=== Bildirim — Web Push Notifications ===
Contributors: bildirim
Tags: push notifications, web push, notifications, pwa, engagement
Requires at least: 5.9
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.3.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Add Bildirim web push to your WordPress site, and announce new posts to your subscribers without leaving the editor.

== Description ==

**This is the official plugin for [Bildirim](https://bildirim.io), built and
maintained by the Bildirim team.** "Bildirim" is our own service and brand — we
operate bildirim.io; this plugin is not a third-party integration.

Bildirim is a web push notification platform. Installing it by hand takes three
steps: a `<head>` snippet, a service worker file uploaded to `/bildirim/` over
FTP, and (for iPhone/iPad) a manifest. This plugin does all three.

**What it does**

* Injects the Bildirim SDK into `<head>` with the right attributes.
* Serves the required service worker at `/bildirim/BildirimSDK-sw.js` from your
  own domain — browsers refuse to load a service worker from another origin, so
  it cannot come from a CDN.
* Optionally serves a `manifest.json` so iOS 16.4+ users can add your site to
  the Home Screen and receive notifications.
* Verifies your public key against the Bildirim API before saving it, so a
  mistyped key cannot leave you with a silently dead install.
* Registers exclusion rules for LiteSpeed Cache, WP Rocket and Autoptimize so
  the SDK is not merged into a combined file (which would stop updates).

* Announces new posts: a **Bildirim** box in the editor with a "send when
  published" switch and per-channel checkboxes (Web / iOS / Android). A post is
  announced at most once — editing a published post never sends again.

**What it does not do**

Segments, automations, A/B tests and scheduling live in the Bildirim dashboard.
From WordPress you can announce a post to everyone (optionally per channel);
anything more targeted is a campaign in the dashboard.

== External services ==

This plugin connects to Bildirim (bildirim.io), the notification service this
plugin is built for and which the plugin author operates. An account on that
service is required for the plugin to function. The requests it makes, and the
data each one carries, are listed below.

* `https://api.bildirim.io/v1/public/vapid` — called once from your server when
  you save a public key, to confirm the key is valid. Only the key is sent.
* `https://api.bildirim.io/v1/push` — called from your server when a post is
  announced. The post title, summary, link and (optionally) the featured image
  URL are sent. Only happens if you configured a secret key and ticked the box.
* `https://cdn.bildirim.io/sdk.js` and `https://cdn.bildirim.io/bildirim-sw.js`
  — loaded by your visitors' browsers. The SDK talks to
  `https://api.bildirim.io` to register subscriptions.

Visitor data handled by Bildirim (push endpoint, browser, operating system,
time zone) is described in the
[privacy policy](https://bildirim.io/gizlilik) and the
[terms of service](https://bildirim.io/kosullar).

== Installation ==

1. Install and activate the plugin.
2. Go to **Settings → Bildirim**.
3. Paste the public key (`pk_…`) from the Setup screen of your Bildirim
   dashboard and save. The key is verified immediately.
4. Open the Setup screen in the dashboard and run "Check installation".

If your filesystem is not writable, the plugin serves the service worker
through a WordPress rewrite rule instead of a file. That path needs pretty
permalinks; the settings page tells you which strategy is active and whether
the file is actually reachable.

== Frequently Asked Questions ==

= Do I need the manifest option? =

Only for iPhone and iPad. iOS delivers push exclusively to sites the user added
to their Home Screen, and that requires an installable manifest. Chrome,
Firefox and Edge do not need it. Leave the option off if your site already has
its own `manifest.json` — the plugin will not overwrite it.

= Why is the service worker written to the site root instead of uploads? =

Because a service worker can only control the paths below its own URL, and
browsers refuse to load one from another origin. Bildirim's SDK registers
`/bildirim/BildirimSDK-sw.js`, and the server-side installation check requires
exactly that path on your own domain, so the plugin cannot invent a location
under `wp-content/uploads`.

It is one 236-byte file in a single `bildirim/` folder. The plugin uses the
`WP_Filesystem` API (never direct file functions), and if the filesystem is not
writable it does not fail: it falls back to serving the same bytes dynamically
through a rewrite rule, so **no write is required for the plugin to work**. On
deactivation it removes that file and only that file, after checking the
content for a Bildirim marker.

