=== Bookingistic ===
Contributors: developershuvo
Tags: booking, appointment, appointments, calendar, scheduling
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 2.6.0
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Booking, calendar & email automation for WordPress — form designs, calendar views, Google Sync, staff scheduling, and payments via WooCommerce.

== Description ==

Bookingistic turns your WordPress site into a premium booking system — for strategy calls, salons, clinics, tutors, fitness trainers, consultants, and any appointment-based business.

Visit [Bookingistic.com](https://bookingistic.com) for the live product overview, setup guidance, and booking workflow examples.

**Booking form designs (pick per site or per shortcode)**

* **Classic** — two-panel layout with service details
* **Modern Card** — elevated card with soft shadows, perfect for coaches
* **Split Hero** — bold gradient header, great for salons and clinics
* **Minimal Inline** — borderless, blends into any theme

Switch templates instantly under Bookingistic → Appearance, or per form: `[bookingistic service="consult" template="modern"]`.

**Three calendar views**

* Month grid — the classic date picker
* Pills — horizontal next-14-days scroller (mobile-first)
* List — upcoming dates with Today / Tomorrow labels

**One-click industry presets**

Salon/Spa, Clinic/Medical, Fitness/Yoga, Tutoring, Consulting, Home Services — each applies a tuned design, brand color, and scheduling defaults (slot interval, notice window, booking horizon). Everything stays editable.

**Elementor widget**

Drag-and-drop the Bookingistic Form widget with live controls for service, template, and calendar view. (Appears automatically when Elementor is active.)

**Real scheduling engine**

* Services with duration, buffers, price, category, manual/auto confirmation
* Staff with per-day working hours, days off, holidays, daily booking limits
* Double-booking guard, min-notice, max-advance window, slot interval
* Timezone-aware: slots render in the visitor's timezone
* Cancel & reschedule via signed, expiring links — no account needed

**Google Calendar**

* Free on every site: .ics attachments + one-click "Add to Google Calendar" links
* Two-way sync (bring your own free Google OAuth client): confirmed bookings push to each staff member's calendar, and their external events automatically block booking slots. Refreshed every 15 minutes.

**Email automation**

Branded HTML confirmations, reminders (hourly cron), cancellation and reschedule notices. Automation rules fire on booking events; every send is logged. Site owners can add their own custom footer text under Settings.

**Payments (bring your own gateway)**

* Paid services collect payment through a WooCommerce order per booking — customers pay with any payment method WooCommerce already supports, and payment status flows back to the booking automatically (paid → booking confirmed).
* Payment ledger: every attempt (pending, paid, refunded, failed) is logged under Bookingistic → Payments.
* Developer gateways: plug additional providers into the `bookingistic_payment_gateways` filter — no core billing decision is hard-coded.

**Developer-friendly**

* REST API at `/wp-json/bookingistic/v1/` (services, staff, availability, bookings)
* Actions & filters: `bookingistic_booking_confirmed`, `bookingistic_available_slots`, `bookingistic_external_busy_intervals`, `bookingistic_can_remove_branding`, and more
* Clean custom tables; opt-in data removal on uninstall (`BOOKINGISTIC_DELETE_DATA`)
* Backward compatible with the v1 `wpistic_booking` CPT and legacy REST route

= Shortcode =

`[bookingistic service="strategy-call"]`
`[bookingistic service_id="1"]`
`[bookingistic template="split" calendar_view="pills"]`

= REST API =

`GET  /wp-json/bookingistic/v1/services`
`GET  /wp-json/bookingistic/v1/availability?service_id=N&date=YYYY-MM-DD`
`POST /wp-json/bookingistic/v1/bookings`
`POST /wp-json/bookingistic/v1/bookings/{id}/reschedule`
`GET  /wp-json/bookingistic/v1/payments`
`GET  /wp-json/bookingistic/v1/payments/gateways`

== Installation ==

1. Upload the `bookingistic` folder to `/wp-content/plugins/`, or install via Plugins → Add New.
2. Activate the plugin.
3. Open **Bookingistic → Appearance** and pick an industry preset (or your own design).
4. Add your services under **Bookingistic → Services**.
5. Drop `[bookingistic service="your-service"]` on any page — or use the Elementor widget.

