=== Wohno – Immobilien-Inserate ===
Contributors: wohno
Tags: real estate, listings, property, rentals, immobilien
Requires at least: 6.4
Tested up to: 7.0
Requires PHP: 8.1
Stable tag: 0.23.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Show your Wohno real-estate listings natively and SEO-friendly on your WordPress site. Detail page and application stay on wohno.de.

== Description ==

The official **Wohno** plugin fetches your real-estate listings through the Wohno
API and renders them as **native, SEO-friendly HTML** directly on your WordPress
site (list/grid). Clicking a listing opens its detail page on wohno.de, where the
application also takes place. This keeps the applicant folder — including all
personal data and the related GDPR responsibility — entirely with Wohno, while you
present a high-quality showcase on your own domain.

**Highlights**

* **Native & SEO-friendly** – real HTML listings on your domain, no iframe.
* **Image gallery & detail modal** – each card shows all photos; a click opens
  an in-page modal with the description, key facts and "view / apply" buttons.
* **Four ways to embed** – Gutenberg block, Elementor widget, classic widget, and shortcode.
* **Four layouts** – grid, large cards, list and an interactive map.
* **Front-end search** – an optional filter bar (city, rooms, rent, type, WBS,
  full-text) lets your visitors search your whole portfolio, server-side and
  SEO-friendly. Enable with the block toggle or `search="1"`.
* **Single listing** – embed one listing's card via `[wohno_listing id="…"]`.
* **Adjustable branding** – accent colour and corner radius in the settings.
* **Filters** – city, ZIP, number of rooms, maximum rent, property type, WBS,
  full-text search.
* **"Load more"** – cursor-based pagination for the list/grid.
* **Map layout** – optional interactive map (Leaflet + OpenStreetMap, no API key).
* **Fast** – server-side fetch with caching (transient + ETag) and a background
  prewarm, so page rendering never blocks on the API and your quota is spared.
* **Secure** – the API key is encrypted at rest, used server-side only over HTTPS,
  and never reaches the browser; no applicant data is stored on your site.
* **Translatable** – fully i18n-ready (text domain `wohno`).

**Embed via shortcode**

`[wohno_listings city="Köln" rooms_min="2" rent_max="1200" limit="9" columns="3"]`

== External services ==

This plugin connects to the **Wohno API** (https://wohno.de) to fetch and display
your listings. Without this connection the plugin cannot show any listings.

* **When:** on every page view that displays listings (server-side, with ~5
  minutes of caching), plus when you click "Test connection" in the admin.
* **Where:** `https://wohno.de/api/v1/listings`
* **What is sent:** your API key (in the `X-API-Key` header, server-side only,
  never in the browser), the filters configured in the block/widget/shortcode
  (e.g. city, price), and a plugin version identifier (`X-Wohno-Plugin`). **No**
  data about your site's visitors is sent.
* **What is received:** public listing data (title, key facts, image URLs, slug
  for the detail link).

Provider: WOHNO UG (haftungsbeschränkt). Terms: https://wohno.de/agb · Privacy:
https://wohno.de/datenschutz

**OpenStreetMap (only with the map layout):** if you use the map layout
(`layout="map"`), your visitors' browsers load map tiles from OpenStreetMap
(`https://*.tile.openstreetmap.org`). This transmits the visitor's IP address to
OpenStreetMap. Without the map layout no such connection is made. Tile usage
policy: https://operations.osmfoundation.org/policies/tiles/ · Privacy:
https://wiki.osmfoundation.org/wiki/Privacy_Policy

== Installation ==

1. Install and activate the plugin.
2. In the Wohno dashboard, under **API Keys**, create a secret key (`sk_…`) with
   the **`listings:read`** scope.
3. In WordPress, open the new **Wohno** menu in the sidebar, paste the key, and click "Test".
4. Place the **"Wohno – Inserate"** block, the matching widget, or the
   `[wohno_listings]` shortcode on a page.

== Frequently Asked Questions ==

= Do I need a Wohno account? =
Yes. You create an API key with the `listings:read` scope in the Wohno dashboard.

= Are applications handled through my site? =
No. The detail page and the application run first-party on wohno.de. No applicant
data is created on your site.

= Will my listings on my domain be indexed by Google? =
Yes, the overview list is rendered as real HTML. The individual detail pages live
canonically on wohno.de.

