=== Vectoron ===
Contributors: vectoron
Tags: rest-api, content-management, shortcode, ga4, analytics
Requires at least: 5.6
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 2.11.13
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A WordPress REST API plugin for external content management with authenticated API endpoints, GA4 tracking shortcodes, and ACF integration.

== Description ==

Vectoron provides three main features:

**1. REST API Endpoints**

Secure REST API endpoints for external content management, perfect for integrating with automation platforms like Superblocks, Zapier, or custom applications.

* Create and update posts programmatically
* Manage categories
* Upload media (file upload, base64, or URL)
* Full authentication support (Basic Auth or custom headers)

**2. Content Shortcodes**

The `[vectoron_article]` shortcode provides:

* Automatic wpautop disabling for custom HTML content
* Built-in GA4 event tracking
* FAQ accordion styling support

**3. ACF Integration**

Automatically sync post content to Advanced Custom Fields:

* Settings page under Settings > Vectoron
* Auto-detect WYSIWYG fields in ACF field groups
* Support for Flexible Content, Repeaters, and Groups
* ACF sync triggered by Vectoron API or X-Vectoron-Sync header
* Works with both custom Vectoron API and native WP REST API

**4. Page Builder Integrations**

Seamless integration with popular WordPress page builders:

* **Elementor**: Auto-sync content to Elementor's text-editor widgets
* **Beaver Builder**: Auto-sync content to Beaver Builder's rich-text modules
* **DIVI**: Auto-sync content to DIVI's shortcode format (sections, rows, columns, text modules)
* **WP Bakery**: Auto-sync content to WP Bakery's shortcode format (rows, columns, column_text)
* Configurable sync modes: Auto (detect existing builder posts), Always (convert all posts), or Disabled
* Cache clearing for immediate visual updates

**5. SEO Plugin Integrations**

Automatic SEO metadata sync with popular SEO plugins:

* **Yoast SEO**: Sync meta description, SEO title, and focus keyword
* **SEOpress**: Sync meta description, SEO title, and target keyword
* **Rank Math**: Sync meta description, SEO title, and focus keyword
* All SEO fields set via API are automatically synced to the active SEO plugin

== API Endpoints ==

All endpoints use the namespace `vectoron/v1`:

* `POST /wp-json/vectoron/v1/posts` - Create a new post
* `PUT /wp-json/vectoron/v1/posts/{id}` - Update an existing post
* `POST /wp-json/vectoron/v1/categories` - Create a category
* `POST /wp-json/vectoron/v1/media` - Upload media
* `GET /wp-json/vectoron/v1/status` - Health check (no auth required)

== Authentication ==

Three authentication methods are supported:

1. **HTTP Basic Auth** - Standard username:password
2. **Authorization Header** - `Authorization: Basic <base64>`
3. **Custom Headers** - `X-WP-Username` and `X-WP-Password`

== ACF Sync Header ==

When using the native WordPress REST API (`/wp-json/wp/v2/posts`) instead of the Vectoron custom API, you can trigger ACF sync by adding the `X-Vectoron-Sync` header:

`X-Vectoron-Sync: true`

This is useful when:

* You want to use WordPress's native post creation/update endpoints
* Your integration already uses the WP REST API
* You need features only available in the native API

Without this header, native WP REST API requests will NOT trigger ACF sync, ensuring Gutenberg and other WordPress interfaces don't interfere with ACF content.

== Security Features ==

* Rate limiting (60 requests/minute per IP)
* Capability-based permission checks
* SSRF protection for URL uploads
* Input sanitization and validation
* Protected meta key filtering

== Installation ==

1. Upload the `vectoron` folder to the `/wp-content/plugins/` directory
2. Activate the plugin through the 'Plugins' menu in WordPress
3. Test the API status at `/wp-json/vectoron/v1/status`

== Frequently Asked Questions ==

= What permissions are required for API access? =

* Creating posts: User must have `edit_posts` capability (or `edit_pages` for page post type)
* Updating posts: User must have `edit_post` capability for the specific post being edited
* Categories: User must have `manage_categories` capability
* Media: User must have `upload_files` capability

= What image formats are supported for media uploads? =

JPEG, PNG, GIF, and WebP formats are supported, with a maximum file size of 10MB.

= How do I use the shortcode? =

Simply add `[vectoron_article]` to any post or page where you want to disable automatic paragraph formatting and enable GA4 tracking. (Note: The legacy `[marketing_visionary_article]` shortcode has been removed; please update any existing content to use `[vectoron_article]`.)

= Is the API rate limited? =

Yes, the API is rate limited to 60 requests per minute per IP address to prevent abuse.

