v0.5.0 add email notifications blacklist emails and export field control

Author: coowinit

CHANGELOG.md

@@ -1,50 +1,32 @@
 # Changelog
 
+## v0.5.0
+
+- added blocked email and blocked domain management
+- added email notification center with `log_only` and `mail` modes
+- added dashboard 7-day trend, top forms and country summary widgets
+- added export field selection for inquiry CSV export
+- enhanced API receive flow with blocked email/domain checks
+- added `blacklist_emails` table and `email_notifications` system setting
+- logged notification delivery attempts into system logs
+
 ## v0.4.0
 
-- Added site-level Field Mapping JSON
-- Added admin note editing in inquiry detail page
-- Added inquiry list filter for inquiries with or without notes
-- Added Spam Rule Center page in backend
-- Added configurable rules for honeypot, links, duplicates, rate limits, keywords, and disposable email domains
-- Added `system_settings` model and spam rule service
-- Added database upgrade script for v0.4.0
-- Updated receive API to apply field mapping before validation
-- Updated receive API to include mapped payload in `extra_data` when mappings are used
+- added site field mapping JSON support
+- added admin note editing in inquiry detail page
+- added spam rule center page and settings persistence
 
 ## v0.3.0
 
-- Added site create and edit functions
-- Added API token rotation
-- Added signature secret rotation
-- Added optional HMAC signature verification per site
-- Added system logs page
-- Added CSV export from inquiry list
-- Added blocked IP delete action
-- Updated dashboard with v0.3.0 summary and recent logs
-- Added database upgrade script for v0.3.0
-- Added signed PHP forwarder example
+- added site create and edit management
+- added HMAC signature verification support
+- added CSV export and system logs page
 
 ## v0.2.0
 
-- Added unified receive API endpoint
-- Added API health check endpoint
-- Added `site_key + api_token` validation
-- Added required field validation for `name`, `email`, `content`
-- Added blocked IP check before insert
-- Added basic spam checks for honeypot, duplicate content, link count, IP/email rate limit
-- Added storage for `extra_data` and `raw_payload`
-- Added inquiry filters in the backend
-- Added quick status update actions
-- Added blocked IP add form in the backend
-- Added API quick start info in dashboard and sites page
-- Added GitHub Actions build-release workflow
-- Added PHP and JavaScript integration examples
+- added unified inquiry receive API
+- added base spam detection and payload storage
 
 ## v0.1.0
 
-- Initial scaffold version
-- Added login/logout
-- Added dashboard, inquiries, detail, sites, blocked IPs, profile pages
-- Added schema and seed files
-- Added basic project structure and UI
+- initial scaffold with login, dashboard and basic inquiry pages

README.md

@@ -1,175 +1,87 @@
-# Inquiry Management System
+# Inquiry Management System v0.5.0
 
-Version: **v0.4.0**
+A lightweight **pure PHP + MySQL** inquiry hub for collecting form submissions from multiple websites and managing them in one backend.
 
-A pure PHP + MySQL inquiry management system for collecting inquiry forms from multiple websites into one centralized backend.
+## What is included in v0.5.0
 
-## v0.4.0 Highlights
+- Multi-site inquiry receive API
+- Site management with token and signature secret rotation
+- Field mapping JSON per site
+- Inquiry list, detail page, note management and status flow
+- CSV export with selectable export fields
+- Spam rule center
+- Blocked IP management
+- Blocked email / domain management
+- Email notification center
+- Dashboard with 7-day trend, top forms and country summary
+- System logs
+- GitHub Actions ZIP build workflow
 
-- Added per-site **Field Mapping JSON** so different form field names can map into the system's standard fields
-- Added **Admin Note** editing on the inquiry detail page
-- Added **Spam Rule Center** in the backend for honeypot, links, duplicates, rate limits, keywords, and disposable email domains
-- Added filtering by **Has Note** in inquiry list
-- API now stores mapped payload data into `extra_data` when field mapping is applied
-
-## Environment
-
-- PHP 8.1+
-- MySQL 5.7+ or MySQL 8+
-- Apache or Nginx
-
-## Installation
-
-1. Create a database, for example: `inquiry_system`
-2. Import:
-   - `database/schema.sql`
-   - `database/seed.sql`
-3. Update database settings in `config/database.php`
-4. Point your web root to `public/`
-5. Open the project in your browser
-
-## Upgrading from v0.3.0
-
-If you already have a v0.3.0 database, run:
-
-- `database/upgrade-v0.4.0.sql`
-
-This adds:
-
-- `field_mapping_json` on `inquiry_sites`
-- default `spam_rules` in `system_settings`
-
-## Default Admin Account
+## Default admin account
 
