=== MediaNest Upload Manager ===
Contributors: dilip2615, rafikwp, dixitpujara
Tags: media, upload, files, directory, import
Requires at least: 6.7
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 2.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Upload files into a dedicated uploads subfolder, browse from wp-admin, and import into the Media Library.

== Description ==

MediaNest Upload Manager is a complete media staging and workflow platform for WordPress.

*Features:*

* Chunked uploads (Plupload) with pause/cancel
* Folder drag-and-drop upload
* Directory browser with search and filter
* File preview (images, PDF) and URL copy
* Delete, rename, and move files
* Single, bulk, and folder import to Media Library
* Import status tracking in tree view
* Settings page (file types, roles, duplicates, import destination)
* Activity / audit log
* REST API (`/wp-json/mediupma/v1/`)
* Action/filter hooks for developers
* Gutenberg block: MediaNest File Browser
* Frontend shortcode: `[medianest_upload folder="client-name"]`
* Webhook notifications (optional)

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/`
2. Activate the plugin through the Plugins menu in WordPress
3. Go to Media -> MediaNest Upload Manager
4. Configure settings at Media -> MediaNest Settings

== Frequently Asked Questions ==

= Does this plugin create files outside WordPress uploads? =

No. All content stays inside your WordPress uploads directory.

= Can I allow video files? =

Yes. Go to Media -> MediaNest Settings and configure allowed extensions.

= How do I add frontend upload for clients? =

Use the shortcode: `[medianest_upload folder="client-deliveries" roles="subscriber"]`

== Shortcode ==

Display a frontend upload form for logged-in users:

[medianest_upload folder="optional/subfolder" roles="subscriber,contributor"]

*Attributes:*

* folder -> Target subfolder inside the staging directory (optional).
* roles -> Comma-separated WordPress roles allowed to upload (optional).

== REST API ==

The REST API lets external tools and custom integrations work with the staging folder. Enable it in Media → MediaNest Settings.

Namespace: mediupma/v1  
Base URL: /wp-json/mediupma/v1/

= Authentication =

Requests must be made by a logged-in WordPress user. Send the REST nonce header: X-WP-Nonce

You can also use Application Passwords. Each endpoint checks plugin capabilities (view, import, delete, or manage_options).

= GET /files =

List all files and folders in the staging directory.

Example: GET /wp-json/mediupma/v1/files

Returns a tree array with file name, relative path, size, mime type, and URL.

Permission: User can view staging files.

= POST /import =

Import one or more staging files into the Media Library.

Example: POST /wp-json/mediupma/v1/import

Body: JSON object with a relatives array of file paths, e.g. invoices/2026/photo.jpg

Returns success, failed, and skipped arrays.

Permission: User can import files.

= DELETE /files/{path} =

Delete a file or empty folder from the staging directory.

Example: DELETE /wp-json/mediupma/v1/files/invoices/2026/photo.jpg

Returns a success message on delete.

Permission: User can delete staging files.

= GET /activity =

Retrieve the latest activity log entries (upload, import, delete).

Example: GET /wp-json/mediupma/v1/activity

Returns an entries array with action, relative path, user, and timestamp.

Permission: User can view staging files.

= GET /settings =

Read plugin settings. The webhook URL is excluded for security.

Example: GET /wp-json/mediupma/v1/settings

Permission: manage_options (administrator only).

== Developer Hooks ==

Extend or customize plugin behavior using WordPress actions and filters.

= Action Hooks =

Run custom code when staging files are uploaded, imported, or deleted.

Upload:

* mediupma_before_upload -> Before upload completes. Args: relative path, user ID.
* mediupma_after_upload -> After file is saved. Args: relative path, user ID.

Import:

* mediupma_before_import -> Before Media Library import. Args: relative path, user ID.
* mediupma_after_import -> After successful import. Args: attachment ID, relative path, user ID.

Delete:

* mediupma_before_delete -> Before delete. Args: relative path, user ID.
* mediupma_after_delete -> After delete. Args: relative path, user ID.

= Filter Hooks =

Modify plugin defaults and permissions.

* mediupma_allowed_extensions -> Filter allowed file extensions. Args: extensions array.
* mediupma_import_attachment_args -> Filter attachment data before import. Args: args array, relative path.
* mediupma_can_manage -> Filter user permission for an action. Args: can (bool), user ID, action name.

= Example =

Use add_action on mediupma_after_import with 3 parameters: attachment ID, relative path, and user ID.

== Changelog ==

= 2.0.0 =
* Added file management: delete, rename, and move files from the directory browser.
* Added bulk import, folder import, and import status tracking in the tree view.
* Added image/PDF preview, copy URL, search, and file-type filters.
* Added settings page for file types, roles, duplicate handling, import destination, and uninstall cleanup.
* Added activity log, REST API, developer hooks, optional webhooks, Gutenberg block, and frontend shortcode.
* Added folder upload and upload queue pause/cancel controls.
* Added video and audio file support (configurable in settings).
* Improved chunked upload performance with memory-efficient file append.
* Fixed Copy URL on HTTP and local development sites.
* Added activation hook, translations support, and role-based permissions.

= 1.1.1 =
* Updated branding and improved admin/readme wording for WordPress.org.
* Security: restrict uploads and imports to images (JPG, PNG, GIF, WebP) and PDF only.
* Security: server-side content validation (image MIME detection, PDF magic bytes).
* Security: harden upload subfolders with index.php and .htaccess (Apache).
* Security: validate assembled file size after chunked uploads.
* Initial release.

== Upgrade Notice ==

= 2.0.0 =
Major update: file management, settings, bulk import, REST API, activity log, Gutenberg block, frontend shortcode, and developer hooks.
