v1.1.0

changelog.txt

@@ -1,5 +1,73 @@
 == Changelog ==
 
+= 1.1.0 =
+
+_Release date: 2026-03-28_
+
+**Changed**
+
+* Code quality: phpcbf auto-fixed 112 formatting issues across 12 files (operator alignment, array double arrows, pre-increment style).
+
+**Compatibility**
+
+* WordPress: 6.7, 6.8, 6.9
+* PHP: 8.2, 8.3, 8.4, 8.5
+* MariaDB: 10.6 or newer
+* Multisite: Supported
+* Two-Factor plugin: 0.16 or newer
+* Tested on WordPress 6.7.5, PHP 8.5.3; PHPUnit 9.6.34 — 28 unit tests, 64 assertions, all passing
+
+= 1.0.2 =
+
+_Release date: 2026-03-28_
+
+**Changed**
+
+* Plugin renamed from "Two Factor Extended" to "Two-Factor Extended" (hyphen added for consistency with the Two-Factor plugin naming convention).
+* `get_required_providers_for_user()` now intersects enforcement requirements with Two-Factor's globally-enabled providers list (`two_factor_enabled_providers` option, introduced in Two-Factor 0.16). Providers disabled site-wide by Two-Factor will no longer be enforced.
+* Added Catalan (ca) translation — 145 strings, 100% coverage.
+* Updated Spanish (es_ES) translation to reflect the new plugin name.
+
+**Multisite**
+
+* Two-Factor (base plugin) has no network-level settings — it is entirely per-site. Two-Factor Extended already provides the network layer on top of this with network-wide enforcement, super admin requirements, and site override controls. No changes required.
+
+**Compatibility**
+
+* WordPress: 6.7, 6.8, 6.9
+* PHP: 8.2, 8.3, 8.4, 8.5
+* MariaDB: 10.6 or newer
+* Multisite: Supported
+* Two-Factor plugin: 0.16 or newer
+* Tested on WordPress 6.7.5, PHP 8.5.3; PHPUnit 9.6.34 — 28 unit tests, 64 assertions, all passing
+
+= 1.0.1 =
+
+_Release date: 2026-03-28_
+
+**Changed**
+
+* Settings menu now registered at `admin_menu` priority 20 to always appear after Two Factor plugin's Settings page (Two Factor 0.16+).
+* PHPUnit downgraded from 10.x to 9.6 for compatibility with the WordPress test library.
+* `phpunit.xml.dist` updated: uses PHPUnit 9 schema, `<coverage>` block replaces removed attributes, `suffix=".php"` for test directory discovery.
+* Test files renamed from `test-*.php` to `Test_*.php` to match PHPUnit 10/9 class name mapping (class names unchanged).
+* `yoast/phpunit-polyfills` downgraded to `^1.1` (matches WordPress core requirement).
+
+**Fixed**
+
+* PHPCS: spacing after parameter type in `robotstxt-updater.php`, `class-enforcement.php`, `class-bulk-actions.php`.
+* PHPCS: `list<int>` docblock type replaced with `int[]` to match `array` PHP type hint in `class-bulk-actions.php`.
+* PHPStan level 9: all errors resolved across all plugin files.
+
+**Compatibility**
+
+* WordPress: 6.7, 6.8, 6.9
+* PHP: 8.2, 8.3, 8.4, 8.5
+* MariaDB: 10.6 or newer
+* Multisite: Supported
+* Two-Factor plugin: 0.16 or newer
+* Tested on WordPress 6.7.5, PHP 8.5.3; PHPUnit 9.6.34 — 28 unit tests, 64 assertions, all passing
+
 = 1.0.0 =
 
 _Release date: 2026-02-17_
@@ -79,18 +147,12 @@ This is the first comprehensive release of Two-Factor Extended, implementing ent
 
 **Compatibility**
 
-* WordPress: 6.7 - 6.9
+* WordPress: 6.7, 6.8, 6.9
-* PHP: 8.2 - 8.5
+* PHP: 8.2, 8.3, 8.4, 8.5
-* MariaDB: 10.6+
+* MariaDB: 10.6 or newer
-* Two Factor Plugin: 0.15.0 (tested)
+* Multisite: Supported
-* Multisite: Fully supported (Network: true)
+* Two-Factor plugin: 0.15 or newer
-
+* Tested on WordPress 6.9, PHP 8.2, MariaDB 10.6; plugin detection verified, dependency checks working, PHPCS passing, unit tests passing
-**Testing Environment**
-
-* WordPress: 6.9
-* PHP: 8.2
-* MariaDB: 10.6
-* Testing: Plugin detection verified, dependency checks working, PHPCS passing, unit tests passing
 