 - Username: `admin`
 - Password: `Admin@123456`
 
-## Main Backend Routes
-
-- `/login`
-- `/dashboard`
-- `/inquiries`
-- `/inquiries/export`
-- `/sites`
-- `/sites/edit?id=1`
-- `/logs`
-- `/tools/blacklist-ips`
-- `/tools/spam-rules`
-- `/profile`
+## New in this version
 
-## API Routes
+### 1. Email notifications
 
-### Health Check
+You can now configure notification delivery from:
 
-`GET /api/v1/health`
+- `Tools > Email Notifications`
 
-### Submit Inquiry
+Supported modes:
 
-`POST /api/v1/inquiries/submit`
+- `log_only`: safe testing mode, writes notification attempts to system logs
+- `mail`: uses native PHP `mail()`
 
-Supported payload types:
+### 2. Email and domain blacklist
 
-- `application/json`
-- standard form POST
+You can now block:
 
-### Minimum payload
+- a specific sender email
+- an entire email domain
 
-```json
-{
-  "site_key": "a_main",
-  "api_token": "token_a_main_2026",
-  "name": "John Smith",
-  "email": "john@example.com",
-  "content": "I want more information about your products."
-}
-```
+Manage them from:
 
-### Optional fields
+- `Tools > Blocked Emails`
 
-- `form_key`
-- `title`
-- `country`
-- `phone`
-- `address`
-- `from_company`
-- `source_url`
-- `referer_url`
-- `language`
-- `browser`
-- `device_type`
-- `submitted_at`
-- `client_ip`
-- `extra_data` (array)
+### 3. Better export control
 
-Unknown fields will also be merged into `extra_data` automatically.
+The inquiry list page now lets you choose which CSV columns should be exported.
 
-## Field Mapping JSON
+### 4. Dashboard enhancements
 
-You can configure a site-level JSON mapping in the backend to transform external field names into the system's standard fields before validation and storage.
+The dashboard now shows:
 
-Example:
+- 7-day inquiry trend
+- top forms
+- top countries
+- current notification configuration summary
 
-```json
-{
-  "name": ["fullname", "your_name"],
-  "email": ["user_email", "contact_email"],
-  "title": ["subject"],
-  "content": ["message", "comments"],
-  "from_company": ["company", "company_name"],
-  "phone": ["mobile", "tel"]
-}
-```
-
-## Signed Request Mode
-
-For sites with **Require HMAC signature** enabled:
-
-- Header: `X-Timestamp` = unix timestamp in seconds
-- Header: `X-Signature` = `hash_hmac('sha256', X-Timestamp + "\n" + raw_body, signature_secret)`
-
-Recommended usage:
-
-1. Your website backend builds the final request body
-2. Your website backend signs the raw body with the site's signature secret
-3. Your website backend sends the request to the central inquiry system
-
-## Spam Rule Center
-
-The backend now includes a configurable spam rule center for:
-
-- honeypot field check
-- link threshold check
-- duplicate submission check
-- IP rate limit
-- email rate limit
-- keyword-based spam detection
-- disposable email domain detection
-
-## Example Files
-
-- `examples/php-forwarder.php`
-- `examples/php-signed-forwarder.php`
-- `examples/javascript-fetch-example.js`
+## Installation
 
-## GitHub Actions
+### Fresh install
 
-Workflow file:
+1. Create a MySQL database
+2. Import:
+   - `database/schema.sql`
+   - `database/seed.sql`
+3. Update `config/database.php`
+4. Point your web root to `public/`
 
-- `.github/workflows/build-release.yml`
+### Upgrade from v0.4.0
 
-It creates a ZIP package automatically when you push a tag like:
+Run:
 