= Is my API key safe? =
Yes. The key is stored server-side only (encrypted where the server provides
openssl) and sent only over HTTPS in the `X-API-Key` header — never in the
browser, never in the page source, never in logs.

= Are "discrete" listings shown? =
No. Discrete listings are intentionally not delivered by the API.

== Screenshots ==

1. Native listings grid on your website, with the optional search and filter bar.
2. Interactive map with price pins and clustering — privacy-friendly, loaded on click.
3. Visitor search and filter with a grid / list / map switcher — no page reload.
4. List view of the layout switcher.
5. Ready in minutes: paste your API key, connect, done.

== Changelog ==

= 0.23.1 =
* Hardening: resolved the Plugin Check input-sanitization notices — the request
  method is now unslashed and sanitized, and the two already-validated AJAX
  inputs (JSON filters, opaque cursor) carry a documented, scoped ignore. No
  behaviour change.

= 0.23.0 =
* New: a native **Elementor widget** — drag „Wohno – Inserate" into any
  Elementor layout and configure city, filters, template, columns, search and
  the layout switcher visually in the panel. It uses the same engine as the
  block and shortcode, with a live preview in the editor.

= 0.22.3 =
* Refreshed the wordpress.org screenshots into a clean, consistent gallery —
  wide desktop views in a browser frame, each with a short headline — covering
  the native grid, the interactive map, search & the layout switcher, the list
  view, and the quick setup.

= 0.22.2 =
* Fix: the listing image controls (close, previous/next, dots, favourite) could
  appear as dark, stretched ovals on some classic themes (e.g. Twenty Twenty-One)
  that force their own styling onto every button. The plugin now defends its own
  overlay controls so they render correctly on any theme.

= 0.22.1 =
* Docs: the settings “Hilfe” tab now includes a full shortcode reference — every
  attribute grouped by query/filter, display and interactivity, each with its
  default and a short description — plus a note on placing listings in a sidebar.

= 0.22.0 =
* New: the classic **widget** now offers the full static set of options — city,
  rooms, maximum rent, property type, WBS, a template (skin), count and columns —
  and renders through the same engine as the block and shortcode. (Interactive
  features like visitor search or the layout switcher stay with the block, which
  you can place in block-based widget areas.)
* New: the **block** gained a "show discrete listings" toggle, matching the
  shortcode. Discrete listings' address and map pin always stay hidden either way.

= 0.21.2 =
* Accessibility: improved colour contrast to meet WCAG 2.1 AA (1.4.3) on three
  spots that were just under the 4.5:1 threshold — the "Search" button, the
  inactive layout-switcher labels, and the settings "live preview" label. An
  axe-core audit of the 0.21.0 interface (map, switcher, filters) confirmed
  keyboard operation, focus management, focus-visible rings and the screen-reader
  live-region announcements are otherwise solid.

= 0.21.1 =
* Fix: a shortcode attribute like `show_discrete="false"` is now correctly read
  as off. Previously any non-empty string (including "false") turned the option
  on, because it was parsed with a loose emptiness check.
* Security: the settings page now shows a clear admin notice when the API key is
  stored as plaintext — i.e. when the server cannot encrypt it (no AUTH_KEY /
  SECURE_AUTH_KEY in wp-config.php, or the openssl extension is unavailable). No
  more silent crypto downgrade; the key material itself is never displayed.
* Compat: refreshed the wordpress.org screenshots to the current interface
  (instant filters, price-pin map with clustering, layout switcher) and resolved
  a Plugin Check false positive about `array_is_list()` without raising the
  minimum WordPress version.

= 0.21.0 =
* New: **instant filters** — the search bar now filters your listings without a
  page reload. Adjust city, rooms, rent, type or WBS and hit "Search"; the list
  updates in place and the address bar keeps a shareable link to that exact
  selection.
* New: **map upgrade** — the interactive map now shows a price pin (warm rent)
  for every listing, groups nearby listings into clusters when there are many,
  and highlights the matching pin when you hover a card in the list (and vice
  versa), so the list and the map stay in sync.
* New: **layout switcher** — let your visitors toggle between grid, list and map
  themselves (opt-in). It works together with the filters, so a visitor can
  filter and then switch views without losing their selection.
* New: **privacy-friendly map** — OpenStreetMap now loads only after the visitor
  actively agrees ("click to load"). No map tiles are fetched and no visitor IP
  address is transmitted to OpenStreetMap until consent is given.
* Internal: "Load more" now runs through a single, signed render endpoint
  (faster and more secure). Fully backward compatible — nothing changes for
  existing embeds.

