=== AppEditor - App Builder for WordPress ===
Contributors: appeditor
Tags: app builder, android, woocommerce, firebase, mobile login
Requires at least: 6.9
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 0.6.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Create Android, Windows and web apps from WordPress or WooCommerce with starter templates, secure customer APIs, Digits login and Firebase notifications.

== Description ==

AppEditor - App Builder for WordPress helps a site administrator turn an existing WordPress site into an application. The guided setup detects WordPress, WooCommerce and Digits, retrieves currently available starter templates from AppEditor, and creates the selected starter app in the administrator's AppEditor account.

The plugin also supplies the customer-facing API used by generated apps:

* Secure short-lived access tokens and rotating refresh tokens.
* WordPress account, menu and comment features.
* WooCommerce customer, address, order, download, favorite and review features.
* Digits-compatible login and registration with a mobile verification code.
* Extensible mobile authentication providers for integrations similar to Digits.
* WooCommerce visual attribute color codes and variation-to-color mappings.
* Firebase HTTP v1 notifications, manual sending and configurable automatic order-status messages.
* Android, web and Windows selections. iOS is reserved for a future release.

No WordPress administrator operation is exposed to the generated app.

== External services ==

This plugin can connect to the AppEditor service configured by the administrator (default: `https://panel.appeditor.ir/api/wordpress/v1`). It connects only after an administrator saves a site-specific AppEditor key and explicitly tests the connection or requests app creation. Site name, public URL, language, public discovery URL, detected integrations, selected template ID, app name and selected output platforms may be sent. AppEditor terms and privacy information are available at https://appeditor.ir/.

When Digits mobile login is enabled, verification messages are sent through the SMS gateway already selected in Digits. The destination number, verification code and gateway-required data are handled under the configuration and terms chosen by the site administrator.

When Firebase notifications are enabled, the plugin requests an OAuth token from `https://oauth2.googleapis.com/token` and sends notification content and registered device tokens to `https://fcm.googleapis.com/` using Firebase Cloud Messaging HTTP v1. This happens only after the administrator supplies a Firebase service account and enables notifications. Google privacy information is available at https://policies.google.com/privacy and Firebase terms at https://firebase.google.com/terms.

WordPress and WooCommerce public REST endpoints continue to be provided by those products.

== Installation ==

1. Upload the `appeditor-app-builder` directory to `/wp-content/plugins/` or install its ZIP file.
2. Activate "AppEditor - App Builder for WordPress".
3. In the AppEditor panel, add this WordPress site and generate its one-time connection key.
4. Open **AppEditor > Settings** in WordPress and save the API address and connection key.
5. Open **AppEditor**, test the connection, choose a retrieved starter template and select the required outputs. The selection is saved with the starter app; configure and start each build from the AppEditor panel.
6. To use mobile login, configure Digits first and then enable mobile login under **AppEditor > Settings**.
7. To use notifications, paste a Firebase service-account JSON, enable Firebase and select the order statuses that should notify customers.

== Frequently Asked Questions ==

= Does the plugin send site data automatically? =

No. It contacts AppEditor only when an administrator tests the connection, requests app creation, refreshes app/build status or revokes the connection. Firebase is contacted only when notification functionality is enabled and a message needs to be sent.

= Is the AppEditor connection key stored securely? =

The raw key is shown once in the AppEditor panel. Only its SHA-256 hash is stored by AppEditor. WordPress stores the entered key as a private administrator option and never exposes it through a public endpoint.

= Does the app receive a WordPress administrator session? =

No. Generated apps use separate opaque bearer tokens for customer accounts. Tokens are stored only as keyed hashes in WordPress.

= How are product colors returned? =

The plugin supports WooCommerce visual attributes and several common term-meta keys. It adds `color_attributes` and `variation_colors` to the standard Store API product extension. Developers can add another metadata key with the `appeditor_product_color_meta_keys` filter.

= Can another mobile login plugin be supported? =

Yes. Implement `AppEditor_Mobile_Auth_Provider_Interface` and register it with the `appeditor_mobile_auth_providers` filter. See `docs/mobile-auth-provider.md`.