-```bash
-git tag v0.4.0
-git push origin v0.4.0
-```
+- `database/upgrade-v0.5.0.sql`
 
-## Notes
+## API endpoint
 
-Recommended production flow:
+- `POST /api/v1/inquiries/submit`
+- `GET /api/v1/health`
 
-1. Website form submits to the current website backend
-2. The current website backend maps and forwards the payload to this central system
-3. This system validates, filters, stores, and manages the inquiry
+## Notes about outbound mail
 
-This is safer than exposing tokens directly in front-end JavaScript.
+When using `transport = mail`, the hosting environment must already support outbound email for PHP `mail()`.
+If your server does not support it yet, use `log_only` first to verify the notification workflow safely.

VERSION.txt

@@ -1 +1 @@
-v0.4.0
+v0.5.0

app/Controllers/DashboardController.php

@@ -9,6 +9,7 @@
 use App\Models\Inquiry;
 use App\Models\InquiryLog;
 use App\Models\Site;
+use App\Services\EmailNotificationService;
 
 final class DashboardController extends Controller
 {
@@ -26,6 +27,10 @@ public function index(): void
             'sites' => $siteModel->allWithStats(),
             'recentLogs' => $logModel->paginate(1, 6)['data'],
             'apiEndpoint' => base_url('api/v1/inquiries/submit'),
+            'trendRows' => $inquiryModel->dailyTrend(7),
+            'topForms' => $inquiryModel->topForms(6),
+            'countrySummary' => $inquiryModel->countrySummary(6),
+            'notificationSettings' => (new EmailNotificationService())->getSettings(),
         ]);
     }
 }

app/Controllers/InquiryController.php

@@ -24,13 +24,17 @@ public function index(): void
         $inquiryModel = new Inquiry();
         $siteModel = new Site();
         $pagination = $inquiryModel->paginate($filters, $page, $perPage);
+        $allowedExportFields = $inquiryModel->allowedExportColumns();
+        $selectedExportFields = $this->collectExportFields(array_keys($allowedExportFields));
 
         $this->view('dashboard/inquiries', [
             'pageTitle' => 'Inquiry Management',
             'pagination' => $pagination,
             'filters' => $filters,
             'sites' => $siteModel->all(),
             'csrfToken' => Csrf::token(),
+            'allowedExportFields' => $allowedExportFields,
+            'selectedExportFields' => $selectedExportFields,
         ]);
     }
 
@@ -134,18 +138,16 @@ public function updateNote(): void
     public function exportCsv(): void
     {
         $filters = $this->collectFilters();
-        $rows = (new Inquiry())->exportRows($filters, 5000);
+        $inquiryModel = new Inquiry();
+        $allowedColumns = array_keys($inquiryModel->allowedExportColumns());
+        $selectedFields = $this->collectExportFields($allowedColumns);
+        $rows = $inquiryModel->exportRows($filters, $selectedFields, 5000);
 
-        (new InquiryLog())->create(null, Auth::id(), 'inquiries_exported', 'Exported ' . count($rows) . ' rows as CSV');
+        (new InquiryLog())->create(null, Auth::id(), 'inquiries_exported', 'Exported ' . count($rows) . ' rows as CSV with fields: ' . implode(', ', $selectedFields));
 
         send_csv_download(
             'inquiries-' . date('Ymd-His') . '.csv',
-            [
-                'id', 'site_name', 'form_key', 'status', 'name', 'email', 'title', 'content',
-                'country', 'phone', 'address', 'from_company', 'source_url', 'referer_url',
-                'ip', 'browser', 'device_type', 'language', 'admin_note', 'submitted_at',
-                'created_at', 'updated_at', 'extra_data',
-            ],
+            $selectedFields,
             $rows
         );
     }
@@ -167,4 +169,13 @@ private function collectFilters(): array
 
         return $filters;
     }
+
+    private function collectExportFields(array $allowed): array
+    {
+        $fields = $_GET['fields'] ?? [];
+        $fields = is_array($fields) ? array_map('strval', $fields) : [];
+        $fields = array_values(array_intersect($fields, $allowed));
+
+        return $fields !== [] ? $fields : $allowed;
+    }
 }