=== Vinh XD Form Notifications for Zalo OA ===
Contributors: vinhxomdoi
Tags: zalo, notification, fluent forms, contact form 7, anti-spam
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Get instant Zalo Official Account messages when Fluent Forms or Contact Form 7 forms are submitted, with rate limiting and spam filters.

== Description ==

Vinh XD Form Notifications for Zalo OA sends a message through the official Zalo Official Account (OA) API every time a visitor submits a Fluent Forms or Contact Form 7 form, so you can respond to leads in seconds.

This plugin is not affiliated with or endorsed by Zalo or VNG Corporation. It uses only the official, documented Zalo OA API.

**Features**

* Works with Fluent Forms and Contact Form 7.
* Per-form configuration: enable, recipient, message template, optional webhook. A table lists all configured forms with Edit, Enable/Disable and Delete actions.
* Message templates with placeholders: `{all_data}`, `{ip}`, `{embed_post.permalink}`, `{form_title}`, `{submitted_at}` and any field name, including Fluent Forms style `{inputs.names.last_name}`.
* Sends immediately after the submission (no dependency on WP-Cron); WP-Cron is only used for retries.
* Automatic access token refresh using your OA refresh token.
* Delivery logs with status filters and automatic cleanup.
* Anti-spam: rate limit (default 3 messages / 10 minutes and 20 messages / day, editable), one summary message for held submissions, duplicate detection, link / foreign-script / IP-flood filters, and a hidden honeypot field.
* No tracking, no external assets. Credentials are stored encrypted using your WordPress salts.

**Requirements**

* A Zalo Official Account and an app on [Zalo for Developers](https://developers.zalo.me/) linked to it.
* The recipient must be the OA `user_id` of a person who follows or has interacted with your OA (Zalo OA cannot message arbitrary phone numbers).

== External services ==

This plugin connects to the Zalo Official Account API, operated by VNG Corporation, to deliver notifications. It is required for the plugin's core function.

* **openapi.zalo.me** (`https://openapi.zalo.me/v3.0/oa/message/cs`): called each time a configured form is submitted (and when you click "Send test", or when a failed message is retried). Data sent: the recipient OA user_id, the notification text built from your template (which may include the submitted form fields, the visitor's IP address and the page URL), and your OA access token.
* **oauth.zaloapp.com** (`https://oauth.zaloapp.com/v4/oa/access_token`): called when the access token is about to expire, once a day, or when you click "Refresh access token now". Data sent: your App ID, Secret Key and refresh token.

Nothing is sent before you enter your OA credentials and enable a form.

Zalo terms of use: https://zalo.vn/dieukhoan/
Zalo privacy policy: https://zalo.me/zalo/policy/
Zalo OA developer terms: https://developers.zalo.me/docs/official-account/bat-dau/dieu-khoan-dich-vu

If you set an optional webhook URL, a JSON copy of each notification (form id, title, message, time; raw fields are not included) is also posted to that URL, which you control.

== Installation ==

1. Upload the plugin to `/wp-content/plugins/` or install it from the Plugins screen, then activate it.
2. Go to **Vinh XD Form Notifications > Zalo OA** and enter the App ID, Secret Key, Access Token and Refresh Token of your OA app.
3. Use **Send test** with your own OA user_id to confirm delivery.
4. Go to **Forms**, pick a Fluent Forms or Contact Form 7 form, tick **Enable**, set the recipient and template, then **Save form**.
5. Optionally adjust limits in **Settings > Anti-spam**.

== Frequently Asked Questions ==

= Can it send to a phone number? =

No. The official OA API only delivers to users who follow or have interacted with your OA, identified by their OA user_id.

= Where do I find my OA user_id? =

Follow your OA from your Zalo account and send it a message, then look up the sender's user_id in the OA management tools or your webhook events.

= What happens when the rate limit is reached? =

Extra submissions are logged as "limited" and not sent individually. When quota is available again, one summary message tells you how many were held.

= Does it work without WP-Cron? =

Yes. Messages are sent at the end of the submission request. WP-Cron is only used to retry failed messages.

= What does uninstalling remove? =

All plugin options, credentials, the queue and the log table.

== Screenshots ==

1. Zalo OA connection and test message.
2. Per-form configuration and the configured forms table.
3. Delivery logs.
4. Anti-spam settings.

== Changelog ==

= 1.0.1 =
* Renamed display name to "Vinh XD Form Notifications for Zalo OA" (not affiliated with Zalo).
* Removed bundled translation files; translations are handled by translate.wordpress.org.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.0.1 =
Name update and packaging cleanup.

= 1.0.0 =
Initial release.
