📝 Changelog

Post and edit forms now annotate each community checkbox with membership
status (with a link to review subscriptions) and a notice when moderation
will hold the post for approval. Checkboxes for communities the user isn't
a member of are disabled, and submitted community IDs are filtered
server-side against actual membership so posting to a non-member community
is never possible even if the UI is bypassed.
Also widens the edit-item modal and makes it scroll internally instead of
overflowing on mobile, and fixes a stray unscoped .modal-content CSS rule
in templates/item.php that was overriding the modal's sizing.

Reduces button clutter on the item detail page by collapsing
owner-only actions into an "Options" menu next to the price. Also
gives the price/options bar the same card styling as Description,
Details, Waitlist, and History, and tightens row/section spacing that
was twice the needed height.

New activity_log table + logEvent() hooks on every meaningful
mutation (items posted/edited/gone/relisted/deleted/visibility
toggled, claims added/removed, community join/leave/create/
update/delete, moderator and allow/denylist changes). Adds an
admin Activity Log page to review everything, and a collapsed
"History" disclosure on the item detail page so an owner can see
what's happened to their own listing.
Truncate/archive tooling and wiring this into a future
customizable notification system are intentionally deferred.

Items and Users stat blocks had no gap between grid columns, so a
value in one column ran up against the label of the next. Gives each
section its own card and adds a proper gap.

Lets community moderators/admins review all items posted to a
community in one place (visible/not-visible toggle, gone-item filter)
instead of hunting through the live feed. Reuses the existing
items_communities status model and toggle_item_visibility action.
Also adds an item count column to the communities list, with hidden
counts shown in red.

Moves the Tests, Reports, and User Management sections out of the
increasingly crowded admin.php into their own pages, linked from the
Management card. Reports is likely to gain tabs later, and this keeps
admin.php as a lightweight index.

The image controls (rotate, add, delete) on the item detail page were
gated on \$isOwnItem (strict ownership), while the Edit button right
next to them uses \$canEditItem (owner or admin) - and the backend
rotate_image/upload_additional_image/delete_image actions already
authorize owner-or-admin. Bring the front-end gating in line with the
authorization it's actually protecting.

Documents the tenant-unavailable handling, postal_codes view, S3 image
path nesting, and admin-bootstrap work from this session, plus the
follow-up gaps they surface. Also removes two known-issue entries that
turned out to be stale: multi-image upload on initial creation and the
rotation/cache-busting collision were both already fixed in prior
commits (67fa6cc, 0324c32) that predate this doc's last edit.

A freshly provisioned tenant database has no users at all, so nobody
can pass isAdmin()/isSuperAdmin() there until someone is manually
flagged is_admin=1 - and there was previously no way to do that before
the tenant's first real login. Add a "Tenant Admin" section to the
tenant editor (same free-text-email pattern already used for community
moderators): look up a user by email in the control plane and grant
them is_admin=1 directly in the tenant's own database via a dedicated
connection, so they show up as an admin the next time they log into
that tenant's subdomain.
Also fixes a related bug in AuthService::completeLogin(): it preserved
display_name, zipcode, and other preferences from the existing DB row
on every login, but never is_admin, so updateUser()'s unconditional
write silently reset any admin flag - pre-seeded or panel-granted - to
0 on the user's next OAuth login. Verified by provisioning a throwaway
tenant, granting admin by email, and confirming is_admin survives a
simulated re-login instead of being clobbered.

Thread a tenant-prefix segment into every image/staging key builder in
includes/images.php (upload, listing, promotion, rotate/delete), and
stop hardcoding the CloudFront domain in client-side search-result
rendering.
Matches the layout already agreed in claimit-infra's multitenant.md:
the tenant segment nests inside the existing images/ and staging/
prefixes rather than wrapping around them, so CloudFront's fixed
/images origin path keeps working unchanged for every tenant with no
per-tenant CloudFront config. Outside a tenant subdomain the segment
is empty, so main-site keys are byte-for-byte unchanged.

Tenant provisioning replays every Phinx migration, so each tenant
database ended up with its own full duplicate of the static
GeoNames-style postal_codes reference table instead of reading the
control plane's single copy.
On any non-control-plane database, drop the local duplicate (if
present) and replace it with a view onto the control-plane table,
mirroring the existing tenant_info view. No application code changes
needed - getLocationByZipcode()/getZipcodeCoordinates() keep querying
postal_codes through the tenant's own connection unmodified.
Verified by provisioning a throwaway tenant database and confirming
the view resolves rows from the control plane.

Look up the tenant row directly against the control-plane database before
ever opening a connection to the tenant's own database, via a dedicated
raw connection (never getDbConnection(), which would otherwise pin the
request to the control-plane DB before setResolvedDatabaseName() runs).
Unknown/typo'd subdomains now redirect to the control plane instead of
a bare 404; disabled or not-yet-provisioned tenants, and tenants whose
database is unexpectedly unreachable, get a styled 503 page instead of
inline HTML strings.

Google's redirect_uri must stay fixed at the apex domain (no wildcard
subdomains allowed), so the OAuth callback always lands on claimit.cc
regardless of which tenant subdomain the login started from. Previously
this meant a tenant login would both save the user to the wrong (apex)
database and bounce the browser back to the apex afterward.
AuthService.handleCallback() is split into exchangeCodeForProfile()
(verifies with Google only) and completeLogin() (saves user + session).
A tenant login now carries its prefix via OAuth state; the apex callback
verifies identity, then hands off a short-lived HMAC-signed token to the
tenant subdomain's own /auth/complete endpoint, which completes login
against that tenant's own database. Apex/self-hosted logins are
unaffected - same exchange+complete call, same behavior as before.
Also fixes a second, independent bug in includes/core.php's redirect()
helper (hardcoded to claimit.stonekeep.com) that would have undone the
above fix at the last step. The replacement validates the Host header
against CONTROL_PLANE_HOST/its subdomains rather than trusting it
outright, since this app's Apache vhost is a catch-all default for its
IP and would otherwise let a spoofed Host header build a redirect
target.

Adds request-time tenant routing: a subdomain request now resolves to and
runs against that tenant's own database transparently, via a
setResolvedDatabaseName() override on the previously-hardcoded DB_NAME
connection. Each tenant DB gets an identical tenant_info view (filtered by
DATABASE() = db_name, so no per-tenant customization and no cross-tenant
visibility) to check enabled/status without a second connection. Missing
or disabled tenants get a distinct 404/503 instead of falling through.
Also updates the tenant editor's Provision button to read "Re-run
Provisioning" (green) once a tenant is already provisioned, with a
confirmation dialog clarifying the re-run is a non-destructive schema
update.

Adds a super-admin-only, claimit.cc-only Tenant Management screen for the
first multitenancy step. Includes a tenants table (prefix/name/status/
enabled), CRUD editor, and Provision/Deprovision actions that create/drop
a tenant's MySQL database and run schema migrations via Phinx's PHP API
(no shell-out). A live "Database" badge shows whether the DB actually
exists, independent of the status field. Bootstrapping an admin user and
OAuth setup are deferred to later steps.

Merge name/email into one cell with inline SUPER/Admin badges, drop the
standalone Verified/Admin columns, and add a Communities column (short
names) backed by a new batch-fetch helper. Also fixes getUserById()
omitting is_admin, which meant the edit-user modal's admin checkbox
never reflected a user's actual admin status.

actions/checkout@v4 and actions/setup-python@v5 still target the
deprecated Node 20 runtime. v7 and v6 respectively declare node24 and
resolve the GitHub Actions warning.

rjstone/discord-webhook-notify@v2 runs on a deprecated Node 20
runtime. A direct curl POST to the Discord webhook avoids the
dependency and gives full control over the payload.

