=== SafeUser – Registration Alerts for Telegram ===
Contributors: ravinovikau
Tags: telegram, notifications, registration, user registration, security
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 8.0
Stable tag: 1.3.7
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Instant Telegram alerts on every new WordPress user registration. Catch admin hijacking and suspicious signups in real time.

== Description ==

**Registration Alerts for Telegram** fires a customisable Telegram message every time a new user registers on your WordPress site — via the standard registration form, WooCommerce checkout, REST API, or the admin panel.

= Free Features =

* Instant Telegram notification on every new user registration
* Customisable message template with dynamic shortcodes (`{display_name}`, `{user_login}`, `{user_email}`, `{role}`, `{source}`, `{site_name}`, `{admin_url}`)
* Registration source detection (WooCommerce, form, admin, REST API, bulk import)
* Non-blocking delivery — notifications are deferred to shutdown so checkout flows are never slowed
* Auto-detect Chat ID from the bot's recent messages
* Live Telegram message preview in the admin
* One-click token validation and test message
* Supports private chats, groups, supergroups, and channels

= Pro add-on (optional, separate plugin) =

**SafeUser Pro** is a standalone add-on — distributed separately from this free plugin — that adds:

* **Role-Based Routing** — send notifications to different Telegram chats per user role
* **Registration Insights** — charts of registration trends by source and role

SafeUser Pro is not included in or required by this free plugin. Learn more: https://fnlpulse.com/safeuser/

= Security =

The bot token can be locked via a `wp-config.php` constant so it is never stored in the database:

`define( 'REATG_BOT_TOKEN', 'your-token' );`

== External Services ==

This plugin connects to the **Telegram Bot API** (`api.telegram.org`) — a third-party service operated by Telegram — to deliver notifications and configure your bot. This is required for the plugin to function.

What is sent and when:

* **On each new user registration:** the plugin calls the `sendMessage` endpoint to deliver your notification. The message contains whatever fields you include in your template — by default this can be the new user's username, email address, display name, role, and registration source.
* **When you save/validate the bot token or send a test message:** the plugin calls the `getMe` and `sendMessage` endpoints to verify the token and chat.
* **When you click Auto-Detect:** the plugin calls the `getUpdates` endpoint to read your bot's recent messages and find your Chat ID.
* **Connectivity check:** the plugin may make a request to `api.telegram.org` to confirm outbound HTTPS is available.

Your bot token is transmitted to Telegram as part of each API request. No data is sent to Telegram unless you have configured a bot token.

Telegram's terms and privacy policy:

* Terms of Service: https://telegram.org/tos
* Privacy Policy: https://telegram.org/privacy

== Installation ==

1. Upload the `safeuser-registration-alerts-for-telegram` folder to `/wp-content/plugins/`
2. Activate via **Plugins > Installed Plugins**
3. Go to **Settings > Registration Alerts for Telegram**
4. Enter your Telegram bot token (create one at @BotFather on Telegram)
5. Click **Auto-Detect** to find your Chat ID, or enter it manually
6. Save settings — you will receive an alert on every new registration

== Frequently Asked Questions ==

= How do I create a Telegram bot? =

Open Telegram, search for @BotFather, send `/newbot`, and follow the prompts. Copy the token it gives you into the plugin settings.

= How do I find my Chat ID? =

Send any message to your bot, then click **Auto-Detect** in the plugin settings. The plugin calls `getUpdates` on your bot and returns the most recent chat ID automatically.

= Does this slow down registration or WooCommerce checkout? =

No. Notifications are sent on the `shutdown` hook, after the HTTP response is delivered. The user's browser never waits for the Telegram API.

= Can I send to a group or channel instead of a private chat? =

Yes. Add the bot as an admin of the group or channel, then paste the group/channel Chat ID (usually a negative number starting with -100) into the settings.

= Where is registration source data stored? =

In user meta (`_reatg_registration_source`), used to populate the `{source}` placeholder. The plugin options are removed on uninstall.

== Screenshots ==

1. Telegram Integration settings — bot token, chat ID, and live preview
2. Notification Designer — template editor with shortcode pills and real-time Telegram render
3. System Status & Diagnostics

== Changelog ==

= 1.3.7 =
* Fixed: Auto-Detect now clears any active webhook on the bot token before polling for messages — Telegram refuses `getUpdates` while a webhook is registered, which caused detection to fail with a "Conflict" error.

= 1.3.6 =
* Fixed: Auto-Detect Chat ID could miss a brand-new chat until a second message was sent; the bot's first `my_chat_member` (start) event is now recognized too.

= 1.3.5 =
* Fixed: Bot Token field no longer triggers the browser's "save password" prompt.
* Fixed: Header subtitle left-aligned with the plugin title.

= 1.3.4 =
* Changed: Admin menu label shortened to "SafeUser".
* Added: `{profile_url}` and `{order_url}` message template placeholders — `{order_url}` links to the user's most recent WooCommerce order, if any.

= 1.3.3 =
* Chore: Added screenshots/ to .gitignore for WordPress.org compliance.

= 1.3.2 =
* Changed: Removed Insights and Pro tabs from free plugin settings page.
* Added: Footer message with link to SafeUser Pro (https://fnlpulse.com/safeuser/).

= 1.3.1 =
* Fixed: Admin page heading and menu label no longer abbreviate "Telegram" to "Tg".
* Changed: Pro add-on link now points to https://fnlpulse.com/safeuser/.