 **Development Tools**
 

includes/class-audit-log.php

@@ -439,11 +439,11 @@ class Two_Factor_Extended_Audit_Log {
 			if ( ! isset( $stats['by_action'][ $action ] ) ) {
 				$stats['by_action'][ $action ] = 0;
 			}
-			$stats['by_action'][ $action ]++;
+			++$stats['by_action'][ $action ];
 
 			// Count recent logs (last 7 days).
 			if ( $ts >= $recent_cutoff ) {
-				$stats['recent_count']++;
+				++$stats['recent_count'];
 			}
 		}
 

includes/class-bulk-actions.php

@@ -158,7 +158,7 @@ class Two_Factor_Extended_Bulk_Actions {
 				);
 			}
 
-			$processed++;
+			++$processed;
 		}
 
 		return $processed;
@@ -203,7 +203,7 @@ class Two_Factor_Extended_Bulk_Actions {
 				);
 			}
 
-			$processed++;
+			++$processed;
 		}
 
 		return $processed;

includes/class-cli-commands.php

@@ -196,7 +196,7 @@ class Two_Factor_Extended_CLI_Commands {
 				);
 			}
 
-			$processed++;
+			++$processed;
 			$progress->tick();
 		}
 

includes/class-compliance-report.php

@@ -71,7 +71,7 @@ class Two_Factor_Extended_Compliance_Report {
 			$required = $enforcement->get_required_providers_for_user( $user->ID );
 
 			if ( empty( $required ) ) {
-				$stats['no_requirements']++;
+				++$stats['no_requirements'];
 				continue;
 			}
 
@@ -79,11 +79,11 @@ class Two_Factor_Extended_Compliance_Report {
 			$in_grace  = $enforcement->is_in_grace_period( $user->ID );
 
 			if ( $compliant ) {
-				$stats['compliant_users']++;
+				++$stats['compliant_users'];
 			} elseif ( $in_grace ) {
-				$stats['grace_period']++;
+				++$stats['grace_period'];
 			} else {
-				$stats['non_compliant']++;
+				++$stats['non_compliant'];
 			}
 
 			// Count by role.
@@ -98,12 +98,12 @@ class Two_Factor_Extended_Compliance_Report {
 					);
 				}
 
-				$stats['by_role'][ $role ]['total']++;
+				++$stats['by_role'][ $role ]['total'];
 
 				if ( $compliant ) {
-					$stats['by_role'][ $role ]['compliant']++;
+					++$stats['by_role'][ $role ]['compliant'];
 				} else {
-					$stats['by_role'][ $role ]['non_compliant']++;
+					++$stats['by_role'][ $role ]['non_compliant'];
 				}
 			}
 		}

includes/class-rest-api.php

@@ -368,7 +368,7 @@ class Two_Factor_Extended_REST_API {
 				);
 			}
 
-			$processed++;
+			++$processed;
 		}
 
 		return new WP_REST_Response(
@@ -435,7 +435,7 @@ class Two_Factor_Extended_REST_API {
 				);
 			}
 
-			$processed++;
+			++$processed;
 		}
 
 		return new WP_REST_Response(

includes/class-two-factor-extended.php

@@ -34,7 +34,7 @@ class Two_Factor_Extended {
 	 * @since 0.1.0
 	 * @var string
 	 */
-	private string $version = '1.0.2';
+	private string $version = '1.1.0';
 
 	/**
 	 * Plugin directory path.

readme.txt

@@ -3,9 +3,9 @@ Contributors: javiercasares, robotstxt
 Tags: two-factor, 2fa, authentication, security
 Requires at least: 6.7
 Tested up to: 6.9
-Stable tag: 1.0.2
+Stable tag: 1.1.0
 Requires PHP: 8.2
-Version: 1.0.1
+Version: 1.1.0
 License: GPL-3.0-or-later
 License URI: https://www.gnu.org/licenses/gpl-3.0.txt
 
@@ -117,6 +117,63 @@ We take security seriously and will respond promptly to all security reports.
 
