=== Destino Access Audit ===
Contributors: destinoexterior
Tags: security, audit, application passwords, mainwp, updraftplus
Requires at least: 5.6
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.4.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Audit who has access to your site: Application Passwords, admin accounts, and connected remote management tools in one dashboard.

== Description ==

Destino Access Audit adds a single admin page (**Tools → Destino Access Audit**) that centralizes the answer to one question: *who, and what, currently has access to this site?*

The page is read-only audit information except for one deliberate action — revoking an Application Password — which delegates entirely to WordPress core's own API. Destino Access Audit never creates, modifies, or stores any remote-management connection itself.

**What it shows**

* **Application Passwords** — every active Application Password on the site (all users), with creation date, last used date, last IP, and a one-click **Revoke** button (AJAX, no page reload) plus a **CSV export**.
* **Administrator Users** — a plain list of every user with the `administrator` role, with a direct link to edit each one. Useful for spotting an admin account you don't recognize.
* **UpdraftPlus / UpdraftCentral** — whether UpdraftPlus is installed/active, a direct link to its settings screen, whether it is connected to an UpdraftCentral dashboard (including *which* WordPress user made that connection), and whether UpdraftPlus's own password-protected "Lock Settings" feature is currently hiding that screen.
* **MainWP Child** — whether MainWP Child is installed/active, a direct link to its settings screen, whether it is paired with a MainWP Dashboard, and *which* WordPress user established that pairing.
* **ManageWP Worker** — installed/active status. ManageWP Worker pairs with its dashboard through an OpenSSL key exchange with no locally readable "connected" flag, so this block documents that limitation instead of guessing.
* **InfiniteWP Client** — installed/active status, with the same honest limitation note as ManageWP Worker.

**Security notes**

* Every write action (revoking a key) is protected by a nonce, a `manage_options` capability check, and a second capability check (`edit_user`) specific to the user who owns the key.
* The CSV export is generated server-side and neutralizes fields that could be interpreted as spreadsheet formulas (CSV/Excel formula injection).
* The dashboard itself requires the `manage_options` capability to view.

== Installation ==

1. Upload the `destino-access-audit` folder to `/wp-content/plugins/`, or install the plugin zip through **Plugins → Add New → Upload Plugin**.
2. Activate the plugin through the **Plugins** menu in WordPress.
3. Go to **Tools → Destino Access Audit**, or use the **Settings** link on the plugin's row on the Plugins page.

== Frequently Asked Questions ==

= Does this plugin modify or create any remote connections? =

No. It is read-only with respect to UpdraftCentral, MainWP, ManageWP, and InfiniteWP. The only write action anywhere in the plugin is revoking an Application Password, which calls WordPress core's own `WP_Application_Passwords::delete_application_password()`.

= Why don't ManageWP Worker and InfiniteWP Client show a "Connected" status? =

Both plugins pair with their remote dashboard using an OpenSSL key exchange rather than a locally readable option or user meta. There is no reliable local signal to read, so instead of guessing (and risking a false positive or negative in a security tool) Destino Access Audit shows an honest "Not determinable" badge and points you to the plugin's own connection-management screen.

= Does the plugin store any data of its own? =

No. It has no settings, no database tables, and no options. It only reads data already stored by WordPress core and by the other plugins it reports on.

= Does deactivating or deleting Destino Access Audit affect Application Passwords or any remote connection? =

No. Destino Access Audit never owns that data; it only displays it.

== Screenshots ==

1. Application Passwords table, with Revoke and CSV export.
2. Administrator Users list.
3. UpdraftPlus / UpdraftCentral connection status.
4. MainWP Child connection status.

== Changelog ==

= 1.4.0 =
* Renamed the plugin from "WhoHasAccess" to "Destino Access Audit" at the request of the WordPress.org Plugin Review Team, who flagged "WhoHasAccess" as a likely existing project/trademark name. No public version was ever released under the old name.
* Moved the admin page from its own top-level menu item into Tools → Destino Access Audit, so it stops competing for space in the main admin menu.
* Added a "Settings" link to the plugin's row on the Plugins page, next to Deactivate.
* MainWP Child: added a direct link to its settings screen.
* UpdraftPlus: added a direct link to its settings screen, plus a badge reporting whether UpdraftPlus's own "Lock Settings" feature (Advanced Tools tab) is currently hiding that screen behind a password, with instructions on how to review or remove that lock. Destino Access Audit only reports this status — it never reads, writes, or removes the lock itself.
* Fixed all findings from the official Plugin Check tool: escaping false-positives, the discouraged `load_plugin_textdomain()` warning, and a short description over the 150-character limit.
* Removed the bundled `languages/` folder and the `load_plugin_textdomain()` call: WordPress.org plugins must not ship their own `.po`/`.mo` files, since translate.wordpress.org generates and serves them automatically once the text domain matches the plugin slug.
* Replaced the escaping-related `phpcs:ignore` comments with an actual fix (wrapping the affected output in `wp_kses_post()`), following a second Plugin Review pass.

= 1.3.0 =
* MainWP Child: now shows which WordPress user established the connection to the MainWP Dashboard (read from the `mainwp_child_connected_admin` option), with a link to that user's profile — mirroring what the UpdraftCentral block already did.
* New "Administrator Users" section: a separate list of every user with the `administrator` role on the site, with a direct edit link for each.
* Moved the bundled translations into the `languages/` folder, matching the `Domain Path` header (they were previously left in the plugin root, where local/non-WordPress.org installs could not load them).
* Added this readme.txt.

= 1.2.0 =
* Renamed the plugin from "Who Control" to "WhoHasAccess" (class, text domain, menu slug, asset handles, nonce/AJAX action names, and CSS classes all updated to match).
* Translated all code and user-facing strings to English, in preparation for the WordPress.org plugin directory.
* Added a `languages/` folder with a `whohasaccess.pot` template and a Spanish (es_ES) translation.

= 1.1.0 =
* AJAX revoke for Application Passwords, without leaving the page.
* New read-only blocks for ManageWP Worker and InfiniteWP Client.
* CSV export (UTF-8 with BOM) of the Application Passwords table.
* Hardening: nonces on every write/delete action, sanitization of `$_POST`/`$_GET`, an extra per-user capability check before revoking.

= 1.0.0 =
* Initial version: Application Passwords (read-only), UpdraftPlus/UpdraftCentral, MainWP Child.

== Upgrade Notice ==

= 1.4.0 =
Renamed from "WhoHasAccess" to "Destino Access Audit" (slug and text domain changed). No public version was ever released under the old name. Bundled translation files were removed; WordPress.org now manages translations for this plugin.