= Can uninstall remove all plugin data? =

Yes. Enable "Delete plugin data on uninstall" first. Otherwise settings, app sessions and notification-device registrations remain available for a later reinstall.

= Does it support WordPress multisite? =

Each site can use its own AppEditor connection and settings. Activate the plugin separately on each site; network-wide activation is intentionally blocked so site-specific tables and keys cannot be skipped.

== Privacy ==

The plugin stores hashed app session tokens, device labels, a keyed IP hash, temporary mobile verification challenges, hashed email-verification tokens, a pending password hash and Firebase device tokens. Verification codes, links and pending passwords are never stored in plain text. Expired pending email accounts and mobile challenges are removed daily. Firebase service credentials and AppEditor keys are restricted to WordPress administrators and are never returned by public endpoints.

AppEditor WordPress service privacy notice: https://appeditor.ir/docs/legal/wordpress-service-privacy/

AppEditor WordPress service terms: https://appeditor.ir/docs/legal/wordpress-service-terms/

== Changelog ==

= 0.6.2 =
* Require WordPress membership to be enabled before email or mobile registration.
* Require a one-time email verification link before a new email/password account can sign in.
* Add rate-limited email-verification resend support and remove expired pending accounts.
* Resolve client addresses only through explicitly trusted Cloudflare or Nginx proxies.

= 0.6.1 =
* Expose email and password requirements for mobile registration through discovery.
* Validate required registration fields and apply the chosen password after OTP verification.
* Keep passwords out of stored mobile challenge payloads.

= 0.6.0 =
* Added secure guest-order status lookup using the WooCommerce order key.
* Switched checkout gateway discovery to the Store API and kept plugin metadata only as an optional enhancement.
* Added capability discovery, push-device lifecycle, logout-all and mobile-code resend support to generated apps.
* Removed obsolete duplicate customer, product-color and legacy Flutter WordPress endpoints and widgets.
* Stored customer access and refresh tokens in platform secure storage.

= 0.5.1 =
* Added dependent country, state, and city selectors for checkout.
* Added automatic preferred shipping and card-based payment selection.

= 0.5.0 =
* Added authenticated CRUD for posts, pages, comments, and media.
* Added profile/avatar/address editing, password reset, and password change.
* Added order cancellation, refund requests, shipment tracking, subscriptions, and bookings adapters.
* Added capability-protected store management for products and order statuses.
* Added live country, state, and optional city sources for dependent checkout selectors.
* Added hierarchical menu payloads and direct WooCommerce attribute filters.

= 0.4.2 =
* Added a payment-gateway listing endpoint so generated apps can show the store's active gateways before checkout.
* Advertised the new endpoint through discovery so older apps keep working unchanged.

= 0.4.1 =
* Persisted requested Android, web and Windows outputs with each starter app and exposed them in app status.
* Added WooCommerce-template capability checks based on AppEditor template tags and recognized store-template names.
* Synchronized the development, test and release source trees.

= 0.4.0 =
* Added AppEditor account status and recent build/error reporting inside WordPress.
* Added remote connection revocation instead of local-only disconnect.
* Added clickable notification destinations, background batches and retry handling.
* Declared WooCommerce HPOS and Cart/Checkout Blocks compatibility.
* Added WordPress privacy export/erase support and Site Health readiness tests.
* Completed the generated app actions for WordPress login, registration, Digits verification, favorites, comments, reviews and Store API checkout.
* Added automatic access-token refresh and application system variables for WordPress sessions, checkout and notifications.

= 0.3.0 =
* Finalized the `appeditor-app-builder` product name and plugin slug.
* Added automatic Persian administration translations for Persian WordPress sites.
* Added the secure AppEditor account, template-list and starter-app creation API flow.
* Added Firebase HTTP v1 settings, device registration, manual notifications and configurable WooCommerce order notifications.
* Added WooCommerce visual attribute colors and variation color mappings to app-facing product data.

= 0.2.0 =
* Added a guided AppEditor connection, capability checks, starter templates and platform selection.
* Added extensible mobile authentication providers and complete Digits integration.
* Added secure one-time mobile challenges, throttling, expiration, retry limits and resend control.

= 0.1.0 =
* Initial customer-facing WordPress and WooCommerce API.
