Skip to content

19 July 2026

Unified token administration, admin breadcrumbs & session/stats fixes. Token management is now consolidated behind a single controller, the admin scaffolding pages gained a consistent breadcrumb trail, and several admin-UI defects (empty session lists, the JSON-dumping stats link, non-clickable token rows) are fixed across all three scaffold themes.

3 changes:

  • Unified token administration
  • Admin breadcrumbs
  • Fixes

Unified token administration

Per-user token management and the global token list now live behind one controller, Pramnos\Auth\Controllers\TokensController, split into two permission tiers:

  • Global (cross-user) — /Tokens, revoke, revokeall. Sensitive because it exposes every user's tokens, so it keeps requiring usertype ≥ 90.
  • Per-user — a single user's tokens, part of the base auth User admin, so it requires only usertype ≥ 80 (the same tier as the Users admin).

Added

  • TokensController::userid($id) — lists every token (any status) for one user, reachable as Tokens/userid/{id}, with per-token management actions.
  • TokensController::deactivate() — POST: set a user's token to inactive (status=0). Expects userid, tokenid.
  • TokensController::delete() — POST: soft-delete a user's token (status=2). Expects userid, tokenid.
  • $perUserUserType property on TokensController (default 80) controlling the per-user tier independently of the global $requiredUserType (90).
  • New scaffold view tokens/user.html.php in all three themes (plain-CSS, Bootstrap, Tailwind) with clickable rows that open each token's audit log.

Changed

  • Pramnos\Application\Controllers\UsersController::tokens() is now a backward-compatible redirect to Tokens/userid/{id}.
  • UsersController::deactivateToken() / deleteToken() remain for backward compatibility and redirect to the unified per-user list after acting.

Removed

  • The now-unused users/tokens.html.php scaffold view (replaced by tokens/user.html.php) in all three themes.

Admin breadcrumbs

Admin scaffolding pages now render a Home / Dashboard / … breadcrumb trail via Pramnos\Html\Breadcrumb, mirroring the account area, instead of ad-hoc "Back" buttons. A new partials/admin_breadcrumb.html.php drives the trail from $this->activeNav for tokens, token actions, and users (list / view / edit / sessions / tokens) in all three themes.

The trail is origin-aware for the token-actions view: reaching TokenActions?token_id=… from the Tokens list shows … / Tokens / Token #N, while reaching it from a user shows … / Users / <user> / Token #N (links carry a from=tokens / from=user&uid=N hint).

Fixes

Fixed

  • User sessions list showed nothing. UsersController::sessions() ordered by a non-existent date column and the view read the wrong column names; it now orders by time and reads visitorid / host_addr / agent / time, plus a Status column.
  • Token Actions "Stats" dumped raw JSON. TokenActionsController::stats() emitted JSON followed by the HTML layout, breaking response.json(). It now switches to the JSON document type and returns Response::json(...), and is rendered in an in-page modal.
  • Stats showed opaque URL IDs. The stats endpoint now resolves each urlid to its URL so the modal lists real endpoint paths.
  • Token rows were not clickable. Rows in the Tokens list and a user's recent tokens now open the corresponding Token Actions view.
  • "Back to User" on a user's tokens pointed at the edit form; it now points at the user detail page (moot after the breadcrumb change, but corrected).
  • Corrected a malformed page-section wrapper in the plain-CSS users/edit view.

Security / CSP

  • All new admin-UI behaviour (clickable rows, the stats modal) is wired through data-attributes handled by assets/js/pf-utils.js — no inline onclick handlers, which the nonce-based Content-Security-Policy blocks. New pf-utils.js hooks: data-href (clickable rows), data-stats-open / data-stats-url / data-stats-close (the stats modal).