Bang! Invites - complete changelog
==================================

The readme keeps only recent versions, as the directory truncates long histories.
This file is the whole story.

= 1.0.38 =
* Naming and structure tidied for the plugin directory. The admin screen's page identifier now carries the plugin's own prefix, so it cannot collide with another plugin's menu. The old unprefixed registration shortcode has been removed - if you were using it, replace it on your registration page with [banginvites_form], which has always been the documented shortcode and behaves identically. The plugin's functions are no longer wrapped in existence checks, so a name collision surfaces as a clear error rather than quietly disabling part of the plugin.
* Invitations are now restricted to low-privilege, subscriber-like roles. No role that can edit or publish content (Contributor, Author, Editor) or manage the site (options, users, plugins, themes) can be assigned by an invitation link; membership and client-area roles built on read-level access are unaffected. The role is re-checked at the moment the account is created, so a tampered record or a role that later gained capabilities falls back safely to your default role. To give someone a higher role, invite them and promote their account under Users after they register.
* Registration is processed before the page renders rather than while the registration page is being output. On sites where the theme or a page builder (Elementor's image-loading module is one) sends output early, the post-registration login and redirect could previously fail with "headers already sent" warnings and the person would not be logged in or moved on. Handling it earlier removes that class of conflict.
* An accepted invitation can no longer be flipped back to Pending by generating a new link for it (previously possible from a stale Tracking tab). Send a fresh invitation instead.
* Every settings screen with more than one section now has an "On this page" index down the side that tracks where you are as you scroll and jumps to any section when clicked. Fields and help text fill the full width of the panel; below a narrow width the index becomes a row of pills above the content.

= 1.0.35 =
* Stronger cache prevention on invitation links, covering every class of cache: no-cache headers for standards-respecting caches and CDNs, the DONOTCACHEPAGE constant for WordPress caching plugins, a dedicated header for LiteSpeed servers, and a session cookie for platform caches that override the site's own headers (20i's StackCache among them) - the same layered approach WooCommerce uses to keep checkouts out of caches. A hint under the registration page selector and an FAQ entry cover the rare host cache that ignores all of these, where the page should be added to the host's cache exclusion list.

= 1.0.34 =
* Invitation links are never cached. Page caches were able to serve a stale copy of the registration page from before an invitation was accepted, so a used single-use link could keep showing the registration form to logged-out visitors. Requests carrying invite parameters, and the registration page itself, now send no-cache headers and set the DONOTCACHEPAGE constant that the major cache plugins respect.
* Re-inviting an address now clears its old accepted record too (previously only pending ones), so Tracking no longer shows a stale Accepted row beside the fresh Pending invitation.
* Deleting a WordPress user now clears their accepted invitation record, so Tracking never shows Accepted for an address with no account behind it. Pending invitations for that address are left live, so the person can use their link again.

= 1.0.33 =
* Housekeeping for the plugin directory. All admin and front-end CSS and JavaScript now goes out through WordPress's own enqueue system against a registered handle, instead of being printed as raw style and script tags. The admin's Inter font is served as four ordinary font files rather than being base64-encoded into the stylesheet on every page load, which is both lighter and no longer looks like obfuscated code to a scanner. Author details updated to Bang! Plugins.

= 1.0.32 =
* New admin logo: the "bang! invites free" artwork now heads the plugin screens.

= 1.0.31 =
* Settings tab tidy-up. The shortcode now appears exactly once, as a click-to-copy chip right under the registration page selector (it used to be mentioned three times, with copying possible only at the bottom); the Invite tab's setup reminder uses the same chip. Cards are reordered to follow the setup flow: Registration method, then the form's styling directly beneath it (so in external mode everything greyed out sits together), then invitation behaviour, then Pages - which now also holds the invitation-only protection toggle, since that protects the page, with the redirect and login destinations. In external mode the page hint now says to place your registration plugin's form there instead of the shortcode.

= 1.0.30 =
* Works alongside other registration plugins. A new "Registration method" choice at the top of Settings lets you say "I'm using another registration plugin": place that plugin's form on your registration page instead of the shortcode, and everything else keeps working. Invite links, expiry and tracking are unchanged; the moment the other plugin (or an admin) creates the account, the invitation is marked accepted, the invited role is applied, and the welcome and notification emails send. In this mode the page itself validates every invite link on load - a valid pending link shows the page, a used link shows "you have already signed up" with a Log in button, and an invalid or expired link shows a notice - so single-use enforcement no longer depends on the built-in form. Acceptance matches by the invited email address. Settings that belong to the built-in form (post-registration destination, auto-login, form styling) are greyed out, not hidden, while this mode is on.

= 1.0.29 =
* Review fixes. Silencing WordPress's own account emails no longer triggers PHP warnings from core on PHP 8 (the filter now returns a properly-shaped value). A custom post-registration destination on another domain now actually redirects there instead of silently falling back to the dashboard. Tracking no longer offers "Copy link" on an expired invitation, since that link is dead - use New link or Resend, which issue a fresh one.

