=== SimplyMade Connector ===
Contributors: akifsms123
Tags: connection, integration, read-only
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect a WordPress site to SimplyMade Social with an explicit, read-only grant.

== Description ==

SimplyMade Connector lets a site administrator authorize a read-only site
identity check for a client workspace in SimplyMade Social. A SimplyMade
website plan and client portal account are required for the hosted service.
The plugin does not publish, edit, delete, track visitors, add users, or create
WordPress Application Passwords. Installing or activating it makes no outbound
request. The administrator explicitly clicks Connect to begin pairing.

The WordPress REST route `/wp-json/simplymade/v1/connection` returns the site
address, blog ID, authorizing user ID, grant ID, HTTPS status, and read-only
scope to a caller presenting the plugin's scoped token. The token does not
authorize WordPress core post, page, theme, or plugin APIs. Publishing would
require a separate, explicit future authorization and is not part of this
read-only pairing.

External service: when the administrator clicks Connect to SimplyMade, the
plugin sends a short-lived, one-use code, canonical HTTPS site address, random
grant ID and freshly generated scoped token to
`https://portal.simplymadesocial.com/v1/wordpress/plugin-pair` over verified
HTTPS. SimplyMade checks the code against the portal requester, workspace and
site, then stores the token encrypted. SimplyMade later sends the token only
in a read-only HTTPS connection-check request to this site's route. The site
stores a SHA-256 token digest, grant ID, authorizing user ID and state in a
non-autoload WordPress option; it does not store the token in plaintext. The
service stores connection identity, state, and verification results. No data
is sent before the administrator clicks Connect, and there is no visitor
tracking or telemetry from this plugin. See the [SimplyMade privacy policy](https://www.simplymadesocial.com/privacy-policy)
and [terms](https://www.simplymadesocial.com/terms-of-service).

== Installation ==

1. Install and activate SimplyMade Connector on the intended HTTPS WordPress site. Its public home address must be a root HTTPS origin with the standard `/wp-json/` REST route; WordPress core may itself live in a subdirectory.
2. In the SimplyMade client portal, request that exact site's main HTTPS URL.
3. In the portal, explicitly authorize pairing and copy the ten-minute code.
4. As a WordPress administrator, open Settings > SimplyMade Connector, enter the code, and click Connect to SimplyMade.
5. Return to the portal. Pairing receipt is not a verified connection; SimplyMade must complete a separate read-only site check.

Only enter a code for a site and workspace that you are authorized to connect.
The code and token are sent in the HTTPS request body, never in a URL.

== Frequently Asked Questions ==

= Can this plugin publish posts? =

No. The pairing token works only for the plugin's connection-check route.

= How do I disconnect? =

Disconnect in the SimplyMade portal to stop server-side access. Also click
Disconnect and revoke local access under Settings > SimplyMade Connector.
SimplyMade erases its encrypted token after revocation is confirmed. Deactivate
or uninstall also removes the site's local grant.

= What if pairing times out? =

Do not reuse the code. A timeout can have an uncertain server outcome. Remove
the pending grant in WordPress and ask SimplyMade to retire the pending
connection before requesting a new code.

== Changelog ==

= 0.2.0 =
* Add explicit one-use, read-only plugin pairing and local revocation.
* Keep a legacy Application Password connection check for existing assisted pilots.