== Screenshots ==

1. API status endpoint response
2. Shortcode usage in the editor

== Changelog ==

= 2.11.13 =
* Fixed: Content detection now matches `am-article` as substring instead of exact `class="am-article"`, fixing CSS/JS not loading on posts with compound class attributes like `am-article am-article-type-*`

= 2.11.12 =
* Fixed: Asset version now uses VECTORON_VERSION constant for proper cache busting on plugin updates

= 2.11.11 =
* Fixed: Plugin CSS now uses @layer so theme styles always take precedence over plugin defaults

= 2.11.10 =
* Fixed: DIVI posts now inherit the site's configured page layout (sidebar, full-width, etc.) instead of always using full-width
* Fixed: DIVI Visual Builder now recognizes Vectoron-published posts for visual editing (VB|Divi| version prefix)
* Fixed: Re-publishing a post now repairs incorrect DIVI metadata (layout, version, gutter width)
* Added: `vectoron_repair_divi_post_meta()` function for retroactive repair of existing posts
* Added: Supplementary DIVI meta fields (gutter_width, built_for_post_type) for full native DIVI parity
* Fixed: Exception handler now catches PHP 7+ Errors (Throwable) in DIVI sync

= 2.11.8 =
* Internal improvements to content formatting structural integrity checks

= 2.11.7 =
* Fixed: Multiple JSON-LD schema tags (e.g. FAQPage + ItemList for listicle articles) now all render in `<head>`
* Previously only the first schema tag was extracted; the second was left in the content body as visible text
* The `wp_head` output now emits one `<script type="application/ld+json">` per schema object
* Fixed: Elementor sync no longer sets `hide_title=yes` in page settings, which caused post titles to be hidden on themes that don't render titles outside Elementor
* On re-sync, existing `hide_title` is surgically removed while preserving other Elementor page settings
= 2.11.6 =
* Fixed: ACF flexible content fields empty after publish when native WP REST API (Tier 2) is used
* Root cause: save_post hook fires inside wp_insert/update_post before _vectoron_sync_pending flag can be set, causing ACF sync to exit early
* Fix: new rest_after_insert_post hook detects X-Vectoron-Sync header and re-runs ACF content sync + SEO metadata sync after native API saves
* Also fixes Yoast/SEOPress/Rank Math metadata not syncing on Tier 2 requests

= 2.11.3 =
* Fixed: Draft posts now return pretty permalinks instead of `?p=NNN` ugly URLs
* Added `get_pretty_permalink()` helper using WordPress's `get_sample_permalink()` technique
* Applies to both create_post and update_post API responses

= 2.11.2 =
* Added Schema Sync integration: auto-extract JSON-LD from content body into `<head>`
* Fixes WPBakery/Elementor/Divi rendering `<script type="application/ld+json">` tags as visible text
* Two-layer fix: new posts receive schema via API field, existing posts auto-migrate on first view
* Supports all three publishing tiers (Vectoron API, Native WP REST API, AJAX proxy)
* XSS-safe output via `wp_json_encode()` re-serialization
* Zero configuration required

= 2.10.3 =
* Added collapsible help documentation to Elementor Integration settings card
* Help section explains sync modes: Disabled (recommended for Theme Builder), Always, and Auto
* Includes quick reference table and troubleshooting tips
* Only visible when Elementor is detected on the site

= 2.10.2 =
* Fixed: Added `_elementor_page_settings` with `hide_title=yes` to match working Elementor posts
* Without this setting, pages displayed with unstyled/default WordPress title formatting

= 2.10.1 =
* Fixed: Always use 'wp-page' template type for Elementor (using 'wp-post' caused content not to render)
* This matches the working configuration found in properly formatted Elementor posts

= 2.10.0 =
* Enhanced Elementor integration with proper metadata and modern container support
* Added `_elementor_template_type` meta field (wp-page for pages, wp-post for posts)
* Added `_wp_page_template` meta field for pages (required by Elementor)
* Added `_elementor_pro_version` meta field when Elementor Pro is installed
* Smart container detection: uses modern flexbox containers (Elementor 3.6+) when enabled
* Fallback to legacy section/column structure for older Elementor or when containers are disabled
* Status endpoint now reports `containers_enabled` and `layout_mode` for debugging
* Improved code quality: centralized container detection helper function

= 2.9.9 =
* Fixed: Page builder integrations now wrap content in `.vectoron-content` container
* This ensures all Vectoron CSS styles (FAQ accordions, headings, tables, etc.) work correctly
* Affects: Elementor, Beaver Builder, DIVI, and WP Bakery integrations
* Existing posts will be styled correctly on next publish/update via Vectoron API

