• split long line for name fields query


• include all name fields in user queries to avoid fullname() debugging notice


• move recordingaccesslog string before recordingbloquedby alphabetically


• move recordingaccesslog string to correct alphabetical position


• detect seeks via timeupdate delta instead of seeking/seeked events to avoid timing race


• move watchprogress string to correct alphabetical position


• code style - space after function keyword, watchprogress string ordering


• track milestones via cumulative playback seconds instead of scrubber position


• default todate includes end of today instead of yesterday midnight


• prevent $cm overwrite in transcription parser; log milestone 0 directly from delegation handler


• use event delegation for recording view tracking to support lazy-loaded recordings


• correct jitsi_record column name from sourcerecord to source


• replace sql_like with PHP strpos for GCS filter; use get_recordset_sql for milestone events


• replace sql_like CASE WHEN with PHP aggregation for recording milestones


• use existing uniqueusers string instead of missing totaluniqueusers


• add attendance report to secondary navigation instead of header action


• move add_header_action before header() output


• use Moodle header action icon for attendance report link


• correct 3 bugs in sessionusagestats page


• phpcs lang string key order


• phpcs style fixes in lang file


• phpcs style fixes in sessionusagestats.php


• phpcs style fixes in aggregate_usage_stats task


• remove duplicate page heading in sessionusagestats


• improve sessionusagestats.php performance and remove dead code (#180)


• resolve moodle.org prechecker warnings


• bump version to 2026042102 for server compatibility [skip ci]


• avoid loading all recordings into memory on view.php


• resolve ESLint warnings in call.js and remaining prechecker leftovers

Changed

• Merge branch 'origin/master' into master — keep version 4.6.8 from dev


• Merge branch 'dev' into master


• update README to reflect GCP recording support and simplicity


• update telemetry strings to list new session stats fields


• add table of contents to README


• update README with heatmap, course overview and 3-tab attendance report


• Merge pull request #185 from SergioComeron/feat/recording-analytics


• merge course dashboard into attendance report, remove standalone page


• clarify why Dropbox links cannot be captured automatically


• clarify OAuth Testing mode and test users terminology


• clarify OAuth test users are Google accounts, not YouTube accounts


• rewrite streaming/recording section with GCP/Jibri as recommended method


• clarify telemetry is automatic on registration, no separate toggle


• fix registration flow description


• remove basic attendees report from features list


• clarify GCP only requires a Google Cloud account with billing


• rewrite intro to focus on server options instead of meet.jit.si


• restructure README — move mod_jitsi Account to top, fix grammar, remove outdated announcement


• remove outdated ansible playbook reference


• remove outdated permissions screenshot and moderator icon reference


• add missing capabilities to permissions section; fix viewusersonsession typo


• update README with mod_jitsi Account, attendance report and recording views


• restore original telemetry secret (rotation not viable in open-source plugin)


• hardcode telemetry endpoint/key; show URL in setting description instead of editable fields


• remove old attendees tab, replaced by attendancereport.php


• Merge master into dev


• Merge branch 'master' into dev

Fixed

• resolve remaining moodle.org prechecker warnings (#176) (#177)

Fixed

• phpcs style in xmldb_schema_test


• remove empty string DEFAULT from CHAR NOT NULL columns in install.xml (#175)

Changed

• Merge branch 'dev' into master


• Merge branch 'fix/xmldb-char-not-null-defaults' into dev


• add schema lint test for CHAR NOT NULL columns with empty default (#175)


• Merge branch 'master' into dev


• clean up CHANGES.md — consolidate v4.6.0 and v4.6.1 entries [skip ci]

Changelog

v4.6.1

Added

• AI enable toggle (aienabled) — disabled by default for GDPR safety (#174)


• GDPR data notice tab in recordings view for users with AI generation capabilities (#174)


• GCP zone selector — dropdown with ~30 zones replacing free-text input (#174)


• Configurable Vertex AI processing region (vertexairegion) with EU default (#174)


• Privacy metadata declarations for Vertex AI external location and AI-generated fields (#174)


• Dedicated "AI Features" settings section, separate from Experimental (#174)


• README documentation for AI features, DPA/GDPR requirements and data retention (#174)

Fixed

• Default Vertex AI region and GCP zone changed to europe-west1 / europe-west1-b (#174)


