=== Metis - IA Community Platform ===
Contributors: tindaro
Tags: community, courses, groups, events, membership
Requires at least: 6.4
Requires PHP: 8.0
Tested up to: 7.1
Stable tag: 0.7.307
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/old-licenses/gpl-2.0.html

Build a community with groups, courses, lessons and events in a dedicated WordPress member portal.

== Description ==

Metis - IA Community Platform provides a responsive community and learning portal that runs on your WordPress site and stores its community data in your WordPress database.

* Groups with discussions, replies, reactions, polls, tags and scheduled posts.
* Public, private and hidden groups and courses with access management.
* Courses organized into chapters and lessons, video embeds and learning progress.
* Personal lesson notes and bookmarks.
* Events, calendars and attendance responses.
* Member profiles, privacy preferences and personal data export.
* Administration with member management, bulk access changes and registration email templates.
* Portal branding, light and dark appearance, sidebar navigation and responsive layouts.
* Italian, English, French and German portal interfaces.

All functionality included in this package is available without a paid license, expiration or group/course quota. AI services, commercial order integrations and FluentCommunity migration implementations are not included in this distribution.

= External services and privacy =

Metis - IA Community Platform has no license activation server, telemetry or automatic premium installer. Fonts use a local system font stack. The following optional services may be used:

* Cloudflare Turnstile: only after an administrator enables it and configures the site key and secret under registration security. The browser loads challenges.cloudflare.com/turnstile/v0/api.js. Verification sends the challenge response, secret key and, where supplied, visitor IP address to challenges.cloudflare.com/turnstile/v0/siteverify to prevent automated registrations. Terms: https://www.cloudflare.com/website-terms/ . Privacy: https://www.cloudflare.com/privacypolicy/ .
* YouTube: when an author supplies a YouTube video URL, lesson playback embeds www.youtube-nocookie.com. The provider receives the visitor IP address, browser information and playback requests. Terms: https://www.youtube.com/t/terms . Privacy: https://policies.google.com/privacy .
* Vimeo: when an author supplies a Vimeo video URL, lesson playback embeds player.vimeo.com, transmitting the visitor IP address, browser information and playback requests. Terms: https://vimeo.com/terms . Privacy: https://vimeo.com/privacy .
* Bunny Stream: when an author supplies a Bunny Stream embed URL, the video is loaded from iframe.mediadelivery.net. Its player integration may load assets.mediadelivery.net/playerjs/player-0.1.0.min.js for playback control. Bunny receives the visitor IP address, browser information and playback requests. Terms: https://bunny.net/tos/ . Privacy: https://bunny.net/privacy/ .
* Other video URLs supplied by authors are loaded from their configured hosts. Those hosts receive normal browser video requests.
* Avatars use WordPress's avatar API; WordPress or another installed plugin may resolve them through Gravatar according to the site's avatar settings. Privacy: https://automattic.com/privacy/ .

Email is sent through WordPress wp_mail and the site's configured mail transport. No separate Metis email delivery service is required. The site administrator is responsible for its privacy notice, consent configuration and retention policy.

Metis stores community content, access assignments, learning progress, notes, notifications and registration/login security records in the site's database. Deactivation and uninstall retain data to prevent accidental loss. The profile export exposes the signed-in user's supported personal data sections; it does not automatically establish legal compliance.

= Source code and build =

Readable source is included under src/ and includes/. Build configuration and the lockfile are included. See BUILD.txt for exact steps. WordPress's wp-element dependency supplies React; this plugin does not bundle another React runtime.

== Installation ==

1. Upload the metis directory to wp-content/plugins/ or install this ZIP in Plugins > Add New.
2. Activate Metis - IA Community Platform. Activation creates the portal page and its database tables.
3. Open Metis settings in WordPress administration and configure the portal.
4. Create groups, courses and events, then assign member access where needed.

Do not activate this standalone package alongside an older standalone Metis Pro or Development package. Back up the site before changing editions. Existing data is retained, but features belonging to an absent edition are unavailable.

== Frequently Asked Questions ==

= Is there a limit on groups or courses? =
No. This WordPress.org-targeted edition has no group or course quota.

= Are AI and payment integrations included? =
No. Their implementations are excluded from this distribution.

= Can I change the portal language? =
Yes. Choose Italian, English, French or German in the portal settings. Registration email templates can be customized separately for each supported language.

= What happens when I uninstall? =
Content and database records are retained. Export or back up the data before removing the plugin.

== Changelog ==

= 0.7.307 =
* Added a review invitation in the Metis admin area for Free administrators, with persistent “Already reviewed” and a 30-day “Later” choice.