 == Changelog ==
 
+= 1.1.0 =
+
+_Release date: 2026-03-28_
+
+**Changed**
+
+* Code quality: phpcbf auto-fixed 112 formatting issues across 12 files (operator alignment, array double arrows, pre-increment style).
+
+**Compatibility**
+
+* WordPress: 6.7, 6.8, 6.9
+* PHP: 8.2, 8.3, 8.4, 8.5
+* MariaDB: 10.6 or newer
+* Multisite: Supported
+* Two-Factor plugin: 0.16 or newer
+
+= 1.0.2 =
+
+_Release date: 2026-03-28_
+
+**Changed**
+
+* Plugin renamed from "Two Factor Extended" to "Two-Factor Extended".
+* Enforcement now respects Two-Factor's globally-disabled providers (`two_factor_enabled_providers` option, Two-Factor 0.16+). Users will no longer be blocked by providers disabled site-wide.
+* Added Catalan (ca) translation — 145 strings, 100% coverage.
+* Updated Spanish (es_ES) translation to reflect the new plugin name.
+
+**Compatibility**
+
+* WordPress: 6.7, 6.8, 6.9
+* PHP: 8.2, 8.3, 8.4, 8.5
+* MariaDB: 10.6 or newer
+* Multisite: Supported
+* Two-Factor plugin: 0.16 or newer
+
+= 1.0.1 =
+
+_Release date: 2026-03-28_
+
+**Changed**
+
+* Settings menu now registered at `admin_menu` priority 20 to always appear after Two Factor plugin's Settings page (Two Factor 0.16+).
+* PHPUnit downgraded from 10.x to 9.6 for compatibility with the WordPress test library.
+
+**Fixed**
+
+* PHPCS: spacing and docblock type hint fixes across multiple files.
+* PHPStan level 9: all errors resolved.
+
+**Compatibility**
+
+* WordPress: 6.7, 6.8, 6.9
+* PHP: 8.2, 8.3, 8.4, 8.5
+* MariaDB: 10.6 or newer
+* Multisite: Supported
+* Two-Factor plugin: 0.16 or newer
+
 = 1.0.0 =
 
 _Release date: 2026-02-17_
@@ -159,11 +216,11 @@ This is the first comprehensive release of Two-Factor Extended, implementing ent
 
 **Compatibility**
 
-* WordPress: 6.7 - 6.9
+* WordPress: 6.7, 6.8, 6.9
-* PHP: 8.2 - 8.5
+* PHP: 8.2, 8.3, 8.4, 8.5
-* MariaDB: 10.6+
+* MariaDB: 10.6 or newer
-* Two Factor Plugin: 0.15.0 (tested)
+* Multisite: Supported
-* Multisite: Fully supported
+* Two-Factor plugin: 0.15 or newer
 
 = Previous versions =
 

two-factor-extended.php

@@ -3,7 +3,7 @@
  * Plugin Name: Two-Factor Extended
  * Plugin URI: https://git.robotstxt.es/ROBOTSTXT/two-factor-extended
  * Description: Extends the WordPress Two Factor plugin with advanced role-based controls, forced 2FA methods, and enhanced administrative features for single-site and Multisite installations.
- * Version: 1.0.2
+ * Version: 1.1.0
  * Requires at least: 6.7
  * Requires PHP: 8.2
  * Requires Plugins: two-factor
@@ -18,7 +18,7 @@
  * Primary Branch: main
  *
  * @package TwoFactorExtended
- * @version 1.0.2
+ * @version 1.1.0
  */
 
 // Prevent direct access.

