=== Manager (by ROBOTSTXT) ===
Contributors: javiercasares, robotstxt
Tags: dashboard, catalog, updates, subscriptions, management
Requires at least: 4.4
Tested up to: 7.1
Stable tag: 0.5.3
Requires PHP: 8.0
Version: 0.5.3
License: GPL-3.0-or-later
License URI: https://www.gnu.org/licenses/gpl-3.0.txt

Client-side dashboard for the ROBOTSTXT plugin ecosystem. Browse the catalog, see what's installed, and spot subscription issues — all from your own wp-admin.

== Description ==

Manager (by ROBOTSTXT) is a WordPress plugin that customers install on **their own** site. It connects to a remote Plugins Core installation (via REST API + account-level API key) and provides a single dashboard for the ROBOTSTXT plugin ecosystem:

* Lists the full plugin catalog with name, type (free/premium), price, and current version.
* For each catalog entry, shows the **local install state**: not installed, installed (inactive), up to date, or update available.
* Click a plugin's row to expand its description and a link to its website on the store.
* One-click actions: Install, Activate, and Update run on a classic page load with a standard admin notice (green/red) reporting the outcome; Buy redirects to checkout on the store site.
* Subscription health dashboard (Phase 4+): license expiring soon, payment failed, expired — surfaced as admin notices so issues are visible before updates silently stop.

This plugin does **not** re-implement the per-plugin update mechanism. Every ROBOTSTXT plugin bundles its own copy of the `Robotstxt_Core_Plugin_Updater` SDK, so updates keep working even if Manager is deactivated. Manager's value is visibility and one place to click.

**Requires Core 1.4.2+** on the store for descriptions in the catalog list (older Core versions still work; rows simply show no description).

== Using the plugin ==

= Settings =

Configure at **ROBOTSTXT → Settings**:

* **Store URL** — Base URL of the remote Plugins Core installation (defaults to `https://www.robotstxt.software`).
* **API Key** — Account-level API key issued by the ROBOTSTXT store. Encrypted before storage; masked in the UI (last 4 characters shown). Use the "Test connection" button to verify connectivity.
* **Catalog Cache (minutes)** — How long the catalog response is cached in a transient. Default: 60 minutes.
* **Data on Uninstall** — Opt-in checkbox. When enabled, all Manager options and transients are deleted on uninstall. Default: off.

= Main screen =

**ROBOTSTXT → Plugins** shows the catalog table:

| Column | Description |
|---|---|
| Plugin | Name and current version from the store. Click ▸ to expand the description and website link. |
| Type | Free or Premium. |
| Price | Annual price in EUR, or — for free plugins. |
| Local state | Not installed / Installed (inactive) / Up to date / Update available (vX → vY). |
| Action | Install / Activate / Update / Buy, depending on local state. |

Click "Refresh catalog" to force a fresh fetch from Core. Install, Activate, and Update run on a classic page load (no JavaScript) and report the result as a standard admin notice.

== Extra Configurations ==

No extra `define()` constants are required in `wp-config.php`. All configuration is done via the Settings page in wp-admin.

== Installation ==

= Automatic download =

Visit the plugin section in your WordPress, search for Manager (by ROBOTSTXT); download and install the plugin.

= Manual download =

Extract the contents of the ZIP and upload the contents to the `/wp-content/plugins/robotstxt-manager/` directory. Once uploaded, it will appear in your plugin list. Go to **ROBOTSTXT → Settings** to configure the Store URL and API key.

== Frequently Asked Questions ==

= Is this plugin compatible with WordPress Multisite? =

No. This plugin is intentionally not compatible with WordPress Multisite, matching the architecture of the rest of the ecosystem.

= What PHP version is required? =

PHP 8.0 or higher.

= Do I need Plugins Core installed on my site? =

No. Plugins Core runs on the ROBOTSTXT store site. This plugin talks to it remotely via REST API. You do not need Core, Mollie, or Sync installed locally.

= How is the API key stored? =

Encrypted at rest using AES-256-CBC with a key derived from your site's WordPress `AUTH_KEY` and `AUTH_SALT` constants. Never stored in plaintext, never logged, never exposed in any response.

