=== DadsFam Invoice Manager ===
Contributors: dadsfam
Tags: woocommerce, invoices, pdf, protected-storage, invoice-download
Requires at least: 6.1
Requires PHP: 8.1
Tested up to: 7.0
Stable tag: 2.1.5
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Secure WooCommerce invoice manager — upload, store, track and deliver PDF invoices with signed expiring download links and customer My Account access.

== Description ==

**DadsFam Invoice Manager** is the free base plugin of a freemium WooCommerce invoice solution. It handles secure upload, management, payment tracking and delivery of PDF invoices.

Install **DadsFam Invoice Manager PRO** alongside it for the full invoice generator, automatic PDF creation, PDF status sync, automated payment reminders, bulk upload and the audit log. The PRO add-on requires this free plugin to be installed and active.

**Free Features:**

* Upload and manage PDF invoices per WooCommerce order
* Protected folder storage (blocks direct URL access) or Media Library mode
* HMAC-signed, single-token expiring customer download links
* Payment status tracking (Paid / Unpaid / Overdue / Cancelled) with one-click change
* Email status tracking (Uploaded / Sent / Resent)
* Resend an invoice email to the customer at any time
* CSV export of all invoice records
* Missing-invoices tracker with ignore / restore
* Customer My Account → Invoices integration (download + email-me)
* Custom From Name / From Email (fixes the wordpress@ sender bug)
* Full email branding — logo, header/button/text colours, footer text and social links
* Complete HTML email template editor with live preview and placeholders
* Configurable download-link validity
* Accent colour customisation

**PRO Features (get PRO at [plugins.dadsfam.co.za](https://plugins.dadsfam.co.za/)):**

* **Invoice Creator** — generate professional PDF invoices from any WooCommerce order in one click
* **Auto-Generation** — create invoices automatically when an order reaches a chosen status
* **Smart Email Triggers** — email the customer on a separate configurable status
* **PDF Status Sync** — the invoice PDF re-stamps itself from UNPAID to PAID when the order (or the manual status dropdown) changes — no delete-and-recreate
* **Product Variations & Bundles on the PDF**
* **Invoice Settings** — company logo, address, tax/VAT number, banking details, payment terms and numbering
* **Automated Payment Reminders** (cron)
* **Bulk Upload** via ZIP + CSV mapping
* **Audit Log** of every admin action

== Installation ==

1. Upload the `dadsfam-invoice-manager` folder to `/wp-content/plugins/`
2. Activate through the **Plugins** menu in WordPress
3. Go to **Invoices** in your WP Admin sidebar
4. Set your From Email in **Invoices → Email Settings**
5. *(Optional)* Install and activate **DadsFam Invoice Manager PRO** to unlock generation, PDF status sync, branding and more

== Frequently Asked Questions ==

= What is the difference between free and PRO? =
The free plugin lets you upload, manage, track and deliver existing PDF invoices. PRO adds the Invoice Creator (generates PDFs from WooCommerce orders), auto-generation, PDF status sync, automated payment reminders, bulk upload and the audit log. PRO requires this free plugin to be active.

= Where are invoices stored? =
By default in a protected folder inside your WordPress uploads directory, blocked from direct public access via .htaccess. You can switch to Media Library mode in General Settings.

= Can customers download their invoices? =
Yes — invoices appear in the customer's My Account → Invoices tab with signed, expiring download links, plus an "Email Me" button.

= When I change the payment status, does the PDF update? =
The badge updates everywhere immediately. Re-stamping the actual PDF document (e.g. UNPAID → PAID) is done by the PRO add-on for invoices the plugin generated. Uploaded PDFs keep their original file.

= Why are my emails going to spam? =
Set a real From Email address on your own domain in Email Settings (e.g. invoices@yourdomain.com).

= Does this work with WooCommerce HPOS? =
Yes — fully compatible with WooCommerce High Performance Order Storage.

== Changelog ==

= 2.1.5 =
* Changed: all plugin and support links now point to https://plugins.dadsfam.co.za/ (the plugin site) rather than the main DadsFam site. Support email is unchanged at support@dadsfam.co.za.

= 2.1.4 =
* Security: colour values are now re-validated as literal hex colours at the moment they are written into a stylesheet, a style attribute or an email body, rather than being trusted from the options table. Options can be written by WP-CLI, an import or another plugin, so sanitising on save is not enough on its own — escaping now happens late, at the point of output, in the front-end My Account styles, the admin styles, the branded email header and the email template placeholders.
* Security: every placeholder substituted into the email template is now escaped for the context it lands in — the download link through `esc_url()`, the customer name and site name through `esc_html()`, and the order number and link expiry as integers.
* Security: the logo URL and its pixel dimensions in the branded email header are escaped and type-cast on output.
* Security: the payment-status badge in the Manage Invoices list is passed through `wp_kses_post()` on output instead of relying on the helper escaping its own contents.
* Quality: variables in the admin views that shared a name with a WordPress global (`$order`, `$status`, `$search`, `$paged`, `$tab`, `$tabs`, `$s`) were renamed to plugin-prefixed names.
* Quality: replaced the two remaining `@` error-suppression operators with real checks, made the `in_array()` comparisons strict, capped the invoice list query at 100 rows per view, and documented that the base64 helpers are URL-safe transport encoding for the signed download token, not obfuscation.

