ParkHub PHP v4.13.0 — Modular UX Platform + Service Layer + Security

[nash87]

ParkHub PHP v4.13.0 — Modular UX Platform + Service Layer + Security

Released 2026-04-17. Biggest release since v4.8.0, bundling the same Modular UX story as the Rust edition plus a ground-up service-layer extraction. Full CHANGELOG →

Highlights

Modular UX platform

Parity with the parkhub-rust edition: admins can see, toggle, and configure every module from the web UI.

• GET api/v1/modules returns a 68-module registry across 11 categories. Backwards-compat envelope: legacy {modules: {name: bool}} map preserved alongside the new module_info array.
• PATCH api/v1/admin/modules/{name} (admin-only, ModuleGate middleware): flip runtime_enabled on 13 safe modules without redeploying.
• PATCH api/v1/admin/modules/{name}/config: per-module JSON Schema config editor backed by opis/json-schema 2.6.0. Five modules ship declared schemas.
• Frontend (shared with Rust edition, byte-identical on all touched files): /admin/modules dashboard + Command Palette (Cmd+K) + ConfigEditor modal. Hand-rolled JSON Schema form renderer, zero external deps.
• Every toggle + config write emits AuditLog entry.

Service layer extraction

Went from 3 services 77 controllers (~4 %) to 12 services shipped. Approximately 1,164 LOC of controller logic relocated into focused services:

Pass	Services
1	BookingCreationService, AuthenticationService, ReportExportService
2	StripeWebhookService, VehicleService
3	AdminSettingsService, ComplianceService
4	ModuleConfigurationService, UserAccountService
5	AdminUserManagementService, WebhookDispatchService
6	AuditLogQueryService

Controllers shed: BookingController 1035 → 397 (across pass 1); AdminSettingsController 494 → 351; ComplianceController 327 → 82; AuditLogController 241 → 77; AdminController 330 → 251; WebhookV2Controller 313 → 171 — and more.

Security hardening

• ** — SVG removed from branding logo upload mimes** (stored-XSS class closed).
• ** — Cross-tenant admin write guards** (parity with Rust edition).
• ** part 1 — Multi-tenancy enforcement**: AdminAnalyticsController / AdminReportController pin explicit tenant predicates on every Booking User ParkingLot query; CSV exports filter BEFORE ->cursor; rate-limit cache keys are now tenant-namespaced.
• ** — Laravel Policies**: 3 → 11 policies (Vehicle, Webhook, Notification, Favorite, Tenant, Announcement, AuditLog, Widget).
• Session absolute lifetime middleware — hard 1440-min default, configurable.
• Audit log purge cronjob — daily 03:15 UTC, 90-day retention.
• CSP + NEL report endpoints for in-product browser telemetry.

Testing infrastructure

• infection/infection 0.32.6 mutation testing scoped to app/Rules + app/Http/Middleware. Nightly @ 05:00 UTC.
• schemathesis 4.15.2 nightly OpenAPI contract fuzzing @ 06:00 UTC (local smoke surfaced 48 contract violations across 5 categories — follow-up triage).
• PHPStan baseline shrunk 1795 → 727 lines (−60 %) via @property PHPDoc on 13 Eloquent models + @mixin on 13 JsonResource subclasses.

Admin N+1 elimination

• /api/v1/bookings/history?per_page=10 went from 12 → 4 queries — 3× fewer.
• 3 regression tests using DB::enableQueryLog / count(DB::getQueryLog) assertion pattern.

FormRequest migration complete

• 98 FormRequest classes shipped. 0/91 → 98/91 inline $request->validate(...) calls migrated; 6 remaining carry /-intentional: annotations with rationale.

Dependencies

• opis/json-schema 2.6.0 (module config validation).
• infection/infection 0.32.6 (mutation testing).
• laravel/pint current stable.
• PHPStan level 5 (level 6 promotion deferred — 328 new findings surfaced, not worth the baseline bloat today).

Tests

• Feature + unit tests: 1297 → 1701 across the cycle (new policy + service unit suites account for most).
• Zero flakes in the current required-check matrix; nightly flake fixes shipped under.

---

Live demo: https://parkhub-php-demo.onrender.com (login admin@parkhub.test / demo).
Architecture context: #183

Feedback welcome.

[nash87]

v4.13.0 maintenance update (2026-04-19)

• parkhub-web bundle version corrected 4.12.0 → 4.13.0 (fix(ui): bump parkhub-web package version 4.12.0 → 4.13.0 #312) — the React Login footer imports the version directly from its own parkhub-web/package.json, which had drifted behind the repo's VERSION file, so the deployed login page was advertising v4.12.0 while the release tag was v4.13.0. Bumped the sub-package to align — the deployed footer now shows the right number.

No backend changes. The PHP release is still v4.13.0.