DEV Community

Cover image for OpenSparrow v3.3 — Click Statistics, Production Readiness Check, and Deployment Hardening
Tomasz
Tomasz

Posted on

OpenSparrow v3.3 — Click Statistics, Production Readiness Check, and Deployment Hardening

#php #lowcode #postgres #devops

OpenSparrow v3.3 is a stability‑focused and deployment‑focused release that brings real‑world operational visibility, a production‑readiness checklist, and a full hardening pass across environment variables and configuration defaults.

This update introduces an optional Click Statistics module, expands the Admin Health Check into a proper production‑readiness validator, and tightens deployment settings for anyone running OpenSparrow outside a local dev box. Below is a detailed breakdown of what changed, why it matters, and how it improves day‑to‑day operations.

Click Statistics

A new optional module — off by default, and off genuinely means off.
When the module disabled, no collector script is emitted, nothing is downloaded, and the endpoint returns 204 without writing even if a page stays open across a toggle‑off.

Admin click statistic module

  • Records who clicked what, when, on which page, and optionally the table/record in context (“Record Table And Record” can be turned off to keep entries to just user/time/element)
  • Log tab: recent clicks newest‑first, filterable by element and user, with a Top Elements rollup of the 20 most‑clicked elements
  • Retention: “Delete Automatically After N days” (default 90, 0 = keep forever) enforced by the notifications cron so the table doesn’t grow unbounded

Admin Health Check: Production Readiness tab

Health Check now includes a dedicated tab answering is this deployment actually production‑ready? instead of just “is the database reachable.

Admin production verify

It validates:

  • APP_ENV
  • demo mode being off
  • secure cookies
  • HTTPS (including behind reverse proxies via X-Forwarded-Proto / CF-Visitor)
  • display_errors off
  • Argon2id availability
  • minimum password length of 12
  • API rate limiting configuration
  • SESSION_SAMESITE
  • trusted‑proxy‑header configuration

Existing checks were refreshed as well — minimum supported PHP version now correctly requires 8.4, matching the rest of the codebase.

Deployment hardening

A broad pass through .env.example and includes/config.php:

  • every environment variable is now documented
  • numeric config values are clamped to sane ranges
  • APP_TIMEZONE and SESSION_SAMESITE are validated instead of trusted blindly
  • new settings cover: APP_URL, STORAGE_PATH, SESSION_COOKIE_NAME, DB_SSLMODE, API rate limiting, statement/SMTP/HTTP client timeouts, session idle timeout, Argon2 tuning, and a trusted‑proxy IP list

Additional hardening:

  • API throttle now fails open (instead of blocking all requests) if its state store becomes unwritable
  • libpq connection‑info values are quoted
  • CSP report URI restricted to same‑origin

Also in this release

Users information

  • Optional first name, last name, email, and phone fields on admin user accounts (informational only — not used for login, ownership, or notifications)
  • Logo and favicon refreshed; login/admin brand text sized down to match
  • Large internal cleanup: PHP/JS variable names expanded from abbreviations to full words, public API endpoints moved behind typed controllers (App\Controller), and die() / exit() replaced with a typed exception hierarchy — no behavior change, but relevant if you track the codebase

Following this series?

OpenSparrow v3.2 — Per‑User Access Control, Materialized Views in RAG, and a Business Design Refresh

Websites

Top comments (0)