=== BloomDesk Chatbot ===
Contributors: kwiatekelk
Tags: chat, chatbot, customer-support, live-chat, ai
Requires at least: 7.1
Tested up to: 7.1
Requires PHP: 8.2
Stable tag: 0.2.0
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Adds a BloomDesk chat widget so visitors can talk to an AI assistant or a human operator.

== Description ==

BloomDesk Chatbot places a chat widget on your WordPress site. Visitors send messages to BloomDesk, where a conversation can be handled by an AI assistant or a human operator. The site administrator pastes a SaaS webhook URL in the plugin settings. The webhook token stays on the server; the browser only talks to your own site.

The widget can be added automatically in the footer or with the `[bloomdesk_chatbot]` shortcode. Existing content that uses `[bloomtech_chatbot]` keeps working.

= External services =

This plugin does not work without an external chat service. By saving a SaaS webhook URL and using the widget, you connect the site to that service.

**BloomDesk** (required for chat)

* Service: https://bloomdesk.pl
* Terms of use: https://bloomdesk.pl/terms
* Privacy policy: https://bloomdesk.pl/privacy

The plugin calls BloomDesk when an administrator has saved a SaaS webhook URL and a visitor sends a message, the widget checks for new messages, or the visitor confirms or declines a proposal.

Data sent to BloomDesk:

* message text
* session ID
* page URL and page title
* user agent
* `Origin` header set to this site's address (added by the plugin on the server)
* when checking for new messages: `externalSessionId`, `afterId`, and the polling mode

Data received: the AI or operator reply, and session metadata needed to continue the conversation.

**Google reCAPTCHA** (only when an administrator turns it on and saves a site key)

* Service: https://www.google.com/recaptcha/about
* Privacy policy: https://policies.google.com/privacy
* Terms of use: https://policies.google.com/terms

When reCAPTCHA is enabled, the visitor's browser loads `https://www.google.com/recaptcha/api.js` and shows the checkbox. Google receives the visitor's IP address and interaction data under Google's own policy. After the visitor completes the checkbox, this site's server sends the reCAPTCHA token and the visitor's IP address (`REMOTE_ADDR`) to `https://www.google.com/recaptcha/api/siteverify`.

== Installation ==

1. Upload the plugin directory to `/wp-content/plugins/`, or install the zip from the Plugins screen.
2. Activate BloomDesk Chatbot through the Plugins screen. WordPress 7.1 or newer is required.
3. Open BloomDesk Chatbot → Connection and paste the full SaaS webhook URL from BloomDesk. It must contain `/ai/webhook/{token}`.
4. Optionally set the language, privacy-policy link, and footer behavior under Widget.
5. Visit the front of the site. The widget appears in the footer when automatic footer placement is enabled, or wherever you place `[bloomdesk_chatbot]`. The older `[bloomtech_chatbot]` shortcode still works.

== Frequently Asked Questions ==

= Where do I put the webhook URL? =

In WordPress admin, open BloomDesk Chatbot → Connection and paste the full SaaS webhook URL. The URL must start with `http://` or `https://` and must contain the path `/ai/webhook/{token}`. The token is stored in the database and is added to BloomDesk requests on the server. It is not sent to the browser.

= Can I override settings from wp-config.php? =

Yes. Optional constants override the values saved in the plugin settings. This replaces any older `.env` file in the plugin directory; the plugin no longer reads `.env` files.

* `BTCB_SAAS_WEBHOOK_URL` — full webhook URL, including `/ai/webhook/{token}`. A URL without that path leaves message polling and proposal actions unconfigured.
* `BTCB_RECAPTCHA_SECRET` — reCAPTCHA secret key.
* `BTCB_RATE_LIMIT_PER_MINUTE` — integer.
* `BTCB_RATE_LIMIT_PER_DAY` — integer. `0` disables the daily limit.

Example:

`define('BTCB_SAAS_WEBHOOK_URL', 'https://example.com/ai/webhook/your-token');`

= Does the widget show a "Powered by" link? =

No, not unless an administrator turns it on under BloomDesk Chatbot → Widget. When enabled, the link says "Powered by BloomDesk" and points to https://bloomdesk.pl.

= What does the plugin store, and what goes to BloomDesk? =

The plugin stores its settings and a hash of the browser owner token. Conversation text is sent to BloomDesk and is not kept as a chat log in WordPress. Rate-limit counters are transients and expire. Uninstall removes the `btcb_settings` and `btcb_session_owners` tables and the plugin options. Terms and privacy for the chat service stay at https://bloomdesk.pl/terms and https://bloomdesk.pl/privacy. Saving the webhook is the administrator's agreement to call BloomDesk.

The anonymous widget does not use a logged-in user nonce. The first message creates an owner cookie. Later reads and writes of that conversation, including proposal confirm and decline, require the same cookie. A different browser cannot read or append. Message reads before that first message are refused. reCAPTCHA verification before any conversation stays open.

== Screenshots ==

1. Connection settings. The webhook token is masked.
2. The chat widget on the front of the site.
3. Appearance settings.

== Development ==

JavaScript and CSS in this plugin are written by hand.

`assets/js/widget.js` is the human-readable source and runtime file. It is not compiled, bundled, or minified. There is no build step. Edit that file directly.

The other scripts in `assets/js/` (`backend-connection.js`, `admin.js`, `btcb-defaults.js`, `appearance-preview.js`, `recaptcha.js`, `translations.js`, `dashboard-hero.js`) and the stylesheets in `assets/css/` are also the original source.

== Changelog ==

= 0.2.0 =
* Chat widget, connection settings, appearance settings, and optional Google reCAPTCHA.
* Message text is rendered as text and DOM nodes, not as HTML assembled from the message string.
* Optional configuration constants in wp-config.php. The plugin does not load a `.env` file.
* reCAPTCHA session pass is bound to the session ID it was issued for.
* The "Powered by" link is off unless an administrator enables it.
