=== MLC Live Chat ===
Contributors: HsHHiri
Tags: live chat, bale, support, messenger, chat widget
Requires at least: 6.2
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 2.3.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Live chat widget that forwards messages to your Bale bot, with replies from the WordPress dashboard.

== Description ==

MLC Live Chat adds a live chat widget to your site that forwards visitor messages to your Bale bot, and lets you reply either from Bale itself or directly from the WordPress dashboard. The plugin stores all conversation data in your own WordPress database, ensuring full privacy and control.

= Features =

* Live chat delivered through the Bale messenger
* Dedicated conversations dashboard in wp-admin with direct reply support
* Floating admin-bar/dashboard notification for new messages
* Customizable chat widget (colors, position, welcome message)
* Automatic or manual naming of guest conversations
* Compatible with Elementor and other page builders — the widget does not load inside the live-preview editor to avoid conflicts

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/`, or install it through the WordPress plugin installer.
2. Activate the plugin from the "Plugins" menu.
3. Go to the plugin settings, enter your Bale bot token and admin chat ID.
4. Click "Set webhook automatically" so the plugin registers the delivery URL with your bot.

== Frequently Asked Questions ==

= Why aren't messages being delivered to Bale? =

Use the "Check current webhook status" button in the settings page to diagnose the connection between your server and the Bale API.

= Is this plugin compatible with Elementor? =

Yes. The chat widget is automatically disabled while editing in Elementor's live preview (as well as Divi, Beaver Builder, and Visual Composer) to avoid interfering with the builder's editing tools; it displays normally for visitors on the published site.

== External services ==

This plugin connects to the Bale messenger's Bot API (tapi.bale.ai), which is required for its core functionality: delivering visitor chat messages to your Bale bot and receiving the admin's replies back to the visitor.

It sends data to this service in two situations:
* When a visitor sends a message through the chat widget, the message text is sent to tapi.bale.ai so it can be forwarded to the site owner's Bale bot.
* When the site owner replies (from Bale or from the WordPress dashboard), the plugin calls tapi.bale.ai to deliver that reply, and Bale calls back a webhook URL on your own site to pass admin replies to the plugin.

No data is sent unless the plugin is enabled and a Bale bot token has been configured by the site owner in the plugin settings.

This service is provided by "Bale" (Sadad Informatics Corporation / Bank Melli Iran): [Terms of Service](https://bale.ai/terms), [API documentation](https://docs.bale.ai/).

== Changelog ==

= 2.3.2 =
* Moved the debug log directory back under `wp_upload_dir()` (a randomized, per-site subfolder) instead of a custom path directly under `WP_CONTENT_DIR`, per the plugin directory's guidance on determining writable locations correctly.
* Replaced all direct `file_put_contents()`/`file_get_contents()` calls for log files with `WP_Filesystem`, for better compatibility across hosting environments.
* Log files are now capped at 500KB (oldest entries are trimmed) to keep the read-then-write pattern required by `WP_Filesystem` fast.

= 2.3.1 =
* Fixed the Bale "Reply" button (and `/reply` command) not delivering replies after upgrading from 2.2.x. The REST API namespace changed in 2.3.0, which left the webhook URL previously registered with Bale pointing to a route that no longer existed; the plugin now automatically re-registers the webhook on the new route the first time it runs after this update, without any action needed from the site owner. Sites still on 2.3.0 can also fix this immediately by clicking "Set webhook automatically" in the settings page.

= 2.3.0 =
* Renamed all PHP classes, functions, constants, option names, AJAX actions, the REST API namespace, and JS globals from the `mlc`/`MLC` prefix (3 characters) to `mlclich`/`MLCLICH`, to comply with the WordPress.org plugin directory's uniqueness requirements. The plugin slug and text domain (`mlc-live-chat`) are unchanged.
* Security fix: the webhook signature check (`verify_secret()`) previously allowed requests through when no secret was configured yet; it now rejects them instead, closing a window where replies could be spoofed on a freshly-activated site.
* Moved all inline `<script>`/`<style>` blocks in admin pages and the chat widget to properly enqueued files via `wp_enqueue_script()`/`wp_enqueue_style()`, `wp_localize_script()`, and `wp_add_inline_style()`.
* The `register_setting()` sanitize callback now fully sanitizes every settings field (previously only two of the fields were handled there, relying on the AJAX handler for the rest).
* Lowered the admin menu position so it no longer competes with WordPress core menu items.
* Moved the debug log files out of `wp-content/uploads` (a web-accessible directory) to a dedicated folder outside of it, with a randomized per-site filename, so log contents are not exposed regardless of web server type (this previously relied on `.htaccess`, which Nginx ignores by default).
* Documented the plugin's use of the Bale Bot API as an external service in the readme, per the plugin directory's guidelines.

= 2.2.9 =
* Fixed two unescaped/unprepared SQL warnings in the sessions-overview and new-messages queries by inlining the SQL directly into `$wpdb->prepare()` calls.
* Added a lightweight object-cache layer (`wp_cache_get()`/`wp_cache_set()`) to frequently-read queries to reduce direct-database-query notices and improve performance; the cache is invalidated on every write.
* Polling queries (new admin replies, live message count) remain intentionally uncached to keep the chat real-time.

= 2.2.8 =
* Removed the temporary connectivity diagnostic tool (ping-test buttons and its unauthenticated logging endpoint) from the settings page.
* Replaced remaining direct SQL string interpolation with `$wpdb->prepare()` identifier placeholders (`%i`), removing all direct-database-query warnings.
* Bumped minimum required WordPress version to 6.2 (required by the `%i` placeholder) and updated "Tested up to" to the current release.

= 2.2.7 =
* Plugin now supports the Bale messenger exclusively; other messenger integrations have been removed.
* Security hardening: added missing input unslashing/sanitization, escaped all admin-page output, and reduced direct database query warnings.
* Replaced direct filesystem calls with WordPress-recommended equivalents (`wp_delete_file()`, `WP_Filesystem`).
* Removed the deprecated `load_plugin_textdomain()` call and the unused `Domain Path` header.

= 2.2.1 =
* Fixed a critical bug where the settings sanitize function always returned "enabled" as active.
* Fixed conflicts with Elementor's live preview mode.
* Added ABSPATH security guard to all PHP files.
* Added readme.txt for release on the WordPress plugin repository.

= 2.1.0 - 2.2.0 =
* Added the conversations dashboard, floating notification icon, automatic webhook detection, and various security and UI improvements.

== Upgrade Notice ==

= 2.3.2 =
Moves log storage to the standard uploads-based writable location and uses WP_Filesystem for all log file operations, per WordPress.org plugin guidelines.