Glimpse BI

Registro de cambios

1.1.0

• New: Ask — ask questions about your data in plain language and get a chart, number or table back, with the query it ran. Ask is optional and off by default: an administrator connects the site to a Glimpse account and accepts the privacy notice first. It runs on Glimpse credits; queries still run on your own database, and private tables and hidden columns never leave the site. See «External services».
• New: Ask settings control what Ask may see (schema only, schema + values, or full results), private tables, hidden columns, a glossary, a daily limit per person, thread retention and an optional audit log of what was sent.
• Developer: glimpsebi_ai_relay_credential, glimpsebi_ai_monthly_limit and glimpsebi_ai_role_grants_available filters for add-ons. GLIMPSEBI_API_BASE and GLIMPSEBI_PORTAL_URL can be overridden in wp-config.php.
• Changed: uninstalling also removes Ask’s tables, settings, connection and scheduled clean-up.
• Fixed: embedded dashboards now apply the selected date range to every chart, including charts scoped through the dashboard’s filter mappings, and so do their per-chart exports.
• Fixed: charts saved without an explicit builder mode opened as an empty SQL editor. They now open in the chart builder.
• Fixed: the preset card’s Install button was hard to read.
• Fixed: table charts showed internal column names (DIM, MEASURE) as headers. They now show the field and measure, for example «status» and «Count».

1.0.3

• Security: the schema allowlist is now enforced on the server when builder (GUI) charts are previewed and saved, not just hidden in the builder. A builder chart can no longer read a table that Settings hides, such as the users table. Existing saved charts keep rendering. SQL-mode charts, which only administrators can write, are not restricted by the allowlist.
• Fixed: a chart whose query the database rejects (for example a column that no longer exists) now shows an error instead of an empty chart, and the error is never cached.
• Fixed: previewing or saving a chart that references a missing table or column now names the exact field to fix.
• Developer: chart definitions accept Min, Max and Count distinct measures and an optional order (by value or group) for top-N charts; GlimpseBI_Query::json_schema() and GlimpseBI_Query::describe() expose the definition contract.
• Changed: the readme documents where the source of every compiled file lives and how to rebuild it, with links to each bundled library’s source.

1.0.2

• Security: chart labels and series names are now escaped in chart tooltips and legends, so text stored in your data (post titles, customer names) can never run as code in wp-admin or on embeds.
• Security: dashboard exports only include charts the current user is allowed to see.
• Fixed: uninstalling now also removes dashboard presets and the stored schema version.
• Changed: the bundled JavaScript can be rebuilt from the included source with npm ci && npm run build from the plugin folder.

1.0.1

• Fixed: chart and dashboard exports could download as empty files. Exports now use the dashboard’s selected date range, ignore filters a chart doesn’t use, and show a clear message when a chart still needs filter values instead of silently returning nothing.
• Fixed: exporting a whole dashboard failed with a fatal error.
• Fixed: «New dashboard», «Duplicate» and embed-token creation could throw a script error.
• New: date ranges Last quarter, Last 6 months, Last 12 months and Last year, plus a custom From/To picker on dashboards. Embedded dashboards offer the longer ranges too.
• Changed: re-installing a preset over an existing one now keeps your existing dashboard and charts (renamed «(previous)») instead of deleting them.
• Developer: new glimpsebi_admin_export_formats filter lets add-ons offer extra export formats in the Export menus.

1.0.0

• First public release on WordPress.org. Self-serve BI inside wp-admin: a no-code chart builder and validated read-only SQL mode over your existing WordPress tables (WooCommerce, members, bookings, and more), a responsive dashboard grid, public embed iframes with token auth, CSV/JSON exports, dashboard presets, and a stale-while-revalidate cache that keeps it polite to your database. Consolidates all prior 0.x development into a stable 1.0.

0.4.4

• Changed: the chart builder’s Chart-tab preview now shows table charts as a capped 25-row sample (with a «first 25 of N rows» note) instead of the full paginated tile. The builder is for shaping a definition, not browsing the whole result set — the live dashboard tile and public embed still show all rows with pagination/search. No effect on non-table chart types.