Posts deploy status to Discord after the deploy job finishes,
whether it succeeds or fails.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

These are downloaded source files for the postal_codes loader, not
project source, and shouldn't be tracked in the repo.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Shows the poster's city/state on the item view, with a soft-phrased
distance estimate ("about 5 miles away") when the viewer also has a
zipcode on file, using the GeoNames postal_codes table added earlier.
Also simplify load_postal_codes.php's dev/prod detection and show a
formatted location (instead of raw zip) in account settings.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

- Migration creates postal_codes table with full GeoNames schema, indexes for zip lookup and geo queries
- CLI loader script loads any country file, safe to re-run (deletes country rows before insert)
- docs/updating-postal-codes.md explains source URL and usage
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Split System Tools into separate Management and Tests cards
- Add Reports section with item counts (total/open/claimed/gone) and user counts (total/active 30d)
- Expand architecture.md with full column-level schema from migrations
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

phpcbf incorrectly added spaces around = and & in JavaScript template
literals (treating them as PHP operators), breaking AJAX calls for
mark_gone, relist_item, toggle_item_visibility, edit_item, and
get_item_communities. PHP parses space-padded keys with underscores,
so $_POST['action'] was never set and requests fell through to the HTML
page render.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Replace the single file input on the create listing page with a full
image management widget. Images are uploaded via AJAX to a session-scoped
staging area in S3 (staging/{id}/) and served via presigned URLs, bypassing
CloudFront entirely so rotate and delete edits are immediately visible.
On form submit, staged images are promoted to their permanent S3 paths
(images/{trackingNumber}.*) before the item is written to the database.
Also adds ImageMagick CLI fallback for image rotation when php-gd is not
available in the environment.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Convert the community add/edit modal into a standalone, tabbed
community-edit page (Details/Settings/Notifications/Moderators)
- Rename community "administrators" to "moderators" throughout
(DB table, functions, AJAX actions, UI) to avoid confusion with
site administrators; moderators now get the same edit access as
owners
- Add moderated-community support: communities can require approval
for new postings, with a per-(item, community) Online/Hidden status,
a configurable "hide new postings by default" setting, a "Not
Visible" badge, and a moderator/admin-only toggle button on item
cards to flip visibility
- Add scripts/check.sh (composer check): phpcs, phpstan, composer
audit, and Semgrep in one local pre-push check; phpcs.xml now
ignores line-length warnings
- Fix AuthService missing its ClaimIt namespace (PSR-1 violation,
inconsistent with EmailService/AwsService)
- Run phpcbf across the codebase for PSR-12 formatting
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

When viewing an item via direct link while not logged in, the page had no way to claim—only Contact Seller and Share.
- Show 'Claim this item' button when: not logged in, not own item, item not gone
- Button links to Google OAuth (/?page=auth&action=google)
- Same styling as logged-in claim button (btn-primary btn-large)
- No button for gone items (only Contact Seller and Share)
Co-authored-by: Cursor <cursoragent@cursor.com>

- Community page now displays all items posted to that specific community
- Removed summary info (member count, item count, description) for cleaner UI
- Tightened vertical spacing in page header for better use of space
- Items displayed in same grid layout as main items page
- Shows empty state with helpful message when no items exist
- Maintains join/leave community functionality in header

- Add 'Interest' indicator in item details that shows claim count to everyone (including logged out users)
- Green text for no claims
- Yellow text for 1 claim
- Red text for multiple claims
- Change button text from 'Gone!' to 'Mark as Gone' for better clarity
- Updated both item detail page and user listings page

- Add red GONE badge overlay on item images
- Dim gone items to 75% opacity (85% on hover)
- Display badge on both item cards and detail pages

Enhanced Slack notifications to include a link to the poster's items page.
Changes:
- Modified includes/slack.php to build user listings URL
- Both the text fallback and formatted message now show the poster's name with a clickable link
Example: 'New item posted in mosaic by Bob Smith' where 'Bob Smith' links to their user-listings page.
This helps community members quickly see all items from a specific poster.

Problem: When Slack unfurls item links, the image displays initially but breaks after 10-15 minutes because the Open Graph metadata was using presigned S3 URLs that expire after 1 hour.
Solution: Changed Open Graph image URLs to use permanent CloudFront URLs instead of presigned URLs. Since images are public, CloudFront URLs never expire and Slack can cache them indefinitely.
Changes:
- Modified includes/utilities.php to use getCloudFrontUrl() instead of getPresignedUrl() for Open Graph metadata
- Added comment explaining why permanent URLs are needed for social media sharing
- Removed try/catch block since getCloudFrontUrl() is more reliable
This fix ensures Slack unfurled images remain visible permanently.

Previously, deleting an item only removed S3 files (YAML and images) but left the database record intact.
Changes:
- Added deleteItemFromDb() function in includes/items.php
- Deletes from items_communities table (foreign key associations)
- Deletes from claims table (any claims on the item)
- Deletes from items table (main item record)
- Uses transaction to ensure atomic deletion
- Updated delete_item handler in public/index.php to call deleteItemFromDb()
Items are now fully deleted from both S3 storage and the database.

✅ Fully functional Slack integration - notifications automatically sent when items are posted
Changes:
- Added includes/slack.php with notification functions
- Modified templates/communities.php to add Slack webhook URL and enable checkbox fields
- Added 'Send Test Message' button to community editor (working)
- Fixed test_slack action handler to accept action from GET parameters
- Integrated Slack notifications into createItemInDb() function
- Notifications now automatically sent when items are posted to communities with Slack enabled
- Fixed item creation in templates/claim.php to pass community IDs to createItemInDb()
- Slack unfurls item links automatically using existing Open Graph metadata (works on production)
- Detailed logging added for debugging

Database:
- Added slack_webhook_url (TEXT, nullable) to communities table
- Added slack_enabled (BOOLEAN, default false) to communities table
- Created idempotent migration with column existence checks
Backend (includes/communities.php):
- Updated createCommunity() to save slack_webhook_url and slack_enabled
- Updated updateCommunity() to save slack_webhook_url and slack_enabled
- getAllCommunities() and getCommunityById() automatically include new fields
Community Management UI (templates/communities.php):
- Added Slack Webhook URL input field with validation
- Added Enable Slack Notifications checkbox
- Added 'Send Test Message' button for testing webhooks before enabling
- Form loads and saves Slack settings when editing communities
- Client-side validation for webhook URL format
Test Webhook Handler (public/index.php):
- Added test_slack action to communities API
- Validates webhook URL format (must start with https://hooks.slack.com/services/)
- Sends formatted test message to Slack using cURL
- Returns success/failure with descriptive error messages
Features:
- Per-community Slack configuration
- Test webhook before going live
- Validates webhook URL format
- Pretty formatted test message with blocks
Next step: Implement actual item posting notifications (trigger when items are created)

- Added Share button to item-card.php for all contexts (listing, dashboard)
- Moved shareItem() function to app.js for global availability
- Share button now appears on page=items (browse) and page=user-listings
- Consistent 🔗 Share button across all item displays
- All share buttons use same clipboard copy functionality

- Added 🔗 Share button in item actions section
- Button always visible to everyone (logged in or not)
- Clicking copies item title + URL to clipboard
- Shows success notification: 'Share info copied to clipboard'
- Uses modern navigator.clipboard API with fallback for older browsers
- Format: Title on first line, URL on second line
This makes it easy for users to share items via email, text, social media, etc.

- Removed Zipcode column from table header (th)
- Removed Zipcode column from table body (td)
- Updated colspan from 10 to 9 for 'no users' message
- This makes the table narrower so Actions column is visible without scrolling
- Zipcode is still editable in the Edit User modal, just not shown in main table

- Restored flex-direction: row for nav-container on mobile
- Re-hid search box on mobile (was accidentally re-shown)
- Restored compact logo and hamburger sizing on small screens
- Ensures hamburger appears on right, logo on left (single horizontal line)
This fixes the layout issues caused by PR merge conflicts.

- Added hamburger menu button (three-line icon with animation)
- On mobile (≤768px), navigation collapses behind hamburger button
- Menu slides down from navbar when hamburger is clicked
- Logo and hamburger are on single horizontal line (logo left, hamburger right)
- Menu items are left-aligned with clean styling
- User dropdown opens within mobile menu with indented items
- Click outside or on links closes the menu automatically
- Search box hidden on mobile to maximize space
- Navbar height reduced to ~50-56px on mobile (was 400-500px)
This completely eliminates the excessive white space issue on mobile devices
by collapsing the vertical navigation into a compact hamburger menu.

- Reduced nav-container gap from 16px to 8px on tablet, 4px on mobile
- Reduced navbar padding for more compact mobile layout
- Fixed nav-search to be full-width on mobile
- Reduced page-header and content-section padding on mobile
- Removed duplicate @media (max-width: 768px) CSS rules
- Made nav-logo and nav-menu more compact on mobile screens
- Overall improved mobile spacing to eliminate large white gaps

- Updated AJAX handler to check both $_POST and $_GET for action/id parameters
- Fixed issue where claims were returning HTML instead of JSON
- Improved fetch error handling in templates/item.php and templates/items.php
- Changed fetch URLs from empty string to explicit '/' for clarity
- Added debug logging to track AJAX request handling
This fixes the 'Unexpected token' error when claiming items.

Mobile Layout Fixes:
- Remove min-height from .main-content (was forcing full viewport height)
- Reduce .page-header mobile padding from 2rem to 1rem
- Reduce .content-section mobile padding from 2rem to 1rem
This eliminates the large blank space between search bar and content
on mobile devices when items are loading or no items are present.

