=== MediaNest Upload Manager ===
Contributors: dilip2615, rafikwp, dixitpujara
Tags: media, upload, files, directory, import
Requires at least: 6.7
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 2.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Upload files into a dedicated uploads subfolder, browse from wp-admin, and import into the Media Library.

== Description ==

MediaNest Upload Manager is a complete media staging and workflow platform for WordPress.

*Features:*

* Chunked uploads (Plupload) with pause/cancel
* Folder drag-and-drop upload
* Directory browser with search and filter
* File preview (images, PDF) and URL copy
* Delete, rename, and move files
* Single, bulk, and folder import to Media Library
* Import status tracking in tree view
* Settings page (file types, roles, duplicates, import destination)
* Activity / audit log
* REST API (`/wp-json/mediupma/v1/`)
* Action/filter hooks for developers
* Gutenberg block: MediaNest File Browser
* Frontend shortcode: `[medianest_upload folder="client-name"]`
* Webhook notifications (optional)

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/`
2. Activate the plugin through the Plugins menu in WordPress
3. Go to Media -> MediaNest Upload Manager
4. Configure settings at Media -> MediaNest Settings

== Frequently Asked Questions ==

= Does this plugin create files outside WordPress uploads? =

No. All content stays inside your WordPress uploads directory.

= Can I allow video files? =

Yes. Go to Media -> MediaNest Settings and configure allowed extensions.

= How do I add frontend upload for clients? =

Use the shortcode: `[medianest_upload folder="client-deliveries" roles="subscriber"]`

== Shortcode ==

Display a frontend upload form for logged-in users:

`[medianest_upload folder="optional/subfolder" roles="subscriber,contributor"]`

*Attributes:*

* `folder` — Target subfolder inside the staging directory (optional).
* `roles` — Comma-separated WordPress roles allowed to upload (optional).

== REST API ==

The REST API lets external tools and custom integrations work with the staging folder. Enable it in *Media -> MediaNest Settings*.

*Namespace:* `mediupma/v1`  
*Base URL:* `/wp-json/mediupma/v1/`

= Authentication =

Requests must be made by a logged-in WordPress user. Send the REST nonce in the request header:

`X-WP-Nonce: your_rest_nonce`

You can also use Application Passwords. Each endpoint checks plugin capabilities (view, import, delete, or manage_options).

= GET /files =

List all files and folders in the staging directory.

*Example request:*

`GET /wp-json/mediupma/v1/files`

*Example response:*

`{ "tree": [ { "type": "file", "name": "photo.jpg", "relative": "photo.jpg", "size": 158000, "url": "..." } ] }`

*Permission:* User can view staging files.

= POST /import =

Import one or more staging files into the Media Library.

*Example request:*

`POST /wp-json/mediupma/v1/import`

*Body (JSON):*

`{ "relatives": [ "invoices/2026/photo.jpg", "report.pdf" ] }`

*Example response:*

`{ "success": [...], "failed": [...], "skipped": [...] }`

*Permission:* User can import files.

= DELETE /files/{path} =

Delete a file or empty folder from the staging directory.

*Example request:*

`DELETE /wp-json/mediupma/v1/files/invoices/2026/photo.jpg`

*Example response:*

`{ "message": "Deleted successfully." }`

*Permission:* User can delete staging files.

= GET /activity =

Retrieve the latest activity log entries (upload, import, delete).

*Example request:*

`GET /wp-json/mediupma/v1/activity`

*Example response:*

`{ "entries": [ { "action": "upload", "relative": "photo.jpg", "user": "Admin", "time": 1700000000 } ] }`

*Permission:* User can view staging files.

= GET /settings =

Read plugin settings (webhook URL is excluded for security).

*Example request:*

`GET /wp-json/mediupma/v1/settings`

*Permission:* `manage_options` (administrator).

== Developer Hooks ==

Extend or customize plugin behavior using WordPress actions and filters.

= Action Hooks =

Run custom code when staging files are uploaded, imported, or deleted.

*Upload*

* `mediupma_before_upload` — Fires before a file upload completes.  
  Parameters: `$relative` (string), `$user_id` (int)
* `mediupma_after_upload` — Fires after a file is saved to the staging folder.  
  Parameters: `$relative` (string), `$user_id` (int)

*Import*

* `mediupma_before_import` — Fires before a file is imported into the Media Library.  
  Parameters: `$relative` (string), `$user_id` (int)
* `mediupma_after_import` — Fires after a successful import.  
  Parameters: `$attachment_id` (int), `$relative` (string), `$user_id` (int)

*Delete*

* `mediupma_before_delete` — Fires before a staging file or folder is deleted.  
  Parameters: `$relative` (string), `$user_id` (int)
* `mediupma_after_delete` — Fires after a staging file or folder is deleted.  
  Parameters: `$relative` (string), `$user_id` (int)

= Filter Hooks =

Modify plugin defaults and permissions.

* `mediupma_allowed_extensions` — Filter the list of allowed file extensions.  
  Parameters: `$extensions` (string array)
* `mediupma_import_attachment_args` — Filter attachment data before import.  
  Parameters: `$args` (array), `$relative` (string)
* `mediupma_can_manage` — Filter whether a user can perform an action.  
  Parameters: `$can` (bool), `$user_id` (int), `$action` (string: upload, import, delete, view, manage)

= Example =

Run custom code after a file is imported:

`add_action( 'mediupma_after_import', function( $attachment_id, $relative, $user_id ) { /* your code */ }, 10, 3 );`

== Changelog ==

= 2.0.0 =
* Added file management: delete, rename, and move files from the directory browser.
* Added bulk import, folder import, and import status tracking in the tree view.
* Added image/PDF preview, copy URL, search, and file-type filters.
* Added settings page for file types, roles, duplicate handling, import destination, and uninstall cleanup.
* Added activity log, REST API, developer hooks, optional webhooks, Gutenberg block, and frontend shortcode.
* Added folder upload and upload queue pause/cancel controls.
* Added video and audio file support (configurable in settings).
* Improved chunked upload performance with memory-efficient file append.
* Fixed Copy URL on HTTP and local development sites.
* Added activation hook, translations support, and role-based permissions.

= 1.1.1 =
* Updated branding and improved admin/readme wording for WordPress.org.
* Security: restrict uploads and imports to images (JPG, PNG, GIF, WebP) and PDF only.
* Security: server-side content validation (image MIME detection, PDF magic bytes).
* Security: harden upload subfolders with index.php and .htaccess (Apache).
* Security: validate assembled file size after chunked uploads.
* Initial release.

== Upgrade Notice ==

= 2.0.0 =
Major update: file management, settings, bulk import, REST API, activity log, Gutenberg block, frontend shortcode, and developer hooks.