Upgrading from 1.x? Your existing bookings and the legacy form keep working.

== Frequently Asked Questions ==

= Does the free version include payments? =

Yes — via WooCommerce. Turn on "WooCommerce Orders" under Bookingistic → Payments and every paid booking creates a WooCommerce order the customer can check out with (cards, PayPal, bank transfer — whatever your store supports). Payment status syncs back to the booking, and confirmed payment auto-confirms the booking. Direct Stripe/PayPal gateways without WooCommerce are on the roadmap.

= Does Google Calendar sync need a paid service? =

No. The deep-link + .ics features work everywhere. Two-way sync uses your own free Google OAuth client credentials (setup guide under Bookingistic → Integrations → Google Calendar).

= Can each staff member have their own calendar? =

Yes — per-day working hours, days off, daily limits, and individual Google Calendar connections.

= Will it slow my site down? =

No external CDN calls, no jQuery dependency, one small CSS + one JS file, loaded only where the form appears.

== Screenshots ==

1. Calendar — month view with filters and booking events
2. Calendar — week view for staff planning
3. Calendar — list view for upcoming bookings
4. Classic template — two-panel booking form with service details and available times
5. Modern Card template — compact card layout with calendar and time selection
6. Split Hero template — full-width branded booking experience
7. Minimal Inline template — lightweight form that blends into any theme
8. Services — configure duration, buffers, pricing, deposits, and confirmation rules
9. Staff — add a staff member and set availability details
10. Staff availability — working hours and days off
11. Email automations — confirmation, cancellation, reschedule, and reminder rules
12. New automation — event triggers, recipients, delays, and template variables
13. Reports — booking status, service totals, and weekly activity
14. Integrations — WooCommerce, Google Calendar, Outlook, Messageistic, and CRMistic

== External services ==

**Google Calendar (optional, per staff member)**

This plugin can connect to Google Calendar so each staff member can two-way sync their bookings. Nothing is sent to Google until a staff member explicitly clicks "Connect Google Calendar" in the staff editor and authorizes access with their own free Google OAuth client.

* What it is used for: pushing confirmed bookings to the connected Google Calendar, and reading that calendar's free/busy blocks so external events block booking slots.
* What data is sent and when: booking details (service name, date/time, customer name and notes) are sent when a booking is confirmed, rescheduled, or deleted, for staff members who connected their calendar. OAuth tokens are stored in the site's own database.
* Which services are contacted: Google's OAuth endpoints (accounts.google.com, oauth2.googleapis.com) and the Google Calendar API (www.googleapis.com).
* Google Terms of Service: https://policies.google.com/terms
* Google Privacy Policy: https://policies.google.com/privacy

== Changelog ==

= 2.6.0 =
* New: premium booking-form design language across all four form designs and all three calendar views — elevated card, step progress ("Step 1 of 3"), service summary card with price pill, day tiles, time pills and a live "Continue with Tue at 1:30 PM →" button
* New: motion — slide/fade step transitions, spring-like day/time selection, skeleton shimmer while availability loads, staggered time pills, crossfading CTA text, animated success checkmark, floating toast cards and hover micro-interactions; pure CSS + vanilla JS, no new libraries or external requests, and fully disabled under prefers-reduced-motion
* Accessibility: arrow-key / Home / End navigation for days, times and hosts; full-date labels on day buttons; polite live region for loading and availability; focus moves to each new step; visible focus rings; forced-colors support
* Changed: Modern Card is the default design and #1b7257 the default accent for sites that have never saved Appearance settings; saved settings, shortcode attributes and the Elementor widget are unchanged
* Security: every custom-table SQL query now goes through $wpdb->prepare() with placeholders; table and column identifiers are bound with %i (whitelisted columns only), optional filters are value-bound instead of concatenated, and ORDER BY uses a strict column whitelist. No phpcs:ignore remains on any SQL-preparation (PreparedSQL / PreparedSQLPlaceholders / InterpolatedNotPrepared) sniff.
* Performance: reads from the plugin's own tables are now object-cached (wp_cache_get/wp_cache_set, one cache group per table) and invalidated through a per-table last_changed key on every write (create, update, delete, status change, cancel, payment updates, schema install/upgrade, uninstall, and at the end of every booking transaction). Availability, overlap/double-booking, daily-limit, slot-lock, slug-uniqueness and reminder checks always read live data. The remaining Plugin Check DirectQuery notices carry narrow line-level ignores with the reason stated. No functional changes.
* Fixed: PHP 8.1+ "Passing null to htmlspecialchars()" deprecation notice when editing a staff member with an empty bio (found while testing on MySQL/MariaDB).
* Changed: the booking form uses the system UI font stack; no web font is loaded or referenced
* Hardening: admin form input (staff hours, days off, phone, integration settings) is sanitized with core functions before validation, admin pagination output is passed through wp_kses_post(), Google Calendar ICS files are written through WP_Filesystem, the cron schedule is registered next to its callback, and uninstall (with BOOKINGISTIC_DELETE_DATA) also removes the plugin's transients. Plugin Check (with experimental checks) and PHPCS (WordPress standard) report no errors or warnings.