Critical Bugs Fixed:
- Fix URL parameter formatting in markItemGone and relistItem functions
- Remove spaces around = and & in request body parameters
- Caused backend to not parse parameters correctly, breaking functionality
Error Message Improvements:
- Replace generic 'An error occurred' messages with descriptive errors
- Show actual error messages from network errors in catch blocks
- Added error.message to all catch blocks for better debugging
- Apply to addClaimToItem, markItemGone, and relistItem functions
Files Updated:
- public/assets/js/app.js: Fixed parameter formatting and error messages
- public/index.php: Improved claim error message
- templates/item.php: Improved claim error message
- templates/items.php: Improved claim error message

Private Communities:
- Add migration for 'private' flag on communities table
- Private communities hidden from non-admin users in browse list
- Add private checkbox to community create/edit forms
- Private communities require membership to view items
- Items in General or non-private communities remain public
- Admin users can see all communities
User Management:
- Add Edit button to admin user management table
- Create edit modal for managing user details and community subscriptions
- Allow admins to edit: display name, zipcode, admin status, notifications
- Allow admins to manage user's community memberships
- Fix bug where name/email were being overwritten during updates
- Add is_admin field to user update SQL statement
- Default community owner to current user when creating
Item Visibility Security:
- Implement access control for item detail pages
- Items only in private communities require membership to view
- Non-members see 'Item not found' error
- Item owners and admins can always view
- Items in General community are always public
- Staging items (no communities) only visible to owner/admin

- Add explicit community associations via items_communities table
- Community 1 (General) is default for new items
- Items can belong to multiple communities or none (staging/invisible)
- Home page filters items by user's subscribed communities
- Anonymous users see General community items only
- Update item creation/editing forms to select communities
- Add getUserCommunityIds() to fetch user's subscriptions
- Update getAllItemsFromDb() to accept array of community IDs
- Display community visibility on item detail page
- Tighten vertical spacing on item detail page
- Remove 'All Communities' concept in favor of explicit associations

- Add community selection when creating/editing items
- Create items_communities junction table for many-to-many relationships
- Add 'All Communities' option with automatic deselection logic
- Fix edit item modal to include community checkboxes on all pages
- Add community detail page (page=community)
- Add join/leave community functionality for logged-in users
- Fix AJAX handlers to properly process community associations
- Remove duplicate backward compatibility handler block
- Clean up debug logging and backup files
- Update JavaScript to send POST data correctly

Changed 'Communities' to 'Browse communities' to match the verb-based
pattern of other navigation links (View, Make, Browse)

Changes:
- Communities page now accessible to everyone (removed admin-only check)
- Changed title from 'Community Management' to 'Communities'
- Add/Edit/Delete controls only visible to administrators
- 'Add New Community' button hidden from non-admins
- Edit and Delete buttons in table hidden from non-admins
- 'Back to Admin' button only shown to admins
- Added 'Communities' link to main navigation menu
- Updated table colspan and messaging for public users
- All PHPStan checks passing

- New many-to-many relationship between users and communities
- Allows users to belong to multiple communities
- Allows communities to have multiple users
- Indexes on user_id and community_id for fast lookups
- Unique constraint on (user_id, community_id) pair
- Idempotent migration with hasTable() check
- Tested successfully

- Fixed add_is_admin_to_users migration to check if column exists
- Created MIGRATION_GUIDELINES.md with best practices
- All migrations now safe to re-run multiple times
- Memory created to enforce idempotency for all future migrations

Migration was partially completed on production, causing errors on re-run.
Now checks each step:
- Check if item_tracking_number exists before renaming in claims
- Check if item_tracking_number exists before renaming in items_communities
- Check if tracking_number exists before renaming in items
- Check if PRIMARY KEY exists before adding it
- Safe to re-run multiple times

MySQL requires AUTO_INCREMENT to be removed before dropping PRIMARY KEY.
Added MODIFY COLUMN step to convert id from AUTO_INCREMENT to regular INT.

- Check if auto-increment id column exists (prod vs dev difference)
- Drop primary key and old id column before renaming tracking_number
- Add primary key to renamed id column
- Fixes 'Duplicate column name' error on production deploy

Database changes:
- Renamed items.tracking_number to items.id
- Renamed claims.item_tracking_number to claims.item_id
- Renamed items_communities.item_tracking_number to items_communities.item_id
- Created new items_communities junction table for many-to-many relationship
Code changes:
- Updated 12 PHP files (includes, templates, src)
- Updated 1 JavaScript file (app.js)
- Replaced 161 occurrences of tracking_number with id across codebase
- All PHPStan checks passing
- All functionality tested and working

- Fixed modal display issue: removed inline style conflict with CSS class
- Fixed JavaScript event listener initialization with DOMContentLoaded
- Fixed delete function to send action parameter in POST body
- All CRUD operations (Create, Read, Update, Delete) now working correctly

- Moved 14 image/AWS functions to includes/images.php
- Moved 14 utility functions to includes/utilities.php
- Reduced functions.php from 1800+ lines to 35 lines
- Complete modularization: 87 functions across 9 modules
- All PHPStan checks passing

BUG FIX:
- Fixed getClaimsForItem() to filter for status = 'active'
- Issue: Removed claims were still showing in waitlist
- Cause: Query was fetching ALL claims including removed ones
- Now correctly filters to show only active claims
CLEANUP:
- Removed orphaned getItemsClaimedByUser() function (YAML-based)
- Function was using legacy S3 YAML file iteration
- Replaced by getItemsClaimedByUserOptimized() (database version)
- Verified no code uses the old YAML function
- Removed 105 lines of dead YAML code
VERIFICATION:
- All claims operations now use database only
- No YAML references remain in claims.php
- PHPStan clean: 0 errors
- claims.php: 582 → 477 lines
The waitlist now correctly updates when members are removed.

ITEMS.PHP (13 functions, 588 lines):
- getAllItemsEfficiently, getAllItemsFromDb, getUserItemsFromDb, getUserItemsEfficiently
- getItem, getItemFromDb, createItemInDb, updateItemInDb
- markItemAsGone, relistItem, isItemGone
- clearItemsCache, shouldClearItemsCache
CLAIMS.PHP (14 functions, 582 lines):
- addClaimToItem, removeClaimFromItem, removeMyClaim
- getActiveClaims, getPrimaryClaim, getUserClaimPosition
- isUserClaimed, canUserClaim, hasUserClaimedItem
- getItemsClaimedByUser, getItemsClaimedByUserOptimized
- getClaimsForItem, getClaimedItemsByUser, createClaimInDb
PROGRESS:
- functions.php: 2,391 → 1,229 lines (1,162 lines moved)
- Completed modules: core, auth, users, communities, items, claims
- Remaining: 28 functions (images, cache, utilities)
- PHPStan clean: 0 errors
Modular structure now contains 1,991 lines in 6 completed modules:
- core.php: 132 lines
- auth.php: 135 lines
- users.php: 423 lines
- communities.php: 131 lines
- items.php: 588 lines
- claims.php: 582 lines

- Remove all functions now defined in modular files (core, auth, users, communities)
- Removed 895 lines of duplicate code
- functions.php now 2,391 lines (down from 3,286)
- Remaining 55 functions will be moved to placeholder modules later
- PHPStan clean: 0 errors
Functions removed (now only in modular files):
- core.php: escape, getDbConnection, testDbConnection, redirect, CSRF functions
- auth.php: isLoggedIn, getCurrentUser, isAdmin, canUserEditItem, etc.
- users.php: getUserById, createUser, updateUser, getAllUsers, user settings, etc.
- communities.php: getAllCommunities, getCommunityById, create/update/delete
Remaining functions (to be moved):
- 55 functions for items, claims, images, cache, utilities modules

REFACTOR:
- Split monolithic functions.php (3,082 lines) into 10 modular files
- Created core.php: Database, escaping, redirects, CSRF (3.0 KB)
- Created auth.php: Authentication and authorization (2.9 KB)
- Created users.php: User management (12 KB)
- Created communities.php: Community CRUD (3.1 KB)
- Created placeholder modules: items.php, claims.php, images.php, cache.php, utilities.php
- Updated functions.php to loader pattern with function_exists() guards
- All functions wrapped to prevent duplicate definitions
- PHPStan clean: 0 errors
COMMUNITIES FEATURE:
- Add communities management system (admin-only)
- Create communities database migration
- Add CRUD interface with modal form
- Display all communities in sortable table
- Show community short name, full name, description, owner
- Link from admin page to communities management
- Fix modal CSS specificity to prevent conflicts
Benefits:
- Better code organization and maintainability
- Easier to find and modify specific functions
- Clear separation of concerns by domain
- Scalable structure for future growth
- Backward compatible with existing code

- Add getAllUsers() function to fetch all users from database
- Add comprehensive user table displaying all user fields
- Show admin status with three levels: SUPER (config), Yes (db), No
- Display profile pictures, verification status, and notification preferences
- Include total user count and responsive design

- Delete templates/dashboard.php (replaced by user-listings)
- Remove getUserItems() and userOwnsItem() methods from AuthService (YAML-based)
- Remove awsService dependency from AuthService constructor
- Update currentUserOwnsItem() to use database instead of YAML
- Remove 'dashboard' from available pages list

