=== BrewmyApp — Mobile App Builder for WooCommerce ===
Contributors: anshahuja
Donate link: https://brewmyapp.io
Tags: Mobile App Builder, WooCommerce Mobile App Builder, Native App Builder, Website to App
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
Requires Plugins: woocommerce
Stable tag: 2.4.9
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Turn your WooCommerce store into a native mobile app. OTP login, in-app payments, push notifications — no coding required.

== Description ==

**BrewmyApp** transforms your WooCommerce store into a fully native iOS & Android app — no coding required. This plugin is the bridge between your WordPress store and your mobile app, providing secure REST API endpoints for OTP authentication, in-app payments, push notifications, cart sync, and more.

Design your app using our block-based Visual App Designer, connect it to your store with this plugin, and go live on the App Store & Google Play.

= Key Features =

* **OTP Authentication (Email)** — Passwordless login via secure 6-digit email OTP with rate limiting and JWT token response
* **OTP Authentication (WhatsApp)** — Send OTP codes via WhatsApp Business API for instant verification
* **In-App Payments** — Generate secure payment URLs that auto-login customers and redirect to WooCommerce checkout. Works with any payment gateway.
* **Push Notifications** — Send broadcast or targeted push notifications to app users via Expo. Fully configurable from the dashboard.
* **Order Status Alerts** — Automatically notify customers when orders are confirmed, shipped, delivered, cancelled, or refunded
* **Cart Sync** — Full cart management via REST API — add, remove, update items, and apply coupons. Cart stays in sync across app and website.
* **Back-in-Stock Alerts** — Customers can subscribe to out-of-stock products and get a push notification when the item is restocked.
* **API Logging** — Full audit trail of every OTP request, verification, and API call. Filter by channel and export as JSON.
* **Health Check** — Simple ping endpoint for monitoring your store's API availability from your app
* **JWT Authentication** — Secure token-based auth using HS256 algorithm with configurable secret and expiry

= How It Works =

1. Sign up at [brewmyapp.io](https://brewmyapp.io) and design your app using our block-based Visual App Designer
2. Install and activate this plugin on your WooCommerce store
3. Configure JWT settings, WhatsApp OTP (optional), and push notification templates
4. Your mobile app communicates with the REST API endpoints provided by this plugin
5. Users authenticate via OTP, make payments, and receive push notifications — all powered by your WordPress backend

= Built For =

* Store owners using [BrewmyApp](https://brewmyapp.io) to create their mobile app
* Mobile app developers building WooCommerce apps
* Agencies building custom mobile commerce solutions

= Requirements =

* WordPress 5.8 or higher
* PHP 7.4 or higher
* WooCommerce 5.0 or higher (for payment features)
* WhatsApp Business API account (optional, for WhatsApp OTP)

== Installation ==

= From the WordPress Plugin Directory (Recommended) =

1. Log in to your WordPress admin dashboard
2. Go to **Plugins → Add New Plugin**
3. Search for **BrewmyApp**
4. Click **Install Now** next to "BrewmyApp — Mobile App Builder for WooCommerce"
5. Click **Activate**
6. Navigate to **BrewmyApp** in the admin sidebar to access the dashboard
7. Configure your JWT settings under **BrewmyApp → Settings**
8. (Optional) Set up WhatsApp OTP under **BrewmyApp → WhatsApp**
9. (Optional) Configure push notifications under **BrewmyApp → Push Notifications**

= Manual Installation =

1. Download the plugin ZIP file from [wordpress.org/plugins/brewmyapp-mobile-app-builder-for-woocommerce](https://wordpress.org/plugins/brewmyapp-mobile-app-builder-for-woocommerce)
2. Log in to your WordPress admin dashboard
3. Go to **Plugins → Add New Plugin → Upload Plugin**
4. Choose the downloaded ZIP file and click **Install Now**
5. Click **Activate**
6. Navigate to **BrewmyApp** in the admin sidebar to access the dashboard
7. Configure your JWT settings under **BrewmyApp → Settings**
8. (Optional) Set up WhatsApp OTP under **BrewmyApp → WhatsApp**
9. (Optional) Configure push notifications under **BrewmyApp → Push Notifications**

== Frequently Asked Questions ==

= Do I need WooCommerce? =

WooCommerce is required for payment features (order-pay URL, order status). OTP authentication and push notifications work without WooCommerce.

