=== Colvor Announcement Bar ===
Contributors: colvor
Requires at least: 6.4
Requires PHP: 8.1
Stable tag: 0.4.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
Tested up to: 7.1

Display a lightweight announcement bar at the top of your WordPress site, managed through Colvor.

== Description ==

Colvor Announcement Bar adds a lightweight announcement bar above your content. It safely renders a cloud-managed message, caches the last valid configuration locally, and keeps the front end working if the remote service is temporarily unavailable.

Connect the plugin with one click to manage the announcement from the Colvor dashboard. The first connection creates a Free guest workspace automatically; no Colvor account, email, password, or verification code is required. Free sites receive a seamless scrolling marquee, can edit the announcement text, and can control whether it is shown. Pro adds custom links, all-site or selected-page display scope, background and text colors, scroll speed, an optional separator, and link underline control. Set the scroll speed to zero to show one announcement without looping.

If the site credential is revoked in Colvor, the connector marks the site as disconnected, stops configuration sync, and keeps the last valid local configuration until the site is connected again.

The announcement can be hidden from the WordPress settings page at any time. This local display setting does not change the configuration stored in Colvor.

== Setup ==

1. Install and activate this plugin.
2. Open Settings > Colvor Announcement Bar.
3. Click Connect Colvor. The plugin connects in place to a Free guest workspace, without a login or authorization page. Click Open Colvor to open its dashboard.
4. Change the announcement in the Colvor Dashboard. An open WordPress page checks for the latest configuration automatically.

The plugin stores the long-lived site credential in WordPress. Later, Open Colvor requests a short-lived, one-time dashboard handoff and returns to the same workspace, even if browser cookies have been cleared.

Registration or login is requested only for Upgrade to Pro, payment, or account-level features. Claiming the guest account keeps the existing Workspace, Site, plugin binding, and settings in place.

Connection credentials are provisioned and stored automatically and are never rendered into the public page.

Subscription access and capabilities are calculated by Colvor's server; the connector only consumes the returned effective configuration and plan capability.

== External services ==

This plugin connects to Colvor at https://colvor.com.

When you click Connect Colvor, the WordPress server sends the site URL, installation ID, locally generated installation secret, and plugin version over HTTPS to Colvor at /api/v1/connect/bind. Colvor calls the public WordPress /wp-json/colvor/v1/connection-proof endpoint (also available through ?rest_route=/colvor/v1/connection-proof) with a random, short-lived challenge. WordPress signs the challenge with its stored installation secret; the proof response includes the challenge, expiry, installation ID, site URL, and HMAC signature, but never the secret. Colvor verifies this proof before creating the Free guest workspace or recovering an eligible Guest site after reinstallation. Colvor stores a hash of the installation secret. The plugin stores the returned site credential in WordPress for a twice-daily health check and authenticated configuration synchronization. When opening the dashboard, the plugin exchanges that credential for a short-lived, one-time browser handoff; the long-lived credential is never placed in a URL or exposed to the browser. An open page also performs a lightweight same-origin check at most once per minute, with an immediate first check. Configuration responses can include the current plan, feature capabilities, and announcement settings.

The plugin does not send visitor activity, page content, WooCommerce orders, or payment details to Colvor. The public refresh response contains only the announcement already displayed on the page. You can disconnect the site from the Colvor dashboard. Deactivating the plugin stops scheduled health checks, and uninstalling it removes the locally stored connection data.

For details, see the [Colvor Privacy Policy](https://colvor.com/privacy).

== Frequently Asked Questions ==

= Does this plugin require a Colvor account? =

No. Click Connect Colvor in Settings > Colvor Announcement Bar to connect a Free guest workspace in place, then use Open Colvor to open the dashboard. Register or log in only when upgrading to Pro, paying, or using an account-level feature.

= Does the plugin require a manually copied token? =

No. Free connection uses a server-to-server Direct Bind with WordPress ownership proof, without a login or browser authorization page. Credentials are generated and stored automatically. Connecting an existing registered Colvor account uses the separate browser login authorization flow.

= What happens if I uninstall and reinstall the plugin? =

Uninstalling removes the local settings, installation ID, installation secret, and site credential. After reinstallation, Connect Colvor generates new credentials. If the same site URL still belongs to an Anonymous Guest workspace and WordPress ownership proof succeeds, Colvor reuses that Site and Workspace and rotates its connection credentials, preserving the cloud announcement settings. A site belonging to a registered account requires login recovery. Failed proof cannot recover a site.

= Does my WordPress REST API need to be reachable? =

Yes. Colvor must be able to reach the public connection-proof endpoint over HTTP(S) to verify a new connection, a changed URL, or a Guest reinstallation. The endpoint signs only with this WordPress installation's stored secret and does not reveal it. A firewall or REST restriction that blocks the endpoint prevents verification.

= Where are subscription and feature permissions calculated? =

Colvor calculates the effective plan and capabilities. The WordPress plugin consumes that result and does not make pricing or entitlement decisions locally.

== Changelog ==

= 0.4.2 =

* Add a public HMAC connection-proof endpoint for one-click Free Direct Bind and Site URL changes.
* Preserve newly generated installation credentials when saving the site token.
* Support proof-verified Guest recovery after uninstalling and reinstalling, preserving the cloud Site, Workspace, and configuration. Registered accounts still require login recovery.
* Document the installation secret sent to Colvor, server-to-server proof, and separate registered-account authorization flow.

= 0.4.1 =

* Replace the browser cross-site POST connection handoff with a one-time token and GET authorization flow.
* Keep the connection token short-lived and exchange it server-side for the long-lived site credential.

= 0.4.0 =

* Connect a WordPress site directly to a Free guest workspace without registration or login.
* Persist the installation identity and site credential in WordPress.
* Reopen the same workspace through a short-lived, one-time dashboard handoff.

= 0.3.7 =

* Refresh an open page at most once per minute while keeping the initial check immediate.
* Acquire the local sync lock before contacting Colvor and keep the last valid configuration during outages.

= 0.3.6 =

* Center a single announcement when the Pro scroll speed is set to zero.

= 0.3.5 =

* Place optional separators between repeated announcement items so they are centered between messages.

= 0.3.4 =

* Use the same announcement-bar runtime for live front-end refreshes and dashboard previews.
* Keep the marquee structure, spacing, link behavior, separator, and static mode consistent.

= 0.3.3 =

* Refresh an open WordPress page automatically after a cloud configuration change.
* Keep the site credential on the WordPress server while the same-origin refresh endpoint returns only public announcement state.

= 0.3.2 =

* Add an optional Pro scroll separator.
* Show one announcement without looping when the Pro scroll speed is set to zero.

= 0.3.1 =

* Add Pro control for showing or hiding the announcement link underline.
* Keep new announcement links empty by default.

= 0.3.0 =

* Add Pro display scope for all pages or selected page paths.
* Add a Pro scroll-speed slider and live announcement preview in the Colvor dashboard.
* Keep Free configuration limited to announcement text and visibility.

= 0.2.0 =

* Use browser authorization as the connection flow.
* Synchronize cloud configuration with ETag caching.
* Add a user-controlled announcement display setting.
* Add WordPress privacy policy content and uninstall cleanup.
* Add the native WordPress plugin details dialog while directory review is pending.
* Add a Settings shortcut to the installed plugins list.
* Use translatable English strings throughout the WordPress admin interface.
* Simplify the disconnected settings screen to one short explanation and one connection button.

= 0.1.0 =

* Initial connector release.