= 0.20.1 =
* Improved: the "Display" settings now use more of your screen — a wider layout
  with a larger live preview — and the template gallery has cleaner spacing.
* Improved: the dropdowns and inputs across "Display" and the shortcode generator
  got a consistent, refined look.
* Improved: the "Embed" tab now shows ready-to-use examples first, with the
  shortcode generator below.
* Fixed: on the split-map view, clicking a listing now opens its detail page on
  your own site (when native detail pages are enabled) instead of jumping straight
  to wohno.de — consistent with the grid.
* Improved: the setup wizard is now a clean overlay above your settings, with a
  consistent Wohno-orange button style and a full-screen view on mobile.

= 0.20.0 =
* New: a guided setup wizard walks you through first-time configuration in four
  short steps — connect your API key, test the connection, pick a skin and accent
  colour with a live preview, and see a sample of your listings — then hands you
  straight to the shortcode generator.
* New: after activating the plugin, a dismissible notice offers to start the
  wizard; you can skip it at any time. Existing sites that already have an API
  key are never interrupted — no notice, no redirect.
* New: the connection test tells you right away whether your key can fetch
  listings, with a clear message if it can't. Your key is only ever stored
  server-side and is never shown or sent back to the browser.
* New: "Restart the setup assistant" link on the Start tab, so you can reopen the
  wizard whenever you like.
* Fully backward compatible: the wizard writes the same options as the settings
  page and never changes existing configuration.

= 0.19.0 =
* New: the "Display" tab is now a live design studio — a preset gallery with a
  thumbnail per template, a live preview beside the controls that updates as you
  change the template, style or building blocks (sample data until your API key
  returns listings), and a two-column layout that stacks cleanly on small screens.
* New: the four style options (accent colour, corner radius, density, font size)
  are grouped into one clear "Style" section.
* New: optional global "building blocks" pre-set — choose site-wide which card
  blocks are visible. Off by default, so existing sites look exactly the same;
  blocks and shortcodes can still override it.
* Fully backward compatible: the same options/keys as before, no migration.

= 0.18.0 =
* New: native listing detail pages with their own URL on your domain
  (SEO-friendly, server-rendered, live data from Wohno) — optional, off by
  default; the base path is configurable ("inserate" by default).
* The card click and the modal's "View in full" now open this local detail page;
  the application still runs safely first-party on wohno.de.
* Each detail page carries a `rel=canonical` to its wohno.de page plus valid
  schema.org structured data (Accommodation + Offer), built only from real fields.
* Removed/unknown listings return a real 404; a temporary API hiccup returns a
  503 (never a cached "not found"); discrete listings never expose an address.
* Fully backward compatible: with the feature off, everything behaves exactly as
  in 0.17.0.

= 0.17.0 =
* New: six ready-made display templates ("skins") — Classic Grid, Editorial Cards,
  Compact List, Split Map, Portfolio/Masonry and Hero Showcase. Choose one in the
  block, via the shortcode (`skin="…"`), or as the site-wide default in the settings.
* New: every card is a slot system — show or hide badges, the favourite heart,
  price, stats and more, per block ("building blocks" panel).
* New: in-card image slider with swipe, status badges (New / Available now /
  Reserved), and a favourites heart stored locally in the visitor's browser
  (no account, no tracking, no network request).
* New: global style settings — card density and font size — next to the existing
  accent colour and corner radius.
* New: optional visitor layout switcher (grid / list / map).
* Refined card design: full address line, clean price line, larger gallery arrows,
  framed rounded images.
* Fully backward compatible: existing shortcodes and blocks keep working — the old
  `layout` attribute maps to the matching skin.

= 0.16.1 =
* Internal: the short-lived negative-cache transient now uses an explicitly
  prefixed name ("wohno_neg_…") so its option/transient key is unmistakably
  namespaced in the shared transient store (plugin-review hardening).

= 0.16.0 =
* Privacy/compliance: the public "Bereitgestellt von Wohno" credit link is now
  off by default and only appears when the site admin explicitly opts in on the
  settings page (no attribution on the front end without consent).
* Internal: all admin CSS is now enqueued via wp_enqueue_style /
  wp_add_inline_style instead of inline <style> tags.
* Internal: every registered setting uses a named sanitize callback.
* Privacy: the suggested privacy-policy text now also notes that listing images
  load from Wohno's servers in the visitor's browser.
* Internal: bundled a LICENSE file for the included Leaflet library.

