=== Woo Ops Connect ===
Contributors: apturn
Tags: woocommerce, application passwords, qr code, rest api
Requires at least: 6.5
Tested up to: 6.5
Requires PHP: 7.4
Stable tag: 0.4.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Pairs this store with the Woo Ops companion app via a QR-coded Application Password, and exposes a ping endpoint for app detection.

== Description ==

Woo Ops Connect adds a pairing page under WooCommerce (or Tools, if WooCommerce isn't active) where a store manager can generate a WordPress Application Password and present it to the Woo Ops app as a QR code. The password is generated using WordPress core's own Application Passwords feature. This plugin does not store it anywhere, and the plaintext password is shown to the admin exactly once.

A lightweight `GET /wp-json/woo-ops/v1/ping` REST endpoint lets the app detect that the plugin is installed and active, and reports the plugin, WordPress and WooCommerce versions.

== Installation ==

1. Upload the `woo-ops-connect` folder to `/wp-content/plugins/`.
2. Activate the plugin through the "Plugins" menu in WordPress. You land on the pairing screen right away.
3. Later on, you can reach it again from WooCommerce > Woo Ops Connect (or Tools > Woo Ops Connect if WooCommerce is not installed).
4. Click "Generate pairing code" and scan the QR code with the Woo Ops app.

== Frequently Asked Questions ==

= Is the password stored anywhere? =

No. The plaintext Application Password only exists in memory for the single request that generates it, and is displayed once. WordPress core stores a hash of it, exactly as it does for any Application Password.

= What if I don't see the pairing form? =

Application Passwords must be available on your site and for your account (they can be disabled by hosting or security plugins, or by a site-level filter). The page explains why if they are unavailable.

== Changelog ==

= 0.4.0 =
* After activation the plugin takes you straight to the pairing screen instead of leaving you to find it in the menu. Deliberate exceptions: bulk activation (you are looking at the plugins list you just acted on) and users without permission to pair (they would land on an access-denied page) are never redirected, and the one-shot flag is a 30-second transient, so nothing lingers to hijack a later admin page load.

= 0.3.1 =
* Fix: the pairing QR code and one-time password are no longer rendered inside a WordPress admin notice. Plugins that collect, collapse or hide admin notices (e.g. Admin and Site Enhancements) were sweeping the code away with them — the password was created server-side, but the operator only saw the pairings table. The pairing result now uses the plugin's own block, invisible to notice-targeting selectors.

= 0.3.0 =
* Self-hosted updates. The plugin now declares an `Update URI` and answers WordPress core's own `update_plugins_{$hostname}` check from a static manifest on wooops.pl, so installs outside the wordpress.org directory are offered upgrades in wp-admin like any other plugin. Downgrades are refused and the update package is only ever accepted from https://wooops.pl.

= 0.2.1 =
* Header bridge: the `X-Woo-Ops-Authorization` credentials now take precedence over PHP_AUTH values already populated from the pass-through `Authorization` header. On Apache+FPM stacks the server gate's credentials reach PHP on every gated request, which previously made the bridge a no-op exactly when it was needed.

= 0.2.0 =
* Add a header bridge for stores served behind server-level Basic Auth (e.g. htpasswd-protected staging sites): translates `X-Woo-Ops-Authorization` into the Application Password credentials WordPress expects, without touching real Basic Auth when present. `woo-ops/v1/ping` now reports the `header-bridge` feature.

= 0.1.0 =
* Initial release: pairing page (generate/list/revoke Woo Ops Application Passwords as a QR code) and `woo-ops/v1/ping` REST endpoint.

== Upgrade Notice ==

= 0.4.0 =
Activating the plugin now opens the pairing screen directly.

= 0.3.1 =
Fixes a missing QR code on sites where a plugin hides admin notices.

= 0.3.0 =
Adds automatic update checks. Install this one by hand; from here on wp-admin will offer new versions itself.

= 0.2.0 =
Adds a header bridge so pairing works on stores behind server-level (htpasswd) Basic Auth.

= 0.1.0 =
Initial release.

== Credits ==

Bundles qrcodejs (https://github.com/davidshimjs/qrcodejs) 1.0.0 by davidshimjs, licensed under the MIT License. See assets/js/qrcode.min.js.