0.4.3

• New: dashboard toolbar now has a kebab menu next to the dashboard selector with Rename, Duplicate, and Delete actions.
• New: POST /dashboards/{id}/duplicate endpoint. Copies the layout and pinned charts (charts are referenced, not cloned — editing a chart still reflects on every dashboard that pins it). New dashboard is named «{Original} (copy)» with an incrementing suffix if needed.
• Note: the Home dashboard cannot be deleted (the menu item is disabled with a tooltip explaining why; the server also enforces this).

0.4.2

• Fixed: public embed iframes refused to render on hosts whose nginx/security layer also sets X-Frame-Options: SAMEORIGIN. We were sending the (invalid, non-spec) X-Frame-Options: ALLOWALL; browsers see the two conflicting values and fall back to deny. Now we remove any prior X-Frame-Options and send the spec-compliant Content-Security-Policy: frame-ancestors * instead, which takes precedence over X-Frame-Options in modern browsers per CSP Level 2.

0.4.1

• Fixed: sticky column headers in table charts now have an opaque background, so scrolling rows no longer bleed through them.
• Fixed: rows-per-page selector now has a visible border, hover state, focus ring, and pointer cursor so it actually looks like a control instead of label text.

0.4.0

• New: every table chart now has proper Prev/Next pagination + a rows-per-page selector (25/50/100/200). Previously, only the first 50 filtered rows were visible regardless of how many the SQL returned. Search now resets to page 1 automatically.
• New (kivicare preset): Encounters KPI + table, sourced from wp_kc_patient_encounters (the clinical-visits table, distinct from appointments). The dashboard’s Services charts were inadvertently counting service-line-items-on-appointments, not encounters — so visit volume was missing entirely.
• Changed (kivicare preset): the Services charts now show the catalog. Total Services = distinct active services in wp_kc_services. Services table = catalog rows plus Times Performed and Distinct Doctors columns aggregated from wp_kc_appointment_service_mapping in the selected date range. One table answers both «what do we offer?» and «what’s getting used?»
• Changed: directory-table SQL LIMITs bumped from 200 to 2000 so pagination has room to navigate large clinics.
• Existing kivicare installs: Library -> Presets -> KiviCare -> Install (Replace) to pick up the new charts + layout.

0.3.4

• Fixed: KiviCare preset queries now seed from the wp_kc_{doctor,patient,receptionist}_clinic_mappings tables instead of scanning wp_usermeta for LIKE '%kiviCare_*%'. The capability LIKE pattern was forcing a full table scan on every chart load — measured 5–6s cold-start with 196 doctors. The rewrite drops that to <1s by seeding from a small indexed table. Existing installs: Library → Presets → KiviCare → Install (Replace) to pick up the new SQL.
• Note: an unintended side-effect is that doctors/patients/receptionists who have the WordPress role but aren’t assigned to any clinic disappear from the directory tables. This matches typical «operations dashboard» intent (unassigned = inactive). Open an issue if you need the old behavior back.

0.3.3

• Fixed: dashboards with many tiles no longer storm shared/managed WP hosts with parallel chart-data requests. The client now loads charts in batches of 3 at a time, and transient upstream failures (502/503/504) are retried once with a short backoff. Eliminates the «first few tiles load, the rest 502» failure mode on EasyWP and other tight PHP-FPM pools.

0.3.2

• Fixed: write requests now succeed on shared/managed WP hosts whose WAFs reject both PATCH/DELETE verbs and the X-HTTP-Method-Override header (Imunify360 on EasyWP, observed in the wild). Every PATCH route now also accepts plain POST on the same URL; every DELETE route has a parallel POST {path}/delete alias. The client sends plain POST with no special headers — invisible to WAFs that pattern-match suspicious patterns.

0.3.1

• Attempted fix using X-HTTP-Method-Override. Worked locally but the header itself is WAF-flagged on some hosts. Superseded by 0.3.2 — please upgrade directly to 0.3.2.

0.3.0

• New: dashboard presets registry — install ready-made dashboards in one click, including a KiviCare clinic-operations preset.
• New: per-dashboard date-range global filter that auto-injects into SQL charts declaring date_from / date_to parameters.
• New: embed iframes now expose a date-range picker and per-chart CSV / JSON download links.
• Fixed: chart builder no longer crashes when loading preset-installed SQL charts (made column_mapping optional).
• Fixed: REST preview returns 400 (was 500) for missing required runtime parameters.

0.2.0

• Earlier release; see commit history for details.