=== BMDRM Video Player ===
Contributors: bmdrm
Tags: video, drm, secure video, streaming, embed
Requires at least: 5.0
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv3 or later
License URI: https://www.gnu.org/licenses/gpl-3.0.html

Securely embed DRM-protected videos from BMDRM into WordPress.

== Description ==

BMDRM Video Player allows you to embed secure, DRM-protected videos from your BMDRM account into WordPress posts and pages.

Videos are streamed using industry-standard DRM and can only be viewed by authenticated users. The plugin works out of the box using either a shortcode or a Gutenberg block.

All communication with BMDRM happens server-side, keeping your API key secure.

== Features ==

* DRM-protected video playback
* Shortcode and Gutenberg block support
* Server-side API handling (API keys never exposed)
* Logged-in user access control
* Responsive video player
* Simple admin settings page
* Rate limiting for API protection

== Requirements ==

* WordPress 5.0 or later
* PHP 7.4 or later
* BMDRM account with API key
* Users must be logged in to view videos
* **HTTPS is required on production sites**
  * HTTP works only on `localhost` for development

== Installation ==

1. Install the plugin from **Plugins → Add New**
2. Activate **BMDRM Video Player**
3. Go to **Settings → BMDRM Video**
4. Enter your BMDRM API key and save
5. Ensure your site uses HTTPS (required for DRM)

== Usage ==

= Shortcode =

Embed a video using:

`[bmdrm video="YOUR_VIDEO_ID"]`

Example:
`[bmdrm video="15c7b691-f5e5-4dba-84e5-584b91352ce5"]`

= Gutenberg Block =

1. Open the block editor
2. Add the **BMDRM Video** block
3. Paste your video ID (GUID format)
4. Publish or update your post

== Frequently Asked Questions ==

= Where do I get a video ID? =
From your BMDRM dashboard.

= Do users need to be logged in? =
Yes. Videos are restricted to authenticated users.

= Why doesn’t the video work on HTTP? =
DRM requires a secure browser context. Production sites must use HTTPS. HTTP works only on `localhost` for development.

= Can I add multiple videos on one page? =
Yes. You can embed multiple shortcodes or blocks on the same page.

== Screenshots ==

1. Plugin settings page – API key configuration  
2. Gutenberg block – Embedding a DRM-protected video

== Changelog ==

= 1.0.0 =
* Initial release
* Shortcode support
* Gutenberg block support
* Secure server-side API integration
* Logged-in user enforcement
* HTTPS / localhost validation

== Upgrade Notice ==

= 1.0.0 =
Initial release.

== External services ==

This plugin relies on the BMDRM (video-crypt.com) third party service to deliver DRM-protected video playback. It is required for the plugin to function: without it, no video can be played.

What the service is and what it is used for:
BMDRM is a commercial DRM and secure video streaming service provided by BMDRM. The plugin uses it to request a short-lived, secure playback session URL for each embedded video. The returned URL is then loaded inside an iframe so the end user can watch the DRM-protected video.

What data is sent and when:
Every time a logged-in user views a page containing a `[bmdrm]` shortcode or a BMDRM Video block, your WordPress site makes a server-side request to `https://cdn-lb.video-crypt.com/api/Sessions` containing:
* The video ID configured in the shortcode/block (set by the site administrator).
* The current WordPress user's username (`user_login`), used by BMDRM to bind the session to the viewer.
* Your BMDRM API key, sent as an `apiKey` HTTP header (stored on your server, never exposed to the browser).

No request is made until a page with the shortcode/block is rendered for a logged-in user.

Service provider and legal links:
This service is provided by BMDRM (https://bmdrm.com).
* Terms of Service: https://bmdrm.com/terms-of-service/
* Privacy Policy: https://bmdrm.com/privacy-policy/

By using this plugin you agree that the data described above is transmitted to BMDRM in order to provide the video playback functionality.

== Privacy Policy ==

This plugin connects to the BMDRM API (https://cdn-lb.video-crypt.com/api/Sessions) to retrieve secure video playback URLs.

Data sent to BMDRM:
* Video ID
* WordPress username (`user_login`)
* API key (sent as an HTTP header; stored securely on the server and never exposed to the browser)

No additional personal data is collected by this plugin.

For details on how BMDRM handles this data, see the BMDRM Privacy Policy: https://bmdrm.com/privacy-policy/

== Support ==

For plugin issues, use the WordPress.org support forum.  
For BMDRM service questions, contact **contact@bmdrm.com**.
