fix(security): Licora v5.0.1.1 High Security Stabilization

[victorsteele]

Licora v5.0.1.1 — High Security Stabilization

Summary

This pull request upgrades Licora from v5.0.1 to v5.0.1.1 through backward-compatible security stabilization only.

This is not a feature release, UI redesign, database redesign, or architecture rewrite.

The Phase 0 baseline and compatibility contract remain the source of truth.

Security fixes

• Added proper Authorization: Bearer TOKEN support while preserving X-API-Key.
• Restricted Viewer accounts from license exports, API-key exports/tests, and management actions.
• Hardened the installer against execution after installation.
• Added installer lock detection and recovery documentation.
• Added a critical admin-panel warning when temporary administrator credentials remain active.
• Introduced versioned authenticated encryption for new encrypted values.
• Preserved decryption compatibility for existing legacy encrypted values.
• Enforced the existing administrator-session timeout throughout protected admin pages.
• Improved rate-limit consistency and concurrency safety without changing limits or JSON responses.
• Preserved /api/check_license.php and its existing response contract.
• Improved security-event logging without deleting or changing historical logs.
• Added backward-compatible security headers.
• Added security smoke and compatibility regression tests.

Compatibility guarantees

• Database schema unchanged.
• No database migration required.
• Existing license keys remain valid.
• Existing encrypted license and API-key values remain decryptable.
• Existing API URLs remain unchanged.
• Existing API JSON request and response contracts remain unchanged.
• Existing routes and folders remain unchanged.
• Existing admin pages remain available.
• Existing installer flow remains unchanged except for post-installation locking.
• Existing clients using X-API-Key continue working.
• Legacy API clients continue working.
• Manager and Super Admin behavior remains unchanged.
• No SQL, CSS, or JavaScript file was modified.

Validation completed

• PHP syntax validation passed for all modified and added PHP files.
• Security smoke test passed.
• Compatibility regression checks passed.
• Git whitespace validation passed after documentation cleanup.
• No SQL, CSS, or JavaScript modifications detected.
• Branch working tree is clean.

Environment note

The full Bash validation wrapper could not run locally because Windows WSL2 failed to mount the configured Docker virtual disk.

The PHP tests were run directly using the local XAMPP PHP executable. The executable reported unrelated OCI, Firebird, duplicate-extension, and SNMP configuration warnings, but both Licora test suites completed successfully.

Manual regression testing required before merge

The following workflows must be verified in a disposable local installation:

• Admin login
• Session timeout
• Logout
• License creation
• License verification
• Device registration and reconnection
• X-API-Key authentication
• Bearer authentication
• Legacy API verification
• Viewer permission restrictions
• Manager and Super Admin permissions
• License and log exports
• Dashboard
• Cron scripts
• Settings
• Installer lock
• Temporary administrator warning
• Legacy encrypted-value decryption

Documentation

• PHASE1_SECURITY_FIX_SUMMARY.md
• RELEASE_NOTES_v5.0.1.1.md
• SECURITY.md
• CHANGELOG.md
• docs/INSTALLATION.md