= Will deactivating the plugin delete my files? =

It removes the service worker file it created, and only that file: the content
is checked for a Bildirim marker first, so a worker you replaced by hand stays
where it is. Settings are removed on uninstall, and only if you left that
option enabled.

= Does it work with caching plugins? =

Yes. The script tag carries exclusion attributes for the common optimisers and
the plugin registers their filters. If an optimiser still merges the tag, push
keeps working but SDK updates stop arriving — exclude it manually then.

= How do I announce new posts? =

Go to **Settings → Bildirim** and press **Enable sending from WordPress**.
Bildirim verifies that this site really is yours (it asks your site for a
one-time code) and hands the plugin a send-only key — no dashboard visit, no
copying credentials by hand. A "Bildirim" box then appears on the post editor
with a send switch and channel checkboxes (Web / iOS / Android). Publish the
post and it goes out; there is also a "Send now" button for posts that are
already published.

= What can the key from "Enable sending" do? =

Only send notifications for this project. It cannot read your subscriber list,
change settings or create other keys. It is listed in the dashboard under
Settings → Keys and can be revoked there at any time; the project owner also
gets an email when it is issued.

= Will editing a post send a second notification? =

No. A post is announced once; the box shows when it was sent. Use "Send again"
if you really want a second notification.

= Why does my notification not go out? =

The plugin shows the API's own message on the post screen. The most common one
is the send gate: a project cannot broadcast until its domain is verified and
one test notification was delivered. Both are done from the dashboard's Setup
screen.

= Is the secret key safe in WordPress? =

It is stored in your site's options table and shown masked. Treat it as a
credential: anyone who can administer this site can send notifications to your
subscribers with it. If the site is compromised, revoke the key from the
dashboard — sending stops immediately.

= Is it multisite compatible? =

Yes, with per-site settings: each site in the network uses its own public key,
because a Bildirim project maps to one site.

== Screenshots ==

1. Settings → Bildirim. Paste the public key and, if you need iPhone/iPad
   support, switch the manifest on. The key is checked against the Bildirim API
   before it is saved, so a mistyped key cannot leave a silently dead install.
2. The status panel. Whether the service worker is a real file or a rewrite
   rule, whether the URL actually answers, and whether the manifest is being
   served. Every line is measured on the spot, not assumed.

== Changelog ==

= 1.3.3 =
* Tested with WordPress 7.1.

= 1.3.2 =
* Clarified in the readme that this is the official plugin of the Bildirim
  service, operated by the plugin author.
* Documented why the service worker must live at `/bildirim/` on your own
  domain, and that no filesystem write is required for the plugin to work.

= 1.3.1 =
* Fixed (critical): saving a post in the block editor failed with "Sorry, you
  are not allowed to edit the _bildirim_sent_at custom field" as soon as the
  Bildirim panel was touched. The sent-at stamp was exposed as protected REST
  meta; the editor sends the whole meta object back on save, and one unwritable
  key rejects the entire request. The stamp is now a read-only REST field, so
  it can still be read but is never part of a write.

= 1.3.0 =
* Fixed: in the block editor (Gutenberg) the send options were rendered as a
  classic meta box far below the content and were easy to miss. They now appear
  as a "Bildirim" panel in the document sidebar, next to Publish.
* The box is shown even before sending is enabled, with a direct link to enable
  it - previously it was hidden entirely, so the feature was invisible.

= 1.2.0 =
* New: one-click "Enable sending from WordPress". The site proves it owns the
  domain and receives a send-only key automatically — no more copying a secret
  key from the dashboard.
* The editor's send box is ticked by default once sending is enabled (it stays
  visible on every post, so you can still decide per post).

= 1.1.0 =
* New: announce posts from the editor. "Send when published" switch, per-channel
  checkboxes (Web / iOS / Android), title/text templates with placeholders, and
  the featured image as the notification image.
* New: "Send now" button for already published posts.
* A post is announced at most once; the send request carries an idempotency key
  derived from the post, so a double publish hook cannot produce two
  notifications.
* Failures are never silent: the API's own message is stored on the post and
  shown in the editor.

= 1.0.0 =
* First release: SDK injection, service worker delivery (file with rewrite
  fallback), optional iOS manifest, key verification, installation self-test.