= How does OTP authentication work? =

When a user requests an OTP, a 6-digit code is generated and sent via email or WhatsApp. The code is hashed and stored as a WordPress transient (expires in 10 minutes). When verified, a JWT token is issued for subsequent authenticated API calls.

= Is the JWT token secure? =

Yes. Tokens are signed with HS256 (HMAC-SHA256) using your WordPress salt keys or a custom secret. Tokens expire after 7 days by default (configurable). The secret is never exposed in API responses.

= Can I use this without BrewmyApp? =

Absolutely. While this plugin integrates seamlessly with apps built on the BrewmyApp platform, all API endpoints are standard REST and can be used with any mobile app framework (React Native, Flutter, Swift, Kotlin, etc.).

= How do push notifications work? =

The plugin uses Expo Push Notification service. Your mobile app registers its push token via the API. You can then send notifications from the WordPress admin or via the API. Order status changes automatically trigger notifications.

= Is WhatsApp OTP free? =

The plugin is free. However, sending WhatsApp messages requires a Meta WhatsApp Business API account, which has its own pricing from Meta.

== Screenshots ==

1. Dashboard — Health check, integration status, stats, and feature overview
2. Settings — JWT authentication and OTP configuration
3. WhatsApp — WhatsApp Business API setup with step-by-step guide
4. Push Notifications — Send broadcast or targeted notifications and manage order status alerts
5. Logs — API activity monitoring with channel filtering and JSON export
6. API Reference — Complete REST endpoint documentation with request/response examples

== Changelog ==

= 2.4.9 =
* Maintenance - Version bump; no functional changes.

= 2.4.8 =
* Changed - Extended the connect nonce lifetime from 10 to 30 minutes so email/Google sign-up has time to finish before the link expires.

= 2.4.7 =
* Added - Admin language switcher (11 languages) in the plugin header; per-user, applies only to the plugin's admin UI. Translation files (.po) scaffolded for all locales.
* Changed - Moved the full Free plan details ($0/forever and feature list) into the subscription Plan block; the pricing card now focuses on the Pro upgrade.
* Fixed - Added spacing between card titles and quick-link button groups in the admin UI.

= 2.4.6 =
* Fixed - Pricing card now correctly splits Free vs Pro features (Free: design, preview, sync, branding, OTP; Pro: builds, publishing, OTA, advanced push/marketing/analytics).
* Added - Free $0 plan, Pro intro pricing, and reassurance points (14-day money-back, no revenue share, cancel anytime) to the pricing card.

= 2.4.5 =
* Changed - Added spacing between card titles and descriptions for clearer separation.

= 2.4.4 =
* Added - Current Subscription card now shows a Free badge and exactly what the free plan includes (sync, designer, live preview).
* Added - Pricing card with a Monthly/Yearly billing toggle, yearly savings, and the full "everything included" feature checklist.

= 2.4.3 =
* Changed - Streamlined the admin UI to match the app dashboard: removed the Integration Status, stats, How It Works, and Get Started Guide / Quick Setup sections so the connected view focuses on Live Preview, OTP testing, subscription, and pricing.

= 2.4.2 =
* Added - Auto-detect connection status from the BrewmyApp backend so an already-connected store skips the connect step (bypass).
* Added - Refresh button on the connect panel and connected dashboard to re-check status and re-sync subscription/preview.
* Added - Upgrade plan button on the subscription card.
* Changed - Welcome / Get Started page now shows the same unified connect panel / connected dashboard as the main page.

= 2.4.1 =
* Added - Pass merchant email and site name to the connect confirmation page so it can pre-fill and lock the email.
* Fixed - Welcome-page connect button used the old URL format without the email hint.