• GDPR notice tab now appears last and is not auto-activated (#174)


• AI generation endpoints return error when aienabled is off (#174)

v4.6.0

Added

• Jibri pool — simultaneous GCS recordings via a pool of Jibri VMs with status badges, add/remove VM and pool size control (#163)


• Per-server GCP machine type selection with specs


• Jibri status monitor (jibri-monitor.sh) for automatic pool management and immediate top-up when a unit goes busy


• AI transcription of GCS recordings with clickable timestamps and chapter headings (#166, #167)


• Students can view AI-generated content (summary, quiz, transcription) when available


• Private sessions — symmetric 1-on-1 rooms between coursemates, direct access from user profiles (#170)


• call.php — coursemate search, call history and incoming call modal (#170)


• Web Push notifications for incoming private session calls (#171)


• Tutoring schedule — teachers define per-course availability; students see badge and warning outside hours (#171)

Fixed

• Match Jibri room names when separator (e.g. dot) is stripped from MP4 filename


• Install jibri-monitor.sh from scratch in image-based VM startup script


• Disable live streaming in configOverwrite using both legacy and current Jitsi keys


• Hide recording/streaming buttons while Jibri pool entry is provisioning


• Delete AI quiz course module when its recording is deleted


• Hide Chrome automation infobar in Jibri recordings (#164)


• Grant moderator role to both participants in private sessions (#170)


• Base64url encoding for Web Push keys; mailto: VAPID subject (#171)


• Remove explicit SW scope to support Moodle subdirectory installs (#171)


• Various Jibri pool lifecycle fixes (stop/start VMs, idle marking, provisioning timeout)

Added

• Jibri pool, AI features, private sessions, tutoring schedule (v4.6)


• add chapter headings to AI transcription (#167)


• top up Jibri pool immediately when a unit goes busy


• allow students to view AI-generated content (summary, quiz, transcription)


• add Jibri status monitor for pool recording tracking; fix image forceCreate


• Jibri pool UI — pool status badges, add/remove VM, pool size control


• Jibri pool — DB schema, pool management task and provision refactor


• merge feature/gcp-machine-type into dev


• add per-server GCP machine type selection with specs


• AI transcription of GCS recordings with clickable timestamps (#166)


• show last 10 calls chronologically and missed calls in call.php


• incoming call polling + Web Push notifications (#171)


• tutoring schedule for private sessions (#171)


• show recent call history in call.php (#170)


• log private session access via Moodle event system (#170)


• restrict private session link to coursemates; add call.php search page (#170)


• simplify private sessions - symmetric room, direct access from profile (#170)

Fixed

• match Jibri room names when separator is stripped from filename


• install jibri-monitor.sh from scratch in image-based VM startup script


• include lib.php in NO_MOODLE_COOKIES callback path


• use string_sanitize() and default sesionname in jibrirecording callback


• disable live streaming in configOverwrite using both legacy and current Jitsi key


• hide recording/streaming buttons while Jibri pool entry is provisioning


• add defensive guard in process_server for non-GCP/non-Jibri servers


• disable adhoc task deduplication when provisioning Jibri pool


• delete all pool Jibris when Jitsi VM is stopped


• skip Jibri pool management when Jitsi VM is not running


• stop/start all Jibri pool VMs when stopping/starting the Jitsi server


• mark pool entry idle immediately when recording finishes


• reduce jibri-monitor polling interval from 10s to 2s


• set unique MUC nickname per Jibri VM when booting from image


• preserve jibri_provisioningstatus=ready when all pool entries are deleted


• show delete button for Jibri/GCS recordings in adminrecord.php


• use timecreated instead of timemodified for provisioning timeout check


• update POOL_ENTRY_ID in baked monitor script when booting from image


• call jibriready callback from image-based VMs; add provisioning timeout fallback


• indent jibri-monitor heredoc bodies to satisfy PHP 7.3+ flexible heredoc rules


• add mkdir -p /etc/jibri before writing delete-token in Jibri startup script


• use pool status to determine Jibri availability for recording/streaming


• use GCP instance status instead of Jibri health API port


• create Jibri base image without stopping the VM


• merge fix/jibri-automation-banner into dev


• wrap /opt/google/chrome/chrome not /usr/bin/google-chrome


• hide Chrome automation infobar in Jibri recordings (#164)


