OpenSparrow Files

Added

• Click Statistics module — optional, off by default; records user/time/element/page (and optionally table/record) per click. Settings tab (enable toggle, "Record Table And Record", retention days), Log tab with filtering and a Top Elements rollup. Retention enforced by the notifications cron (default 90 days, 0 = unlimited).
• Production Readiness tab in Admin Health Check — checks APP_ENV, demo mode, secure cookies, HTTPS (incl. behind reverse proxies), display_errors, Argon2id availability, minimum password length (≥12), API rate limiting, SESSION_SAMESITE, and trusted-proxy configuration.
• Optional first name, last name, email, and phone fields on admin user accounts (3.3_user_contact migration; informational only).
• New deployment environment variables: APP_URL, STORAGE_PATH, SESSION_COOKIE_NAME, DB_SSLMODE, API rate limit settings, statement timeout, SMTP timeout, setup lock, cookie path, error log path, session idle timeout, Argon2 tuning, trusted proxy list.

Changed

• Every environment variable in .env.example is now documented; numeric config values are clamped to sane ranges; APP_TIMEZONE and SESSION_SAMESITE are validated instead of trusted as-is.
• Minimum supported PHP version check in Health Check bumped from 8.1 to 8.4, matching the actual codebase floor.
• Large internal refactor: abbreviated PHP/JS variable names expanded to full words; public API endpoints moved behind App\Controller classes and os_request(); die()/exit() replaced by a typed exception hierarchy with a central handler; page views split into templates/. No behavior change.
• Logo and favicon refreshed; login/admin brand text resized to match.

Fixed

• Calendar drag-and-drop move broken by event-variable shadowing; matching calendar delete-event bug fixed.
• Click statistics table_name truncated to fit the column; missing user-contact migration now reported clearly instead of failing silently.
• Log-purge (clickstats retention) input hardened against unusable retention windows, now rejected instead of silently coerced to one day.

Security

• API throttle fails open (never blocks all requests) if its state store becomes unwritable; RAG throttle fails closed when its state is unavailable.
• libpq connection-info values are quoted; CSP report-uri restricted to same-origin.
• Contact-info input (email/phone) validated as text, rejecting non-text values.

Full changelog: https://github.com/wrobeltomasz/OpenSparrow/compare/3.2...3.3