=== IntranetOS Employee Intranet with Entra ID ===
Contributors: wadimelouk
Tags: intranet, sso, microsoft, employee-directory, entra
Requires at least: 6.4
Tested up to: 7.0
Requires PHP: 8.1
Stable tag: 1.12.1
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.txt

Turn WordPress into a secure employee intranet with Microsoft 365 — Entra ID single sign-on, employee directory sync, unified search, intranet blocks and a full engagement pack. 100% of the included features are free and unlocked.

== Description ==

IntranetOS Employee Intranet with Entra ID connects your WordPress site to Microsoft 365 and gives your team a modern intranet — no per-user fees, no locked features, no upsells inside the plugin.

**🔐 Microsoft Entra ID Single Sign-On**

* "Sign in with Microsoft" button on wp-login.php (OAuth2 + PKCE)
* Automatic account matching and creation — new accounts always start as Subscriber
* B2B guest accounts are matched to their real email, never duplicated
* Optional: force Microsoft sign-in for linked accounts, and sign out of Microsoft on WordPress logout
* Built-in connection test with clear, human-readable error guidance

**👥 Employee Sync + Directory**

* Pull users from Microsoft Entra ID via Microsoft Graph delta sync (incremental — later syncs only process changes, including removals)
* Optional WordPress account provisioning for synced employees
* Front-end directory with `[eicp_employee_directory]` (filter by department, 2–4 columns)
* Auto-sync every 15 minutes via WP-Cron (optional)

**🔎 Unified Intranet Search**

* One search box across pages, posts, synced people and the FAQ knowledge base: `[eicp_unified_search]`
* Optionally redirects the theme's native search for logged-in users
* ElasticPress integration when that plugin is installed

**🎉 Engagement Pack (100% local — no Microsoft tenant needed)**

* `[eicp_announcements]` — company news with pinning
* `[eicp_kudos_wall]` — peer recognition with email notification
* `[eicp_polls]` — quick polls with one vote per employee and live results
* `[eicp_celebrations]` — birthdays and work anniversaries, today and this month
* `[eicp_faq]` — categorized knowledge base
* `[eicp_my_day]` — personal daily dashboard combining all of the above
* Engagement Hub admin screen to publish and moderate everything

**🧱 Intranet Blocks + One-Click Setup**

* Six Gutenberg blocks: News Card, Event Grid, Quick Action Tiles, Document Accordion, Portal Carousel, Employee Directory Card
* One-Click Intranet Setup wizard: generates Intranet Home (portal with quick tiles), My Day, Directory, News, Search, Kudos, Polls, Celebrations and FAQ pages plus an "Intranet" navigation menu — idempotent, never duplicates your pages
* Dark IntranetOS page style: applies automatically to any page containing a plugin shortcode, or per-page via the editor sidebar checkbox

**Privacy-friendly:** your Microsoft client secret is stored AES-256-GCM encrypted in your own database. This plugin never phones home and sends no data to the plugin author.

A separate commercial edition with SharePoint, Power BI and Service Desk connectors is available at [intranetos.com](https://intranetos.com). It is not required for any feature of this plugin.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/` or install via Plugins → Add New → Upload.
2. Activate the plugin.
3. Open **IntranetOS → Microsoft SSO** and follow the one-time Azure app registration steps (Tenant ID, Client ID, Client Secret).
4. Run **IntranetOS → Setup Wizard** to generate your intranet pages in one click.
5. Optionally enable auto-sync under **IntranetOS → Employee Sync**.

== Frequently Asked Questions ==

= Is anything locked behind payment? =

No. Every feature in this plugin is fully functional for everyone. There are no license keys, no feature gates and no trial limitations in this plugin.

= Do I need a Microsoft 365 tenant? =

Only for SSO and Employee Sync. The entire Engagement Pack (announcements, kudos, polls, celebrations, FAQ, My Day), the blocks, search of site content and the setup wizard work without any Microsoft account.

= Which Microsoft permissions do I need? =

Delegated `User.Read` for sign-in (usually present by default) and application `User.Read.All` with admin consent for Employee Sync.

= Does the plugin create administrator accounts? =

Never. Accounts auto-created via SSO or Employee Sync always get the Subscriber role. You can promote users manually under Users.

== External services ==

This plugin connects to the following Microsoft services. No other external service is contacted; no data is sent to the plugin author or any third party.

**Microsoft identity platform (login.microsoftonline.com)** — used for Entra ID single sign-on: tenant discovery (OpenID configuration), authorization redirects when an employee clicks "Sign in with Microsoft", token exchange/refresh, and the optional Microsoft logout redirect. Data sent: your Tenant ID, Client ID and Client Secret, the OAuth authorization code, and sign-in state tokens. Data received: ID/access tokens and the signed-in user's profile.
Terms: [Microsoft Services Agreement](https://www.microsoft.com/en-us/servicesagreement) · [Microsoft identity platform terms](https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use) · [Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement)

**Microsoft Graph API (graph.microsoft.com)** — used to read the signed-in user's profile (`/me`) during login, and — only when you enable Employee Sync — to read your tenant's user list (`/users/delta`: name, job title, department, email) into the plugin's local directory table. Data sent: OAuth access tokens. Data received: user profile and directory data, stored in your own WordPress database.
Terms: [Microsoft Graph API Terms of Use](https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use) · [Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement)

The admin settings page also links to portal.azure.com for the one-time app registration; this is a documentation link only — the plugin makes no calls to it.

== Screenshots ==

1. "Sign in with Microsoft" on the WordPress login page
2. Intranet Home portal with quick-action tiles (dark style)
3. Employee Directory synced from Microsoft 365
4. My Day personal dashboard with announcements, kudos, celebrations and polls
5. Engagement Hub admin — announcements, kudos, polls, celebrations, FAQs

== Changelog ==

= 1.12.1 =
* Security hardening following the WordPress.org review: every database query now uses $wpdb->prepare() with %i table placeholders, and all generated HTML output is escaped at output with wp_kses()/esc_*(). The delete confirmation in the Engagement Hub moved from an inline handler to the enqueued admin script.

= 1.12.0 =
* First public release on WordPress.org: Entra ID SSO, Employee Sync + Directory, unified search, six intranet blocks, full Engagement Pack (announcements, kudos, polls, celebrations, FAQ, My Day), One-Click Setup wizard, dark intranet page style.

== Upgrade Notice ==

= 1.12.1 =
Security hardening: fully prepared SQL queries and escaped HTML output everywhere.