Code Quality Improvements:
- Add PHPStan (static analysis) and PHP_CodeSniffer (style checker)
- Auto-fix 1,458 PSR-12 style violations across 18 files
- Remove trailing whitespace, fix indentation, standardize formatting
- PHPStan now reports zero errors at level 5
Bug Fixes:
- Fix edit item form POST body formatting (spaces around = and &)
- Fix uniqid() type error - cast time() to string
- Fix dead catch blocks - use \Exception instead of AwsException
- Fix isset() on resources - use is_resource() instead
- Initialize template variables to prevent undefined variable warnings
- Remove redundant isset/empty checks
Files Added:
- phpstan.neon - PHPStan configuration
- phpcs.xml - PHP_CodeSniffer configuration
- Updated composer.json with dev dependencies

- Replace custom non-commercial license with standard CC BY-NC-SA 4.0
- Add ShareAlike requirement: derivatives must use same license
- Include trademark notice protecting 'ClaimIt' name
- Update README with CC license badge and clear terms
- Maintain non-commercial restriction and attribution requirements
- Better international legal recognition and clarity

- Add is_admin boolean column to users table (defaults to false)
- Update isAdmin() to check master admin in config first, then database flag
- Fix AddMissingColumnsToItems migration to check if columns exist before adding
- Fix migration to check if claims table exists before creating
- Allows multiple users to have admin privileges beyond config master admin

- Replace S3 YAML file search with fast SQL query
- Search across title, description, tracking_number, user_name, contact_email
- Use single database query with LIKE instead of downloading all YAML files
- Massive performance improvement: milliseconds instead of seconds
- Still respects user's 'show gone items' preference
- Limit results to 100 items for performance
- Order by most recent first

- Correct description: community item sharing/marketplace (not claims management)
- Add all current features: Google OAuth, AWS S3/CloudFront, MySQL, claiming system
- Update project structure with all current files and directories
- Add database migration instructions with Phinx
- Include AWS and Google OAuth configuration references
- Add deployment checklist and production setup
- Document admin features and user dashboard
- Update license information to non-commercial license
- Add links to all documentation files
- Include required PHP extensions and dependencies
- Add changelog generation instructions
- Update version history to v2.0 (2025)

- Allows free use, modification, and distribution for non-commercial purposes
- Prohibits charging money for the software or services based on it
- Permits use of 'ClaimIt' name with proper attribution
- Requires link back to original repository
- Copyright held by Stonekeep Consulting, Inc.

- Query database for user's display_name instead of showing user ID
- Get accurate item count from items table
- Fallback to 'User' if database unavailable or user not found
- Social previews now show 'John Smith's Items' instead of 'User #123...'

- Shows '(not currently visible)' when user has hidden gone items
- Only displays when gone items exist but are filtered
- Added styling for subtle, italic note text

- Added getUserItemStats() function that queries database for accurate counts
- Stats now show correct totals even when 'Don't show gone items' is enabled
- Uses single efficient SQL query with aggregations
- Dashboard stats (total, free, for sale, gone, with claims) now always accurate

- Added columns: contact_email, image_width, image_height, user_name, user_email
- Added columns: submitted_at, submitted_timestamp, gone, gone_at, gone_by, relisted_at, relisted_by
- Created claims table with proper indexes
- These columns are needed for the migration script to work

The migration file was created but was empty. Added proper Phinx code to create the items table with all columns and indexes.

- Created items table migration with full schema
- Added migration script to move items from S3 YAML to database
- Updated functions.php to use database for item storage
- Modified templates to work with database-backed items
- Fixed duplicate closing HTML tag in index.php
- Added migration summary documentation

- Update EmailService to use MySQL database functions instead of S3 YAML files
- isEmailNotificationsEnabled() now uses getUserEmailNotifications() from database
- getUsersWithNewListingNotifications() now queries MySQL directly
- Remove deprecated saveUserProfile() and loadUserProfile() methods from AuthService
- All user preferences (show_gone_items, email_notifications, new_listing_notifications) now fully MySQL-based

- Use parseSimpleYaml() instead of yaml_parse() (no YAML extension required)
- Add error_reporting for better debugging
- Show error messages inline during migration
- Include stack traces in error summary
- Better error handling for YAML parsing failures

- Add database helper functions (getUserById, createUser, updateUser, saveUser)
- Update AuthService to use MySQL instead of S3 for user accounts
- Update settings page handler to save directly to database
- Update all user preference functions to read from database
- getUserEmailNotifications, getUserNewListingNotifications
- getUserShowGoneItems, saveUserShowGoneItems
- getUserDisplayName, getUserZipcode
- Update migration script to merge JSON account data + YAML preferences
- Session data now stays in sync with database
- Old S3 methods marked as deprecated but kept for reference
This completes the migration from flat files to relational database for
all user data. Items will be migrated in a future update.

- Create scripts/migrate_users_to_db.php for one-time data migration
- Migrates user account data from S3 JSON files to MySQL users table
- Safe to run multiple times (skips existing users)
- Uses AwsService wrapper methods (listObjects, getObject)
- Respects DEVELOPMENT_MODE for environment-specific migration
- Provides detailed progress output and error reporting
- Ready to migrate 37 production users to claimit_prod database

- Remove config/config.php from repository
- File is already in .gitignore
- Prevents git pull from overwriting production credentials
- Each environment maintains its own config.php locally

- Add platform config to force PHP 8.3 compatible dependencies
- Downgrade Symfony packages from v8.0 to v7.4 for PHP 8.3 support
- Ensures composer.lock works on both dev (PHP 8.4) and prod (PHP 8.3)
- Fixes dependency resolution errors in production deployment

- Move robmorgan/phinx from require-dev to require
- Ensures Phinx is available on production for migrations
- Fixes 'vendor/bin/phinx: No such file or directory' error in deployment

- Add detailed logging to GitHub Actions deployment
- Add section separators for better readability
- Add explicit echo statements for each deployment step
- Make Phinx migration output clearly visible in logs
- Add set -e to exit on any error

- Fix CreateUsersTable migration with proper NOT NULL constraints
- Add database migration step to GitHub Actions deploy workflow
- Migrations now run automatically on production deployment
- Users table structure matches existing YAML/JSON format

- Install Phinx for database schema management
- Configure Phinx to use RDS credentials from config.php
- Create initial migration for users table with:
- Google OAuth fields (id, email, name, picture, etc.)
- User settings (display_name, zipcode, notifications, etc.)
- Proper indexes and constraints
- Ready to test deployment pipeline to production

- Add database configuration with environment-based switching
- Create getDbConnection() and testDbConnection() helper functions
- Add database connection test tool to admin page
- Show database info in admin panel (name, environment)
- Add config.example.php template for deployment
- Keep actual config.php with credentials local (in .gitignore)
- Support claimit_dev and claimit_prod databases

- Ensure all image keys consistently include images/ prefix throughout
- Fix item detail page to store full S3 path with images/ prefix
- Fix getItemImages() to return full paths instead of stripping prefix
- Remove manual images/ prepending in delete/rotate handlers
- Remove manual images/ prepending in CDN bypass blocks
- Fixes image display bug in item detail view and thumbnails

- Fix image path bug: ensure images/ prefix is included in S3 keys
- Add CloudFront bypass in development mode for immediate updates
- Configure dev-php.ini to log errors to stderr for terminal visibility
- Fix EmailService to dynamically use current port (8000/8080)
- Strip images/ prefix for CloudFront URLs (origin path is /images)

- Create new admin page (templates/admin.php) for administrative functions
- Move test email functionality from settings to admin page
- Add admin menu item in user dropdown (visible only to admins)
- Configure dev-php.ini with proper error reporting for development
- Fix redirect() function to support localhost:8080
- Add error logging for authentication failures
- Add admin to page whitelist and auth-required pages

- Fix loading message being offset to the left
- Add CSS to make loading indicator span all grid columns and center horizontally
- Loading indicator now properly centered when it's the only child in items-grid

New Features:
- Paste images directly with Ctrl+V/Cmd+V on claim page
- Client-side file size validation (8MB limit)
- Professional loading overlay during upload (~10 seconds)
- Image preview for pasted and selected files
Paste-to-Upload:
- Detects images in clipboard and auto-attaches to file input
- Creates proper File object from pasted blob
- Works with screenshots, copied images, etc.
- Shows instant preview with success message
File Size Validation:
- Client-side validation before upload (8MB limit)
- Matches PHP's actual upload limit to prevent failures
- Shows red error box with actual file size if too large
- Applies to both pasted and manually selected images
- Updated all error messages and help text to reflect 8MB limit
Loading Overlay:
- Appears when form is submitted with valid data
- Centered modal with animated spinner
- Clear messaging: 'Posting Your Listing...'
- Prevents double-submission by disabling button
- Professional design with dark semi-transparent background
Bug Fixes:
- Removed closing PHP tags from config.php and functions.php
- Fixed 'headers already sent' errors caused by whitespace
- Added output buffering to allow redirects from templates
- Updated redirect() function to discard output buffer
Technical:
- Added ob_start() in index.php for output buffering
- Updated redirect() to call ob_end_clean() before header
- Client-side JS validates required fields before showing overlay
- All file size checks now consistent at 8388608 bytes (8MB)
UX Improvements:
- Faster workflow - paste screenshots directly
- Immediate feedback on file size issues
- Visual confirmation during upload process
- Prevents confusion during slow uploads

New Feature:
- Users can now paste images directly from clipboard (Ctrl+V or Cmd+V)
- Works on the claim page when posting new items
- Automatically attaches pasted image to file input
Implementation:
- Added paste event listener to detect clipboard images
- Creates File object from pasted blob and assigns to file input
- Shows instant preview of pasted image with success message
- Also shows preview for manually selected files
- Handles cleanup of object URLs to prevent memory leaks
UX Improvements:
- Added helpful hint: 'Press Ctrl+V (or Cmd+V) to paste'
- Visual feedback with green success box and image preview
- Preview shows max 300x200px thumbnail
- Works with screenshots, copied images, etc.
Usage:
1. Copy an image (screenshot, right-click copy, etc.)
2. Go to claim page
3. Press Ctrl+V (Windows/Linux) or Cmd+V (Mac)
4. Image is attached and preview shown
5. Submit form normally
Makes posting items much faster and more convenient!

