=== IoT Data Widget ===
Contributors: wpveloxa
Tags: home assistant, smart home, iot, shortcode
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Show live data from your smart home devices on your WordPress site with a shortcode or block. Pro adds more data sources, history graphs and alerts.

== Description ==

IoT Data Widget lets you embed live values from smart home sensors and devices — temperature, humidity, tank levels, device status, anything with a numeric or text value — on any WordPress page or post. Activating the plugin drops you straight into a guided setup wizard that gets you from "no connection" to a working widget and a ready-to-paste shortcode in a few clicks.

The free version is fully functional, not a crippled trial: unlimited connections, Home Assistant, push mode, Generic REST, the Card/Status list/Gauge display styles, the shortcode and Gutenberg block, the setup wizard, and the diagnostics page all work with no time limit and no license. Pro adds more data sources, history graphs and alerts — see "What's included in Free vs Pro?" in the FAQ below for the full breakdown.

== Installation ==

1. Upload the `iot-data-widget` folder to `/wp-content/plugins/`, or install the zip through **Plugins → Add New → Upload Plugin**.
2. Activate the plugin through the **Plugins** screen — this opens the **setup wizard** automatically (skip this step by activating several plugins at once, or by clicking "Skip the wizard" on its first screen).
3. Follow the wizard: pick a connection type, configure and test it live, choose an entity, and copy the ready-made shortcode from the preview screen — or configure a connection manually under **IoT Data Widget** in the admin menu instead:
   * **Home Assistant**: enter your instance URL (e.g. `http://homeassistant.local:8123`) and a Long-Lived Access Token. Generate one in Home Assistant under your profile page → **Security** → **Long-Lived Access Tokens** → **Create Token**.
   * **Push mode**: no URL/credentials to enter — the wizard generates a channel and a ready-to-paste snippet for your device instead.
   * **Generic REST, advanced mode**: enter the full URL of a JSON endpoint. Leave Authorization empty for public APIs, or enter a full header (e.g. `Authorization: Bearer xxx` or `X-API-Key: xxx`) if the API requires one.
4. Add the widget to a page (the wizard already does this for you, with a shortcode ready to paste):
   * **Gutenberg**: insert the "IoT Data Widget" block, pick your connection and entity in the sidebar — for Home Assistant, search and filter by domain instead of typing an entity ID.
   * **Shortcode**: use `[iotdw_widget]` directly — see the FAQ below for examples.

== Screenshots ==

1. Card, gauge and list widgets showing live values on a page.
2. The setup wizard previews the widget and gives you a ready-to-paste shortcode.
3. Insert the IoT Widget block and choose the connection, entity and style in the sidebar.
4. The wizard starts by asking where your site runs, so the device and WordPress can actually reach each other.

== Frequently Asked Questions ==

= Where's the human-readable source for the minified JavaScript? =

`blocks/iot-widget/build/index.js` (the Gutenberg block editor script) is a compiled bundle. Its full, human-readable source is included in this plugin's ZIP at `blocks/iot-widget/src/` — build it yourself with `npm install && npm run build` (standard `@wordpress/scripts` toolchain, see `package.json`).

= What's included in Pro? =

Free (no time limit, no license, unlimited connections): Home Assistant, push mode, Generic REST data sources; Card/Status list/Gauge display styles; the setup wizard, shortcode, Gutenberg block, and diagnostics page.

= What shortcode examples are there? =

Card (single value): `[iotdw_widget connection="Home" entity="sensor.living_room_temperature"]`

Status list (several entities at once): `[iotdw_widget connection="Home" style="list" entities="sensor.temperature,sensor.humidity,sensor.battery"]`

Gauge (numeric value with a min/max range): `[iotdw_widget connection="Home" style="gauge" entity="sensor.tank_level" min="0" max="100"]`

Generic REST (entity is a JSONPath into the JSON response): `[iotdw_widget connection="Weather API" entity="current_weather.temperature"]`

Entities with a non-numeric state (a relay's on/off, a presence sensor's home/away...) show their real value ("ON", "true") in Card and Status list styles.

= I don't want to use the setup wizard — can I skip it? =

Yes, every wizard screen has a "Skip the wizard, I'll configure manually" link that takes you straight to the regular Connections page, where everything works exactly as it did before the wizard existed. Nothing about manual configuration changed or was removed.

= Can I run the setup wizard again after my first connection? =

Yes — click "Run the setup wizard again" on the Connections page. It always creates a brand-new connection through the same guided steps; it never edits or overwrites one you already have.

= Why didn't activating the plugin open the setup wizard? =

If you activated several plugins at once (the "bulk actions" checkbox list on the Plugins screen), the wizard intentionally doesn't open — a redirect in the middle of a bulk action would be disruptive. Open it anytime from **IoT Data Widget → Setup Wizard** in the admin menu.