= 1.0.28 =
* Clear "already signed up" handling on the registration page. Someone who revisits a used invite link now sees "You have already signed up - this invitation has been used" with a Log in button pointing at your chosen login page, instead of the generic invalid-or-expired notice. The same applies when an account already exists for the invited email even though the invite is still pending (e.g. registered another way). A logged-in visitor now gets a "Go to your client area" button pointing at your post-registration destination. All of these notices share one branded style, tinted from your registration-button colour.

= 1.0.27 =
* Fixed the Role shown in Tracking for people brought over from the old theme-based invites. Those records were imported with the default role (Subscriber) because the old data held no role of its own, so accepted clients showed as Subscriber even though their actual account role was correct. Tracking now reads each person's live account role where an account exists, and a one-time pass corrects the stored role on those older records. Pending invites with no account yet are left as-is.

= 1.0.26 =
* Registration form now matches your brand on the front end. The input focus outline and glow use your chosen registration-button colour instead of the plugin's fixed indigo, and the invitation-only notice box is tinted from that same colour rather than a hardcoded indigo panel. The submit button was already brand-matched; this brings the rest of the form into line.

= 1.0.25 =
* Added {first_name} and {last_name} tokens to the welcome email, with click-to-insert chips on the Welcome email tab, so you can greet people by either name part on its own rather than only the full display name.

= 1.0.24 =
* Added a setting for where clients log in. On the Settings tab, next to the post-registration destination, you can now choose the login page the welcome email points to: the standard WordPress login, any page on your site, or a custom URL. The welcome email's Log in button and {login_url} link follow this choice. Existing sites keep the standard WordPress login until changed.

= 1.0.23 =
* Fixed: the welcome email (and the admin new-registration notification) never sent. They were queued after WordPress had already passed the point where they were meant to fire, so the step that sent them always ran too early and gave up. Both now send reliably the moment a registration completes.

= 1.0.22 =
* Restored the full plugin name ("Bang! Invites - Invite People to Register by Email") and matched it across the plugin header and readme, keeping the descriptive name rather than the shortened one.

= 1.0.21 =
* WordPress.org compliance pass. Escaped a translated dropdown label and the resent-invitation notice; unslashed and sanitised all remaining form inputs (passwords are unslashed but deliberately left unaltered); prefixed the uninstall script's global variables; removed the manual text-domain loader, since translations load automatically on WordPress.org; documented the nonce-verified settings handlers for the code sniffer; matched the plugin name across the header and readme; trimmed the short description; and set "Tested up to" to 7.0. No change to features or behaviour.

= 1.0.20 =
* Registration form label spacing now holds on themes that force their own label margins. The plugin's spacing rule was being overridden by a more specific theme rule; it is now scoped through the field wrapper so it wins.

= 1.0.19 =
* More space between each registration form label and its field.

= 1.0.18 =
* Registration button now reliably darkens (rather than lightens) on hover. The darker hover shade and the chosen text colour are forced over the theme, and theme opacity/brightness effects are neutralised, so the site theme can no longer flip the hover to a lighter colour or the text to white.

= 1.0.17 =
* Forced a compact registration-input height so the theme or Elementor cannot inflate it.

= 1.0.16 =
* Registration form spacing: more room under each label, shorter inputs, more gap between fields.

= 1.0.15 =
* Usernames now auto-generate from the person's name (unique, with an email fallback); removed the username field.

= 1.0.14 =
* Registration form asks for First and Last name as separate required fields; sets the display name and nickname to the full name.

= 1.0.13 =
* Added an "Invites" shortcut to the top WordPress toolbar with a live pending count and quick links; toggle on Settings.

= 1.0.12 =
* Email invitation and login links now render as explicit clickable links, fixing the stray character some mail clients appended.

= 1.0.11 =
* Left-aligned emails to a wider column (removed the narrow centred gap); registration button dulls slightly on hover.

= 1.0.10 =
* Sending reports the exact skip reason (already registered, invalid, or created-but-could-not-email via SMTP) instead of one catch-all message.

= 1.0.9 =
* Clarified the two email tabs with a one-line note on when each is sent.

= 1.0.8 =
* Moved the menu high in the admin sidebar, just below Dashboard.

= 1.0.7 =
* Click-to-insert token chips under the editor; full styling controls on the invite email button; removed the duplicate "saved" banner.

= 1.0.6 =
* Floating save bar that appears only on unsaved changes, with Discard and a self-fading "Saved" confirmation (matching Bang! Cart); rich-editor edits are tracked.

= 1.0.5 =
* Registration button controls: editable label, position (left, centre, right or full width) and corner radius; capitalised default labels.

= 1.0.4 =
* Invitation-only page protection with a configurable notice (admins exempt; Elementor-safe).

= 1.0.3 =
* Post-registration destination can be a custom URL; reworded to clarify it is a one-time redirect.

= 1.0.2 =
* Indigo accent to match Bang! Cart; plugin logo in the header; rich editor for both emails; registration-button colour settings; one-click shortcode copy.

= 1.0.1 =
* Fixed the one-time migration of existing theme invites when the records store was created empty on activation.

= 1.0.0 =
* First release. Email invitations, secure expiring single-use links, role selection, registration form, welcome and notification emails, and invitation tracking.