Changes:
- Added date_default_timezone_set('America/New_York') to generator
- Automatically handles EDT (summer) and EST (winter) transitions
- All timestamps now display in local Eastern time instead of GMT
- Regenerated changelog with 110 commits showing correct times
Example: '7:58 PM' instead of '12:58 AM' (GMT)
This makes commit times more intuitive for development team.

Issue:
- Production server had local changes to composer.lock
- Git pull was aborting due to conflicts
- New files (scripts/generate-changelog.php) weren't being pulled
- Changelog generation failed with 'Could not open input file'
Solution:
- Added 'git stash' before 'git pull' in deploy workflow
- Stashes any local changes on server before pulling
- Allows clean pull without conflicts
- Ensures all new files are properly deployed
This prevents deployment failures when files are modified on server.

Changes:
- Reduced line-height for better text density (1.3 for subjects, 1.4 for body)
- Added regex filter to collapse multiple newlines into single ones
- Removes excessive blank lines between bullet points in commit messages
- Regenerated changelog with 108 commits
Result: Cleaner, more compact changelog display

Issue:
- Navigation links used relative URLs (?page=home)
- When on /changelog, links became /changelog?page=home
- Router didn't recognize these, so navigation broke
Solution:
- Changed all navigation links to absolute URLs (/?page=home)
- Works correctly from any page including clean URLs
- Affects: header nav, footer, login, settings, logout links
Testing: Navigation now works from /changelog page

New Features:
- Automated changelog generation from git commit history
- Accessible at /changelog with clean URL routing
- Displays commits grouped by date with full details
- Shows commit hash, subject, body, author, and timestamp
- Auto-generates during deployment via GitHub Actions
Files Added:
- scripts/generate-changelog.php: Generates changelog JSON from git log
- templates/changelog.php: Displays changelog with nice formatting
- public/data/changelog.json: Generated changelog data (106 commits)
Updates:
- .github/workflows/deploy.yml: Added changelog generation step
- router.php: Added /changelog route mapping
- public/index.php: Added 'changelog' to available pages & footer link
Implementation:
- Changelog script parses git log with formatted output
- Groups commits by date for better organization
- Filters out merge commits for cleaner history
- JSON output includes full commit details
- Template displays in card layout with hover effects
- Runs automatically on every deployment
- Can also be run manually: php scripts/generate-changelog.php
UI:
- Modern card-based layout
- Grouped by date with collapsible sections
- Monospace font for commit hashes
- Shows total commit count and last update time
- Responsive design matching site style

Issue:
- AWS SDK was trying to parse system ~/.aws/config files
- PHP 8.4's stricter INI parser was throwing warnings about
incompatible multi-line syntax (e.g., 's3 =' with no value)
- Warning: 'syntax error, unexpected = in Unknown on line X'
Solution:
- Added 'use_aws_shared_config_files' => false to AWS client configs
- This prevents SDK from loading ~/.aws/config and ~/.aws/credentials
- App now only uses credentials from config/aws-credentials.php
- Eliminates PHP 8.4 compatibility warnings completely
Also:
- Updated aws/aws-sdk-php from 3.356.5 to 3.359.13
- Better PHP 8.4 support in newer SDK version
Result: Clean console output, no AWS warnings

Major Features:
- Support up to 10 images per listing
- Thumbnail gallery with click-to-swap main image
- Add/rotate/delete individual images (owners only)
- Smart CDN cache bypass for instant updates after rotation
File Naming:
- Primary image: 20251115171627-a7k3.jpg (no index)
- Additional images: 20251115171627-a7k3-1.jpg, -2.jpg, etc.
New Helper Functions:
- getItemImages() - Fetches all images for an item
- getImageIndex() - Extracts index from filename
- deleteImageFromS3() - Safely deletes images with validation
- getNextImageIndex() - Gets next available slot
New API Endpoints:
- upload_additional_image - Add images to existing listings
- delete_image - Delete specific images (prevents deleting last/primary)
- rotate_image (updated) - Now supports rotating any image by index
UI Enhancements:
- Thumbnail gallery below main image
- Hover controls on thumbnails (rotate/delete buttons)
- Click thumbnails to view in main display
- Add Image button for owners (when < 10 images)
- Informational note on upload form
Bug Fixes:
- Fixed tracking number validation for new format (YmdHis-xxxx)
- Updated both POST and GET-based request handlers
- Fixed delete_item action mismatch in multiple templates
- Fixed image index extraction in both PHP and JavaScript
- Fixed thumbnail click event blocking by overlay controls
- Fixed CloudFront CDN bypass for thumbnail images after rotation
Backward Compatibility:
- Old format (YmdHis) still fully supported
- Single-image listings work as before
- All validation handles both formats

- Changed tracking number format from YmdHis to YmdHis-xxxx
- Adds 4-character random hex suffix (65,536 combinations per second)
- Prevents filename collisions when multiple users upload simultaneously
- Only affects new uploads; existing files remain unchanged

- Add CloudFront invalidation support to clear CDN cache after image rotation
- Implement hybrid approach: direct S3 URLs for immediate display + CloudFront invalidation
- Add bypass_cdn flag to use presigned S3 URLs while CloudFront cache propagates
- Fix broken cache clearing functions that weren't actually clearing PHP static caches
- Add CloudFront distribution ID to AWS config
- Update aws-credentials.example.php with CloudFront configuration template
This ensures users see rotated images immediately without cache-related delays or image 'pop-back' issues.

- Fix image key lookup to use correct 'images/' prefix for S3 storage
- Add cache-busting timestamp to force CloudFront refresh after rotation
- Enhance JavaScript to immediately update image with cache-busting parameter
- Improve user experience with better visual feedback and timing
Fixes issue where rotated images weren't displaying due to CloudFront caching.

- Enhanced loading indicator design with rounded box and animated dots
- Improved horizontal centering of loading indicators
- Added smooth scaling animation for loading dots with staggered timing
- Better typography and color contrast for loading text
- Enhanced error message styling with helpful instructions
- Fixed broken CSS grid layout on items and user-listings pages
- Restored proper grid rendering after layout issues
- Maintained improved loading indicator on home page
- All pages now have consistent, professional loading experience

- Add getUserItemsEfficiently() function with batch YAML loading
- Add getItemsClaimedByUserOptimized() function to eliminate AWS API bottlenecks
- Replace O(n×m) image searches with O(1) lookup tables
- Pre-process claims data to avoid redundant AWS calls
- Add 5-minute caching for user items and claimed items
- Reduce template rendering time from 6+ seconds to milliseconds
- Maintain all existing functionality while dramatically improving performance
- Add comprehensive performance logging for monitoring

- Add email button next to each claimant on item page (only for item owners)
- Pre-fill email with subject and body template for easy communication
- Style both mailto and delete buttons with consistent pale green background
- Improve button visibility with better contrast and unified design
- Only show mailto button if claimant has email address
- Secure implementation with proper escaping and conditional display

- Prevent accidental commits of SMTP configuration file containing sensitive data
- Ensures production deployments won't conflict with local SMTP config files

- Add 'Notify me of any new listings' checkbox to settings page (defaults to unchecked)
- Create getUserNewListingNotifications() function to retrieve user preferences
- Update settings save handler to include new listing notification preference
- Add sendNewListingNotifications() method to EmailService for bulk notifications
- Create beautiful HTML and text email templates for new listing notifications
- Integrate email notifications when new items are posted
- Fix image upload regression - store images in images/ subdirectory for CloudFront compatibility
- Fix EmailService listObjects() array structure access (use 'objects' key and lowercase 'key' property)
- Add comprehensive error handling and logging for email notifications
- Exclude item owner from receiving notifications about their own items

- Create new /settings page with modern responsive design
- Remove settings modal from home page to improve performance
- Update navigation to link to dedicated settings page
- Clean up JavaScript by removing modal-related functions
- Fix checkbox layout styling for better visual balance
- Maintain all existing settings functionality
- Add account information sidebar with user details
- Improve mobile responsiveness and user experience

