CASAVOLAB DEVELOPMENT CONTEXT
Project: CasavoLab Booking Manager FREE
Current version: 1.0.21
Date: 2026-09-24

LATEST 1.0.21 UPDATE TEST ALIGNMENT
- FREE version bumped from 1.0.20 to 1.0.21 only to test the WordPress.org update flow and stay aligned with PRO 1.0.21.
- No FREE feature, database schema, booking logic, iCal import, Elementor, access-role, multilingual, email, security, or frontend behavior changed.
- Keep the FREE distribution on the normal WordPress.org update channel. Do NOT copy the private PRO license/updater code into FREE.
- Before WordPress.org publication, keep running PHP lint, JavaScript syntax checks and WordPress Plugin Check.

LATEST 1.0.20 FREE/PRO VERSION ALIGNMENT
- FREE version bumped from 1.0.16 to 1.0.20 so public FREE and commercial PRO releases share the same release number.
- This is a metadata/release alignment only: no FREE feature, database schema, booking logic, iCal import, Elementor, access-role, multilingual, email, or frontend behavior changed.
- Keep the FREE distribution on the normal WordPress.org update channel. Do NOT copy the private PRO license/updater code into FREE.
- PRO 1.0.20 uses the CasavoLab License Server update mechanism; that mechanism remains PRO-only.
- Before WordPress.org publication, keep running PHP lint, JavaScript syntax checks and WordPress Plugin Check; the previous FREE build was at zero Plugin Check errors.

LATEST 1.0.16 MULTILINGUAL PUBLIC UI
- Added Settings > public interface language with Auto as the default. Auto follows the WordPress site language (WPLANG/get_locale) and passes the matching locale to the public JavaScript calendar/date formatter.
- Built-in complete public/UI + booking-email catalogs: it, en, es, fr, de, pt, nl, pl, ro, el, hr, cs, hu, tr, ru, uk. Every non-Italian catalog covers the same 136 source strings and preserves all sprintf/placeholder tokens.
- Auto continues to respect normal WordPress gettext translations for site locales beyond the bundled public catalogs when a WordPress.org language pack provides them; otherwise the public fallback is English.
- Existing Elementor widgets whose saved text is still exactly the historical Italian default are treated as defaults and translated at render time; genuinely customized widget text is preserved unchanged.
- Back-office localization remains on the normal WordPress gettext/language-pack path. Do NOT re-add load_plugin_textdomain(); WordPress.org loads plugin language packs automatically on supported WordPress versions.
- FREE/PRO are version-aligned at 1.0.16. PRO feature scope is unchanged.
- No database schema, booking availability rules, iCal sync/export protocol, access roles, or license behavior changed.

LATEST 1.0.15 FRONTEND BUTTON FIX
- Fixed the public booking-request submit button that could appear white/invisible until hover because active themes or Elementor applied global button styles after the plugin CSS.
- Submit background/text colors are now carried through CSS custom properties with hardened selectors, so the normal and hover states remain visible without losing Elementor color controls.
- Compact/mobile modal portaling now copies the resolved submit colors to the portaled modal before it is moved under `body`, preserving the selected accent outside the Elementor wrapper.
- FREE/PRO are version-aligned at 1.0.15.
- No booking logic, email workflow, iCal import/export behavior, or database logic was changed.

--- PRIOR CONTEXT ---
# CasavoLab Development Context

> IMPORTANT FOR FUTURE CHATGPT SESSIONS
> Read this file before modifying the project. This is the hand-off state for the current CasavoLab Booking Manager FREE development line.
> Preserve compatibility unless the user explicitly requests a breaking change. Never add secrets or credentials to this file.

**Brand:** CasavoLab.it  
**Current version:** 1.0.12  
**Current hand-off date:** 2026-09-21  
**Distribution target:** WordPress.org FREE plugin

## Commercial architecture

- Booking Manager FREE is published on WordPress.org and must remain fully usable without a license, trial, remote account, or dormant premium code.
- Booking Manager PRO is a physically separate add-on sold from CasavoLab.it.
- FREE provides incoming iCal synchronization (external calendars -> Booking Manager).
- PRO adds outgoing iCal feeds, enabling practical two-way iCal synchronization, plus commercial/reporting additions.
- Do not merge PRO-only code or license checks into the WordPress.org FREE plugin.

