=== MYF Fleet Booking Widget ===
Contributors: myfleet
Tags: cab-booking, taxi, airport-transfer, travel, booking
Requires at least: 5.8
Tested up to: 7.0
Stable tag: 1.0.8
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A hero-banner cab-booking widget for MYF fleet services — outstation, local, one-way and airport transfers, right on your site.

== Description ==

MYF Fleet Booking Widget adds a self-contained cab-booking widget to any page or post. Visitors search live fares and confirm bookings across four service types:

* **Outstation** — one-way or round trip, with per-km and daily-allowance breakdown
* **Local** — hourly/km packages
* **One Way** — point-to-point on-demand rides
* **Airport** — drop-to-airport or pickup-from-airport transfers, with a searchable airport/station picker

Key features:

* Insert via the `[myfboen_booking]` shortcode or the "MYF Fleet Booking Widget" Gutenberg block
* Google Places autocomplete for pickup/drop addresses (requires your own Google Maps API key)
* Light/dark theme and accent colour, configurable from Settings → MYF Fleet Booking Widget
* All calls to the MYF Fleet API are proxied through WordPress — your API token and signing salt are stored server-side and are never sent to the browser
* No build step for the frontend or block editor scripts — pure JavaScript against WordPress core globals

= Requirements =

You need an active MYF Fleet API account (token + security salt) to search fares and take bookings. Without credentials configured, the widget shows a setup notice to administrators instead of rendering.

== External Services ==

This plugin connects to two external services:

= MYF Fleet API =
Used to search available cabs and confirm bookings. Requests are made server-side from your WordPress install; data sent includes the pickup/drop coordinates, travel date/time, and — for bookings — the traveller's name, mobile number and email address.
All calls are proxied through WordPress; your MYF token and salt never leave the server.

* API endpoint: https://carapi.myf.io/w/v1/json/marketplace (search: `.../marketplace/search`, booking: `.../marketplace/booking`)
* Terms of Service: https://mindyourfleet.com/termandcondition.php
* Privacy Policy: https://mindyourfleet.com/privacyandpolicy.php

= Google Maps Places API =
Used for location autocomplete in the booking form. The Google Maps JavaScript library is loaded in the visitor's browser only when a Google Maps API key has been entered in the plugin settings; the key itself is passed to the browser to initialise the Places library.

* Terms of Service: https://developers.google.com/maps/terms
* Privacy Policy: https://policies.google.com/privacy

== Installation ==

1. Upload the `myf-fleet-booking-widget` folder to `/wp-content/plugins/`, or install the plugin ZIP through **Plugins → Add New → Upload Plugin**.
2. Activate the plugin through the **Plugins** screen.
3. Go to **Settings → MYF Fleet Booking Widget** and enter your MYF API token and security salt (and, optionally, a Google Places API key).
4. Add the widget to a page using the `[myfboen_booking]` shortcode, or insert the "MYF Fleet Booking Widget" block from the block editor.

== Frequently Asked Questions ==

= Do I need a MYF Fleet account to use this plugin? =

Yes. The widget searches fares and creates bookings against the MYF Fleet API, which requires an account token and security salt.

= Is my API token safe? =

Yes. The token and salt are stored as WordPress options and are only ever used server-side, inside the REST proxy endpoints this plugin registers. They are never localized to JavaScript or otherwise sent to the browser.

= Does this plugin work without a Google Maps API key? =

The widget still functions, but address fields will not offer autocomplete suggestions — visitors must use the airport/station search (which does not require Google Maps) or type addresses manually where supported.

= Can I change the widget's colours and copy? =

Yes — headline, byline, customer care number, theme (light/dark) and accent colour are all configurable under **Settings → MYF Fleet Booking Widget**.

== Screenshots ==

1. Hero banner widget (light theme) — Outstation tab
2. Available cabs bottom sheet
3. Booking details form
4. Confirmation screen
5. Plugin settings page (wp-admin)

== Changelog ==

= 1.0.8 =
* Require a valid `wp_rest` nonce in the `permission_callback` of the `/search` and `/booking` proxy endpoints, so authorization is enforced at the permission layer rather than as an optional in-handler check. A missing or invalid nonce is now rejected with 403.
* Add a public `GET /myfboen/v1/nonce` endpoint that returns only a fresh nonce (no sensitive action) so full-page-cached pages can obtain a live nonce. The response is sent with no-store cache headers so proxies/CDNs never cache it.
* Front-end now warms a fresh nonce on load and, on a 403, refreshes the nonce and retries the request once — keeping the widget working on aggressively cached sites. Requests send same-origin credentials so the nonce is always evaluated against the correct visitor.

= 1.0.7 =
* Declare the REST proxy endpoints (`/search`, `/booking`) as intentionally public via `__return_true`, since the booking widget is used by anonymous visitors and has no user to authorize.
* Move the `wp_rest` nonce verification into the request handlers as a best-effort CSRF check (a present-but-invalid nonce is rejected; an absent nonce is allowed so full-page-cached pages keep working).

= 1.0.6 =
* Centre the sheet close button icon regardless of theme button padding.
* Stop theme button hover/focus colours bleeding onto the service tabs; hover now tints the tab's own text.
* Preserve entered fields when switching Outstation One Way / Round Trip, and swap them by role when switching Airport Drop / Pickup.
* Anchor the field grid so another embed can't override the From/To column widths.

= 1.0.5 =
* Keep the results/booking sheet overlays edge-to-edge even when another embed on the page defines a generic `.myfb` max-width.

= 1.0.4 =
* Scope all front-end DOM lookups to the widget's own root so a duplicate widget or a same-id element elsewhere on the page can no longer hijack the results sheet.

= 1.0.3 =
* Enqueue the widget config and admin styles via WordPress functions instead of inline tags.
* Prefix all declarations, globals, options, and the REST namespace with `myfboen`.
* Add full-width support (block "Full width" alignment and `[myfboen_booking full_width="1"]`).
* Harden front-end CSS against theme/plugin interference.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.0.8 =
Security update. The REST proxy endpoints now require a valid nonce in their permission_callback; the widget refreshes the nonce automatically so cached pages keep working.

= 1.0.7 =
Recommended update. Clarifies the public REST proxy endpoints' permission handling and keeps the nonce as a CSRF check inside the handlers.

= 1.0.6 =
Recommended update. UI polish for the sheet close button, service-tab hover, and field handling when switching trip types.

= 1.0.5 =
Recommended update. Fixes the results sheet backdrop not covering the full screen when another widget embed is present.

= 1.0.4 =
Recommended update. Fixes an empty results sheet when another widget with the same element ids is present on the page.

= 1.0.3 =
Recommended update. Bump clears cached scripts/styles from the previous version.

= 1.0.0 =
Initial release.