- Add email notification checkbox to user settings
- Create EmailService class with SMTP support
- Add administrator test email functionality
- Support both authenticated and non-authenticated SMTP
- Add comprehensive SMTP debugging and error handling
- Support TLS/SSL with certificate verification options
- Add helo_hostname configuration for proper SMTP identification
- Include beautiful HTML and plain text email templates
- Integrate email notifications when items are claimed

- Updated getCloudFrontUrl() to remove /images prefix from generated URLs
- Updated image detection logic to look for images in images/ folder in S3
- Fixed image loading in getAllItemsEfficiently(), user-listings, and item templates
- CloudFront now correctly maps requests to S3 images/ folder via origin path

- Always compute activeClaims and primaryClaim in getAllItemsEfficiently()
- Previously only computed claim data when user was logged in
- Now logged-out users can see if items have been claimed
- User-specific data (isUserClaimed, canUserClaim) still only computed for logged-in users
- Fixes claim status display on home and items pages for anonymous users

- Add DEBUG configuration option in config.php (default: 'no')
- Create debugLog() function that only logs when DEBUG='yes'
- Convert all performance timing logs to use debugLog() instead of error_log()
- Enable detailed timing logs for:
- YAML file discovery and batch loading
- Image URL generation (getCachedPresignedUrl)
- YAML processing and item creation
- AJAX request timing (getAllItemsEfficiently, template rendering)
- Page load timing (routing, auth, Open Graph data, template rendering)
Usage:
- Set DEBUG='yes' in config.php to enable detailed performance logs
- Set DEBUG='no' in config.php to suppress performance logs (default)
- All timing logs now appear in server output when DEBUG is enabled
- Clean server output when DEBUG is disabled

- Pre-generate image URLs during getAllItemsEfficiently() to avoid AWS calls during template rendering
- Pre-compute item states (isItemGone, canEditItem) to avoid function calls during template rendering
- Pre-compute claim data (activeClaims, primaryClaim, isUserClaimed, canUserClaim) to avoid AWS calls during template rendering
- Add comprehensive performance timing logs to identify bottlenecks
- Add performance display in footer for monitoring
Performance improvements:
- Total AJAX request time: 6.5s → 3.7s (43% improvement)
- Template rendering time: 4.5s → 1.6s (64% improvement)
- Individual item rendering: 225-265ms → 75-90ms (65% improvement)
This eliminates the N+1 problem where expensive AWS calls were being made for each item during template rendering.

- Add fallback case for item pages when item data is not available
- Add safety checks to ensure required meta tag keys always exist
- Prevent undefined array key warnings and null parameter deprecation errors
- Ensure graceful fallbacks for all Open Graph meta tag scenarios
- Fix production errors: undefined 'title', 'description', 'type' keys

- Add item title and description to Open Graph meta tags for item pages
- Format title as 'Item #ID - [Item Title]' for better link previews
- Include item description and price in meta description
- Add image detection for Open Graph image previews
- Implement graceful fallbacks when item data unavailable
- Improve link sharing experience in Slack, Discord, and social media
- Single S3 call per item page for meta tag data (performance optimized)

- Rename 'Items Claimed' to 'Items I've claimed' for better clarity
- Add 'Items people have claimed' stat showing items with active claims
- Add 'Items gone' stat showing items marked as gone
- Fix claims counting logic to use proper claims array structure
- Optimize stats calculation by including claims data in item processing
- Add responsive CSS for 6 stat cards with mobile-friendly layout
- Support waitlist functionality with proper active/removed claim status
- Improve dashboard visual design with hover effects and better spacing

- Load all YAML files in batches of 20 to prevent performance issues
- Users now see all items instead of being limited to first 20
- Added detailed performance logging for batch processing
- Maintains reasonable load times (6-7s) while showing complete catalog
- Improved error handling for individual file failures
- Reverted from parallel HTTP approach to optimized sequential batching

- Removed pagination parameters and logic from getAllItemsEfficiently()
- Simplified home and items templates to show all items at once
- Removed pagination controls and CSS styles
- Updated AJAX endpoint to load all items without pagination
- Simplified JavaScript fetch calls to remove pagination parameters
Performance impact:
- Initial page loads remain fast (13ms for home page)
- Item loading now takes longer (7+ seconds) but shows all items
- Eliminates pagination-related bugs and complexity
- All items are now visible without navigation controls

- Implemented lazy loading for AWS services to eliminate 5+ second startup delays
- Added AJAX-based item loading for home page (2ms initial load vs 5+ seconds)
- Fixed OAuth navigation bar authentication state display
- Optimized static variable caching and OPcache handling
- Added loading indicators and error handling for async operations
- Maintained full functionality while dramatically improving performance
- Fixed variable name conflicts in home template pagination logic
Performance improvements:
- Initial page load: 5.27s → 0.002s (99.96% faster)
- Home page with items: 5.27s → 0.002s + 1.09s async (instant page + deferred items)
- Navigation bar now properly shows logged-in state on all pages
- AWS initialization only occurs when actually needed

- Fixed N+1 S3 API calls: Reduced from 200+ calls to 2-3 calls per page (95% reduction)
- Implemented pagination: 20 items per page with navigation controls
- Added aggressive caching: 5-minute item cache, 1-hour image URL cache
- Optimized image loading: Cached presigned URLs to avoid repeated generation
- Added cache invalidation: Automatic clearing when items are modified
- Fixed layout shift: Added image dimensions and CSS aspect-ratio
- Added performance monitoring: Built-in load time tracking
Expected performance improvement: 20 seconds → 1-2 seconds (90% faster)

- Add flexbox layout to item cards to ensure buttons are always at bottom
- Make item content and meta sections flexible to push buttons down
- Centralize all button styling in main CSS file
- Add complete button color schemes (primary, secondary, success, warning, danger)
- Add hover effects and transitions for all buttons
- Add claim status styling for consistent appearance
- Remove duplicate CSS from item-card.php template
- Improve responsive design with proper button stacking on mobile
- Ensure consistent visual hierarchy across all item cards

- Add markItemAsGone() and relistItem() functions to mark items as gone/not gone
- Add isItemGone() function to check item status
- Add getUserShowGoneItems() and saveUserShowGoneItems() for user preferences
- Add AJAX handlers for mark_gone and relist_item actions
- Add 'Gone!' and 'Re-list' buttons to item cards for owners
- Add 'Show gone items' checkbox to user settings modal
- Filter gone items from listings based on user preference (default: hidden)
- Fix item data mapping to include gone fields from YAML in all templates
- Add gone functionality to single item view, items listing, home, and user listings
- Items marked as gone are hidden by default but can be shown via user setting

- Add 'Log in to claim this!' button for non-logged-in users on item cards
- Button appears when user is not logged in and item is not their own
- Uses same login link as toolbar login button (?page=login)
- Styled consistently with other primary buttons
- Improves user experience by making login requirement clear
- Only shows in listing/home contexts where users browse items
Resolves issue where non-logged-in users couldn't easily discover they need to log in to claim items.

- Remove duplicate edit modal HTML from items.php, user-listings.php, and home.php
- Remove duplicate edit modal CSS from individual templates
- Remove duplicate JavaScript functions from item.php and index.php
- Remove duplicate showMessage function from index.php
- Add centralized edit modal CSS to main stylesheet
- Centralize all edit functionality in shared files (app.js, index.php, style.css)
Reduces codebase by ~400+ lines while maintaining full functionality.
All edit buttons continue to work across all pages.

- Add version parameter to all app.js script tags to force browser cache refresh
- Resolves production issue where edit buttons weren't working due to cached JavaScript
- Ensures production site loads the latest JavaScript with openEditModalFromButton function

- Add edit button to listing context in item-card.php
- Add JavaScript file references to all templates using item cards
- Fix JavaScript syntax errors by using data attributes instead of inline parameters
- Add openEditModalFromButton() function for safer data handling
- Add edit modal HTML and CSS to items.php, user-listings.php, and home.php
- Ensure edit functionality works consistently across all item card views
Resolves edit button not working on items, user-listings, and home pages.

- Create consistent button layout with right-justified, same-sized buttons
- Centralize all button styling in item-card.php template
- Remove conflicting CSS from individual templates (items.php, user-listings.php, dashboard.php)
- Standardize button colors: primary (blue), danger (red), secondary (gray), warning (orange)
- Add responsive design: buttons stack vertically on mobile
- Improve user experience with consistent button placement and sizing
- Fix full-width delete button issue on items page
- Ensure all contexts (listing, dashboard, claimed) use same button layout

- Add rotation button (↻) to single item view for item owners
- Implement 90-degree clockwise rotation using GD library
- Support multiple image formats (JPEG, PNG, GIF, WebP)
- Download image from S3, rotate, and upload back
- Add proper error handling and user feedback
- Fix image key detection to work with dynamic image extensions
- Include loading states and success messages
- Page refreshes after successful rotation to show updated image

- Fix backend delete handlers to use canUserEditItem() for proper admin permissions
- Add delete buttons for admins in all contexts (home, listing, dashboard)
- Add complete delete functionality to home page (modal, JS, CSS)
- Fix redirect after deletion to go to home page instead of items page
- Ensure currentUser is properly passed to item-card template
- Update error messages to include admin privileges
Fixes issue where administrators couldn't see delete buttons on home/items pages
and were getting 'You can only delete your own items' warnings.