## Current FREE behavior

- Multiple accommodation properties.
- Incoming iCal feeds, manual and automatic synchronization.
- Availability search and public booking calendar.
- Booking requests, manual reservations and blocks.
- Owner email notifications with secure Accept/Reject actions.
- Email Accept/Reject flow uses a signed HMAC booking token and, since 1.0.9, a WordPress nonce on the final confirmation POST.
- Owner email may include click-to-WhatsApp via `wa.me` for the guest phone number.
- No WhatsApp Business / Meta Cloud API integration.
- Optional automatic email to the guest after accept/reject.
- Elementor widgets and shortcodes.
- Admin calendar must always display the property/structure name on every booking/event.
- Access & Roles: Editor users can have no access, booking-only management, or full plugin management. Administrators always retain full access.

## WordPress.org review status

On 2026-09-21 WordPress.org pended the submission and requested attention to:

1. Name/ownership review: automated tooling flagged possible confusion between `CasavoLab` and the unrelated `Casavo` trademark. Do not rename without explicit user approval. The user should verify control of `casavolab.it` via a WordPress.org profile email under the domain (for example `info@casavolab.it`) or the DNS TXT verification requested by the review email.
2. Nonces and permissions: modifying admin/AJAX actions already use capability checks and nonces. Version 1.0.9 additionally protects the public availability-search AJAX request and the public email decision POST with WordPress nonces while preserving the signed email token.
3. Human-readable source: `assets/js/search.js` and `assets/js/booking-calendar.js` are reformatted and shipped as direct human-readable runtime source. No build step is required.
4. `load_plugin_textdomain()` removed in 1.0.9 because WordPress.org language packs load automatically on supported WordPress versions.
5. `readme.txt` documents source/build status.

Before another submission/update:
- Run PHP lint on all PHP files.
- Run `node --check` on all JS files.
- Run WordPress Plugin Check with all relevant categories.
- Smoke-test activation, admin booking CRUD, role restrictions, iCal sync, frontend search/request, Elementor editor, owner email, Accept/Reject confirmation and optional guest email.

## URLs

- Plugin URI: https://casavolab.it/wpbooking-manager/
- Author URI: https://casavolab.it/

## Related packages

- PRO add-on current line: 1.0.12 unless subsequently updated/aligned.
- License Server current line: 1.5.2 unless subsequently updated.

## 1.0.10 WordPress.org review-clean pass

- Moved this hand-off file from the plugin root Markdown file to `docs/CASAVOLAB_DEV_CONTEXT.txt` to avoid the production-package Markdown warning.
- Static-analysis-visible nonce checks now sit directly inside every booking-admin AJAX handler before POST processing.
- Sanitized iCal textarea input, access-role arrays and the public anti-spam honeypot before use.
- Custom-table identifiers use WordPress `%i` placeholders where applicable.
- Intentional direct custom-table access is documented with narrow PHPCS annotations; no unsafe SQL warning is intentionally suppressed.
- Uninstall variables are plugin-prefixed and the owned table is dropped with a prepared identifier.

## 1.0.11 final Plugin Check warning cleanup

- Addressed the final four Plugin Check warnings reported after 1.0.10.
- Custom-table update/delete operations now include narrowly scoped NoCaching annotations because they are writes, not cacheable reads.
- Dynamic SELECT queries remain fully prepared with WordPress placeholders and allowlisted SQL fragments; Plugin Check's DirectDB unescaped-parameter false positives are documented with narrow annotations on the final get_results() calls.
- No functional behavior changed. The goal of this release is a clean WordPress.org review package.

## 1.0.12 real DB/cache cleanup

- The four warnings still reported after 1.0.11 were addressed structurally instead of only with annotations.
- Single booking lookups now use the WordPress object cache (`wp_cache_get` / `wp_cache_set`).
- Booking update/delete operations invalidate the corresponding cache key with `wp_cache_delete`, which also satisfies the WPCS NoCaching requirement for direct custom-table writes.
- Dynamic SELECT statements are still fully prepared, but `$wpdb->prepare()` is now passed directly into `$wpdb->get_results()` so Plugin Check can verify the DB parameter without following an intermediate variable.
- If Plugin Check still reports the old line numbers after installing 1.0.12, verify that the old FREE plugin directory was actually replaced and clear any opcode/cache layer before re-running the scan.
