Support PIN Pro v2.0.0 For WHMCS

[HardSoftCode]

Support Pin Pro adds an extra layer of identity verification to your WHMCS installation by letting clients generate temporary, time-limited numeric PINs that your support team can verify over the phone, live chat, or support tickets.

Instead of asking a customer to share a password or other sensitive account data, your staff simply ask for the support PIN displayed in the client's account. The PIN is verified instantly against the database, marked as used, and logged for a full audit trail — making account verification fast, secure, and fully transparent.

The module is written against WHMCS's internal Illuminate Database Capsule, uses explicit Capsule::transaction() blocks for every multi-step state change, validates the WHMCS CSRF token on all state-changing requests, and escapes all output in its Smarty templates. The result is a module that is safe to run in production, simple for clients to use, and comprehensive enough for the busiest support desks.

Buy Now for $45.00 - https://www.paypal.com/ncp/payment/FUUQXQX7N3Y88

The Problem It Solves

When a customer contacts your support team by phone or live chat, you need a fast, reliable way to confirm they really are the account owner. Asking for a password is a security risk. Asking security questions is slow and frustrating. Emailing a code takes time and interrupts the conversation.

Support Pin Pro solves this with a time-limited, one-use support PIN. Your client opens their client area, generates a fresh numeric PIN with the click of a button, and simply reads it out to your agent. The agent verifies the code instantly — no password shared, no sensitive data exchanged, no friction. When the conversation is over, the PIN is marked as used and can never be reused.

What the Module Provides

Support Pin Pro is a complete, enterprise-grade WHMCS addon module that delivers:

• A client-facing PIN portal — clients generate, view, copy, and revoke their own temporary support PINs with a live expiry countdown.
• A powerful admin suite — dashboard statistics, an all-PINs manager, a per-client PIN manager, and a searchable activity log.
• Instant verification everywhere your staff work — the dashboard widget, the support-ticket modal, and the client summary page.
• Sub-user support — account owners can grant PIN permission to their team members, with shared or per-user PINs.
• Full accountability — every generate, extend, terminate, delete, expire, and verify action is recorded in a detailed audit trail.
• Enterprise-grade engineering — PHP 8.1+ OOP, WHMCS's Illuminate Database Capsule, transaction-safe state changes, CSRF protection, and XSS-safe templates.

The Lifecycle of a Support PIN

1. Generate — A client (or sub-user) opens the Support PIN page and clicks Generate New PIN. The module creates a unique numeric code, stamps it with the current time, applies the configured expiry window (if enabled), and sets its status to active. If multiple active PINs are not allowed, any existing active PIN for that account is automatically expired inside a database transaction first.

2. Share — The client reads the PIN to the support agent over the phone or in live chat. With copy-to-clipboard enabled, they can send it instantly in a chat window.

3. Verify — The agent enters the code in the dashboard widget, the ticket modal, or the client summary card. The module looks the PIN up, checks its status and expiry, and returns a clear verdict:

   • Valid — the PIN is active and within its expiry window.
   • Used — the PIN was already consumed and cannot be reused.
   • Expired — the PIN passed its expiry time.
   • Inactive — the PIN exists but is not currently active.
   • Not Found — no PIN matches the entered code.

4. Mark as Used — After the conversation, the agent (or the configured workflow) marks the PIN as Used. This permanently prevents the code from being accepted again, closing the verification loop.

5. Expire & Cleanup — PINs that reach their expiry timestamp are automatically flagged as expired by the daily cron. If enabled, expired PINs older than 24 hours are removed from the database entirely to keep the tables lean.

Features

Identity Verification

• Client-generated PINs — Clients create a unique numeric support PIN directly from their client area with a single click. No staff involvement is required for the client to obtain a code.
• Multi-surface verification — Staff can verify PINs instantly from three places:
  • The dashboard verification widget — ideal for phone calls and live chat, no client context needed.
  • The support-ticket modal — a "Verify Support PIN" button in the ticket interface that checks the code against the ticket's linked client.
  • The client summary card — the current PIN and status are always visible when reviewing a client's profile.
• Clear verdicts — every verification returns one of: Valid, Used, Expired, Inactive, or Not Found, each with a distinct colour-coded result in the modal.
• Replay protection — PINs are marked as Used on explicit admin confirmation (configurable) so a verified PIN can never be accepted again.
• Full ticket workflow — the verify modal is pre-scoped to the ticket's client, so agents never enter the wrong account.

PIN Lifecycle Management (Admin)

• Dashboard — live statistics at a glance: total PINs, active PINs, expired PINs, clients with PINs, generated today, verified today, plus a recent-activity feed and quick actions.
• Support Pins page — a searchable DataTable of every PIN across all clients, showing client, PIN code, live expiry countdown, status, created/expires timestamps, and actions.
• Clients page — search any client by name, email, or ID, then view and manage every PIN that client has ever had.
• Complete action set — per-PIN Generate, Extend (adds the configured hours), Terminate (immediately expires), Mark as Used, and Delete — every state change runs inside Capsule::transaction().
• Client summary card — the native WHMCS client profile page gains a "Support PIN" panel with the current PIN, status, expiry, verify button, and a link into the PIN manager.
• Automatic hygiene — PINs auto-expire after the configured number of hours, and expired PINs older than 24 hours can be removed automatically by the daily cron.

