=== TextMe SMS ===
Contributors: amitrotem, ramiy, sdp49
Tags: sms, text message, notifications, woocommerce, contact form 7
Requires at least: 5.2
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 2.0.6
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Send custom SMS messages from your WordPress site to your customers using the TextMe SMS gateway.

== Description ==

TextMe SMS Integration allows you to send SMS messages from your WordPress site using the TextMe SMS gateway service.

**Features:**

* Send SMS notifications for WooCommerce orders
* Contact Form 7 integration
* Elementor Forms integration
* User registration SMS notifications
* Admin OTP/2FA for secure logins
* Phone number login shortcodes
* Out of stock notifications
* Balance monitoring with email alerts

**WooCommerce Integration:**

* New order notifications (customer and admin)
* Order complete notifications
* Order cancelled notifications
* Pending payment reminders
* Custom order status notifications
* Customer notes via SMS

**Login Security:**

* Two-factor authentication via SMS OTP
* Phone number login support
* International phone number support

== Installation ==

1. Upload the plugin files to the `/wp-content/plugins/textme-sms-integration` directory, or install the plugin through the WordPress plugins screen directly.
2. Activate the plugin through the 'Plugins' screen in WordPress.
3. Go to Settings > TextMe SMS to configure the plugin.
4. Enter your TextMe SMS API credentials.

== Frequently Asked Questions ==

= What is TextMe SMS? =

TextMe SMS is an SMS gateway service that allows you to send text messages from your applications.

= Do I need a TextMe account? =

Yes, you need an active TextMe SMS account with API credentials to use this plugin.

= Does this work with WooCommerce? =

Yes, the plugin includes full WooCommerce integration for order notifications.

== Changelog ==

= 2.0.6 =
* Fix: Remove redundant woocommerce_order_status_{status} fallback hooks and handle_order_status_fallback() — WooCommerce fires both the individual-status hook and woocommerce_order_status_changed from the same status_transition() call, so the fallback provided no additional coverage and could still produce duplicates if the transient lock expired or the object cache was unavailable

= 2.0.5 =
* Fix: Duplicate SMS sent on WooCommerce order status change — replaced per-object order meta lock with a transient-based lock shared across all WC_Order instances in the same request

= 2.0.4 =
* Fix: Remove global session_start() on init — prevents "Active PHP Session Detected" Site Health warning, REST API timeout (cURL error 28), and block editor load failures caused by PHP session lock blocking concurrent requests
* Fix: session_write_close() now called after every AJAX handler that reads/writes $_SESSION, releasing the server-level lock immediately
* Feat: Replace sticky tag-chip block with per-textarea "Insert Field..." dropdown; tag is inserted at cursor position and works in dynamically added custom status rows
* Feat: Switch WooCommerce order SMS from individual woocommerce_order_status_{status} hooks to universal woocommerce_order_status_changed hook — SMS now fires reliably from PayPlus, shipping plugins, REST API, HPOS, and other third-party triggers
* Feat: Add "Status Change Debug Log" toggle in WooCommerce tab; logs every order status transition and SMS send/skip reason to WooCommerce → Status → Logs (source: textme-sms)
* Fix: Deduplication lock (_textme_sms_sent_{status} order meta) prevents duplicate SMS if both the universal and individual hooks fire for the same transition

= 2.0.3 =
* Fix: Fatal error "Cannot use object of type WC_Meta_Data as array" when changing order status — ShipOS tracking number now correctly reads the WC_Meta_Data object value
* Fix: Extension fields added via the textme_sms_form_fields action hook now have a dedicated Save button and AJAX handler; data is saved to textme_sms_option for full backward compatibility with theme extensions

