=== TestPoosh Virtual Try-On for WooCommerce ===
Contributors: testpoosh
Requires at least: 6.5
Requires PHP: 7.4
Requires Plugins: woocommerce
Stable tag: 0.4.18
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Adds the secure, responsive TestPoosh virtual try-on flow to WooCommerce product pages. The store API key stays on the WordPress server and is never exposed to shoppers.

== Installation ==

1. Upload the `pooshhoosh-virtual-try-on` directory to `/wp-content/plugins/`.
2. Activate WooCommerce and this plugin.
3. Open `WooCommerce → پرو فروشگاه` and save the TestPoosh API settings.
4. Select product categories and set the monthly per-visitor limit.

== Security ==

API keys are encrypted at rest, public REST mutations require a WordPress REST nonce, product/category access is resolved server-side, uploaded images are not stored in the Media Library, and monthly reservations use a server-derived anonymous identity and are tracked atomically.

== Requirements ==

The TestPoosh Storefront API contract must be available. See `docs/storefront-api-contract.md` in the plugin package.

== Changelog ==

= 0.4.18 =
* Display completed try-on images through a signed, short-lived, same-origin WordPress response so strict API cross-origin headers cannot break the modal preview.
* Keep inline viewing and attachment download separate without persisting result bytes in the WordPress Media Library or filesystem.

= 0.4.17 =
* Keep approved local API origins enforced server-side without disclosing them in the WordPress settings interface or validation feedback.
* Keep https://api.testpoosh.com as the API address shown by default on every fresh plugin installation.

= 0.4.16 =
* Clarify after saving display rules that the storefront button remains intentionally disabled until an API key is securely stored.
* Show a persistent setup notice beside display rules when the connection configuration is incomplete.

= 0.4.15 =
* Restrict API Key delivery to the official TestPoosh origin and explicit isolated local-test origins.
* Preserve the accepted address as entered, remove forced hostname migration, and disable stale browser URL autofill; both explicitly approved local API origins remain available without conversion.

= 0.4.14 =
* Keep the virtual try-on button available on single-product templates that omit WooCommerce's add-to-cart form hook, without rendering duplicate buttons on standard templates.

= 0.4.13 =
* Make connection and display-setting sanitization idempotent when WordPress sanitizes a newly created option more than once.
* Keep section-less user input rejected while accepting only an exact value sanitized earlier in the same request.

= 0.4.12 =
* Use `api.testpoosh.localhost` and `www.testpoosh.localhost` as the canonical local TestPoosh hostnames.
* Migrate the previously saved local API hostname without changing the stored API key or display settings.
* Make the first settings save idempotent when WordPress creates the option for a fresh installation.

= 0.4.11 =
* Remove encrypted connection settings, plugin transients, schema metadata, and quota tables only when WordPress permanently deletes the plugin.
* Preserve all plugin data during ordinary deactivation and clean each site independently on WordPress multisite.

= 0.4.10 =
* Block direct web execution of the bundled CLI-only static contract test while preserving local release validation.
* Align the minimum WordPress version with Core's native `Requires Plugins` enforcement for the WooCommerce dependency.

= 0.4.9 =
* Preserve saved API URL, encrypted API key, display rules, and limits when the isolated Docker environment is recreated with its named volumes.
* Show a persistent non-copyable masked key status in the admin page without rendering the real API key in HTML.

= 0.4.8 =
* Normalize every camera JPEG regardless of the device currently uploading it, so transferred iPhone photos have their EXIF orientation baked into the image.
* Resize high-resolution photos to the TestPoosh API decoded-pixel limit in addition to enforcing the compressed file-size limit.

= 0.4.7 =
* Distinguish the local customer website URL from the dedicated API origin and show the correct local API URL in validation feedback.

= 0.4.6 =
* Accept iPhone HEIC/HEIF photos and convert them locally to a server-compatible JPEG without uploading to a third-party converter.
* Normalize iOS JPEG metadata/orientation, correct misleading filename/MIME combinations, and optimize camera photos above the 10 MB API limit.
* Show accessible preparation, success, and actionable conversion-error feedback while keeping the modal responsive through a Web Worker.

= 0.4.5 =
* Download generated images as attachments through a short-lived, same-origin WordPress stream instead of opening the cross-origin image in a browser tab.
* Keep result bytes in memory only; no Media item, Attachment, or permanent WordPress file is created.

= 0.4.4 =
* Allow real synchronous try-on submissions enough time to finish instead of disconnecting after 25 seconds.
* Localize provider availability errors and distinguish uncertain provider acceptance from safe retry scenarios.
* Map provider concurrency pressure to a retryable busy response.
* Permit signed result delivery from the exact configured local platform origin without relaxing production URL validation.

= 0.4.3 =
* Send the exact selected WooCommerce gallery or variation image inline from WordPress to the TestPoosh API.
* Preserve SSRF protection for local/private product URLs and localize rejected-image errors for shoppers.

= 0.4.2 =
* Made connection settings atomic and report whether a new API key was actually stored or the previous key was retained.
* Added an isolated local-only allowlist, host mapping, and CA trust path for the local API endpoint.

= 0.4.1 =
* Added accessible success and validation-error feedback after either settings form is submitted.
* Corrected the admin brand mark from PP to TP.
* Reported successful and pending monthly usage in quota errors, and isolated local E2E quota identities from real test users.

= 0.4.0 =
* Bundled the Vazirmatn variable font locally for TestPoosh storefront and admin UI; no font CDN is used.
* Rebuilt the modal close control as a fixed-size accessible SVG button that resists theme overrides.
* Added an integration filter for a controlled public product-page URL in isolated real-API tests.

= 0.3.1 =
* Apply the saved accent palette to the storefront trigger and every modal state.

= 0.3.0 =
* Rebranded the WordPress-facing plugin experience to TestPoosh.
* Send the shopper-selected gallery or variation image after server-side product ownership validation.

= 0.2.2 =
* Limited the virtual try-on button and storefront assets to eligible single-product pages.

= 0.2.0 =
* Added the production Storefront API integration and short-lived signed result delivery.
* Preserved settings across the two admin forms.
* Hardened anonymous quotas, MIME handling, polling failures, URL validation, and browser cancellation.
