=== CloseHub Connector ===
Contributors: closetechnology, davidperez
Tags: api, integration, closehub, woocommerce, gravity-forms
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.1.2
Version: 1.1.2
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect your WordPress site to CloseHub with a single API key in order to send statistics.

== Description ==

CloseHub Connector replaces the multiple credentials previously required to link a WordPress site with [CloseHub](https://close.marketing/closehub/) — a marketing project management platform.

Once the plugin is activated, it generates a secure API key and exposes a dedicated REST API namespace (`/wp-json/closehub/v1/`) that CloseHub uses to interact with your site.

It also exposes content abilities through the WordPress MCP Adapter. MCP clients can discover, list, read, create, update, update a post slug, replace one exact Gutenberg block, and send posts to the trash using the server at `/wp-json/mcp/mcp-adapter-default-server`. `closehub/update-post-slug` accepts a post ID and slug, then returns the normalized unique slug and resulting URL. `closehub/get-post` returns a `content_hash`; use it with `closehub/replace-gutenberg-block`, a zero-based `block_path`, the current block name, and one replacement serialized block so a stale read cannot overwrite newer content. These abilities default to the `post` type but accept a `post_type` input for any other post type registered with an admin UI — pages, WooCommerce products (including product types WooCommerce's own MCP abilities don't support, such as subscriptions), or custom post types. Authenticate with a WordPress user account that has the required post capabilities; the CloseHub API key is not used for MCP authentication.

For WooCommerce, MCP clients with the `manage_woocommerce` capability can retrieve an order summary for a date range, including order count, total sales, average order value, and matching orders.

It also exposes a set of "site" abilities for the CLOSE web go-live checklist — configuration steps that used to be manual or wp-cli only. Each requires the WordPress capability noted below.

**Available MCP site abilities:**

* `closehub/search-replace-domain` (`manage_options`) — Replace `old_domain` with `new_domain` across post content, options, comments, and meta tables, re-serializing serialized values safely. Skips `wp_posts.guid`. Pass `dry_run: true` to preview the number of rows that would change per table without writing anything. Example: `{ "old_domain": "staging.example.com", "new_domain": "example.com" }`.
* `closehub/set-robots-txt` (`manage_options`) — Write `content` to `robots.txt`, physically if the site root is writable, otherwise served virtually through the `robots_txt` filter. Example: `{ "content": "User-agent: *\nDisallow:\nSitemap: https://example.com/sitemap.xml" }`.
* `closehub/set-post-noindex` (`edit_post` on the target `post_id`) — Set or clear the noindex robots meta for one post/page using whichever SEO plugin (Rank Math or Yoast) is active. Example: `{ "post_id": 42, "noindex": true }`.
* `closehub/flush-permalinks` (`manage_options`) — Regenerate rewrite rules, equivalent to `wp rewrite flush`. Takes no parameters.
* `closehub/get-htaccess` (`manage_options`, read-only) — Return whether `.htaccess` exists and its current content. Takes no parameters.
* `closehub/set-site-settings` (`manage_options`) — Update the site timezone and/or admin email; at least one is required. Example: `{ "timezone": "Europe/Madrid", "admin_email": "client@example.com" }`.
* `closehub/reassign-posts-author` (`edit_others_posts`) — Reassign every post of `post_type` (default `post`) from `from_author_id` to `to_author_id`, with a per-post success result. Example: `{ "from_author_id": 3, "to_author_id": 1 }`.
* `closehub/install-wp-org-plugin` (`install_plugins`) — Install (without activating) a plugin from the WordPress.org plugin directory by `slug`. Example: `{ "slug": "two-factor" }`.
* `closehub/list-unused-plugins` (`activate_plugins`, read-only) — List installed plugins that are not currently active, as removal candidates. Takes no parameters.
* `closehub/update-plugins-and-core` (`update_plugins` and `update_core`) — Update every plugin with an available update and WordPress core to the latest version, with a per-plugin success result. Takes no parameters.
* `closehub/create-site-user` (`create_users`, plus `promote_users` when `role` is `administrator`) — Create a WordPress user for the site's client. `role` defaults to `editor`; `username` defaults to the local part of `email` when omitted. Example: `{ "email": "client@example.com", "role": "editor" }`.

