Replaces the callsign+password → JWT flow with a single long-lived
Personal Access Token (pat_*), matching the GitHub/Stripe pattern.
User flow now:
• Sign up on qrzcall.eu (Data or Extra subscription required)
• Account → API Tokens → "Generate new token", label it
(e.g. "Wavelog at home"), copy the pat_… string
• Paste into Wavelog's "QRZCALL.EU API Token" config field
Why this is better than the previous credentials flow:
• The user's QRZCALL.EU password never leaves the SPA
• Each Wavelog install gets its own revocable token
• A leaked Wavelog config exposes a single revocable token,
not the password the user might reuse elsewhere
• The library is simpler: no session cache, no retry-on-expiry,
no /portable-aware re-auth dance — just Bearer on every call
Code changes:
• application/libraries/Qrzcall.php - drops session() and
set_session(), keeps search() and sourcename(). ~30 LOC shorter.
• application/libraries/Callbook.php - QRZCALL_SESSION_DURATION
constant and qrzcall_session_cachekey property removed.
_qrzcall() collapses from ~40 to ~20 LOC.
• application/config/config.sample.php - qrzcall_username and
qrzcall_password replaced with a single qrzcall_token.
• install/config/config.php - same in the wizard's template.
• install/index.php - the wizard now shows a single "API Token"
field when QRZCALL.EU is selected (toggled via JS, no extra
HTML page state machine). callbook_combination() validates
the pat_ prefix when present.
• install/includes/core/core_class.php - refactored to support
both username/password-style providers (qrz/hamqth/qrzcq/qrzru)
and token-style providers (qrzcall) cleanly. Drops the
"all callbooks use the same shape" assumption.
End-to-end re-tested:
✓ Live PAT lookup PA4R via the new library HTTP 200
✓ Unknown callsign XX9XX9XX error: "Callsign not found"
✓ Tampered token error: "Invalid or revoked QRZCALL.EU API token"
✓ Subscription gate (Free user with revoked sub) surfaces upstream 401
✓ php -l clean on all 6 files
✓ All 5 patches dry-run apply cleanly against fresh master
Existing JWT flow on api.qrzcall.eu/v1/auth/login.php remains
available — this PR moves Wavelog to the recommended pattern but
doesn't break anyone who already wired up JWT.
QRZCALL.EU is a QRZ-compatible amateur-radio callsign database
(https://qrzcall.eu/). This adds it as a new 'qrzcall' callbook source
alongside the existing qrz, qrzcq, hamqth, and qrzru providers.
* `application/libraries/Qrzcall.php` — new library, mirrors Qrz.php
* `application/libraries/Callbook.php` — adds case 'qrzcall', `_qrzcall()`
private method, session-duration constant and session-cache key
* `application/config/config.sample.php` — adds `qrzcall_username` /
`qrzcall_password` defaults
* `install/index.php` — adds QRZCALL.EU to the install-wizard callbook
dropdown and extends the tooltip
* `install/config/config.php` — adds `%qrzcall_username%` /
`%qrzcall_password%` placeholders so the wizard writes the credentials
into the generated config
* `install/includes/core/core_class.php` — adds 'qrzcall' to the
$callbooks whitelist
Auth: callsign + password → JWT (cached 7h). The bearer pattern is
hidden behind the existing "session key" abstraction so the Callbook
orchestrator's retry-on-expiry and /portable fallback paths work
unchanged.
Access tier: requires a Data or Extra subscription on QRZCALL.EU.
XML schema: identical field names to QRZ.com → no downstream changes
to the QSO entry form.