= 2.5.5 =
* Fixed: REST requests from the booking form and the admin calendar now work on sites using plain permalinks (the WordPress default on a fresh install) — endpoint URLs are built with a proper query-string join instead of plain concatenation, which previously produced "No route was found matching the URL and request method" on every booking-form and calendar request

= 2.5.4 =
* Hardening: numeric superglobal reads now go through absint()/floatval()/sanitize_key() instead of raw casts, satisfying the stricter WordPress Coding Standards rulesets used by the latest Plugin Check and the WordPress.org review Playground — the plugin reports 0 errors and 0 warnings under it

= 2.5.3 =
* Hardening: every superglobal read is now unslashed and sanitized (or explicitly cast) — admin pages, list filters, and the public cancel/reschedule/pay links
* Hardening: all admin templates now use plugin-prefixed variable names; read-only display filters are annotated for the WordPress coding standards
* Fixed: removed a leftover duplicate "Footer text" field on the Settings screen that referenced the removed 2.5.1 branding gate
* Dev: plugin now reports 0 errors and 0 warnings under the Plugin Check (PCP) static analysis suite

= 2.5.2 =
* Fixed: the Google Calendar sync cron event is now scheduled correctly on a fresh activation — the custom "every 15 minutes" interval is registered before scheduling (previously the interval was only registered after activation, so the event was silently skipped on new installs)
* Security: every admin save and action handler (settings, services, staff, bookings, email automations, integrations, appearance) now verifies a capability before processing, in addition to the existing nonce checks — users without the matching Bookingistic capability get a 403

= 2.5.1 =
* Removed the email footer branding and its license gate — every shipped feature is now free and fully enabled (WordPress.org guidelines)
* Security: staff email addresses are no longer exposed by the public REST endpoints
* Security: client IP detection for rate limiting now uses only the direct connection address unless the site explicitly opts in to trusted proxy headers, and all header input is sanitized
* Security: legacy form nonce is now sanitized before verification; admin error notices sanitize input before escaping
* Privacy: email .ics attachments are written to the system temp directory with random names and deleted after sending — no booking data in the public uploads folder
* Fixed: appearance screen styles load through the standard enqueue system
* Fixed: removed the redundant translation loader (WordPress.org loads translations automatically)
* Brand: plugin links now point to bookingistic.com

= 2.5.0 =
* Fixed: `/wp-json/bookingistic/v1/payments/status` now accepts the signed link's `t` parameter (previously only read `token`, so plugin-issued links always returned 410)
* Security: pay-now links now expire after 90 days — the token embeds its expiry under an HMAC; previously a leaked pay link stayed valid forever
* Security: Google Calendar OAuth tokens are now encrypted at rest (authenticated secretbox keyed from the site salt); existing tokens migrate transparently on the next save
* New: race-safe booking — concurrent submissions for the same staff member are serialized with a row lock and the availability re-check runs inside the transaction, preventing double-booking under simultaneous submits (InnoDB; silently degrades to check-then-insert on MyISAM)
* Dev: standalone test suite under `tests/` (run `php tests/run-all.php`) covering payment token expiry, crypto round-trip, and deposit math