**What it replaces:**

* WordPress Application Password (username + password)
* WooCommerce REST API consumer key and consumer secret
* Gravity Forms API key

**You only need to share two things with CloseHub:**

1. Your site URL
2. The generated API key (found at Settings → CloseHub)

**Available endpoints:**

* `GET /closehub/v1/ping` — verify the connection
* `POST /closehub/v1/posts` — publish or draft a post (or another post type via `post_type`), including optional SEO metadata (Rank Math or Yoast), featured image, and categories
* `PUT /closehub/v1/posts/{id}` — update a post's (or other post type's) title, content, excerpt, status, SEO metadata, featured image, or categories
* `GET /closehub/v1/woocommerce/orders` — fetch order data (requires WooCommerce)
* `GET /closehub/v1/gravity-forms/forms` — list forms (requires Gravity Forms)
* `GET /closehub/v1/gravity-forms/forms/{id}` — get form details
* `GET /closehub/v1/gravity-forms/forms/{id}/entries` — count form entries by date range

WooCommerce and Gravity Forms endpoints return a clear error if those plugins are not active — they are not required.

**Multisite networks:**

On a WordPress Multisite network, the same endpoints listed above are shared by every site in the network — there is no separate namespace or key to manage. Activate the plugin network-wide and go to **Network Admin → Settings → CloseHub** to find one API key shared by the whole network. Every request to those endpoints automatically returns a `sites` array with one entry per site in the network (`site_id`, `url`, and that site's data or an `error` message), instead of a single site's result — handy when a network is used to run the same company in multiple languages.

== Installation ==

1. Upload the `closehub-connector` folder to `/wp-content/plugins/`.
2. Activate the plugin through the **Plugins** screen in WordPress admin.
3. Go to **Settings → CloseHub**.
4. Copy the **Site URL** and **API Key** shown on that page.
5. Paste both values into CloseHub under your project's WordPress connection settings.

== Frequently Asked Questions ==

= Where do I find my API key? =

Go to **Settings → CloseHub** in your WordPress admin. The key is displayed there along with a copy button.

= Can I regenerate the API key? =

Yes. Click **Regenerate Key** on the Settings → CloseHub page. The old key stops working immediately — update CloseHub with the new key right away.

= Do I need WooCommerce or Gravity Forms installed? =

No. Both are optional. If they are not active, those endpoints return a `503` response with a clear message instead of crashing.

= How is the API key secured? =

The key is stored in `wp_options` (or network-wide in `wp_sitemeta` on multisite), never exposed on the frontend, transmitted only via HTTPS, and verified using constant-time comparison (`hash_equals`) to prevent timing attacks. It is never logged or included in REST responses.

= Can I use this plugin on a multisite network? =

Yes. When network-activated, the plugin generates one API key shared by every site in the network (managed from **Network Admin → Settings → CloseHub** instead of a per-site Settings page), and the same REST endpoints automatically query every site and return combined, per-site results. On a regular, non-multisite install, everything works exactly as a single site as described above.

= Is this plugin affiliated with WooCommerce or Gravity Forms? =

No. It integrates with those plugins using their public PHP APIs but is not developed, endorsed, or supported by WooCommerce or Gravity Forms.

== Screenshots ==

1. Settings page showing the Site URL, API key, and available endpoints.
2. Regenerate Key button with confirmation notice.