= 1.3.0 =
* Changed: This plugin is now fully free and self-contained. Role-Based Routing and Registration Insights moved to a separate optional add-on (SafeUser Pro) distributed outside WordPress.org.
* Removed: Bundled Freemius SDK, all license checks, the analytics table/logging, and the bundled Chart.js library.
* Added: Extension hooks (`reatg_chat_id`, `reatg_user_registered`, `reatg_register_settings`, `reatg_admin_assets`, `reatg_settings_telegram_extra`, `reatg_insights_panel`) so the add-on attaches without modifying core.
* Added: `uninstall.php` to remove plugin options on uninstall.

= 1.2.75 =
* Fixed: Corrected Freemius vendor path in bootstrap (dirname with 2 levels to reach plugin root).

= 1.2.74 =
* Changed: Updated Freemius bootstrap configuration — added premium_slug, set is_premium to true.
* Fixed: Removed AI generator metadata from German translation files.

= 1.2.73 =
* Changed: Renamed plugin to "SafeUser – Registration Alerts for Telegram"; slug, text domain, Freemius slug, and language files updated to `safeuser-registration-alerts-for-telegram`. Internal `reatg_` prefix and settings unchanged.
* Changed: Admin heading updated to "SafeUser: registration alerts for Tg".
* Added: "External Services" disclosure section for the Telegram Bot API.
* Fixed: Replaced the Telegram paper-plane header logo with the SafeUser plugin logo (trademark compliance).

= 1.2.72 =
* Added: English POT template and German (de_DE) translation files (.po + .mo)
* Fixed: languages/ directory now committed — Git requires a file inside to track an empty folder

= 1.2.71 =
* Fixed: Remove underline from .reatg-btn anchor elements (WP admin CSS override)

= 1.2.7 =
* Fixed: Removed .DS_Store from repository
* Fixed: Removed deprecated load_plugin_textdomain() call (WP 4.6+ handles this automatically)
* Fixed: Added wp_cache_get/set caching to DB::get_stats() to resolve NoCaching sniff
* Fixed: Suppressed false-positive phpcs warnings for internal table-name interpolation and production error_log usage
* Fixed: Sanitized admin_init routing guards in Settings class
* Fixed: Prefixed all template variables in settings-page.php to satisfy NonPrefixedVariable sniff
* Changed: readme.txt Tested up to bumped to 7.0
* Added: languages/ directory (resolves missing Domain Path header warning)

= 1.2.6 =
* Changed: Uninstall logic moved to Freemius after_uninstall hook; uninstall.php removed

= 1.2.5 =
* Added: Chatbots tab — SendPulse partner panel with €20 free credit offer
* Changed: SendPulse API integration removed (coming back as standalone add-on)
* Fixed: DB::get_stats() integer parameter now correctly passed through wpdb->prepare()
* Fixed: Options flush hook registered unconditionally, not inside is_admin() gate
* Performance: Options static cache eliminates repeated get_option() calls per request

= 1.2.4 =
* Fixed: `{source}` placeholder now correctly populated in deferred shutdown messages
* Fixed: SendPulse transients fully removed on uninstall
* Fixed: Namespace fatal error on activation resolved
* Changed: Chart.js bundled locally (removed CDN dependency)
* Changed: Freemius licensing replaces demo Pro toggle

= 1.2.3 =
* Added: Pro tier — Role-Based Routing and Insights & Analytics dashboard
* Added: Freemius licensing integration
* Added: Custom `wp_reatg_logs` table for registration analytics
* Changed: Modernised admin UI with icon tabs and PRO badges

= 1.2.2 =
* Fixed: Namespace issue in settings view template

= 1.2.1 =
* Security: `REATG_BOT_TOKEN`, `REATG_SP_CLIENT_ID`, `REATG_SP_CLIENT_SECRET` constants for locking secrets in `wp-config.php`

= 1.0.0 =
* Initial release

== Upgrade Notice ==

= 1.3.3 =
Minor maintenance release — no functional changes.

= 1.3.2 =
UI cleanup — Insights and Pro tabs removed from the free plugin settings page. Pro features remain available via the separate SafeUser Pro add-on.

= 1.3.1 =
Minor wording fixes — admin heading spells out "Telegram", Pro link updated.

= 1.3.0 =
The plugin is now fully free with no license checks. Role routing and analytics are available as a separate optional add-on. Recommended update.

= 1.2.75 =
Fixes Freemius vendor path issue on activation. Recommended update.

= 1.2.74 =
Freemius dashboard sync — premium slug and license configuration updates. Recommended update.

= 1.2.73 =
Rebrand to SafeUser with a new slug and name, plus an External Services disclosure required for WordPress.org submission. Recommended update.

= 1.2.72 =
Adds German translation and resolves languages/ directory warning on WP.org plugin check.

= 1.2.71 =
Minor fix — removes underline from CTA buttons in the admin settings page.

= 1.2.7 =
WordPress.org submission readiness — resolves all plugin check errors and warnings. Recommended update.

= 1.2.6 =
Required update for Freemius compatibility — moves uninstall logic to the Freemius after_uninstall hook.

= 1.2.5 =
Recommended update — adds Chatbots partner tab, removes legacy SendPulse API wiring, and includes performance and correctness fixes.

= 1.2.4 =
Recommended update — fixes a placeholder bug where `{source}` appeared blank in some Telegram messages, and replaces the demo license toggle with real Freemius licensing.