== Compatibility ==

* WordPress: 4.4 - 7.1
* PHP: 8.0 - 8.5

== Changelog ==

= 0.5.3 =

_Release date: 2026-08-15_

* Authenticated encryption (encrypt-then-MAC, matching Core 1.6.0) for the stored API key: tampered payloads fail closed; legacy-stored keys keep working and upgrade on next save.

= 0.5.2 =

_Release date: 2026-08-15_

* Fixed: updating (and installing) a plugin from the Manager catalog page failed with a fatal or a bare "Installation failed." Two defects in the panel's upgrader path: `Plugin_Upgrader` was never loaded in the `admin-post` context (it lives in its own file since the WordPress 5.3 class split, and only `class-wp-upgrader.php` was required), and the overwrite option was passed under the key `overwrite`, which current WordPress reads as `overwrite_package` — so the existing folder was never cleared. Verified end-to-end against the live store.

= 0.5.1 =

_Release date: 2026-08-15_

* Stabilization release: full code/security audit, compatibility scans, and documentation alignment. Real floors declared: WordPress 4.4+, PHP 8.0+ (previously declared 4.7/7.4).
* Connection test and catalog fetch now check the HTTP status code — an unauthorized or failing store reports an error instead of "Connected" / an empty catalog (non-200 responses are no longer cached).
* API-key field validates the key format before storing.
* Premium plugins are not offered as native updates when no API key is configured (they would only fail with HTTP 403).
* Domain normalization for premium package URLs strips only the literal `www.` prefix (hosts starting with "w" were mangled).
* Opt-in uninstall now also purges the WordPress update transient (premium entries carry the API key in their package URL) and drops a phantom option.

= 0.5.0 =

_Release date: 2026-08-14_

* Native update integration: catalog plugins now show WordPress's standard "Update available" badge and update through the regular wp-admin flow. Updates download from the ROBOTSTXT store (premium plugins authenticate via the account API key; requires Core 1.5.0+). "View details" modal data comes from the catalog. Refreshing the catalog also forces a fresh WordPress update check.

= 0.4.0 =

_Release date: 2026-08-14_

* Click-to-expand rows in the catalog: each plugin's description and a link to its website are shown in a detail row under the plugin name (CSS-only toggle, no JavaScript). Requires Core 1.4.2+ on the store.

= 0.3.1 =

_Release date: 2026-08-14_

* Default store URL is now `https://www.robotstxt.software`. Existing saved URLs are preserved.

= 0.3.0 =

_Release date: 2026-08-13_

* Classic install/activate/update flow: actions run on a full page load (`admin-post.php` with per-action-and-slug nonces) and report the outcome through standard admin notices (green success / red error), replacing the previous AJAX flow.

= 0.2.0 =

_Release date: 2026-08-13_

* Install action: free and premium plugins install directly from the catalog, authenticated with the account-level API key against Core's `/download` endpoint (requires Core 1.4.0+).

= 0.1.3 =

_Release date: 2026-08-12_

* Composer PHP requirement aligned to scan floor (>=7.4).

= 0.1.2 =

_Release date: 2026-08-12_

* Documentation refresh: readme.txt and changelog.txt aligned to the standard templates. Compatibility scan results documented.

= 0.1.1 =

_Release date: 2026-08-12_

* PHPCompatibility scan (5.6–8.5): real PHP floor is 7.2; project deliberately declares 8.4 to match the ecosystem.
* wp-compat scan against WordPress 4.7: zero errors. Real WP floor is ≤ 4.7; project declares 7.0 to match the ecosystem support window.

= 0.1.0 =

_Release date: 2026-08-12_

* Phase 1 scaffold.

= Previous versions =

If you want to see the full changelog, visit the [changelog.txt](https://git.robotstxt.es/ROBOTSTXT/robotstxt-manager/raw/branch/main/changelog.txt) file.

== Compliance ==

This plugin adheres to the following security measures and review protocols for each version:

* [WordPress Plugin Handbook](https://developer.wordpress.org/plugins/)
* [WordPress Plugin Security](https://developer.wordpress.org/plugins/wordpress-org/plugin-security/)
* [WordPress APIs Security](https://developer.wordpress.org/apis/security/)
* [WordPress Coding Standards](https://github.com/WordPress/WordPress-Coding-Standards)
* [Plugin Check (PCP)](https://wordpress.org/plugins/plugin-check/)