=== Dashbread – Turn Your Site into a SaaS App ===
Contributors: digibread
Tags: dashboard, members, app, portal, client area
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 8.2
Stable tag: 1.3.10
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Turn your WordPress site into a SaaS app. Members get an app-grade dashboard that your other plugins run inside; your public site keeps any theme.

== Description ==

Dashbread adds a logged-in app at `/app` to any WordPress site. Your public site is untouched and keeps whatever theme it has. Signed-in members get something else: an app with its own sidebar, header, dashboard, notifications and pages, where every page or plugin you put inside it looks like part of one product instead of a stack of WordPress screens. Members never have to see wp-admin.

Everything in this plugin is fully functional, with no usage caps and no expiry.

Dashbread is made and maintained by Digital Bread, LLC ([digitalbread.com](https://digitalbread.com)). Docs and Dashbread Pro: [dashbread.com](https://dashbread.com).

= What you get =

* **The app at /app** – a responsive app shell (sidebar, header, breadcrumbs, light/dark mode) at a route you choose, with a conflict check.
* **Hosted pages** – tick "Show in Dashbread app" on any page or post and it opens inside the app, with a menu link, an icon and optional role visibility. Shortcodes from your other plugins (forms, courses, shops, support desks) work there as usual.
* **Menus** – an app sidebar, header and account menu under Appearance › Menus, with icons and per-role visibility per item.
* **Dashboard** – a real WordPress widget area. Use any widget; members can hide or collapse the ones they don't need.
* **Notifications** – an in-app bell and a full notifications page, with built-in notices and an API (`dashbread_notify()`) for other plugins.
* **Profile** – profile, avatar, email change with confirmation, password, notification preferences, appearance and account deletion requests.
* **Sign-in screens** – login, registration and password reset screens that match the app, with optional redirects away from wp-login.php and wp-admin for members.
* **Shortcodes** – `[dashbread_app_link]`, `[dashbread_login]`, `[dashbread_logged_in]`, `[dashbread_logged_out]`, `[dashbread_role]`, `[dashbread_show]`, `[dashbread_protect]`, `[dashbread_expire]` and `[dashbread_user]` for your public pages.
* **Admin** – a single Dashbread menu with Dashboard, Settings, Hosted pages, Notifications, Pro & Add-ons and Help screens.

= Dashbread Pro (optional) =

A separately sold Dashbread Pro adds staff tools such as members and companies screens, plans and memberships, messaging, email delivery, a drag-and-drop dashboard, a field builder and a customizer, plus optional add-ons. Dashbread works on its own without it.

= Source code =

The admin screens and app scripts ship built in `assets/build/`. Their readable source is included in the plugin under `app/` and is built with esbuild (`npm run build` in the project repository).

== External services ==

Dashbread does not connect to any external service. It makes no outbound requests, sends no data about your site or your members anywhere, and loads no files from other sites. (Member photos fall back to WordPress's own avatars, which come from Gravatar if avatars are on under Settings › Discussion; that is WordPress behavior, not Dashbread's.)

* The plans and add-ons on **Dashbread › Pro & Add-ons** and the guides on **Dashbread › Help** ship inside the plugin (`assets/data/`). They are updated with each release.
* Links to dashbread.com and to the WordPress.org support forum on those screens open only when an administrator clicks them, like any other link.
* Dashbread Pro, a separate plugin sold on dashbread.com and not part of this plugin, connects to dashbread.com for license checks, updates, live prices and guides, and support messages sent from the Help screen. Its own readme describes what it sends. Nothing in this plugin does so, with or without Pro installed.

== Installation ==

1. Install and activate Dashbread from Plugins › Add New, or upload the `dashbread` folder to `/wp-content/plugins/`.
2. Visit `/app` while signed in. That's the member app; your public pages don't change.
3. Put content in it: tick **Show in Dashbread app** on a page, add widgets to the **Dashbread Dashboard** widget area, and shape the sidebar under Appearance › Menus.
4. Brand it under **Dashbread › Settings**: name, logo, primary color, preset, light or dark.

== Frequently Asked Questions ==

= Does Dashbread change my theme or public pages? =

No. The app lives at its own route (`/app` by default). Everything else on your site keeps your theme.

= Will my other plugins work inside the app? =

Any page or post can be shown in the app. If a plugin works through a shortcode or block on a page, it works in the app too.

= Can members still reach wp-admin? =

By default, members without editing rights are sent to the app instead of wp-admin and don't see the admin bar. Each of these is a switch under Dashbread › Settings.

= Can I change /app to something else? =

Yes, under Dashbread › Settings. Dashbread checks the new address doesn't clash with an existing page.

