OpenSparrow v4.4 adds one-to-one user chat with bell notifications, a token‑protected HTTP cron trigger for shared hosting, and admin tables that size to their content — plus a fixed chat notification title.
One-to-one user chat
Frontend users can now message each other directly. The messenger is served by public/api/chat.php (a thin router over includes/Controller/Api/ChatController.php) and opens from the Chat entry in the avatar menu (public/assets/js/chat-panel.js, openChatPanel()); a ?chat=1 deep link opens it straight away. Conversations are strictly 1‑to‑1 — there are no group threads, and a message is visible only to its sender and recipient. Reading requires only a login; sending and hiding require the editor role, so viewers can follow their conversations but cannot write. Message bodies are trimmed and capped at 4000 characters in both PHP and a CHECK constraint, and a user cannot message themselves. The search box finds users with an escaped ILIKE match (at least two characters) and the conversation list collapses each peer to their latest message via DISTINCT ON (peer_id).
Instant bell notifications
Sending a message immediately inserts an in‑app notification for the recipient (ChatController::notifyRecipient()) into spw_users_notifications, with the source table chat and a ?chat=1 deep link, so the recipient is alerted without waiting for a cron run. The insert is idempotent (ON CONFLICT … DO NOTHING). Either participant can hide a message; hiding is a soft delete that flips is_visible without removing the row, and the ownership check refuses to hide a message you are not part of.
An HTTP cron trigger for shared hosting
Most shared hosts run cron through a URL fetch and chroot the process to the web root, so they can never reach the CLI‑only cron/ directory. The notification cron can now also run over HTTP: public/cron.php reads a CRON_SECRET environment variable and a token parameter, compares them with hash_equals, and answers plain text. An empty CRON_SECRET disables the endpoint entirely. The worker itself (cron_notifications_run() in includes/cron_notifications.php) is shared by both the CLI entry (cron/cron_notifications.php) and the HTTP endpoint, so there is no second runner to drift. cron/ ships a Deny from all .htaccess like every other backend folder. Secrets placed in a URL must be hex (openssl rand -hex 32), never base64 — a + decodes to a space inside a query string. The admin Cron → Setup tab now includes a ready‑to‑copy HTTP trigger example.
Admin tables that size to their content
Admin tables no longer squeeze their columns into the panel width. public/admin/style.css makes .adm-tbl size to its content (width: max-content; min-width: 100%) with white-space: nowrap cells, and .adm-sec-body scrolls horizontally, so timestamps, buttons and SQL stay readable instead of wrapping. The fix is global — it covers both the literal adm-tbl tables and every mkTable() caller — and the hand‑rolled per‑table overflow-x:auto wrappers were removed.
Also in this release
-
Chat notification title fixed — the new‑message alert rendered the raw i18n key
chat.new_message; the key is now defined in all 20 language files. -
4.4_user_chatmigration — createsspw_chat_messages(sender, recipient, body, timestamp, soft‑hide flag, a foreign key tospw_userswithON DELETE SET NULL, and per‑participant indexes); apply it from System → Migrations → Initialize System Tables. - Demo seed — the CRM demo now ships a sample chat between the demo users, so the messenger is populated right after install.
Top comments (0)