= How do I get a Home Assistant Long-Lived Access Token? =

In Home Assistant, click your username in the bottom-left corner to open your profile, scroll to **Security**, then **Long-Lived Access Tokens** → **Create Token**. Copy it immediately — Home Assistant only shows it once.

Home Assistant doesn't let you limit what a token can do — it inherits the full permissions of whichever account created it, and it never expires until you revoke it. We recommend creating a separate, non-administrator account in Home Assistant just for this token. If your WordPress site is on external/shared hosting, also consider push mode instead — it never stores a Home Assistant token at all.

= How are my device credentials protected? =

Credentials you enter (Home Assistant tokens, MQTT broker passwords, Shelly Cloud keys) are encrypted before being stored in your WordPress database, using a key derived from your site's own configuration. This protects them if the database itself leaks — a backup, a database dump, a SQL injection in an unrelated plugin on the same install, or a staging clone. It does **not** protect against someone who has already fully compromised your server, since the encryption key lives on that same server.

If you ever uninstall the plugin, we recommend also revoking the Home Assistant token (and rotating any MQTT/Shelly Cloud credentials) from the device/service side.

Push mode sidesteps this entirely: the plugin never stores any credentials to your devices, because your device sends data to the plugin instead of the other way around.

= Does this work with any REST API, or only Home Assistant? =

Both. The Generic REST connector (free) works with any API that returns JSON over HTTP(S), authenticated or not.

= Does the plugin send my data anywhere else? =

No. The values shown in your widgets never leave your own WordPress installation to any third party — the plugin only connects to the URL you configure in each connection. See "External services" below for the small number of exceptions.

= What happens if a connection or entity is misconfigured? =

The widget fails gracefully: site visitors simply see nothing where the widget would be, while logged-in administrators see a clear error message in its place.

= Will this hit my Home Assistant instance on every page view? =

No — responses are cached for 60 seconds by default (not configurable per widget in this version), so repeated page views within that window are served from cache.

= Something isn't working — what's the fastest way to get help? =

Go to **IoT Data Widget → Diagnostics** and click "Copy diagnostic report", then paste it into your support email or ticket. Tokens, keys and passwords are never included in the report.

= What languages does the plugin come with? =

English by default. Additional languages are provided via [translate.wordpress.org](https://translate.wordpress.org/) — any string not yet translated falls back to English.

= What's the plugin's privacy policy? =

No telemetry beyond the opt-in Freemius diagnostics (see "External services" below); the plugin author never sees your data or connection details. Credentials are encrypted at rest. Fetched values are cached temporarily (WP Transients, 60s default), not logged or retained beyond that. Uninstalling leaves your data in place unless you check "Remove all plugin data" under Settings first. If the external API/instance you connect to processes personal data, your site's own privacy policy should disclose that connection.

== External services ==

This plugin connects to two services that are **not** the smart-home API/device you configure yourself:

* **Freemius** (licensing, update delivery, and — if you opt in — basic usage analytics). On first activation you're asked whether to allow anonymous diagnostic data (server environment, WordPress/PHP version, plugin version, site URL) to be sent — you can decline, and review/opt out again later from your account on freemius.com. No data about your connections, entities, or the values they return is ever included. [Terms of Service](https://freemius.com/terms/), [Privacy Policy](https://freemius.com/privacy/).
* **Open-Meteo** (optional, user-triggered) — clicking "Try it with demo data" in the setup wizard fetches live weather for a Warsaw coordinate pair from [Open-Meteo](https://open-meteo.com), purely to show a working example widget. No account or personal data involved. [Terms & Privacy](https://open-meteo.com/en/terms). Skip this step and no request is ever made.

Every other outbound request goes only to the URL/host **you** configure for a connection.

== Changelog ==

= 1.0.0 =
Initial release.

* Home Assistant, push mode, and Generic REST connectors — all free, with no connection limit.
* Guided setup wizard: pick a connection type, configure and test it live, choose an entity, and get a ready-to-paste shortcode before anything is saved.
* Card, Status list and Gauge display styles — free. Chart, Mini trend/sparkline, and Grid (recorded history) — Pro.
* `[iotdw_widget]` shortcode and a Gutenberg block with a searchable entity browser and live preview.
* Connection credentials are encrypted at rest.
* Built-in response caching, always on.
* Appearance personalization — site-wide defaults with a live preview, and per-widget overrides in the block editor.
* Diagnostics page with environment info, scheduled-task status, per-connection health (including push channel activity), and a one-click "Copy diagnostic report" button.