= 2.0.2 =
* Fix: WooCommerce SMS templates with v1-style tags ([first name], [last name], [order number] with spaces) were sent with unreplaced literal tags after migration — backward-compatible aliases added
* Fix: [order_status], [ship_num], and [shipping_number] tags were shown in the admin tag picker but never replaced in outgoing SMS messages
* Fix: [ship_num] and [shipping_number] now correctly read from ShipOS (wc-shipos-delivery) order meta using the actual delivery_number field
* Fix: Carriage return characters (\r) from textarea form submissions were appearing as &#xD; in received SMS messages
* Fix: TEXTME_SMS_VERSION constant was out of sync with plugin header version

= 2.0.1 =
**Architecture**

* Complete plugin rewrite with a modular, class-based architecture
* Each feature now stores its own settings separately — no more shared flat options array
* New top-level admin menu replacing the nested Settings page
* Built-in migration tool to carry all v1.x settings forward to v2.0.0 automatically
* PHP 7.4+ and WordPress 5.2+ now required

**WooCommerce**

* Independent customer and admin SMS toggles per order event
* Added pending payment SMS notifications (customer and admin)
* Added support for custom order statuses with individual SMS messages
* Added customer note SMS (send from the WooCommerce order note field)
* Added option to save customer phone number to address book on order

**Out of Stock Notifications (new)**

* Customers can subscribe to restock alerts directly from the product page
* Optional name, email, and terms & conditions fields on the subscription form
* Admin reports page with Pending and Sent tabs showing all subscribers
* Bulk SMS — notify all waiting subscribers in one click when stock returns

**User Registration Coupon (new)**

* Generate a unique WooCommerce coupon automatically on new user registration
* Send the coupon code to the customer via SMS
* Configurable discount type, amount, and coupon code length

**Login Security (new)**

* Admin OTP / 2FA — intercepts wp-login.php and requires SMS verification before granting admin access
* `[textme_login_form]` shortcode — custom login form with username, password, and SMS OTP step
* `[textme_phone_login]` shortcode — passwordless login using phone number and SMS OTP
* Configurable max OTP attempts, resend cooldown, and fallback phone meta field
* International phone number support

**Balance Monitoring (new)**

* Daily cron job checks your TextMe account balance
* Sends an email alert to the site admin when balance drops below a configurable threshold

**Reports & Logging (new)**

* API call log viewer in the admin — shows phone, message preview, status, and HTTP code
* Enable/disable logging toggle — disabled by default
* Clear all logs button
* Logs auto-pruned after 90 days (configurable)

**Admin & UX**

* Test SMS sending directly from the settings page with live response display
* Connection status indicator in the settings header
* Copy-on-click shortcode helper
* Fully responsive admin design

**Internationalization**

* Full Hebrew translation included
* All JavaScript strings localized

**Security**

* Session cookies hardened with Secure, HttpOnly, and SameSite=Strict flags
* Session ID regenerated after every successful OTP login to prevent session fixation
* Brute-force protection on credential login (5 attempts per 15 minutes)
* XXE vulnerability patched in legacy XML API parser
* Open redirect blocked — shortcode redirect attribute restricted to same-site URLs
* SSL verification explicitly enforced on all outbound API calls
* Generic error messages on phone lookup to prevent user enumeration
* Plugin options set to autoload=false — settings not loaded on front-end pages that don't use them

= 1.0.0 =
* Initial release

== Upgrade Notice ==

= 2.0.4 =
Bug fix and feature release. Fixes REST API timeouts, Site Health session warning, and block editor failures caused by PHP session locking. Adds per-textarea tag insertion dropdown and more reliable WooCommerce order SMS via the universal status-changed hook.

= 2.0.3 =
Bug fix release. Fixes fatal error on order status change when ShipOS is active, and restores save functionality for settings page extensions added via the textme_sms_form_fields hook.

= 2.0.2 =
Bug fix release. Fixes SMS template tags not being replaced after v1 migration, &#xD; characters appearing in messages, and ShipOS tracking number tags.

= 2.0.1 =
Major rewrite. All v1.x settings are migrated automatically on first activation. New features include OTP/2FA login, phone number login shortcodes, out of stock notifications, user registration coupons, balance monitoring, and API logs. Requires PHP 7.4+ and WordPress 5.2+.