= 0.15.7 =
* Fix: the "Plugin URI" and "Author URI" headers are now distinct — the plugin
  URI points at the plugin's landing page, the author URI at wohno.de
  (wordpress.org requires the two to differ).

= 0.15.6 =
* Compatibility: tested up to WordPress 7.0.
* Maintenance: display name aligned across the readme and the plugin header
  ("Wohno – Immobilien-Inserate").
* Internal: iterate query parameters by key/value when preserving page context,
  avoiding a needless superglobal index lookup.

= 0.15.5 =
* Fix: the maximum-rent filter now works. The Wohno API expects the rent filter
  in cents (the unit it also returns); the plugin now converts your euro input
  accordingly, so e.g. "max 1,200 €" filters correctly instead of returning
  (almost) nothing.

= 0.15.4 =
* Fix: the readme's "Tested up to" now points at a released WordPress version.
* Fix: the settings-page live preview showed sample prices 100× too low — the
  demo data now uses the same cents unit as the real API.
* Hardening: the detail and "load more" endpoints now restrict the listing id to
  a UUID and briefly cache "not found" results, so the public endpoints can't be
  used to probe the Wohno API with random id/cursor values.
* Hardening: the front-end filter bar no longer lets visitors seed the background
  prewarm cache — only the embed's own (author-defined) view is prewarmed.

= 0.15.3 =
* The sidebar menu shows the coloured WOHNO "W" icon again, now at full opacity
  in every state (idle, hover, current) instead of WordPress' dimmed default.

= 0.15.2 =
* The sidebar menu icon is now monochrome and follows the WordPress admin colour
  scheme (grey when idle, light on hover/current) like a native icon, via a CSS
  mask.

= 0.15.1 =
* Fix: the search/filter fields no longer overflow the bar (box-sizing) and the
  bar is fully responsive — fields stack to two columns, then one, on smaller
  screens.
* The sidebar menu now uses the WOHNO "W" icon.

= 0.15.0 =
* The Wohno settings now live in their own top-level menu in the WordPress
  sidebar (with a building icon) instead of under Settings.

= 0.14.1 =
* Fix: the search bar's fields and the amber "Search" button were invisible on
  some themes — the bar's CSS variables weren't defined (it sits outside the
  listings wrapper). Fields now have a clear background and the button is
  visible.

= 0.14.0 =
* Redesigned, more polished search & filter bar (clear fields with icons, a
  prominent search button, tidy responsive layout).
* New single-listing picker in the settings (Embed tab): choose a listing from a
  dropdown and the `[wohno_listing id="…"]` shortcode is generated — no need to
  look up the ID.

= 0.13.0 =
* The plugin now follows the site language: a bundled English (en_US) translation
  means English sites show English, German sites show German — automatically.
* Availability dates are now formatted in the site's locale/date format instead
  of a fixed German format.

= 0.12.0 =
* Lighter pages: long listing descriptions are no longer embedded in every card.
  A short teaser is embedded and the full text is lazy-loaded (cached) when the
  detail modal opens — much less HTML with many/long listings.

= 0.11.0 =
* Fix: prices were shown 100× too high (e.g. "70,000 €" instead of "700.00 €").
  The Wohno API delivers prices in cents; they are now converted correctly.
* New: the detail modal shows the full cost breakdown (cold rent, utilities,
  warm rent, deposit) when available.

= 0.10.2 =
* The detail modal now shows the full listing description (the safety cap was far
  too low and cut normal descriptions short).

= 0.10.1 =
* The detail modal now uses its own, consistent type scale instead of inheriting
  the theme's font size — balanced headline, facts and description.

= 0.10.0 =
* New "Start" tab (now the default) with an at-a-glance overview of what the
  plugin does and a status-aware "first steps" guide linking to the right tabs.

= 0.9.0 =
* New: block patterns (grid, large cards, search + list, map) for one-click
  insertion.
* New: suggested privacy-policy text (Tools → Privacy) covering the Wohno API
  and OpenStreetMap data flows.
* New: an optional, dismissible review prompt for engaged admins, plus a
  deactivation feedback dialog (the reason is only sent if you choose to, via a
  pre-filled e-mail — no automatic tracking).

