=== Absoluit User Hub ===
Contributors: absoluit, saad_ahmad
Tags: users, user management, multi-site, user control, central dashboard
Requires at least: 5.6
Tested up to: 7.1
Stable tag: 1.1.1
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Centralized dashboard and client system to manage WordPress users across all your connected sites. Powered by Absoluit.

== Description ==

Absoluit User Hub is a powerful, secure, centralized user management system designed specifically for WordPress. It enables network administrators to manage user accounts (create, update, search, and delete) across multiple connected child sites from a single, centralized WordPress master dashboard.

The system is distributed as a single unified plugin package that supports three active roles:
1. **Master Dashboard Mode**: Run on your central administration site. Exposes the main "User Hub" dashboard menus, connection diagnostics, AJAX controllers, and custom database mapping.
2. **Client Agent Mode**: Run on individual child nodes. Exposes custom REST API endpoints under a private namespace (`wp-user-hub/v1`) protected by a strict multi-layer verification middleware.
3. **Both Mode**: Runs both components simultaneously on a single WordPress installation (primarily used for local development and debugging).

Upon first activation, the plugin resides in a safe, uninitialized state and prompts the administrator to select the site's role before loading any features.

= Architecture Overview =
* **Central Dashboard (Master)**: The administrator interacts with the dashboard UI to trigger user operations. The Master component dispatches secure, signed REST requests to connected child sites using WordPress HTTP APIs.
* **Child Nodes (Client)**: Expose custom REST API endpoints. An authentication middleware verifies credentials, allowed IP addresses, timestamp drift boundaries, and duplicate nonces before modifying the local WordPress user database.

== Installation ==

1. Upload the `absoluit-user-hub` directory to the `/wp-content/plugins/` directory of your WordPress site.
2. Activate the plugin through the 'Plugins' menu in WordPress.
3. A notice will appear at the top of the admin dashboard asking you to select the plugin role:
   * **If configuring the central hub**: Select **Master Dashboard Mode**. This will initialize the dashboard tables and show the **User Hub** sidebar menu.
   * **If configuring a child node**: Select **Client Agent Mode**. Go to **Settings > User Hub Client** to copy the generated **API Key** and the **REST API URL**, and whitelist your Master server's IP address.
   * **To change modes**: Go to **Settings > User Hub Settings** at any time to switch roles. Mode switching is non-destructive; all existing settings and database records are preserved.

== Frequently Asked Questions ==

= Do I need a WordPress Multisite network to use this? =
No. Absoluit User Hub is built specifically for independent WordPress installations. It does not require Multisite, letting you manage users across entirely different domains and servers.

= How do I configure a child site? =
Activate the plugin on the child site, select **Client Agent Mode**, navigate to **Settings > User Hub Client**, and configure the Allowed Master IPs (your central server's IP). Copy the API Key and REST API URL. Then log in to your central master site (configured in **Master Dashboard Mode**), go to **User Hub > Connected Sites**, click **Add Site**, and paste the child site's URL and API Key.

= What is the difference between Master and Client modes? =
Master mode runs the administration controls, allowing you to view and manage users on other sites. Client mode is a passive agent that exposes endpoints allowing the Master Dashboard to read/write user profiles securely.

= Can I switch modes later? =
Yes. Go to **Settings > User Hub Settings** in your WordPress admin panel and choose a new active role. All database custom tables and client settings options are retained and preserved.

= Where do I find the Client API Key? =
In Client Mode, go to **Settings > User Hub Client** in your child site's WordPress admin panel. The API key is displayed in a password field. Click the eye icon to toggle visibility and copy the key.

= What are Allowed Master IPs? =
Allowed Master IPs is a security setting on the Client agent. You specify the external IP address of your Master Dashboard server. Any request arriving from a different IP address will be immediately blocked.

= How does authentication work? =
Authentication uses shared secret API keys and HMAC-SHA256 signature verification. Outgoing requests are signed with a hash generated using the API key, request body, nonce, and timestamp. The client re-calculates this hash to verify the integrity and origin of the request.

= Can I bulk import sites? =
Yes. In Master mode, the Connected Sites panel includes a bulk import feature where you can paste lists of sites with names, URLs, and API keys separated by commas or pipes.

= What happens when deleting a user who owns posts? =
When deleting a user from the dashboard, you can choose to assign their existing posts to a fallback administrator on the child site, preventing orphaned content.

= What WordPress and PHP versions are supported? =
This plugin requires WordPress 5.6 or later, and PHP 7.4 or later.

== Screenshots ==

1. The central Master Dashboard displaying connection status, quick actions, and the list of connected child sites.

== Security ==

Absoluit User Hub implements several security controls to protect your user database:
* **API Key Authentication**: A high-entropy shared secret generated for each child site.
* **IP Allowlisting**: Strict enforcement restricting REST API requests to whitelisted Master IPs.
* **Timestamp Drift Validation**: Rejects requests where the server time difference exceeds 300 seconds to prevent outdated requests.
* **Nonce Validation**: Caches request nonces via transients to block replay attacks.
* **HMAC-SHA256 Request Signing**: Incoming request parameters are cryptographically signed using the shared secret API Key, ensuring payload integrity.
* **Primary Admin Protection**: Hardcoded checks explicitly block the deletion of user ID 1 (Primary Administrator).

Best Practices:
* Always run WordPress over HTTPS.
* Restrict Allowed Master IPs on the Client settings.
* Keep WordPress and plugins updated.
* Protect and rotate API keys regularly.

== Changelog ==

= 1.1.1 =
* Security: Enforced strict capability check (manage_options) on the Client settings page.
* Security: Sanitized user identifiers in REST API endpoints to block potential output injection.
* Fix: Adjusted client whitelisting so that leaving Allowed Master IPs blank disables IP checking instead of blocking connections.
* Fix: Prevented API Key from being overwritten to empty on Client settings saves by removing it from registration and using readonly display fields.
* Fix: Restructured Master sites database schema setup to be fully compliant with WordPress dbDelta formatting and self-healing initialization.
* Fix: Migrated dynamic inline stylesheets and JS styles to standard enqueued stylesheet files.
* Fix: Added robust support for HTTP_CF_CONNECTING_IP and HTTP_X_FORWARDED_FOR reverse proxy client IP detection.

= 1.1.0 =
* Feature: Support for bulk importing child sites using CSV/pipe-delimited values.
* Feature: Added real-time connection status check badge.
* Security: Enforced IP Whitelisting checks by default.
* Security: Implemented transient-based nonce tracking to block replay attacks.
* Security: Added strict role validation checks and string bounds checking.
* Integration: Consolidated Master and Client plugins into a single package with a secure role setup flow.

= 1.0.0 =
* Initial stable release.