= Does Dashbread add a credit link to my site? =

Only if you ask it to. "Powered by Dashbread" in the app footer is off unless you turn it on under Dashbread › Settings.

= What happens to my data if I delete the plugin? =

Deleting Dashbread from the Plugins screen removes its settings, its notifications table, and the user and page meta it added. Your pages, menus and users stay.

== Screenshots ==

1. The member app: a widget dashboard inside the app shell, with the sidebar, notifications bell and account menu.
2. Any page or post shown inside the app, with its own sidebar link and icon.
3. In-app notifications in the header panel.
4. The member profile manager: photo, name, contact details, password, notifications, appearance and account.
5. The sign-in screen that matches the app.
6. Dashbread › Hosted pages: choose which pages appear in the app, their icons, order and who can see them.
7. Dashbread › Settings: app route, name, logo, footer, color and light/dark mode.

== Changelog ==

= 1.3.10 =
* Signing in from a limited page's link keeps the rest of the link (such as tracking tags like ?utm_source=) and goes straight to the page, without an extra redirect.

= 1.3.9 =
* Fix: signing in from a limited page's address takes members straight to that page in the app again (1.3.8 sent them to the dashboard).
* Privacy: a page limited to certain roles or plans now behaves exactly like a page that doesn't exist for anyone who can't open it, also in feeds, embeds, preview links, comment forms and the site's API (including saves and comments).

= 1.3.8 =
* Privacy: closed the remaining ways a page limited to certain roles or plans could be told apart from a page that doesn't exist, or have its address or title read, by someone who can't open it: the site's API (including "include" lists, search, revisions and response headers), embeds (oEmbed) and links by page number (?p= and ?page_id=). People who can open the page see it as usual.
* Signing in from a limited page's address now brings you back to that address.

= 1.3.7 =
* Privacy: asking the site's API for a page limited to certain roles or plans, by its number, now answers "not found" for anyone who can't open it, exactly like a number that isn't used. Before, the answer revealed the page's address. People who can open the page see it as usual.

= 1.3.6 =
* Faster pages on sites with many pages limited to roles or plans: the check that keeps them private now takes a handful of database queries instead of two per limited page, and none for administrators.
* Fix: site tools that run without a signed-in user, such as WP-CLI (`wp post list`) and scheduled tasks, see every page again instead of only public ones. Page content stays private.

= 1.3.5 =
* Navigation menus in block themes (such as Twenty Twenty-Five) now leave out links to pages limited to certain roles or plans for people who can't open them.
* Fix: on sites with many app pages, page limits now apply to every page. Before, pages past the first 100 could show to the wrong people or be hidden from the right ones.

= 1.3.4 =
* Pages limited to certain roles or plans are now also left out of search results, page lists, menus and the site's API for people who can't open them, so their titles stay private too.
* Staff who can edit a limited page now see it in the app as well, matching what they see on the site.

= 1.3.3 =
* Security fix: a page shown in the app and limited to certain roles (or to a Dashbread Pro membership plan) is now limited everywhere. Before, its content could still be read at the page's normal address and through the site's API. Visitors who may not see it are now sent to the app (signing in first), and its text is left out of the API, search results and feeds. Pages without a limit are unchanged.

= 1.3.2 =
* Fix: when Dashbread Pro is installed but has no active license, pages limited to a membership plan stay closed and out of the app menu. Before, their content was shown to every member.

= 1.3.1 =
* Fix: changing the app address in Settings (for example from /app to /portal) now takes effect right away. Before, the old address kept working and the new one could fail until permalinks were saved again.
* Fix: the "Upload photo" button on the Profile page uploads the photo as soon as you pick it.
* Fix: with "Keep members out of wp-admin" on, members who open a wp-admin link they can't use (Posts, Media, Settings...) are taken to the app instead of WordPress's "Sorry, you are not allowed" page.
* Fix: signing in from a link that ends in #something (a deep link to a folder, for example) takes you to that exact spot afterwards.
* Fix: an app address that doesn't exist answers "Page not found" with a proper 404, so search engines and uptime checks see it correctly.
* Fix: when Dashbread Pro is switched off, pages that need it (plan-only pages and form pages) leave the app menu instead of showing empty, and plan-only pages stay closed.

= 1.3.0 =
* New: a Support link at the far right of the Dashbread admin header, next to the light/dark switch. One click opens Help & Support, so the guides are always one step away.
* Dashbread now needs PHP 8.2 or newer, as PHP 8.1 is no longer supported. Sites still on PHP 8.1 stay on Dashbread 1.2.1 until their host moves them to PHP 8.2 or later. Ask your host to upgrade PHP if 1.3.0 doesn't show up as an update.
* Dashbread Pro 1.3.0, released alongside, keeps your Pro features working after a license expires. See dashbread.com for its notes.