= 0.8.3 =
* The "Settings saved" confirmation now appears below the header (instead of
  inside it) and reads in German ("Einstellungen gespeichert.").

= 0.8.2 =
* The settings-page buttons, checkboxes and focus rings now use the WOHNO accent
  colour instead of the default WordPress blue.

= 0.8.1 =
* The generator preview now also works before any listings exist: it shows a
  faithful mock (sample listings with placeholder images) rendered through the
  real card template, so you can preview every layout right away.

= 0.8.0 =
* The shortcode generator now has a live preview: the configured listings render
  right below the generator (admin-only, server-side, accurate) as you change
  the options.

= 0.7.0 =
* New: a live shortcode generator on the settings page (tab "Einbinden") —
  configure layout, columns, filters and toggles and copy the generated
  `[wohno_listings …]` shortcode.

= 0.6.1 =
* Fix: a single/few results no longer shrink to a tiny card — grid columns are
  now a maximum, with a comfortable minimum card width.
* Fix: the detail modal now shows the image gallery (the media area no longer
  collapses).

= 0.6.0 =
* Image gallery in every card (browse all photos with arrows/dots) and a detail
  modal on click — description, key facts, price, and "view on wohno.de" /
  "apply now" buttons. Larger, refreshed card. No extra API request.

= 0.5.0 =
* Front-end search & filter bar (block toggle or `search="1"`): visitors can
  filter your portfolio by text, city, type, rooms, rent and WBS — server-side
  and SEO-friendly, working with every layout and "load more".

= 0.4.0 =
* Redesigned settings page: gradient hero, tabbed navigation (Display /
  Connection / Embed / Help) with a quick-start tutorial, FAQ and contact details.
* Adjustable branding: accent colour and corner radius.
* The "Provided by Wohno" link can be turned off.

= 0.3.0 =
* New layouts: large cards (`layout="cards"`) and list (`layout="list"`) next to
  grid and map; refreshed card design closer to wohno.de.
* Site-wide default layout and column count in the settings.

= 0.2.5 =
* Important fix: saving the API key now works. WordPress sanitises a setting
  twice on save; the second pass received the already-encrypted key and discarded
  it, which produced a false "Please enter a secret key (sk_…)" error and left the
  key unsaved. The sanitiser is now idempotent.

= 0.2.4 =
* Fix: the API key field now extracts the key even when copying dragged along an
  invisible character (word joiner, soft hyphen, directional mark), quotes, or a
  label — not just plain spaces.

= 0.2.3 =
* Fix: the API key field now accepts keys that picked up an invisible
  (non-breaking or zero-width) space when copied from a styled dashboard — all
  whitespace is stripped before validation.

= 0.2.2 =
* readme rewritten in English (wordpress.org requirement).
* "Tested up to" set to the current WordPress version.
* Removed the unnecessary load_plugin_textdomain() call; excluded packaging
  artifacts from the distributed build.

= 0.2.1 =
* Provider/author/copyright set to WOHNO UG (haftungsbeschränkt).
* Hardening and cleanup: no internal references in the shipped code, translations
  for editor scripts (`wp_set_script_translations`).

= 0.2.0 =
* Single listing via `[wohno_listing id="…"]` and a dedicated block.
* "Load more" (cursor pagination) for the list/grid.
* Map layout (`layout="map"`) with Leaflet + OpenStreetMap (no API key).
* Non-blocking rendering with background prewarm (WP-Cron); HTTPS enforced.
* API key encrypted at rest; hardened (private key access, template whitelist).
* Theme override for the card markup; third-party services documented.

= 0.1.0 =
* Initial release (Phase 1): native list/grid, shortcode, Gutenberg block, widget,
  filters, caching (transient + ETag), connection test.

== Upgrade Notice ==

= 0.2.5 =
Important: fixes saving the API key (it could fail with a false "please enter a
secret key" error and never store the key).

= 0.2.4 =
More robust API key entry: tolerates invisible characters, quotes or a label
copied alongside the key.

= 0.2.3 =
Fixes API key entry when the copied key contained an invisible space.

= 0.2.2 =
English readme and current-version compatibility for the wordpress.org directory.

= 0.2.1 =
Provider/author details (WOHNO UG) and minor hardening.

= 0.2.0 =
New features (single listing, "load more", map) and security hardening.

= 0.1.0 =
First version.
