=== Kudzu Social Login ===
Contributors: kudzuai
Donate link: https://kudzu.ai
Tags: login, google, apple, oauth, social
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Let visitors sign in with Google, Apple, Microsoft, Facebook, LINE, GitHub, or Discord.

== Description ==

Kudzu Social Login is built by Abdallah Abbasi at [KUDZU](https://kudzu.ai).

Add provider cards under Settings → Kudzu Social Login. Enable a provider, paste its app credentials, verify the connection, and show buttons on the WordPress login page, with the `[kdzsl_login]` shortcode, or with the Kudzu Social Login block.

Supported providers:

* Google
* Apple
* Microsoft
* Facebook
* LINE
* GitHub
* Discord

== Installation ==

1. Upload the `kudzu-social-login` folder to `/wp-content/plugins/`.
2. Activate the plugin through the Plugins menu.
3. Open Settings → Kudzu Social Login.
4. Click Configure on a provider, follow the setup steps, paste the Redirect URI into that provider’s console, then Verify Settings.

== Frequently Asked Questions ==

= Where do the buttons appear? =

You choose: the WordPress login page, the registration form, the `[kdzsl_login]` shortcode, a Gutenberg block, or `kdzsl_the_buttons()` in a theme.

= Google says redirect_uri_mismatch =

Copy the Redirect URI from Settings → Kudzu Social Login → Configure Google and paste it into Authorized redirect URIs. It must match exactly, including http/https, host, port, and the `/kdzsl/callback/google` path. Do not register the site homepage.

= Do I need HTTPS? =

Yes for most providers on a public site, including Sign in with Apple.

== External services ==

This plugin does not send data to kudzu.ai. It connects to an identity provider only when an administrator turns that provider on and a visitor chooses it, or when an administrator clicks Verify Settings.

On Verify Settings, the site sends that provider’s app credentials to the provider’s token address to check that they are accepted. No visitor profile is requested.

When a visitor clicks a provider button, the browser is sent to that provider to approve access. The site then sends the returned authorization code, and the app secret, to the provider’s token address. It then requests the profile fields that provider offers: user id, email, name, and avatar URL. Those values are used only to find, create, or sign in a WordPress user on this site. Nothing is sent until that visitor starts sign-in with that provider.

* Google — sign in with a Google account. [Terms of Service](https://policies.google.com/terms), [Privacy Policy](https://policies.google.com/privacy).
* Apple — Sign in with Apple. [Terms of Service](https://www.apple.com/legal/internet-services/terms/site.html), [Privacy Policy](https://www.apple.com/legal/privacy/).
* Microsoft — sign in with a Microsoft account. [Terms of Service](https://www.microsoft.com/en-us/servicesagreement), [Privacy Policy](https://www.microsoft.com/en-us/privacy/privacystatement).
* Facebook — sign in with a Facebook account. [Terms of Service](https://www.facebook.com/terms.php), [Privacy Policy](https://www.facebook.com/privacy/policy/).
* LINE — sign in with a LINE account. [Terms of Service](https://terms.line.me/line_terms?lang=en), [Privacy Policy](https://www.lycorp.co.jp/en/company/privacypolicy/).
* GitHub — sign in with a GitHub account. [Terms of Service](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service), [Privacy Policy](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement).
* Discord — sign in with a Discord account. [Terms of Service](https://discord.com/terms), [Privacy Policy](https://discord.com/privacy).

== Screenshots ==

1. Provider cards under Settings → Kudzu Social Login.
2. Display settings for where the buttons appear, the role given to new users, and the page shown after sign-in.
3. Help for placing the buttons on the login page, with the shortcode, the block, or a theme function.

== Changelog ==

= 1.0.4 =
* Document the theme snippet as echo kdzsl_the_buttons().

= 1.0.3 =
* Load the button stylesheet when the buttons are placed with a shortcode or block.

= 1.0.2 =
* Clear Plugin Check warnings about unprefixed variables and core login hooks.

= 1.0.1 =
* Restrict new social accounts to subscriber-level roles, bind each login to the browser that started it, and document the identity providers this plugin contacts.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.0.1 =
New social accounts are limited to subscriber-level roles. Update any provider Redirect URI that still uses the old callback path.

= 1.0.0 =
Initial release.
