=== MyDriveCloud ===
Contributors: alexmarinescu, freemius
Tags: private files, file sharing, client portal, cloud storage, secure download
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 1.0.0
License: GPLv2 or later

Turn WordPress into your private cloud — share files, manage clients, and deliver a secure client portal.

== Description ==

MyDriveCloud turns WordPress into a focused private file portal. Every file has an owner, direct storage access is blocked, and downloads pass through an authorization endpoint. The Free edition includes grid/list views, search, sorting, folders, recent items, shared items, favorites, trash, storage usage, previews, drag-and-drop upload, secure sharing, upload policies, transfer limits, notifications, account/profile tools, and responsive navigation.

Optional Premium modules are distributed in a separate package and add portal customization, Vault, Galleries, File Requests, external storage connections, advanced security, server synchronization, and backups. Their implementation files are not included in the WordPress.org Free package.

Security features include REST nonce and capability checks, opaque storage names, private download delivery, hashed public-token lookup with an encrypted recovery copy for persistent links, optional link PIN/password and expiry dates, preview/download controls, user/group access, download logs, and an administrator audit view.

== Installation ==

1. In WordPress, open Plugins > Add New > Upload Plugin.
2. Select mydrivecloud.zip, install, and activate it.
3. Open MyDriveCloud in the WordPress admin menu.
4. Optional: create a normal WordPress page containing the shortcode [mydrivecloud] for a front-end portal.
5. Make sure HTTPS is enabled and your server permits WordPress to write to wp-content/uploads.

== Server protection ==

Apache and IIS protection files are created automatically. On Nginx, add this rule inside the server block and reload Nginx:

location ^~ /wp-content/uploads/mydrivecloud-private/ { deny all; return 404; }

MyDriveCloud stores opaque .bin files, never exposes their physical URL, and serves authorized downloads through WordPress. The Nginx rule provides defense in depth at the web-server layer.

== Roles and permissions ==

WordPress administrators receive full MyDriveCloud access by default. Editors, authors, and subscribers start with the MyDriveCloud Client role. Administrators can see and manage every item; other users see their own items and items explicitly shared with them.

In MyDriveCloud > Clients & Access, administrators can create custom MyDriveCloud roles and choose portal access, upload, sharing, client administration and all-files permissions. Every account can be assigned Administrator, Client or a custom role. These roles change only MyDriveCloud capabilities and do not promote a user to a WordPress role.

Administrators can set an individual storage quota for every account in MyDriveCloud > Settings > Clients & Access, including fractional values such as 0.5 GB, or mark a specific account as Unlimited. The selected value is shown in that client's portal and enforced for regular uploads and folder uploads. Existing installations inherit the previous global quota until an individual client setting is saved.

== Updating MyDriveCloud ==

Install updates from the WordPress dashboard when they become available. Back up the website before major updates and keep only one MyDriveCloud installation active.

== Source code and build process ==

The JavaScript and CSS files included in this plugin are the original, human-readable source files used at runtime. They are not minified, bundled, or generated from another source language, and no build step is required to inspect or modify them. The JavaScript source is included directly under assets/js; some readable template literals contain the portal HTML assembled by the browser.

The bundled Freemius SDK is available from https://github.com/Freemius/wordpress-sdk. Premium-only third-party libraries are documented in the Premium package and are not included in the WordPress.org Free package.

== External services ==

MyDriveCloud uses Freemius for optional licensing, updates, account management, checkout and diagnostic opt-in. No plugin usage data is sent before the administrator explicitly accepts the Freemius opt-in screen. If the administrator opts in, Freemius may receive technical site and plugin information required to provide these services. Purchasing or activating Premium also sends the license and account information required to validate that license.

Service provider: Freemius, Inc.
Terms: https://freemius.com/terms/
Privacy policy: https://freemius.com/privacy/

== Frequently Asked Questions ==

= Where are files stored? =

In wp-content/uploads/mydrivecloud-private using random opaque names. Original names live only in the database.

= Does deleting the plugin delete user data? =

Data is preserved by default. Administrators can enable complete cleanup as the final option under Settings > General. When enabled, uninstall removes the Free plugin's protected files, database tables, options, user metadata, logs and capabilities. A separately installed Premium package also removes its own galleries, connections, backups, scheduled jobs and Premium tables. Deactivation never deletes data. The MYDRIVECLOUD_REMOVE_DATA constant remains available as an advanced override.

= Are public link tokens saved in plain text? =

The lookup value is stored as a SHA-256 digest. To let an authorized owner copy an active link later, its token also has an encrypted recovery copy protected with WordPress salts.

== Changelog ==

= 1.0.0 =
* Initial public release of MyDriveCloud.
* Includes the private file portal, client access management, secure sharing, upload policies, transfer limits, notifications, and Freemius Free/Premium packaging.
* Portal customization and the other Premium modules are maintained as a separate package and are excluded from the WordPress.org Free build.
* Prepared for WordPress.org review with WordPress asset loading, nonce validation, capability checks, REST permissions, and WordPress upload handling.