= 1.2.1 =
* Fix: with WooCommerce's "Coming soon" mode on, the sign-in screen showed the coming soon page instead, so nobody could sign in (wp-admin included). The app's screens are now left out of coming soon mode; the rest of the site stays hidden.

= 1.2.0 =
* New: an Email preferences tab on the member's Profile when Algamail (algamail.com, sold separately) is active. Algamail fills it with the member's email choices; Dashbread does nothing with it otherwise.
* The Communications add-on is gone from Dashbread › Pro & Add-ons and its guide from Help. In its place, an Algamail card: Algamail (algamail.com, sold separately) is now the email, newsletter and CRM layer for Dashbread.
* Developers: the `dashbread_notified` action is documented as a stable hook (notification ID, user ID, type, payload).

= 1.1.0 =
* New: a "Check for updates" link on the Plugins screen asks for updates right away instead of waiting for WordPress' twice-daily check.
* New: the Plugins screen and Dashbread › Dashboard say whether Dashbread and Dashbread Pro are on the latest version.
* Dashbread and Dashbread Pro now have their own version numbers. Each Pro release names the oldest Dashbread it needs, and a Pro update waits until Dashbread is new enough, so "Update all" and automatic updates are safe in any order.
* Database upgrades after an update run once, even when several pages load at the same moment.

= 1.0.2 =
* Fix: the icon preview on Dashbread › Hosted pages shows every icon the picker offers, not just a short built-in list.
* Fix: notifications show the icon they were sent with (any icon in the set), instead of falling back to a bell.
* Readme: screenshot captions match the screens.

= 1.0.1 =
* New name: Dashbread (slug, text domain, settings, hooks and REST namespace).
* Security hardening: every form handler verifies its own nonce; the sign-in, registration and lost-password forms carry nonces; profile custom fields are sanitized as they are read; HTML built by the app's helpers is escaped with wp_kses() where it is printed.
* Admin notices appear only on Dashbread's own screens and can be dismissed; the Pro notes on the member profile page are gone.
* Translations: role names, numbers and dates follow the site language; the account-deletion email is translatable.

= 1.0.0 =
* First public release.
* The app shell at a route you choose, with hosted pages, app menus with icons and role visibility, a widget dashboard members can tidy, and light/dark mode.
* In-app notifications with a bell, a full page and a developer API.
* Profile manager: avatar, email change with confirmation, password, notification preferences, appearance and account deletion requests.
* Matching sign-in, registration and password screens, with optional redirects away from wp-login.php and wp-admin for members.
* Shortcodes for app links and logged-in/logged-out content.
* Admin screens: Dashboard, Settings, Hosted pages, Notifications, Pro & Add-ons, Help. The add-on catalog and the Help guides ship with the plugin; Dashbread makes no outbound requests.
* "Powered by Dashbread" in the app footer is opt-in (off by default).
* Uninstall removes Dashbread's own settings and data.

== Upgrade Notice ==

= 1.3.10 =
Signing in from a limited page's link keeps its tracking tags.

= 1.3.9 =
Signing in from a limited page lands on it again; limited pages stay private in feeds, embeds and comments.

= 1.3.8 =
Limited pages stay private through the API, embeds and page-number links.

= 1.3.7 =
The site's API no longer reveals the addresses of limited pages.

= 1.3.6 =
Faster page loads on sites with many limited pages; WP-CLI and scheduled tasks see every page again.

= 1.3.5 =
Block-theme menus hide limited pages, and page limits hold on sites with many app pages.

= 1.3.4 =
Limited pages' titles stay private in search, menus and the API.

= 1.3.3 =
Security fix: pages limited to certain roles or plans are no longer readable outside the app. Update recommended.

= 1.3.2 =
Keeps plan-only pages closed when Dashbread Pro has no active license.

= 1.3.1 =
Fixes changing the app address, profile photo uploads, wp-admin links for members, and keeps Pro-only pages closed while Pro is off.

= 1.3.0 =
Requires PHP 8.2 or newer (sites on PHP 8.1 keep 1.2.1). Adds a Support link to the admin header.

= 1.2.1 =
Fixes signing in while WooCommerce's Coming soon mode is on.

= 1.2.0 =
Adds an Email preferences tab to the member profile when Algamail is active.

= 1.1.0 =
Adds a Check for updates link. Update all and automatic updates are safe: Dashbread and Dashbread Pro version independently, and Pro waits for the Dashbread it needs.

= 1.0.2 =
Fixes icons on the Hosted pages screen and in notifications.

= 1.0.0 =
First public release.