- Add ADMIN_USER_ID configuration in config.php
- Add isAdmin() and canUserEditItem() helper functions
- Update item-card.php to show edit/delete buttons for admins
- Update item.php to show edit/delete buttons for admins
- Update AJAX handlers to check admin permissions for edit/delete
- Update user-listings.php to show admin controls for all users
- Admins can now edit and delete any item, just like item owners

- Replace urlencode() with rawurlencode() in all mailto: links
- Fixes issue where spaces appeared as + signs in mobile email clients
- Affects Contact Seller links in item-card.php and item.php templates
- rawurlencode() uses %20 for spaces which is more universally supported

- Remove DEBUG error_log statements for file upload details
- Remove file preservation logic in /tmp/claimit_debug/
- Clean up Apache error logs now that upload issue is resolved
- GD extension is now installed and image resizing should work

- Change HTML form MAX_FILE_SIZE from 500KB to 50MB (52428800 bytes)
- This was causing UPLOAD_ERR_FORM_SIZE (error 2) for files > 500KB
- Browser was rejecting uploads before they reached server validation
- Now matches server-side 50MB limit configuration

- Add detailed logging of file upload attempts (name, size, error code, tmp path)
- Preserve rejected files in /tmp/claimit_debug/ for inspection
- Debug both PHP upload errors and custom size validation
- Help diagnose 7.9MB file upload rejection despite 50MB limit

- Update ini_set() calls in public/index.php (50M/51M)
- Update ini_set() calls in router.php (50M/51M)
- Update php.ini file (50M/51M)
- Update dev-php.ini file (50M/51M)
- These ini_set() calls were overriding the server configuration
- This should finally allow 50MB uploads to work properly

- Update UPLOAD_ERR_INI_SIZE and UPLOAD_ERR_FORM_SIZE error messages to show 50MB
- This was the last remaining reference to the old 10MB limit
- Should now show consistent 50MB limit in all error messages

- Update server-side validation in templates/claim.php (50MB limit)
- Update client-side validation in public/assets/js/app.js (50MB limit)
- Update form help text to show 50MB limit
- Update Apache .htaccess configuration (50M/51M)
- Update .user.ini configuration (50M/51M)
- This removes the hard-coded 10MB limit that was blocking larger uploads
- Images will still be automatically resized to under 500KB after upload

- Remove php_admin_value directives that are causing Apache alerts
- Keep only php_value directives which should be allowed
- This should eliminate the 'php_admin_value not allowed here' errors
- The .user.ini file should still provide alternative configuration

- Remove all DEBUG error_log statements from getActiveClaims() function
- Remove all DEBUG error_log statements from isUserClaimed() function
- Remove production debug logging from templates/claim.php
- Keep only essential error logging for actual errors
- This should eliminate the large array dumps in Apache error logs
- Error logs should now be much cleaner and more manageable

- Add .user.ini file as alternative to .htaccess for PHP config
- Add php_admin_value directives in .htaccess (may work when php_value doesn't)
- Add production debugging to show actual server limits
- Try both php_value and php_admin_value approaches
- .user.ini files are often allowed when .htaccess php_value is restricted
- This should help identify what the actual server limits are

- Update public/.htaccess with comprehensive PHP upload settings
- Add php.ini file for production server configuration
- Remove debugging code from templates/claim.php
- Set upload_max_filesize=10M, post_max_size=11M
- Add max_execution_time=300, max_input_time=300, memory_limit=256M
- These settings should work with Apache in production environment
- Local development server issues can be addressed separately

- Root cause: PHP ini_set() calls were being ignored (actual limit was 2M instead of 10M)
- Add .htaccess in root directory with php_value directives
- Add php.ini file with upload configuration
- Add putenv() calls as alternative approach
- Add max_execution_time, max_input_time, and memory_limit settings
- This should override the 2M limit that was preventing 7.9MB uploads

- Add error_log statements to show actual PHP upload_max_filesize and post_max_size values
- Show file upload error code and file size in debug logs
- Update error message to show actual PHP limit for better debugging
- This will help identify if PHP ini_set() calls are working correctly

- Update PHP ini_set() calls in public/index.php and router.php (10M/11M)
- Update Apache upload limits in public/.htaccess (10M/11M)
- Update client-side JavaScript validation in public/assets/js/app.js (10MB)
- Update server-side validation in templates/claim.php (10MB)
- Update HTML form help text to show 10MB limit
- Images will still be automatically resized to under 500KB after upload
- All environments (development and production) now support 10MB uploads

- Change error message from 'Picture uploads are limited to 5MB' to 'File is too large. Maximum upload size is 5MB.'
- Makes it clearer that this is an error for files exceeding the limit
- Avoids confusion since we do allow 5MB uploads (the limit is exactly 5MB)

- Update HTML form help text from 'max 500k' to 'max 5MB - will be automatically resized'
- Clarifies that users can upload up to 5MB and images will be automatically resized
- Matches the actual server-side validation limits

- Raise upload limits to 5MB for both development and production
- Add PHP ini_set() calls in public/index.php and router.php
- Add Apache upload limits in public/.htaccess
- Implement GD library image resizing function in includes/functions.php
- Resize images to max 1200x1200px and under 500KB final size
- Update server-side validation in templates/claim.php (5MB limit)
- Update client-side validation in public/assets/js/app.js (5MB limit)
- Add automatic image resizing before S3 upload
- Maintain aspect ratio and preserve transparency for PNG/GIF
- Fallback to original image if resizing fails
- Clean up temporary files after processing

- Change mobile dropdown from always-visible to proper toggle behavior
- Use absolute positioning instead of static for mobile dropdown
- Add proper opacity, visibility, and transform transitions
- Dropdown now properly shows/hides on mobile when clicked
- Maintains consistent behavior across desktop and mobile

- Update subject line to 'ClaimIt Interest - [Item Title]'
- Add direct link to item in email body
- Apply consistent formatting across all Contact Seller buttons
- Update templates/item.php and templates/item-card.php
- Better email experience for buyers and sellers

- Add Edit button for item owners on single item page (/?page=item&id=...)
- Include Edit modal with form for title and description editing
- Add JavaScript functions for modal handling and AJAX submission
- Edit button appears alongside Delete button for item owners
- Maintains consistency with user-listings page functionality

- Remove all error_log debug statements from both POST and GET edit_item handlers
- Clean up the code while maintaining full functionality
- Item editing is now working correctly and saving to S3

- Fix JavaScript to send request to correct URL: ?page=claim&action=edit_item
- Add comprehensive debugging to both POST and GET edit_item handlers
- This should now properly route edit requests and show debug output

- Add error_log statements to track YAML conversion and S3 upload
- This will help identify why item edits are not being saved

- Change JavaScript to send action as POST data instead of GET parameter
- This ensures the edit_item action reaches the correct backend handler
- Item editing should now properly save changes to S3 YAML files

- Replace json_encode() with htmlspecialchars() and addslashes() for proper escaping
- Remove debugging alert from openEditModal function
- Fix JavaScript syntax error that was preventing modal from opening

- Add console.log and alert debugging to openEditModal function
- Verify if function is being called and modal element is found

- Add 'Edit...' button to dashboard context for own listings
- Create edit modal dialog with title and description fields
- Add backend AJAX handler for edit_item action in both POST and GET routes
- Implement JavaScript functions for modal management and form submission
- Add CSS styling for textarea elements in modal forms
- Use JSON encoding for JavaScript parameters to handle quotes properly
- Validate ownership before allowing edits and update S3 YAML files

- Add GET-based AJAX handler for ?page=claim&action=* endpoints
- Fix mismatch between JavaScript URL parameters and PHP POST data handling
- Ensure both POST and GET-based claim requests work properly
- Add delete_item action to supported actions list

- Add console.log statements to JavaScript removeMyClaim function
- Add error_log statements to PHP remove_claim action handler
- Improve error handling and debugging for claim removal process

- Add missing JavaScript functions (addClaimToItem, removeMyClaim, deleteItem) to main index.php
- Add delete_item action handler for item deletion
- Add getItem() function to functions.php for retrieving individual items
- Fix JavaScript function availability across all templates
- Add showMessage() function for user feedback
- Ensure all claim management functions work with unified item card system

- Fix the last include statement on line 290 that was still using relative path
- This resolves the production error: 'Failed opening templates/item-card.php'

- Change relative include paths to absolute paths using __DIR__
- Fixes 'Failed opening templates/item-card.php' error in production
- Affects home.php, user-listings.php, and items.php templates