= 0.7.306 =
* Internationalization: English is now the canonical source language, with complete Italian, French and German catalogs. This enables WordPress.org to correctly recognize and distribute the Italian translation.

= 0.7.305 =
* Maintenance: version alignment with Pro/Development (no Free-specific changes in this release).

= 0.7.304 =
* Fix: the group tab bar's Tag filter no longer sits pinned far to the right with a large empty gap; it now stays next to the other tabs and only the tabs themselves scroll when space is tight.

= 0.7.303 =
* Fix: the group content tab bar (Discussioni/Corsi/Calendario/Membri/Tag) no longer overflows its rounded container at intermediate window widths; tabs now scroll horizontally within the bar instead of spilling outside it.

= 0.7.302 =
* Design system: unified cards, controls, overlays, chat bubbles and the contextual assistant on one shared border-radius scale.
* Quality: added an automated radius audit to prevent ad-hoc corner values from returning in later releases.

= 0.7.301 =
* Security: course, lesson, group and event content is no longer readable through the core /wp/v2 REST routes; access goes only through Metis memberships and purchases.
* Security: content linked to a WooCommerce/FluentCart product, with a sales page or unpublished can no longer be self-joined for free.
* Security: portal self-registration has its own switch and follows "Anyone can register" on new installs; existing portals keep it open.
* Security: login protection now covers wp-login.php and XML-RPC; client IPs behind a CDN/proxy are resolved via METIS_TRUSTED_PROXIES.
* Security: members can only post safe formatting and links (no inline styles, images or embeds); stored markup is rendered without inline styles.
* Security: member directory and @mentions no longer reveal login usernames; profiles respect the members visibility setting.
* Security: e-mail verification is on by default and unverified accounts never receive guest purchases matched by e-mail.
* Security: Metis content is managed only by users with manage_metis, not by generic WordPress authors/editors.
* Moderation: "mute" and "remove from group" permissions now work; unsupported permissions were removed from the UI.
* Commerce: access is revoked on cancelled/failed WooCommerce orders, cash on delivery grants access only once completed, and refunds revoke by default.
* Data: deactivation never deletes data; opt-in deletion runs on uninstall and never while another Metis edition is installed.
* Fixes: access management scales beyond 500 users, relevance feed pagination is stable, like counters are race-free, discussion search is scoped before limiting, AI assistant no longer blocks questions about API keys.

= 0.7.300 =
* Harden REST permissions for uploads, members, content and settings.
* Prepare every dynamic SQL ID list with dedicated placeholders.
* Remove permanent WordPress account deletion from the community edition.
* Remove non-distribution metadata from the WordPress.org package.

= 0.7.299 =
* Align the package version with the Metis Pro licensing endpoint migration.

= 0.7.298 =
* Align package version with the Pro manual update-check release.

= 0.7.297 =
* Prevent lesson editor crashes by normalizing Bunny video and Smart Transcript data before rendering.
* Recover once from stale dynamically loaded administration assets after a plugin update.

= 0.7.296 =
* Apply the standalone portal reset directly in the document head so theme, cache and CSS optimization cannot offset the interface.
* Keep the mobile sidebar and backdrop above the sticky header.

= 0.7.294 =
* Pro requires a valid license activated for the current site. License recovery and updates remain accessible.
* Free and Development retain their behavior; aligned package versions.

= 0.7.293 =
* Pro: native WordPress updates through the vendor licensing service; protected downloads and manual checks.
* Development: isolated update identity, no commercial auto-updates.
* Free: version alignment only.

= 0.7.292 =
* Pro: license service configured by default; simplified license screen in IT/EN/FR/DE.
* Free: version alignment only.

= 0.7.291 =
* Release version aligned with Pro and Development. No changes to Free functionality; FluentCart remains exclusive to the full editions.

= 0.7.290 =
* Renamed the plugin to Metis - IA Community Platform and aligned the contributor and text domain with the WordPress.org submission.
* Replaced direct script and style output with WordPress enqueue APIs.
* Hardened administrative form processing with explicit nonce and capability checks.

= 0.7.289 =
* Added separate CRM actions to ban, unban and permanently delete WordPress users.
* Banning now preserves group and course assignments so access can be restored safely.
* Permanent deletion requires WordPress delete-user permissions, protects the current administrator and reassigns published content.

= 0.7.288 =
* Independent community edition prepared for WordPress.org review.
* Removed premium module implementations and paid feature restrictions.
* Removed group/course quotas and enabled the community features included in this package.
* Use WordPress's React runtime and local system fonts.
* Align the text domain with metis and document external services and build steps.
* Harden request validation for registration, media uploads, admin views, and content metadata.