• delete AI quiz course module when a recording is deleted


• only open PR when google/apiclient version actually changes


• only open PR when google/apiclient version actually changes


• grant moderator role to both participants in private sessions


• show user names as subject in private session instead of room name


• use data-bs-dismiss for Bootstrap 5 dismiss button in incoming call modal


• base64url encoding for push keys; mailto: VAPID subject; push debug logging


• replace navigator.serviceWorker.ready with per-registration wait


• add step-by-step status feedback during push subscription flow


• remove explicit SW scope to support Moodle subdirectory installs


• improve Web Push error handling and permission flow


• course headings link to course page in tutoringschedule.php


• use js_amd_inline for reliable JS loading in tutoringschedule.php


• use Moodle single_button for back link in tutoringschedule.php


• use Moodle single_button for tutoring schedule link in call.php


• code style in call.php


• code style in jitsi_check_tutoring_availability


• bump version to avoid downgrade error on dev branch


• move private sessions setting out of experimental section (#170)


• disable recording and live streaming in private sessions (#170)


• redirect to call.php after private session; two-column responsive layout (#170)


• add missing jitsi-container div to createsessionpriv() (#170)

Changed

• add regression test for dot-separator stripping in Jibri filename matching


• extract jitsi_build_room_name() and add regression tests


• close issue #163 — Jibri pool with custom GCP image implemented


• run check_jibri_pool every minute instead of every 5 minutes


• fix phpcs in lib.php


• fix phpcs violations in pool task files


• fix phpcs formatting in servermanagement.php


• remove global gcp_machine_type admin setting


• use sparkles emoji for AI Tools header, remove emojis from tab labels


• fix phpcs spacing in closure and remove duplicate aiquiz string


• replace stacked AI buttons with accordion + tabs in view_table.php


• Revert "chore: bump version to v4.5.1 (build 2026041301)" [skip ci]


• add missing vendor dependencies for minishlink/web-push


• fix phpcs blank line after opening brace in external_test


• add unit tests for tutoring schedule, push subscriptions, and incoming call


• remove debug console.log statements from push init AMD module


• granular logs inside button click handler


• add console.log trace to push init flow


• move tutoring schedule to dedicated page; filter hidden courses


• document private sessions feature in README


• close issue on merge to master

Added

• merge dev into master (AI summary and quiz for GCS recordings, phpseclib 3.0.51)


• AI summary and quiz generation for GCS recordings (#162)


• add AI true/false quiz generation for GCS recordings


• add AI summary generation for GCS recordings via Vertex AI Gemini


• embed GCS recordings inline with


• add Google Storage service files to vendor


• GCS integration for Jibri recordings with per-server toggle


• delete physical Jibri recording file when removed from Moodle


• enable live streaming on GCP servers with Jibri


• enable live streaming for GCP servers when Jibri is ready


• show warning badge on Jibri recordings when server may be offline


• complete Jibri recording integration for GCP servers


• add optional Jibri recording support for GCP servers (#145)

Fixed

• check quiz cmid existence before building buttons so generate button reappears immediately


• reset ai_quiz_id if quiz cmid no longer exists so generate button reappears


• set page=1 on all quiz slots so all questions appear on one page


• hide AI buttons when content already generated; show error state for failed attempts


• add quiz_sections row required by Moodle to display quiz questions


• do not set name=null in quiz_grade_items insert (Moodle 5.x column is NOT NULL)


• create quiz_grade_items entry and set quizgradeitemid in slots (Moodle 4.2+/5.x)


• increase Vertex AI curl timeout to 300s for larger videos


• create course module before quiz_slots so context is available for question_references


• handle Moodle 5.x question_references and quiz_slots schema changes


• pass course object (not cm) to course_add_cm_to_section


• capture curl error details for better debugging


• detect question_bank_entry vs question_bank_entries table (Moodle 4.x vs 5.x)


• use gs:// URI for Vertex AI video access (handles large files correctly)


• revert to v1 endpoint without thinkingConfig (worked for id=18)


• move thinkingConfig inside generationConfig


• use v1beta1 endpoint and thinkingBudget=0 for gemini-2.5-flash


• use gemini-2.0-flash for video analysis (2.5-flash is thinking model with different constraints)