= 2.4.0 =
* Added - Setting to toggle the developer credit link in the admin footer.
* Added - Banner image support for push notifications when an image URL is provided.
* Changed - Developer credit option is now removed on plugin uninstall.
* Fixed - Formatting and indentation in the connect panel rendering.

= 2.3.6 =
* Added - Embedded Visual App Designer as the default top-level admin page.
* Added - Automatic WooCommerce API key provisioning on new app connections.
* Added - Nonce-based secure iframe authentication for the embedded app builder.
* Added - REST endpoint for WordPress admin to submit store phone number during onboarding.
* Added - Autoconnect flow on the Get Started page; removed explicit Connect submenu item.
* Added - Suppression of third-party admin notices on BrewmyApp pages for a cleaner UI.
* Added - Logging for push-token register/unregister actions.
* Changed - OTP is now sent via BrewmyApp backend instead of wp_mail.
* Changed - Push Notifications management moved to brewmyapp.io dashboard.
* Changed - Plugin action links updated to point to the embedded app builder.
* Fixed - Submenu wipe on each page load broke welcome page access on fresh installs.
* Fixed - Re-registered brewmyapp-welcome slug so legacy page= links no longer 403.
* Fixed - WooCommerce API credentials re-delivered on every iframe render.
* Fixed - connected_at cleared on plugin activation; activation now redirects to Get Started.
* Updated - Tested up to WordPress 7.0.

= 2.3.3 =
* Added - Onboarding screenshots in the Get Started page step cards.
* Added - "How It Works" and "Support" links in the header/footer of every plugin admin page.
* Added - Top help banner on every plugin admin page linking to brewmyapp.io/contact.
* Added - Inline "Complete Guide" section on the Get Started page.
* Added - Frontend "Mobile app powered by BrewmyApp" credit (filterable via brewmyapp_show_credit).
* Changed - Reordered admin submenu: Get Started, Dashboard, Settings, WhatsApp, Push Notifications, Logs, API Reference.
* Changed - Get Started setup steps now match the brewmyapp.io onboarding flow.
* Removed - "What is BrewmyApp?", "What This Plugin Does", "Video Tutorials" sections and "Go to Dashboard" CTA from the Get Started page.
* Fixed - Missing brewmyapp-logo.png in plugin assets caused broken header logo.
* Updated - All brewmyapp.io URLs normalized to https://www.brewmyapp.io.

= 2.3.2 =
* Fixed - PHP 8.0 dependency requirement causing activation failures on PHP 7.4. Reverted firebase/php-jwt to v6.4.0.
* Fixed - Updated testing environment compatibility checks for QIT.
* Updated - Suppressed false positive security scanner warnings (phpcs/semgrep).

= 2.3.1 =
* Changed variable and function prefixes to bma_ for proper naming conventions
* Removed prohibited self-update logic to comply with WordPress Plugin Directory guidelines
* Updated asset enqueuing implementations for scripts and styles
* Added secure file handling with ABSPATH checks in all core files

= 2.3.0 =
* Changed REST API namespace from app/v1 to bma/v1 for proper prefixing
* Upgraded firebase/php-jwt library from v6 to v7
* Secured test/status endpoints with admin-only permission callbacks
* Added Requires Plugins: woocommerce header
* Removed duplicate Plugin URI / Author URI
* Cleaned up external link tracking parameters
* General code quality and compliance improvements

= 2.2.1 =
* Added Welcome & Getting Started page for new users
* Added API Reference page to admin menu
* Improved first-time activation experience with redirect to Welcome page
* Fixed version mismatch between plugin header and readme.txt
* Removed unnecessary development files from distribution