update.json

@@ -1,8 +1,8 @@
 {
   "name": "Two-Factor Extended",
   "slug": "two-factor-extended",
-  "version": "1.0.2",
+  "version": "1.1.0",
-  "download_url": "https://git.robotstxt.es/ROBOTSTXT/two-factor-extended/releases/download/1.0.2/two-factor-extended-1.0.2.zip",
+  "download_url": "https://git.robotstxt.es/ROBOTSTXT/two-factor-extended/releases/download/1.1.0/two-factor-extended-1.1.0.zip",
   "requires": "6.7",
   "requires_php": "8.2",
   "tested": "6.9",
@@ -11,10 +11,10 @@
   "author_profile": "https://www.robotstxt.es/",
   "homepage": "https://git.robotstxt.es/ROBOTSTXT/two-factor-extended",
   "description": "Extends the WordPress Two Factor plugin with advanced role-based controls, forced 2FA methods, and enhanced administrative features for single-site and Multisite installations.",
-  "changelog": "<h3>1.0.2 - 2026-03-28</h3><ul><li><strong>Name:</strong> Renamed to \"Two-Factor Extended\" (hyphen added for consistency)</li><li><strong>Compatibility:</strong> Two-Factor 0.16 enforcement now respects globally-disabled providers</li><li><strong>i18n:</strong> Added Catalan (ca) translation (100% coverage); updated es_ES</li></ul><h3>1.0.1 - 2026-03-28</h3><ul><li><strong>Compatibility:</strong> Two Factor 0.16 settings panel — settings menu now always appears after Two Factor in admin</li><li><strong>Code Quality:</strong> PHPStan level 9 clean, PHPCS WordPress Coding Standards clean</li><li><strong>Tests:</strong> PHPUnit 9.6 compatible, 28 unit tests passing (PHP 8.5, WordPress 6.7)</li></ul><h3>1.0.0 - 2026-02-17</h3><ul><li><strong>Initial Production Release:</strong> Complete enterprise-level two-factor authentication management for WordPress</li><li><strong>Core Features:</strong> Role-based 2FA requirements, provider visibility control, grace period enforcement, WordPress Multisite support</li><li><strong>Advanced Features:</strong> Audit logging, compliance reporting, bulk operations, WP-CLI integration, REST API, import/export settings</li><li><strong>Security:</strong> Grade A security audit, comprehensive input validation, output escaping, CSRF protection, XSS prevention</li><li><strong>Quality:</strong> 28 unit tests, WCAG 2.1 Level AA compliant, performance optimized, WordPress Coding Standards compliant</li><li><strong>Compatibility:</strong> WordPress 6.7-6.9, PHP 8.2-8.5, Two Factor 0.15.0 tested</li></ul>",
+  "changelog": "<h3>1.1.0 - 2026-03-28</h3><ul><li><strong>Code Quality:</strong> phpcbf auto-fixed 112 formatting issues across 12 files (operator alignment, array double arrows, pre-increment style)</li><li><strong>Compatibility:</strong> WordPress 6.7-6.9, PHP 8.2-8.5, Two-Factor 0.16+</li></ul><h3>1.0.2 - 2026-03-28</h3><ul><li><strong>Name:</strong> Renamed to \"Two-Factor Extended\" (hyphen added for consistency)</li><li><strong>Compatibility:</strong> Two-Factor 0.16 enforcement now respects globally-disabled providers</li><li><strong>i18n:</strong> Added Catalan (ca) translation (100% coverage); updated es_ES</li></ul><h3>1.0.1 - 2026-03-28</h3><ul><li><strong>Compatibility:</strong> Two Factor 0.16 settings panel — settings menu now always appears after Two Factor in admin</li><li><strong>Code Quality:</strong> PHPStan level 9 clean, PHPCS WordPress Coding Standards clean</li><li><strong>Tests:</strong> PHPUnit 9.6 compatible, 28 unit tests passing (PHP 8.5, WordPress 6.7)</li></ul><h3>1.0.0 - 2026-02-17</h3><ul><li><strong>Initial Production Release:</strong> Complete enterprise-level two-factor authentication management for WordPress</li><li><strong>Core Features:</strong> Role-based 2FA requirements, provider visibility control, grace period enforcement, WordPress Multisite support</li><li><strong>Advanced Features:</strong> Audit logging, compliance reporting, bulk operations, WP-CLI integration, REST API, import/export settings</li><li><strong>Security:</strong> Grade A security audit, comprehensive input validation, output escaping, CSRF protection, XSS prevention</li><li><strong>Quality:</strong> 28 unit tests, WCAG 2.1 Level AA compliant, performance optimized, WordPress Coding Standards compliant</li><li><strong>Compatibility:</strong> WordPress 6.7-6.9, PHP 8.2-8.5, Two Factor 0.15.0 tested</li></ul>",
   "sections": {
     "description": "Two-Factor Extended is a comprehensive extension for the WordPress Two Factor plugin that provides administrators with enterprise-level controls over two-factor authentication across their site.<br><br><strong>Core Features:</strong><ul><li>Role-Based 2FA Requirements</li><li>Provider Visibility Control</li><li>Grace Period Enforcement (0-365 days)</li><li>WordPress Multisite Support</li><li>Compliance Reporting</li><li>Audit Logging</li><li>Bulk Operations</li><li>WP-CLI Commands</li><li>REST API Endpoints</li><li>Import/Export Settings</li></ul><strong>Security:</strong> Grade A security audit, comprehensive security hardening, CSRF protection, XSS prevention, SQL injection protection.<br><br><strong>Quality Assurance:</strong> 28 unit tests, WCAG 2.1 Level AA compliant, WordPress Coding Standards compliant, PHP 8.2-8.5 compatible.",