= 2.4.0 =
* New: premium admin UI — every Bookingistic screen restyled with a consistent design system (page headers with taglines, card-based panels, refined tables, status pills, sticky save bar)
* New: Integrations page rebuilt as an animated card grid — icon, description, Connected/Not connected pill, hover lift, and staggered fade-in (pure CSS, respects prefers-reduced-motion)
* New: dashboard, bookings, services, staff, customers, and customer profiles now show live stat cards (real counts from your data)
* New: Reports screen with bookings-by-status summary and top services (replaces the Phase 2 placeholder)
* Tweak: legacy "Bookings (v1)" menu removed from the admin sidebar (data and the legacy REST endpoint are untouched; developers can restore it with the `bookingistic_legacy_bookings_show_ui` filter)
* Tweak: admin stylesheet rebuilt around CSS variables matching the WordPress admin palette; no external fonts or CDNs

= 2.3.0 =
* New: Payments module — WooCommerce Orders gateway with enable/disable switch under Bookingistic → Payments
* New: payment ledger — every payment attempt (pending/paid/refunded/failed) recorded per booking, with admin screen and REST endpoints (`/payments`, `/payments/gateways`, `/payments/status`)
* New: `bookingistic_payment_gateways` (alias `bookingistic_gateways`), `bookingistic_payment_recorded`, `bookingistic_payment_currency` filters — gateway registry is fully pluggable
* New: deposits — per-service deposit percentage; only the deposit is charged upfront (`deposit_paid` status), supported across forms, admin and REST
* New: signed pay-now links (`?bookingistic_action=pay`, HMAC token, 410 on bad token) + `[bookingistic_payment id email]` shortcode with Pay now button
* New: booking form success screen shows a Pay now button when a gateway is connected, or pay-later instructions otherwise
* New: `{payment_link}` email merge tag now carries the booking's signed pay link
* New: admin manual actions — Mark paid / Refund on payment records (nonce + capability checked) for offline payments
* New: paid bookings that receive payment are confirmed automatically (consistent with the WooCommerce integration flow)

= 2.2.0 =
* New: 4 booking form templates — Classic, Modern Card, Split Hero, Minimal Inline (Appearance page + shortcode/Elementor override)
* New: 3 calendar views — month grid, 14-day pills, upcoming list
* New: one-click industry presets with live preview (salon, clinic, fitness, tutoring, consulting, home services)
* New: brand accent color + corner radius controls
* New: Elementor widget with live template/calendar controls
* New: Google Calendar two-way sync — per-staff OAuth connect, booking push, freebusy blocking, 15-min refresh
* New: Appearance admin page with live preview
* New: `bookingistic_gcal_sync` 15-minute cron; `bookingistic_external_busy_intervals` filter
* Improved: refreshed readme, i18n strings, POT file
* Fixed: staff REST responses no longer expose calendar token metadata

= 2.1.0 =
* Version alignment release (matches the distributed 2.1.0 package).

= 2.0.0 =
* Phase 1 rebuild: custom tables, modular OOP architecture, availability engine,
  frontend booking form with side calendar, full REST namespace, email automations
  with branding helper, admin UI, signed cancel & reschedule links.

= 1.0.0 =
* Initial v1 Strategy Call lead-capture plugin.

== Upgrade Notice ==

= 2.6.0 =
New booking-form design and motion across all designs and calendar views, all SQL prepared, object caching for the plugin's tables, and security hardening. No database changes.

= 2.3.0 =
Adds payments: WooCommerce Orders gateway, payment ledger, deposits, signed pay links and the [bookingistic_payment] shortcode. A small automatic database upgrade (service deposit column) runs on update.

= 2.2.0 =
New designs, calendar views, industry presets and Google Calendar sync. Database upgrades run automatically — back up before updating as with any release.
