=== MPSIndex – Customer Feedback & Business Proof ===
Contributors: hajnzs
Tags: customer reviews, testimonials, social proof, customer feedback, business reviews
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.1.6
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect your MPSIndex account, view your own indexes, and display structured customer feedback as business proof with a shortcode.

== Description ==

MPSIndex helps service businesses and B2B companies turn structured customer and partner feedback into visible business proof.

This plugin is a lightweight connector for the MPSIndex hosted service. It provides real WordPress functionality without copying the MPSIndex application into WordPress:

* Explicitly connect one WordPress site to an MPSIndex account.
* View a simple list of MPSIndexes owned by the connected account.
* Copy a shortcode for a completed, displayable MPSIndex.
* Render the MPSIndex as a responsive, server-rendered card on a post or page.
* Open MPSIndex to manage the account or invite customers.
* Disconnect and revoke the site's connector credential.

Use a shortcode copied from **MPSIndex > My MPSIndexes**:

`[mpsindex id="your-index-id"]`

The default card size is medium. Optional responsive sizes are available without a design builder:

* `[mpsindex id="your-index-id" size="small"]`
* `[mpsindex id="your-index-id" size="large"]`

An MPSIndex account is required. The external service offers a Basic account and paid plans. The Basic account can use the default single-card display when the connected account and MPSIndex are eligible. Plan rules, limits, billing, invitations, and index management remain in the MPSIndex service; this plugin does not lock or unlock PHP features.

The plugin has no hidden tracking, advertising, automatic backlinks, remote executable code, or admin nags. It does not contact MPSIndex merely because it was installed or activated.

= External service =

This plugin connects to `https://app.mpsindex.com` to authorize the WordPress site and retrieve MPSIndexes owned by the connected account. The connection is necessary for the plugin's account list and shortcode display features.

No external request is made on installation or activation. A site administrator must select **Connect MPSIndex**, then explicitly approve the exact site on MPSIndex.

During connection, the plugin sends:

* The WordPress site URL and callback URL.
* A random state value and PKCE code challenge used to protect the connection.
* A short-lived authorization code and PKCE verifier during the server-to-server exchange.

After connection, the plugin sends a site-bound, revocable connector token in server-to-server requests. It retrieves limited account metadata (display name, plan, and status) plus display data for the account's own MPSIndexes, such as an opaque index ID, provider name, score, date, company name, logo URL, website URL, evaluated areas, and footer text. Invited customer email addresses and the MPSIndex account login token are not sent to this WordPress plugin.

Responses are cached locally for up to five minutes. The connector token is stored as a non-autoloaded WordPress option and is not placed in a page's HTML. If an account-provided logo URL is displayed, a visitor's browser requests that image from its stated URL.

Service information:

* Service: https://app.mpsindex.com/
* Privacy Policy: https://app.mpsindex.com/privacy-policy-2/
* GDPR information: https://app.mpsindex.com/gdpr/

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/` or install it through the WordPress Plugins screen.
2. Activate **MPSIndex – Customer Feedback & Business Proof**.
3. Open **MPSIndex** in the WordPress admin menu.
4. Select **Connect MPSIndex** and approve this site on MPSIndex.
5. Copy a shortcode from **My MPSIndexes** into a post or page.

== Frequently Asked Questions ==

= Do I need an MPSIndex account? =

Yes. If you do not have one, the plugin provides a link to create an account on the MPSIndex service.

= Does the plugin collect reviews inside WordPress? =

No. Customer invitations, structured feedback, account management, and billing stay in the MPSIndex service. The plugin connects, lists the account's own MPSIndexes, and displays eligible completed indexes.

= Can a Basic account display an MPSIndex? =

Yes, when the connected account is active and the completed MPSIndex is eligible for the service's default basic display. The service remains the source of truth for current plan limits and capabilities.

= Does the plugin send data before I connect? =

No. Installation and activation do not contact MPSIndex. External communication begins only after an administrator explicitly starts the connection.

= What happens when I disconnect? =

The plugin asks MPSIndex to revoke the site credential, then removes the local credential and cache state. It does not delete or alter the MPSIndex account or its indexes.

= What happens when I uninstall? =

The plugin removes its local options and cached data. Uninstall does not make an external request, so use **Disconnect** first if you also want the remote credential revoked.

== Privacy ==

The plugin suggests service-specific wording in **Settings > Privacy** so site administrators can include it in their privacy policy. See the **External service** section for the exact data flow and links.

The plugin itself adds no analytics or tracking and does not create an automatic public backlink.

== Screenshots ==

1. Explicit MPSIndex connection screen and data disclosure.
2. Connected account and My MPSIndexes list.
3. Default MPSIndex shortcode card on a WordPress page.

== Changelog ==

= 0.1.6 =

* Corrected the WordPress.org contributor username in readme.txt.

= 0.1.5 =

* Removed obsolete manual translation loading and its unused domain-path header.
* Documented PKCE callback validation for automated WordPress code checks.
* Improved uninstall cleanup naming and code-check annotations.

= 0.1.4 =

* Minimized request metadata and removed the generic source parameter from the account link.
* Added strict validation before generating an index shortcode in the admin list.

= 0.1.3 =

* Added a size selector beside each MPSIndex to generate small, medium, or large shortcodes without manual editing.

= 0.1.2 =

* Made the optional small card proportionally compact, including spacing, typography, logo, and score.

= 0.1.1 =

* Improved shortcode styling inside visual editor previews.
* Changed the default card to a more compact medium size.
* Added optional small and large responsive card sizes.

= 0.1.0 =

* Initial MVP release.
* Added explicit site authorization with PKCE and state protection.
* Added the owned MPSIndex admin list.
* Added the server-rendered `[mpsindex]` shortcode and default card.
* Added connection revocation and local data cleanup.