== Changelog ==

= 1.1.2 =
* Fixed MCP OAuth discovery on Apache-managed sites, including reliable handling of the protected-resource and authorization-server metadata routes after activation, URL changes, or regeneration. (#27)
* Added precise Gutenberg block replacement through MCP, with content-hash concurrency protection and block-path/type validation, plus an MCP ability to update a post slug and return its normalized URL. (#29)

= 1.1.1 =
* Added 11 MCP "site" abilities covering the CLOSE web go-live checklist: domain search-replace, robots.txt content, per-page noindex, permalink flush, `.htaccess` read, timezone/admin email, bulk post-author reassignment, WordPress.org plugin install, unused-plugin listing, plugin/core updates, and client user creation. See the Description section for the full list and required capabilities.
* Added `post_type` support to all `closehub/*-post` MCP abilities (list-posts, get-post, create-post, update-post, trash-post) and to the `/closehub/v1/posts` REST endpoints. They still default to `post`, but can now read and write pages and WooCommerce products (including product types WooCommerce's own MCP abilities don't support, such as subscriptions) instead of only plain blog posts. Allowed post types are limited to ones registered as public and admin-manageable, so internal WooCommerce records such as orders and coupons, and Media Library attachments, are not exposed as generic content.
* Fixed: creating a post now checks that post type's own `create_posts` capability, and publishing through `create-post`/`update-post` checks its `publish_*` capability (e.g. `publish_products`), instead of always assuming `post`'s `edit_posts`/`publish_posts`.
* Fixed: MCP post creation and updates now recheck those capabilities independently on every site in a multisite network before writing, so a denied site reports a per-site error without changing its content.
* Fixed: setting `categories` on a post type that doesn't support that taxonomy is now rejected before any other change is saved, instead of possibly after the title, content, or other fields were already updated.

= 1.1.0 =
* Added an MCP server (OAuth 2.1 + PKCE) so AI clients such as Claude can list, read, create, update, and trash posts and read WooCommerce order summaries with the permissions of a real WordPress user.
* Added a `PUT /closehub/v1/posts/{id}` endpoint to update a post's title, content, excerpt, status, SEO metadata, featured image, or categories.
* Fixed: MCP post creation/update no longer lets a user without the `manage_categories` capability create new categories by naming one that doesn't exist yet.
* Fixed: MCP get-post/list-posts now include the same featured image and SEO metadata create-post and update-post accept.
* Fixed: a dynamic OAuth client registration using a real client_id metadata URL could no longer have its verified name and redirect URI overridden by the request body — closing an impersonation path where a code could be redirected to an attacker-controlled URI while the consent screen showed a trusted name.
* Fixed: the OAuth consent page now sends `X-Frame-Options`/CSP headers to prevent it from being framed (clickjacking the Authorize button).
* Fixed: an MCP access token could previously authenticate as its user for any WordPress REST route whose query string happened to contain the MCP endpoint path, not just the MCP endpoint itself.
* Fixed: OAuth token responses now send `Cache-Control: no-store`; the dynamic client registration endpoint is now rate-limited per IP.

= 1.0.5 =
* Fixed: featured images from URLs without a filename extension, including Google Drive download URLs, can now be attached when CloseHub creates a WordPress draft.

= 1.0.4 =
* Added support for optional SEO titles, meta descriptions, focus keywords, categories, and featured images when creating posts from CloseHub.
* Added support for saving SEO metadata in Rank Math and Yoast SEO when either plugin is active.
* Improved post creation reliability by completing metadata before publishing and removing incomplete posts when metadata processing fails.

= 1.0.3 =
* Fixed: sites that already had an API key configured on a subsite before multisite support was added (<=1.0.1) now keep working after upgrading — the existing key is migrated to the network-wide setting instead of a new one being generated, which previously caused CloseHub requests to fail with 401.

= 1.0.2 =
* Added WordPress Multisite network support: one API key shared across the whole network, managed from Network Admin → Settings → CloseHub.
* On multisite, existing endpoints (ping, posts, woocommerce/orders, gravity-forms/*) now return combined results for every site in the network instead of a single site.

= 1.0.1 =
* Updated assets.

= 1.0.0 =
* Initial release.
* Single API key replaces WordPress Application Password, WooCommerce REST credentials, and Gravity Forms API key.
* Endpoints: ping, posts, woocommerce/orders, gravity-forms/forms.
* Admin settings page at Settings → CloseHub with copy buttons and regenerate key action.

== Upgrade Notice ==

= 1.0.0 =
Initial release — no upgrade steps required.