- Implement settings modal dialog accessible from user dropdown
- Add display name field allowing users to customize their displayed name
- Store user settings in S3 under users/{userId}.yaml
- Integrate custom display names throughout the application
- Update unified item card template to use custom names
- Add comprehensive CSS styling for modal and form elements
- Include JavaScript functions for modal handling and AJAX submission

- Remove contact link from main navigation menu
- Add contact link to footer with separator pipe
- Add CSS styling for footer link with hover effects
- Cleaner navigation with contact accessible in footer
- Footer link styled with gray color and blue hover state

- Create automated deployment workflow for production server
- Triggers on push to main branch
- Uses SSH to connect to production server
- Pulls latest code and updates dependencies
- Sets proper file permissions
- Ready for GitHub Secrets configuration

- Replace hero section with items grid display
- Remove phone, hours, and address from contact page
- Home page now shows all available items immediately
- Add 'Post a New Item' button in header
- Include empty state when no items exist
- Maintain AWS credentials check for development
- Users can now browse items without extra navigation steps

- Update Google OAuth config to use production redirect URI
- Add auth route rewrite rules to .htaccess for clean URLs
- Update router.php to find assets in public/ directory for localhost dev
- Fixes OAuth redirecting to localhost instead of production domain
- Maintains CSS/JS functionality in both localhost and production

- Move assets/ from project root to public/assets/
- Remove assets rewrite rule from .htaccess (no longer needed)
- Fixes Apache security error with directory traversal (/../assets/)
- Assets now served directly from DocumentRoot/assets/

- Remove RewriteCond %{REQUEST_FILENAME} -f from assets rule
- This was preventing assets from loading when DocumentRoot is set to /public
- Assets requests now properly redirect to ../assets/ directory

- Changed 'Never mind' button to 'You have claimed this!' with checkmark emoji
- Kept mouseover tooltip as 'Unclaim this item' for clarity
- Fixed image scaling on user-listings page to match main items display
- Added proper CSS for item cards and grid layout consistency
- Updated both individual item view and items grid view templates

- Replace generic 'An error occurred' with specific 'Picture uploads are limited to under 500k'
- Add detailed server-side error handling for different PHP upload error codes
- Implement client-side file validation with immediate feedback
- Reduce upload limit from 5MB to 500KB
- Add MAX_FILE_SIZE form field for browser-level enforcement
- Show file size and name on successful selection
- Add success/danger color variables to CSS

- Added company image to about page replacing placeholder
- Reformatted about page content with proper paragraph breaks
- Changed 'My Posts' to 'My Listings' in navigation menu
- Added responsive image styling with hover effects
- Updated documentation references to reflect 'My Listings' terminology

- Fixed vertical alignment issues in navigation bar caused by user avatars
- Added consistent min-height values for nav elements to prevent height changes
- Implemented comprehensive Google profile picture fallback system
- Added automatic fallback to user initials when avatar image fails to load
- Improved Google OAuth picture URLs with proper sizing parameters
- Added CORS handling with referrerpolicy for cross-origin images
- Enhanced responsive design for navigation on mobile devices
- Includes proper error handling and graceful degradation for avatars

- Add required title field to item posting form with validation
- Update YAML data structure to include title field for all new items
- Display item titles prominently on both listing and detail pages
- Ensure backward compatibility: items without titles use description
- Change Claim button color from green to blue to match Contact Seller button
- Improve responsive design for item headers on mobile devices
- Fix image sizing on individual item pages (max-width: 500px, max-height: 70vh)
This enhances the user experience by providing clearer item identification
and consistent button styling throughout the application.

- Add 'item' route to available pages for individual item viewing
- Create templates/item.php with detailed item view including:
* Large image display with sticky positioning
* Prominent price display with FREE badge for /bin/zsh items
* Full description with proper line breaks
* Item details grid (ID, posted date, contact)
* Action buttons (Contact Seller, Claim, Delete)
* Back navigation to items listing
* Mobile responsive design
- Make item listings clickable by wrapping cards in links to individual pages
- Add hover effects and smooth animations for better UX
- Move parseSimpleYaml function to includes/functions.php for reuse
- Maintain all existing functionality (delete, claim, contact) on individual pages
- URLs: ?page=item&id=TRACKING_NUMBER (clean URLs via .htaccess on Apache)
- Proper z-index handling to keep action buttons clickable within linked cards

- Rename templates/s3.php to templates/items.php
- Update routing in index.php to handle 'items' instead of 's3'
- Update all navigation links from ?page=s3 to ?page=items
- Update home page button to link to items page
- Update redirect after posting item to go to items page
- Update all error redirects in items template
- Update deployment guide with new URL structure
- Provides more user-friendly URLs hiding implementation details

- Add .htaccess for clean URLs, static asset handling, and security headers
- Create comprehensive DEPLOYMENT.md guide for Apache hosting
- Include virtual host configuration examples
- Add SSL, permissions, and troubleshooting sections
- Enable clean URLs like /claim and /s3 instead of ?page=claim

- Remove conditional Share Image button that linked to presigned URLs
- Add new 'Claim this!' button with success styling (green)
- Implement claimItem() JavaScript function with placeholder functionality
- Add CSS styling for .claim-btn with hover effects and smooth transitions
- Button shows 'Not implemented yet' alert dialog with tracking number
- Prepares foundation for future claiming functionality

- Change 'for sale' to 'for sale or for giveaway' across templates
- Updated posting page subtitle to be more inclusive
- Updated items listing page descriptions to reflect both sale and giveaway options
- Updated 'no items available' message to include giveaway option
- Makes the platform more welcoming for free item sharing

- Remove the 'Learn More' button that linked to About page
- Add 'View available items' button that links to marketplace (s3 page)
- Maintains consistent navigation experience across site
- Users can now directly access available items from the home page

- Replace browser confirm() popup with custom modal dialog
- Add proper HTML modal with header, body, and action buttons
- Style modal to match site design with rounded corners and shadows
- Include smooth animations for modal show/hide transitions
- Add keyboard support (ESC key to close) for accessibility
- Add click-outside-to-close functionality
- Responsive design for mobile devices
- Maintain all existing delete functionality and error handling

- Change redirect destination from 'claim' to 's3' after successful item posting
- Users now see their posted item immediately after submission
- Improves user experience and confirms item was posted successfully

- Move delete handler from s3.php template to index.php before HTML output
- Prevents HTML headers from being sent with JSON response
- JavaScript can now properly parse the clean JSON response
- Resolves 'There was an error' message during item deletion

- Remove dynamic page names from browser title
- Change from '[Page] - ClaimIt' format to simply 'ClaimIt'
- Provides consistent branding across all pages

- Add deleteObject method to AwsService.php for S3 object deletion
- Implement AJAX-based delete functionality in s3.php template
- Add trash can icon (🗑️) button to each item card with confirmation dialog
- Include smooth fade-out animation when items are deleted
- Add proper error handling and user feedback with floating notifications
- Style delete button with red danger styling and hover effects
- Handle both YAML metadata and image file deletion
- Update item count and show 'no items' message when all items deleted
- Add responsive styling for mobile devices

- Add custom error handler to suppress AWS SDK PHP 8.4 compatibility warnings from browser display while preserving them in environment logs
- Update router.php and public/index.php with environment-appropriate error logging
- Configure clean user experience with professional error suppression
- Maintain developer debugging capabilities through proper log routing
- Ensure compatibility with both development server and production deployment (Apache/nginx)
- Error logs now automatically route to appropriate environment logs (console for dev, web server logs for production)

Major Features Added:
- 🎨 Modern UI with Inter fonts, gradients, and glass-morphism effects
- 📱 Fully responsive design with hover animations and card layouts
- 🛍️ Complete marketplace functionality for posting and browsing items
- 📸 Photo upload support with S3 storage integration
- 💰 Support for /bin/zsh (free) item pricing
- 📧 Direct email contact integration with pre-filled subjects
AWS S3 Integration:
- Automatic tracking number generation (reverse datestamp)
- Image upload to S3 bucket with tracking number naming
- YAML metadata files for item details (description, price, email)
- Presigned URL generation for secure image access
- Complete S3 bucket scanning and YAML parsing
UI/UX Improvements:
- ClaimIt logo now serves as home navigation link
- Removed redundant Home link from navigation
- Beautiful item cards with image placeholders when no photo available
- Modern gradient hero sections and smooth transitions
- Professional marketplace layout with grid display
Technical Enhancements:
- Custom router.php for proper static file serving
- PHP 8.4 compatibility with deprecation warning suppression
- Form validation improvements (allows /bin/zsh values)
- CSRF protection and secure file handling
- Comprehensive error handling and user feedback
The application now functions as a complete online marketplace where users can post items for sale (including free items) and browse available listings with modern, professional UI.

- Complete PHP web application for claims management
- Modern responsive design with professional UI/UX
- Form validation and CSRF protection
- Multiple pages: Home, About, Claims, Contact
- Built with PHP 8.4, HTML5, CSS3, JavaScript
- Composer dependency management
- Security features and error handling