= 2.1.3 =
* Added: `DFIM_Loader::format_invoice_number()` and the `dfim_inv_number_format` option key, so the PRO add-on can build invoice numbers from a token pattern instead of a fixed one. As with the other PRO keys held here, the free plugin neither reads nor writes it.

= 2.1.2 =
* Added: `DFIM_Loader::normalize_status_list()`, a small shared helper so the PRO add-on's auto-generate/auto-email trigger options can hold more than one order status instead of only one. Added here because this is the shared base class both plugins extend — the free plugin itself does not call it for anything and gates no functionality on it.

= 2.1.1 =
* Compliance: audit logging is now entirely part of the separate PRO add-on. The free plugin no longer registers an audit post type or stores any audit data — it simply fires a `dfim_log` action hook that the PRO add-on can listen to. Nothing in the free plugin is locked, limited or gated.
* Removed: leftover licence-activation interface (the licence-key field handlers and its nonce) that belonged to the PRO add-on. The free plugin contains no licence checks and no licence storage of any kind.
* Changed: the two JavaScript data objects were renamed to the plugin's `dfim` prefix (`dfimAdmin`, `dfimFront`) so every registered global name is unique and distinct.

= 2.1.0 =
* Compliance: every feature contained in this plugin is now fully available to all users — the email branding suite (logo, colours, footer, social links, full template editor with live preview) has no licence conditions of any kind. This plugin contains no locked or limited functionality; additional features (invoice generation, reminders, bulk upload, audit log) exist only as a separate add-on plugin and are merely mentioned, per the directory guidelines.
* Changed: automated-reminder settings moved out of this plugin; they are configured inside the PRO add-on, where the reminder feature itself lives.
* Changed: the bundled Select2 library has been removed. Searchable dropdowns now use selectWoo, the maintained Select2 fork that ships with WooCommerce (which this plugin requires), so no third-party library is bundled.
* Changed: the My Account "Email Me" script moved from an inline template tag to a properly enqueued JavaScript file.
* Fixed: plugin and upgrade links now point to the live https://www.dadsfam.co.za/ site.

= 2.0.3 =
* Code quality: Plugin Check now reports zero errors and zero warnings. Uninstall variables carry the plugin prefix (uninstall runs in global scope), and the My Account template documents its function-local scope for the naming sniff.

= 2.0.2 =
* Code quality: full WordPress Coding Standards pass — the plugin now scans clean (0 errors, 0 warnings) under the official Plugin Check security, escaping, sanitization, database and naming sniffs.
* Security: every output is escaped or type-cast; every request input is unslashed and sanitized; all admin redirects use wp_safe_redirect(); direct file deletions use wp_delete_file().
* Fixed: the Missing Invoices pagination footer showed the last order's total instead of the result count (variable shadowing).
* Read-only display filters are explicitly annotated as nonce-exempt with justification.

= 2.0.1 =
* Security: the admin order-search AJAX endpoint now requires a CSRF nonce in addition to the existing capability check.
* Security: invoice file paths resolved from stored attachment metadata are strictly confined to the WordPress uploads directory, so tampered metadata can never point at arbitrary server files.
* Security: the email template preview endpoint now also verifies the WooCommerce-manager capability.
* Improved: escaped all admin URL output in the changelog pagination.

= 2.0.0 =
* Freemium split: this is now the free base plugin. All PRO features (Invoice Creator, auto-generation, PDF status sync, reminders, bulk upload, advanced branding, audit log) have moved to the separate **DadsFam Invoice Manager PRO** add-on, which requires this plugin to be active.
* New: Clean extension points (`dfim_core_booted`, `dfim_register_admin_menus`, `dfim_admin_assets`, `dfim_manage_tabs`, `dfim_render_manage_tab`, `dfim_manage_header_links`, `dfim_invoice_status_changed`, `dfim_is_pro_active`) let the PRO add-on plug in cleanly.
* Improved: The Manage Invoices payment dropdown now fires a status-change event so PRO can re-stamp the generated PDF instantly — no more deleting and re-uploading to fix a Paid/Unpaid stamp.
* Upgrading from a single-plugin (1.9.x) install: all your invoices, settings and license are preserved. Install the PRO add-on to restore generation and the other PRO features.

= 1.9.10 =
* Fixed: long invoices flow onto extra pages instead of being cut off (PRO).
* Changed: download-link validity setting consolidated to Email Settings → Download Links.

= 1.9.9 =
* Fixed: emailed download links no longer fail with "Invalid or tampered download link" — the link is now a single secure token.
* New: "Link valid for (days)" setting and {link_expiry_days} placeholder.

== Support ==

Email: support@dadsfam.co.za
Website: https://plugins.dadsfam.co.za
