# Changelog

A new entry must be added with every version release to briefly describing the changes for that release.

## [Unreleased]
- **Fix**: User role handling – unknown API role values are now safely mapped to avoid sync crashes (UserType parsing)
- **Compiit**: Removed ability to create a new vessel when creating a competency; users must now select a vessel from the existing list only (no New/Existing toggle)

## v1.4.3 (26/01/2026)
- **Security**: Removed client-side password hashing (SHA-256) - passwords are now sent over HTTPS in plain text to be properly hashed server-side using secure algorithms (bcrypt, Argon2, PBKDF2)
- **Security**: Removed `getHashPassword()` function from `UtilService` - passwords should never be hashed on the client side
- **Security**: Removed password hash storage in secure storage - passwords are no longer stored locally in any form
- **Security**: Updated offline login to use JWT token or previous session validation instead of password hash comparison
- **Feature**: Offline login is now available for users who have previously authenticated online (have valid JWT token or stored session) - no password verification required offline for security

## v1.4.2 (23/01/2026)
- **Security**: Replaced all debug `print()` statements with centralized `LoggerService` to prevent sensitive data leakage in production
- **Security**: Implemented automatic sanitization of sensitive data (emails, tokens, user objects, IDs) in log messages
- **Security**: LoggerService only logs in debug/profile modes, completely silent in release/production builds
- **Logging**: Created `LoggerService` singleton with log levels (debug, info, warning, error) and tag-based filtering
- **Logging**: LoggerService uses both `print()` for console visibility and `developer.log()` for DevTools filtering
- **Refactoring**: Updated ~66 files across the codebase to use `LoggerService` instead of `print()` statements

## v1.4.1 (14/01/2026)
- Fixed local dev environment URL (missing trailing slash in baseApiUrl causing API calls to fail)
- Added try-catch wrapper to SnackBarService to prevent app crashes when Overlay not available
- Added debug logging to login flow for easier troubleshooting
- Created test accounts documentation in README for all app roles
- **Security**: Migrated JWT token storage from SharedPreferences to FlutterSecureStorage for enhanced security (uses Keychain on iOS and EncryptedSharedPreferences on Android)
- **Security Refactoring**: Created SecureStorageService to centralize secure token management with methods: saveToken(), getToken(), deleteToken(), and hasToken()
- **Security**: Updated AuthService to use SecureStorageService instead of direct FlutterSecureStorage calls for better code organization
- **Security**: Added automatic migration from SharedPreferences to secure storage for users upgrading from older app versions
- **Testing**: Added comprehensive unit tests for SecureStorageService covering token save, retrieve, delete, migration, and persistence scenarios

## v1.4.0 (09/12/2025)
- Added `X-Entry-Point` header to all API requests.
- Updated media permissions for camera/gallery on android.

## v1.3.0 (28/10/2025)
- Implemented rov supervisor 
- Added supervisor rov notifications
- minor bug fixes
- updated log contractor entry url identifier
- bug fixes requested by testers
  - project supervisor no longer being verified before saving
  - small screen overflow
- Added the vetters
- Added creating log contractor dive
- Added hashes to user, userdetails and project models
- Have the new shariit using logbook entity
- Added login password visibility eye
- Minor bug fixes

## v1.0.28 (29/08/2025)
- Added offline api network status checker dialog with configurable dns to test connection to Offline API on local networks.
- Updated login page to show network status checker when forgot password button is held.
- Added loading indicator to login button on login page so app doesnt appear stuck when clicked.
- Added urls per environment for offline api connectivity.
- Updated pod file ios version from `12.0` to `16.0` to allow build to iphone 16.