Client Area

• Dedicated Support PIN page — a clean, on-brand page showing the current PIN, expiry time, and a live countdown that ticks down to the second.
• Self-service — clients generate and revoke their own PINs through CSRF-protected forms, with clear success and error feedback.
• PIN History & Security Log — a table of every PIN generated for the account, including who generated it, the exact timestamps, status, and verification context.
• Role & permission context card — clients see whether they are the Primary Owner or a Sub-User, along with the capabilities available to them.
• "How verification works" guide — a friendly three-step explainer (Generate → Share → Get verified) that reduces support questions.
• Sidebar widget — an optional, positionable widget in the primary or secondary client-area sidebar with a live countdown, copy button, and show/hide toggle.
• Support menu link — an optional "Support PIN" entry under the client-area Support menu.

Sub-Users & Permissions

• Granular permission — account owners grant sub-users access to Support PINs via the WHMCS Users & Permissions interface; a dedicated "Support PIN" permission is registered with WHMCS.
• Shared or individual PINs — each sub-user can have their own PIN, or share the account owner's PIN, depending on configuration.
• Owner notifications — the account owner is emailed whenever a sub-user generates a PIN, keeping the primary account holder informed.
• Clean UX — sub-users without permission see a clear "Support PIN access not enabled" message instead of a confusing error.
• Full Access accounts — accounts with full-access sub-users are handled correctly and given appropriate capabilities.

Security & Audit

• Comprehensive Activity Log — records every action with client, user (sub-user name or "Owner"), action, detail, PIN code, status, and expiry.
• Human-readable actions — descriptive labels such as "PIN generated by staff", "PIN revoked by client", "PIN removed by cron job", and "PIN verification failed" replace cryptic raw strings.
• Failed attempts logged — invalid, expired, used, and not-found verification attempts are all written to the audit trail for security review.
• CSRF protection — every state-changing request (generate, extend, terminate, delete, mark used, revoke) validates the WHMCS CSRF token via check_token().
• SQL-injection safe — all queries use parameter binding through the Illuminate query builder; no raw concatenated SQL.
• XSS-safe templates — all user and database values are escaped inside the Smarty templates.
• Hide PIN mode — optionally masks the PIN in the client area, revealing only the last two digits, while admins always see the full code.
• Copy to Clipboard — a copy button with visual feedback for chat-based verification.

Emails & Notifications

• PIN delivery — optionally email the newly generated PIN to the client so they never lose it.
• Owner alerts — optionally email the account owner when a sub-user generates a PIN.
• Email preferences — per-client opt-out toggles are added to the WHMCS client profile for both the PIN email and the owner notification.

Database & Maintenance

• Automatic setup — tables and default configuration are created automatically on activation; no manual SQL.
• Idempotent upgrades — the upgrade hook re-runs schema and seed routines so every version lands cleanly.
• Clean teardown — optionally drops all module tables and email templates when the module is deactivated.

Changelog v2.0.0

New Features

• Complete admin UI refresh: modern cards, scoped CSS, FontAwesome icons, and consistent DataTables across pages.
• Redesigned Clients page: wide search bar, client overview card, full PIN display, text-labelled action buttons, empty states.
• Redesigned Activity Log: client, email, user, action, detail, and date columns; human-readable action descriptions; sub-user vs owner resolution; relative timestamps; failed-verification logging.
• Transaction-wrapped PIN mutations (createPin, extendPin, terminatePin, deletePin, expireUsedPin) using Capsule::transaction().
• Failed verification attempts (including PIN-not-found) now written to the audit log.
• Cron job (expireExpiredPins / removeExpiredPins) now writes audit entries for auto-expiry and auto-removal.
• Admin profile links switched to clientssummary.php?userid= for reliable navigation.
• Full PIN codes shown to admins on the client management page regardless of the Hide PIN setting.
• Sub-user full names resolved in the audit log instead of raw emails or generic labels.
• Audit log ordered by primary key for stable newest-first display.

Improvements

• fromMySQLDate() applied consistently to every displayed date in the admin and client areas (PINs list, client summary, audit, verify results, PIN history).
• DataTables pagination fixed so the selected page is clearly highlighted and hover states are correct across Support Pin.
• PIN History table displays formatted generated/expiry dates correctly.
• Sub-user badges on the admin PIN list restyled as compact muted text.
• PIN verification failures now produce a readable "Verify failed" action badge.

Fixes

• PIN History "Generated At" / "Expires At" columns were blank — fixed by supplying formatted date keys from the API.
• DataTables pagination rendered all numbers the same colour — fixed in the module stylesheet.
• Verify-not-found attempts were not logged — fixed.
• Audit log rows could appear out of order — fixed by ordering on the primary key.