# Monitor.Cat WordPress Plugin

Production-ready, modular WordPress operations layer.

## Features

- Core kernel + service container
- Dependency-aware module system with topological resolver
- Upload-based secure storage driver (`wp-content/uploads/monitorcat/<random>/`)
- Chunked job queue with resume support (`backup`, `scan`, `webp`)
- Security layer:
  - HMAC-signed remote API (`Authorization`, `X-MC-*` headers)
  - Replay protection
  - Rate limiting (transient + DB)
  - Redirect hardening
- Setup Wizard (6 steps)
- Preset system (`company_site`, `woocommerce_site`, `agency_site`)
- Admin pages:
  - Dashboard
  - Setup Wizard
  - Job Queue status
- Database migration runner + version tracking (`monitorcat_db_version`)
- Unit + integration test suite scaffold

## Directory Structure

- `monitor-cat.php`: plugin bootstrap
- `src/Core`: kernel, module manager, resolver, settings, cron, health
- `src/Storage`: secure upload storage driver
- `src/Security`: signatures, replay, rate limit, redirect guard, secrets
- `src/Jobs`: queue, runner, handlers
- `src/Modules`: functional modules
- `src/Admin`: dashboard + wizard
- `src/Database`: migration schema
- `presets/*.json`: preset definitions
- `tests`: unit/integration tests

## Modules

- `logger`
- `security`
- `backup`
- `smtp`
- `redirect`
- `privacy`
- `remote`
- `scan`
- `webp`

Modules are load-ordered via dependency resolver and can be enabled/disabled by preset/settings (`monitorcat_settings.modules`).

## Storage Hardening

Runtime files are stored under uploads (not plugin directory):

- `backups/`
- `logs/`
- `cache/`
- `webp/`

Hardening artifacts are generated automatically:

- `index.html`
- `.htaccess` deny rules
- `nginx-deny.conf`

## Job Queue

Table: `wp_monitorcat_jobs`

- `pending`, `running`, `paused`, `success`, `fail`
- chunk state persisted in `chunk_state_json`
- retries/resume via cron (`monitorcat_run_queue`)

## Security Model

Remote command endpoint: `POST /wp-json/monitorcat/v1/remote/command`

Required headers:

- `Authorization: Bearer <token>`
- `X-MC-Timestamp`
- `X-MC-Signature`
- `X-MC-Request-ID`

Signature canonical string:

`METHOD + "\n" + ROUTE + "\n" + TIMESTAMP + "\n" + SHA256(BODY)`

HMAC: `sha256` with shared token.

## Setup Wizard Steps

1. Health check
2. Preset selection
3. Backup schedule
4. SMTP setup/test
5. Privacy enable
6. Remote connect (optional)

## REST Endpoints

- `POST /monitorcat/v1/backup/start`
- `POST /monitorcat/v1/scan/start`
- `POST /monitorcat/v1/webp/start`
- `POST /monitorcat/v1/smtp/test`
- `GET|POST /monitorcat/v1/redirects`
- `DELETE /monitorcat/v1/redirects/{id}`
- `POST /monitorcat/v1/privacy/consent`
- `POST /monitorcat/v1/remote/command`

## Database Tables

- `monitorcat_logs`
- `monitorcat_lockouts`
- `monitorcat_redirects`
- `monitorcat_redirect_logs`
- `monitorcat_backups`
- `monitorcat_jobs`
- `monitorcat_remote_commands`
- `monitorcat_consent_logs`

## Development

### Install dependencies

```bash
composer install
```

### Run tests

```bash
composer test
```

### Run lints

```bash
composer lint
```

## Design System

The plugin's admin UI follows the Monitor.Cat design language used across the homepage and dashboard app. It does NOT use default WordPress admin styling.

### Brand Colors

- **Primary**: `#FF9F43` (orange) - CTAs, active states
- **Primary hover**: `#F08C2E`
- **Background**: `#F7F8FA` base, `#EEF1F6` alt
- **Text**: `#1E293B` strong, `#475569` default, `#94A3B8` soft
- **Accents**: Lavender `#C4B5FD`/`#8B5CF6`, Mint `#6EE7B7`/`#10B981`, Coral `#FCA5A5`/`#F87171`, Cyan `#22D3EE`/`#06B6D4`

### Typography

- **Headings**: Fredoka (Google Fonts) - rounded, friendly
- **Body**: Rubik (Google Fonts) - geometric sans-serif

### Component Style

- **Cards**: White/glassmorphic, 20-24px border-radius, layered shadows with inset highlights, hover lift (`translateY(-4px)`)
- **Buttons**: Fully rounded pill shape (`999px`), orange gradient primary, spring easing hover (`translateY(-2px) scale(1.02)`)
- **Forms**: 1rem border-radius, orange focus glow, min-height 3.1rem
- **Icon pedestals**: Squircle containers (64-96px) with 3D depth shadows
- **Status badges**: Pill-shaped with semantic color backgrounds (green/amber/red)
- **Layout**: 1200px max-width, glassmorphism effects, spring-like easing (`cubic-bezier(0.16, 1, 0.3, 1)`)
- **No dark mode** - light theme only

### Brand Assets

- `assets/img/monitor-cat-orange.svg` - Primary logo
- `assets/img/monitor-cat-monochrome.svg` - Monochrome logo
- `assets/img/cat*.webp`, `threats.webp`, `monitor-cat-with-monitor.webp` - Mascot illustrations
- `assets/fonts/fa-duotone-regular-400.woff2` + `assets/css/vendor/` - FontAwesome 7 Duotone icons

See `CLAUDE.md` for full design token reference and implementation notes.

## Notes

- The plugin includes a fallback PSR-4 autoloader when Composer autoload is unavailable.
- Queue handlers are designed for chunked progress and resumable execution.
- All SQL writes are routed via `$wpdb` helpers.