= 2.0.0 =
* Complete admin UI redesign — modern, branded interface with card-based layouts
* New Dashboard page with health check, stats, and integration status
* New API Reference page with full endpoint documentation
* Tab-based log filtering (All / Email OTP / WhatsApp OTP)
* Toggle switches for order notification settings
* Animated stat cards and smooth page transitions
* Copy-to-clipboard for API base URL and JSON exports
* BrewmyApp branding throughout with consistent design language
* Improved form UX with field hints and better input styling
* Custom SVG menu icon
* Plugin publishing readiness (readme.txt, uninstall.php, proper headers)

= 1.2 =
* Added push notification system with Expo integration
* Order status change notifications with customizable templates
* Push token registration and management API
* Admin notification sender with history
* Deep link support for order notifications

= 1.1 =
* Added WhatsApp OTP authentication
* Added payment URL generation for in-app checkout
* Added auto-login payment redirect
* API logging improvements

= 1.0 =
* Initial release
* Email OTP authentication with JWT
* Health check ping endpoint
* Admin log viewer

== External Services ==

This plugin relies on the following third-party (external) services to provide its functionality. Each service, the data transmitted, and the conditions under which data is sent are described below.

= 1. Expo Push Notification Service (exp.host) =

This plugin sends push notifications to mobile app users via the Expo Push Notification Service. The endpoint used is `https://exp.host/--/api/v2/push/send` (hosted by Expo / 650 Industries, Inc.).

**What data is sent:**

* Expo push tokens (device identifiers registered by the mobile app)
* Notification title and body text
* Optional data payload (e.g. order ID for deep linking into the app)

**When data is sent:**

* When a store administrator sends a push notification from the WordPress admin dashboard
* When a push notification is sent via the plugin's REST API endpoint
* When an order status changes (if order status notifications are enabled)

No data is transmitted to Expo if push notifications are not used.

This service is provided by Expo (650 Industries, Inc.):

* Expo Terms of Service: https://expo.dev/terms
* Expo Privacy Policy: https://expo.dev/privacy
* BrewmyApp WordPress Plugin Terms of Service: https://www.brewmyapp.io/wordpress-plugin/terms-of-service
* BrewmyApp WordPress Plugin Privacy Policy: https://www.brewmyapp.io/wordpress-plugin/privacy-policy

= 2. WhatsApp Cloud API (graph.facebook.com) — Meta =

If WhatsApp OTP login is configured, OTP verification codes are sent to users via the Meta WhatsApp Cloud API. The endpoint used is configured by the store administrator and points to `https://graph.facebook.com/` (hosted by Meta Platforms, Inc.).

**What data is sent:**

* The recipient's phone number
* The OTP verification code (sent as a template parameter or plain text message)

**When data is sent:**

* When a user requests a WhatsApp OTP code for login or verification

No data is transmitted to Meta if WhatsApp OTP is not enabled and configured in **BrewmyApp → WhatsApp** settings.

This service is provided by Meta Platforms, Inc.:

* Meta Platform Terms: https://developers.facebook.com/terms/
* Meta Privacy Policy: https://www.facebook.com/privacy/policy/

= 3. BrewmyApp Platform =

This plugin is designed to work with the BrewmyApp platform (https://brewmyapp.io), a no-code mobile app builder for WooCommerce. The plugin itself does not transmit data to BrewmyApp servers — all communication happens between the mobile app and your WordPress/WooCommerce store directly. However, the mobile apps built using BrewmyApp interact with the REST API endpoints registered by this plugin.

This service is provided by BrewmyApp:

* BrewmyApp Terms of Service: https://www.brewmyapp.io/terms-of-service
* BrewmyApp Privacy Policy: https://www.brewmyapp.io/privacy-policy
* BrewmyApp WordPress Plugin Terms of Service: https://www.brewmyapp.io/wordpress-plugin/terms-of-service
* BrewmyApp WordPress Plugin Privacy Policy: https://www.brewmyapp.io/wordpress-plugin/privacy-policy

== Upgrade Notice ==

= 2.0.0 =
Major UI overhaul with new Dashboard, API Reference page, and modern admin interface. All existing settings and data are preserved. Option names have been migrated automatically (app_* → bma_*).
