=== Telarsys Chat Web ===
Contributors: telarsys
Tags: live chat, web chat, customer support, contact, business
Requires at least: 5.0
Tested up to: 7.0
Stable tag: 1.0.2
Requires PHP: 7.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Adds a Telarsys Web Chat widget and browser-based QR, GPS, and PWA time-tracking interfaces.

== Description ==

Telarsys Chat Web adds a commercial conversation widget to WordPress and provides browser-based interfaces associated with Telarsys services: QR time tracking, GPS capture, and installation of the Time Clock PWA (`Registro Horario`).

The plugin acts as an interface. The Chat requires a provisioned and active Telarsys installation; authorization and business operations are performed by the Telarsys service. Time-tracking functions also require the Telarsys Web API configured for the site or specified in compatible legacy links.

The plugin does not include trial periods, local expiration, advertising, telemetry, or analytics.

== Installation ==

1. Upload the `telarsys-chat-web` folder to `/wp-content/plugins/`, or install the ZIP from the WordPress administration area.
2. Activate Telarsys Chat Web on the Plugins screen.
3. Open **Telarsys Chat Web** from the administration menu.
4. In the installation section, enter the activation code provisioned for the domain. Activation is performed server to server.
5. Configure the required appearance and web features, and enable the Chat locally to display the widget.
6. QR, GPS, and Time Clock features are disabled on new installations. Enable each required time-tracking feature explicitly after reviewing the external-service information shown in the settings.

The activation code must be supplied by the Telarsys service. The plugin never displays or sends the private installation credential to the browser.

== External services ==

This plugin depends on external Telarsys services operated by Solución Informática a Medida S.L. Communication occurs only when the corresponding features are activated, configured, or used.

= Installation and Web Chat =

The installation process and Web Chat communicate from WordPress with the central Telarsys service at `https://erpsiam.azurewebsites.net`.

* During activation, the activation code and the site's HTTPS URL are sent.
* When checking status, the site URL and technical installation credentials stored only on the server are sent.
* When starting a conversation, the visitor's name, company, telephone number, email address, originating URL, and message are sent.
* Technical installation and conversation identifiers, the public conversation token, idempotency identifiers, and a pseudonymous anti-abuse signal derived from the visitor's IP address are also sent. The IP address is not sent in plain text in that header.
* Messages, status queries, and conversation closure transmit the conversation identifier and public token, the submitted text when applicable, and the required sequence or idempotency data.

These communications activate the installation, authorize the site, create and maintain conversations, and prevent duplicates or abuse. The private installation credential is never exposed to the browser.

= QR time tracking and Time Clock =

These features are disabled by default on new installations and communicate only after the administrator explicitly enables them. They use the Telarsys Web API configured by the administrator. For compatibility, legacy links may include an `api` parameter, but that public override is accepted only for HTTPS destinations on public `azurewebsites.net` subdomains.

* The browser sends the `q` identifier to obtain the time-tracking context.
* When recording an entry or exit, the browser sends `q`, the record type, the selected service, the employee key when requested, the correction confirmation, and latitude and longitude if the visitor grants location permission.
* The installation page and Time Clock icon may also request the context associated with `q` from WordPress to obtain the name and logo. If the service returns a logo URL, WordPress requests that image from the specified host.
* Context requests initiated by WordPress only allow HTTPS on public `azurewebsites.net` subdomains. Remote images are requested only from public destinations using WordPress safe URL validation.

The purpose is to identify the authorized context, record the time-tracking event, and customize Time Clock access.

= Legacy GPS capture =

The GPS page is disabled by default on new installations and communicates only after the administrator explicitly enables it. It uses the Telarsys Web API configured by the administrator or, for compatible legacy links, an HTTPS public `azurewebsites.net` destination supplied through the `api` parameter.

* It sends the link's `t` token.
* If the visitor grants location permission, it sends latitude and longitude.
* If the visitor continues without GPS, it sends the token and an indication that no location is available.

The purpose is to associate the location decision with the corresponding time-tracking flow.

Service provider information: https://www.solucioninformatica.es/

Service privacy policy: https://www.solucioninformatica.es/politica-privacidad/

No specific Telarsys terms-of-service page has been identified in this project. This readme does not invent or attribute a policy that has not been provided.

== Privacy ==

WordPress stores the options configured by the administrator, which may include the display name, compatibility telephone numbers, Web API URLs, and interface preferences. It also stores the public installation identifier and its encrypted and authenticated secret, both with autoload disabled. The plugin does not create custom tables, transients, or conversation records.

Conversation content, contact details, and coordinates pass through WordPress or the browser to perform the corresponding request, but this plugin does not persist them in WordPress options, posts, metadata, files, or tables.

The widget uses browser `sessionStorage` to retain the creation phase or active conversation. It may store idempotency identifiers, the public conversation identifier and token, sequence, status, minimal waiting-notice data, and the text of a pending message when applicable. It does not store the name, company, telephone number, or email address from the initial form there.

The plugin does not add cookies, `localStorage`, telemetry, analytics, tracking pixels, or iframes. Executable JavaScript and CSS are distributed locally with the plugin.

The retention and processing policy of the remote service cannot be determined from the plugin code. Consult the provider policy linked in the **External services** section.

== Changelog ==

= 1.0.2 =

* Fixed the unattended-conversation notice timing so the intended three-minute delay is preserved when the server and browser clocks differ.

= 1.0.1 =

* Disabled QR, GPS, and Time Clock features by default on new installations and clarified the administrator opt-in for their external communications.
* Restricted public legacy `api` overrides to HTTPS destinations on public `azurewebsites.net` subdomains while retaining administrator-configured service URLs.
* Moved the QR, GPS, and Time Clock CSS and JavaScript to local resources loaded through the WordPress enqueue APIs.
* Declared WordPress 5.0 as the minimum supported version, covering the privacy APIs used by the plugin.

= 1.0 =

* Consolidated the secure commercial Web Chat and server-to-server central activation, including conversation creation, message delivery, polling, and closure with transparent support for PROPIA and COMPARTIDA service queues.
* Added terminal technical blocking with a clear visitor notice, session persistence, and consistent enforcement of the central `ChatWebActivo` availability flag.
* Improved responsive behavior and accessibility for the widget and its main interaction states.
* Retained the existing GPS, QR, and Time Clock PWA interfaces and their compatible public URLs.
* Completed security hardening and compatibility review for the declared WordPress and PHP requirements.

= 0.3.36 =

* Prepared metadata and the public readme for WordPress.org.
* Added GPL version 2 or later license information.
* Documented privacy and external services.
* Hardened input handling, nonce analysis, image responses, and SSRF protection for dynamic requests initiated by WordPress.
* Cleaned the distribution package.