• pass user language when queuing AI summary task


• generate AI summary in site default language


• use HTTPS URL instead of gs:// URI for Vertex AI video access


• use gemini-2.5-flash model name for Vertex AI


• use gemini-1.5-flash-001 model for broader Vertex AI availability


• phpcs style fixes in generate_ai_summary task


• attach compute service account to Jibri VMs so gsutil uses ADC


• use Moodle file storage credentials for GCS object deletion


• hide edit button for Jibri and GCS recordings


• add Storage to apiclient-services and use namespaced class names


• preserve GCS enable/disable button when JS updates action cell


• catch invalid JSON token exception in deleterecordyoutube


• make Jibri recording warning badge more discrete


• make Jibri recording warning badge more discrete


• fix PHP heredoc indentation in PYJITSICFG block


• show Moodle-integrated streaming switch on GCP servers when Jibri ready


• use Python to apply Jitsi Meet config changes instead of sed


• add --disable-blink-features=AutomationControlled to suppress Chrome banner


• suppress Chrome automation banner in Jibri recordings


• read Jibri external IP dynamically from GCP metadata at recording time


• add hiddenDomain at top-level config to hide Jibri from participants


• hide Jibri recorder participant from Jitsi conference view


• phpcs style fixes in lib.php and servermanagement.php


• preserve Add Jibri button when JS updates action cell dynamically


• phpcs style fixes and remove duplicate lang string

Changed

• merge master (phpseclib 3.0.51 bump) into dev; resolve version conflict


• Merge feature/145-gcp-jibri-recording into dev

Fixed

• extract release notes correctly from CHANGES.md [skip ci]

Changed

• Merge pull request #165 from SergioComeron/dependabot/composer/api/phpseclib/phpseclib-3.0.51


• bump phpseclib/phpseclib from 3.0.50 to 3.0.51 in /api


• reschedule google/apiclient update to 1:00 UTC (3:00 Madrid) [skip ci]


• remove notify-rebase-needed workflow [skip ci]


• add stale workflow to auto-close inactive issues [skip ci]

v4.4.4

Changed

• Merge pull request #159 from SergioComeron/chore/update-google-apiclient


• update google/apiclient from v2.19.0 to v2.19.2

Release v4.4.3

Release v4.4.2

Release v4.4.1

Release v4.4.0

Fixed

• External invitations redirect to login for unauthenticated users on Moodle 5.0


• Existing 8x8.vc recordings with no expiry updated via upgrade step


• GCP server moderation: moderator added to JWT context.user, fix token_owner_party module and server config


• GCP startup script re-ran on every reboot causing JWT credential mismatch and all users joining as moderators (issue #143)


• PHP nowdoc indentation error in GCP startup script


• Compact recording row: remove duplicate date, use Download label for 8x8 links


• Dropbox config excluded for 8x8 servers and warning shown in settings


• Room name not passed to Jitsi API for servers without JWT (meet.jit.si, type=0), causing users to land on Jitsi homepage instead of joining the correct room (issue #138)

Added

• External/Dropbox recording link management (issue #141): manually add and manage recording links for Dropbox and other external providers


• Automatic recording link capture via Jitsi recordingLinkAvailable event for JaaS paid accounts


• Force 24h expiry for 8x8.vc recording links when no TTL is provided by JaaS


• Allow Dropbox recording config on JaaS servers


• Session usage statistics page with date range filtering, monthly chart, top courses/categories, and CSV/Excel download


• Chat and polls settings toggle


• Transcription setting toggle


• GitHub Actions workflow to auto-update google/apiclient


• Send user email to Jitsi (issue #115): new admin setting (disabled by default) to pass the user's Moodle email to the Jitsi JWT. Declared in privacy provider for GDPR compliance.

Changed

• Compact single-line layout for non-embedded recording links; date shown as secondary text next to editable name


• sessionusagestats link moved to top of settings page


• Improved sessionusagestats UI and queries (monthly breakdown, top categories)


• google/apiclient minimum version bumped to ^2.19.0


• Security: updated phpseclib to 3.0.50 and firebase/php-jwt to v7.0.3


• Remove require_login from formuniversal.php to allow unauthenticated access


• Add note to README about jitsi-token-moderation-plugin requirement for JWT moderation on self-hosted servers (issue #133)

Release v4.3.3