-    "changelog": "<h3>1.0.2 - 2026-03-28</h3><ul><li><strong>Name:</strong> Renamed to \"Two-Factor Extended\" (hyphen added for consistency)</li><li><strong>Compatibility:</strong> Two-Factor 0.16 enforcement now respects globally-disabled providers</li><li><strong>i18n:</strong> Added Catalan (ca) translation (100% coverage); updated es_ES</li></ul><h3>1.0.1 - 2026-03-28</h3><ul><li><strong>Compatibility:</strong> Two Factor 0.16 settings panel — settings menu now always appears after Two Factor in admin</li><li><strong>Code Quality:</strong> PHPStan level 9 clean, PHPCS WordPress Coding Standards clean</li><li><strong>Tests:</strong> PHPUnit 9.6 compatible, 28 unit tests passing (PHP 8.5, WordPress 6.7)</li></ul><h3>1.0.0 - 2026-02-17</h3><ul><li><strong>Initial Production Release:</strong> Complete enterprise-level two-factor authentication management for WordPress</li><li><strong>Core Features:</strong> Role-based 2FA requirements, provider visibility control, grace period enforcement, WordPress Multisite support</li><li><strong>Advanced Features:</strong> Audit logging, compliance reporting, bulk operations, WP-CLI integration, REST API, import/export settings</li><li><strong>Security:</strong> Grade A security audit, comprehensive input validation, output escaping, CSRF protection, XSS prevention</li><li><strong>Quality:</strong> 28 unit tests, WCAG 2.1 Level AA compliant, performance optimized, WordPress Coding Standards compliant</li><li><strong>Compatibility:</strong> WordPress 6.7-6.9, PHP 8.2-8.5, Two Factor 0.15.0 tested</li></ul>",
+    "changelog": "<h3>1.1.0 - 2026-03-28</h3><ul><li><strong>Code Quality:</strong> phpcbf auto-fixed 112 formatting issues across 12 files (operator alignment, array double arrows, pre-increment style)</li><li><strong>Compatibility:</strong> WordPress 6.7-6.9, PHP 8.2-8.5, Two-Factor 0.16+</li></ul><h3>1.0.2 - 2026-03-28</h3><ul><li><strong>Name:</strong> Renamed to \"Two-Factor Extended\" (hyphen added for consistency)</li><li><strong>Compatibility:</strong> Two-Factor 0.16 enforcement now respects globally-disabled providers</li><li><strong>i18n:</strong> Added Catalan (ca) translation (100% coverage); updated es_ES</li></ul><h3>1.0.1 - 2026-03-28</h3><ul><li><strong>Compatibility:</strong> Two Factor 0.16 settings panel — settings menu now always appears after Two Factor in admin</li><li><strong>Code Quality:</strong> PHPStan level 9 clean, PHPCS WordPress Coding Standards clean</li><li><strong>Tests:</strong> PHPUnit 9.6 compatible, 28 unit tests passing (PHP 8.5, WordPress 6.7)</li></ul><h3>1.0.0 - 2026-02-17</h3><ul><li><strong>Initial Production Release:</strong> Complete enterprise-level two-factor authentication management for WordPress</li><li><strong>Core Features:</strong> Role-based 2FA requirements, provider visibility control, grace period enforcement, WordPress Multisite support</li><li><strong>Advanced Features:</strong> Audit logging, compliance reporting, bulk operations, WP-CLI integration, REST API, import/export settings</li><li><strong>Security:</strong> Grade A security audit, comprehensive input validation, output escaping, CSRF protection, XSS prevention</li><li><strong>Quality:</strong> 28 unit tests, WCAG 2.1 Level AA compliant, performance optimized, WordPress Coding Standards compliant</li><li><strong>Compatibility:</strong> WordPress 6.7-6.9, PHP 8.2-8.5, Two Factor 0.15.0 tested</li></ul>",
     "installation": "<ol><li>Install the Two Factor plugin (required dependency)</li><li>Upload and activate Two-Factor Extended plugin</li><li>Go to Settings → Two-Factor Extended</li><li>Configure grace period (7-14 days recommended)</li><li>Set role-based 2FA requirements</li><li>Configure provider visibility per role</li><li>Monitor compliance via Compliance tab</li><li>Review audit logs via Audit Log tab</li></ol>",
     "faq": "<h4>Does this plugin replace the Two Factor plugin?</h4><p>No, Two-Factor Extended is an extension that works alongside the Two Factor plugin. Both plugins must be installed and activated.</p><h4>Is this compatible with WordPress Multisite?</h4><p>Yes! Two-Factor Extended fully supports WordPress Multisite with network-wide settings and site-level overrides.</p><h4>Which PHP versions are supported?</h4><p>Two-Factor Extended requires PHP 8.2 or higher.</p><h4>Can users bypass the 2FA requirements?</h4><p>No. When a 2FA method is marked as required for a user's role, they cannot disable or remove it.</p>"
   },