Overview

This plugin bundles a few third-party libraries as built assets. To comply with WordPress.org requirements for human-readable source, the following actions were taken:

- Added human-readable source copies (or references) under `assets/js/src/`:
  - `assets/js/src/tailwincss.js` — unminified/expanded browser build of `@tailwindcss/browser@4.1.4` (source: https://cdn.jsdelivr.net/npm/@tailwindcss/browser@4.1.4/dist/index.global.js)
  - `assets/js/src/chartjs.js` — reference pointing to Chart.js v4.5.1 UMD unminified build (source: https://cdn.jsdelivr.net/npm/chart.js@4.5.1/dist/chart.umd.js). Full unminified file can be included on request.

- The original minified/runtime files remain unchanged in `assets/js/` (e.g., `assets/js/chart.min.js`, `assets/js/tailwincss.js`) and are used by the plugin at runtime.

What this fixes

- Reviewers can now audit or fetch the human-readable sources for bundled libraries directly from `assets/js/src/` or the upstream CDN links.

Notes for reviewer

- If you prefer the literal upstream unminified files included inside the plugin package (instead of references), reply and we will add them under `assets/js/src/`.

- Security fixes applied (REST, CSRF, data storage, & WordPress architecture):
  - All REST endpoints that modify plugin data now use a safe permission callback and require both an authenticated user with the `manage_options` capability and a valid WP nonce. Endpoints updated: `/add-master-script`, `/remove-master-script`, `/clear-master-scripts`, `/debug-ping` (registered under `ultima/v1`).
  - Nonce verification is required and is performed before permission checks to prevent CSRF bypass.
  - Debug logging refactored: removed unsafe file writes to plugin folder (`file_put_contents()`, `__DIR__`); logs now stored in WordPress database transient (100 recent entries, 24-hour expiry). This is multisite-compatible and survives plugin updates.
  - All `require_once` statements load only internal plugin files (no direct WordPress core file loading); all code runs via WordPress hooks and lifecycle (`add_action()`, WordPress actions/filters).

- Naming/Conflict fixes applied (namespace):
  - All generic class names renamed with `Preciso_` prefix: `Preciso_Ultima_Ajax`, `Preciso_Logic`, `Preciso_Ultima_Auth`, `Preciso_Ultima_HTML`, page classes (e.g., `Preciso_LoginPage`, `Preciso_CreateAdsPage`, etc.).
  - All generic action hooks prefixed with `preciso_`: `wp_ajax_preciso_*`, `admin_post_preciso_*`.
  - All global functions prefixed with `preciso_` (e.g., `preciso_init()`, `preciso_handle_add_master_script()`).
  - This prevents conflicts with other plugins/themes that may use similar generic names.

These changes harden the plugin against unauthenticated modification, CSRF, data loss, WordPress architecture violations, and naming conflicts; the runtime behavior for administrators is unchanged.

Contact

For questions about these changes or to request the full upstream files, contact: tech@preciso.net

Additional privacy & legal docs

- `PRIVACY_POLICY.txt` — documents what data is sent to external services, when, and why.
- `TERMS_OF_SERVICE.txt` — summary of terms related to using Ultima services via the plugin.

These files and the expanded `readme.txt` disclose the external endpoints used and provide a contact for reviewers.
