=== Stayhatch Booking ===
Contributors: sportstatswp
Tags: booking, accommodation, availability calendar, vacation rental, ical
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Self-hosted direct bookings for apartments, rooms, and cabins: availability calendars, seasonal pricing, email, and iCalendar channel sync.

== Description ==

Stayhatch Booking lets an accommodation owner accept direct booking requests from a WordPress site. It supports multiple units, optional combined bookings, availability calendars, seasonal pricing, minimum and maximum stays, cleaning fees, owner blocks, email workflows with owner notifications, manual payment instructions, and iCalendar import/export for channels such as Booking.com and Airbnb.

Booking requests are protected against abuse with a maximum stay per request, rate limiting, optional Cloudflare Turnstile, and by keeping unreviewed requests out of channel exports.

The plugin is translation-ready; translations are delivered through translate.wordpress.org.

Card payments with Stripe Checkout (deposits, balance payments, refunds, and disputes) are available in the separate Stayhatch Booking Pro add-on. This plugin is fully functional without it.

Add the Stayhatch Booking block in the editor or use `[stayhatch_booking]`.

= For developers =

Add-ons load on the `stayhatch_booking_loaded` action. Other extension points: `stayhatch_reconcile` (runs every 15 minutes), `stayhatch_compose_mail`, `stayhatch_mail_kinds`, `stayhatch_mail_job_stale`, `stayhatch_owner_event_titles`, `stayhatch_booking_panels`, `stayhatch_booking_list_note`, `stayhatch_guard_edit`, `stayhatch_privacy_retain`, `stayhatch_mail_queue_ids` and `stayhatch_client_ip` (the visitor address used for rate limiting behind a proxy).

= External services =

iCalendar imports are optional. When an administrator adds a feed, WordPress requests that exact HTTPS URL and stores unavailable dates, event identifiers, feed name, unit mapping, fetch time, and errors. Data use is governed by the selected calendar provider's terms and privacy policy.

Cloudflare Turnstile is optional and off by default. When an administrator defines `STAYHATCH_TURNSTILE_SITE_KEY` and `STAYHATCH_TURNSTILE_SECRET`, the booking form loads Cloudflare's challenge script and the server sends the challenge token and the visitor's IP address to Cloudflare to verify the request. Terms and privacy information: https://www.cloudflare.com/website-terms/ and https://www.cloudflare.com/privacypolicy/

The plugin itself does not contact Stayhatch or require a Stayhatch account.

== Installation ==

1. Upload and activate the plugin.
2. Configure Accommodation & pricing.
3. Add the Stayhatch Booking block or `[stayhatch_booking]` shortcode to a page.
4. Configure email and channels as needed.
5. Test the complete flow before accepting live bookings.

== Frequently Asked Questions ==

= Can guests pay by card? =

Not with this plugin alone. It sends your manual payment instructions, such as bank transfer details. Card payments through Stripe Checkout are provided by the Stayhatch Booking Pro add-on; card details are then entered on Stripe-hosted Checkout and never stored in WordPress.

= Can someone block my calendar with fake requests? =

Online requests are limited to a configurable maximum number of nights, rate-limited per visitor, and not exported to other channels until reviewed (unless you choose otherwise). Cloudflare Turnstile can be enabled for additional protection.

= Does it connect directly to Booking.com? =

Version 1.0 imports and exports standard iCalendar availability. It does not implement Booking.com's Connectivity APIs.

= Are imported calendars instant? =

No. Feeds are polled every 15 minutes when WordPress cron runs, and source channels may publish updates later. Operators should monitor sync status and use an appropriate buffer.

= What happens when the plugin is deleted? =

Data is retained by default. An administrator can explicitly enable permanent removal before deleting the plugin.

== Screenshots ==

1. Booking form with the availability calendar for each accommodation.
2. The booking form on a phone.
3. Booking calendar in the admin.
4. Accommodation settings with prices and stay rules.
5. Calendar sync: export and import iCalendar feeds for external booking channels.
6. Email settings for guest and admin messages.

== Privacy ==

The plugin stores guest identity and booking, price, payment-reference, note, and email-delivery data. It registers WordPress personal-data export and erasure callbacks and suggests privacy-policy text. Active or financial records are retained by the eraser because they may be required to fulfil a contract or legal obligation.

== Changelog ==

= 1.2.0 =
* New name: Stayhatch Booking.
* New booking references start with SH-; existing references are unchanged.
* Setup and email notices appear only on the plugin's own screens (and the setup notice on the Plugins screen), and the setup notice can be dismissed permanently.
* Quote signatures and rate-limit keys use a dedicated site secret instead of WordPress authentication salts.
* Translations are loaded from translate.wordpress.org instead of bundled files.
* Fix: the booking calendar and price check now work on sites that use plain permalinks.

= 1.1.1 =
* Fix: with block themes such as Twenty Twenty-Five the booking form fell back to a plain page reload, because its script settings were added before the script was registered.

= 1.1.0 =
* Card payments moved to the separate Stayhatch Booking Pro add-on; existing payment data is kept and works again once the add-on is active.
* All texts are translatable, including emails and the booking form script.
* Extension hooks for payment add-ons: stayhatch_booking_loaded, stayhatch_compose_mail, stayhatch_mail_kinds, stayhatch_mail_job_stale, stayhatch_owner_event_titles, stayhatch_booking_panels, stayhatch_booking_list_note, stayhatch_guard_edit, stayhatch_privacy_retain.
* Expiry of unreviewed requests now runs from the core scheduled task.
* New guest email template for bookings awaiting manual payment.
* Weekday names in the public calendar follow the site language.

= 1.0.2 =
* Administrators see a warning and a menu counter when booking requests await review while email is turned off.
* Owner notifications now name the guest, link to the booking, state the hold deadline, and quote the message sent to the guest.
* Email, payment page, and Stripe panel amounts use the booking's own currency.
* Personal-data erasure handles guests with more than 50 bookings.
* The bookings list is paginated; the mail worker, Stripe check, and calendar export only read relevant bookings.
* An accommodation with only past bookings can now be removed.
* The Stripe return page works with block themes.
* Versioned data migrations.

= 1.0.1 =
* Security: maximum nights per online request (default 30) so one request cannot hold a whole year.
* Security: unreviewed requests are no longer exported to channel calendars unless the administrator enables it.
* Security: optional Cloudflare Turnstile check on booking requests; `stayhatch_client_ip` filter for sites behind a proxy.
* Fix: Stripe amounts are converted correctly for currencies without minor units (for example JPY) and with three decimals; such prices must be whole amounts.
* Fix: the scheduled Stripe check only polls payments that can still change instead of every historic booking.
* Fix: the booking form works on sites without HTTPS and in older browsers without `crypto.randomUUID`.

= 1.0.0 =
* Initial product release.
* Multiple accommodation units, pricing, availability, email, Stripe, privacy tools, and iCalendar channels.