= 2.9.8 =
* Added WP Bakery (Visual Composer) Page Builder integration for automatic content sync
* New settings card for WP Bakery sync mode configuration (Auto/Always/Disabled)
* WP Bakery status added to /status API endpoint (installed, version, sync_mode)
* Content converted to WP Bakery shortcode structure: row -> column -> column_text
* Smart detection prevents double-wrapping of existing WP Bakery shortcode content
* Full cache clearing support for WP Bakery CSS transients and custom CSS files
* Manual sync test diagnostics now include WP Bakery detection and testing
* Page builder integrations section updated in documentation

= 2.9.7 =
* **New Default**: Page builder sync mode now defaults to "Always" for new installations
* Elementor, Beaver Builder, and DIVI now sync ALL Vectoron-published content by default
* This fixes issues where content appeared in the page builder editor but not on the frontend
* Rationale: Vectoron creates content - there's no existing page builder layout to protect
* Existing installations keep their current settings - no action required
* Users who manually design page builder layouts can change sync mode to "Auto" to protect them

= 2.9.6 =
* ACF WYSIWYG fields now automatically process shortcodes via `acf/format_value/type=wysiwyg` filter
* Shortcodes like `[vectoron_article]` in ACF content are now executed when displayed via `the_field()` or `get_field()`

= 2.9.5 =
* Shortcode detection now checks both post_content AND configured ACF field
* CSS/JS assets now load even when shortcode is only in ACF field (not in main content)
* Added `vectoron_has_shortcode()` helper function for unified shortcode detection

= 2.9.4 =
* ACF auto-detection now runs on every admin page load (not just plugin activation)
* Automatically selects first WYSIWYG field if ACF is installed and no field is configured
* Fixes issue where ACF installed after Vectoron was never auto-detected

= 2.9.3 =
* Fixed sync test aborting early when only SEO plugins are installed (no page builders)
* SEO plugins (Yoast, SEOpress, Rank Math) now count as valid sync targets
* Full debug log now displays even when no page builders are configured

= 2.9.2 =
* Fixed Yoast SEO focus keyphrase not appearing in Edit Post UI
* Corrected meta key from `_yoast_wpseo_focuskeyword` to `_yoast_wpseo_focuskw`
* Updated sync test diagnostics to read and display correct meta key

= 2.9.1 =
* Minor bug fixes

= 2.9.0 =
* Added DIVI Theme and Builder integration for automatic content sync
* New settings card for DIVI sync mode configuration (Auto/Always/Disabled)
* DIVI status added to /status API endpoint (installed, version, sync_mode)
* Content converted to DIVI shortcode structure: section -> row -> column -> text module
* Smart detection prevents double-wrapping of existing DIVI shortcode content
* Full cache clearing support for DIVI static resources and builder output
* Manual sync test diagnostics now include DIVI detection and testing
* Page builder integrations section updated in documentation

= 2.8.0 =
* Added Rank Math SEO integration for automatic metadata sync
* New settings card for Rank Math SEO showing plugin status and version
* Rank Math status added to /status API endpoint (installed, version, pro)
* Manual sync test diagnostics now include Rank Math SEO detection and metadata display
* SEO integrations section added to documentation

= 2.7.0 =
* Refactored plugin into modular file structure for improved maintainability
* Extracted integrations into separate files: ACF, Elementor, Beaver Builder, Yoast SEO, SEOpress
* Moved settings page and debug utilities into includes/ directory
* Moved shortcodes and asset loading into includes/shortcodes.php
* No functional changes - all features work identically to 2.6.0
* Main plugin file reduced from ~2,700 lines to ~90 lines

= 2.6.0 =
* Added Beaver Builder integration for automatic content sync
* New settings card for Beaver Builder sync mode configuration (Auto/Always/Disabled)
* Beaver Builder status added to /status API endpoint
* Manual sync test diagnostics now include Beaver Builder detection and testing
* Page builder integrations section added to documentation

= 2.5.0 =
* Added proper output escaping for third-party version constants (WPSEO_VERSION, ELEMENTOR_VERSION, SEOPRESS_VERSION)
* Replaced mt_rand() with wp_rand() for WordPress coding standards compliance
* Security hardening per WordPress Plugin Review Team feedback

= 2.4.0 =
* Improved REST API permission callbacks for WordPress plugin review compliance
* POST /posts now properly checks `edit_pages` capability for page post type
* PUT /posts/{id} now validates per-post `edit_post` capability in permission_callback
* Removed unprefixed `marketing_visionary_article` shortcode (use `vectoron_article` instead)
* Added defense-in-depth permission checks in update_post callback

= 2.1.0 =
* Added X-Vectoron-Sync header support for native WP REST API
* ACF sync now works with both Vectoron custom API and native WP REST API (with header)
* Gutenberg and WP Admin no longer accidentally trigger ACF sync
* Improved sync trigger documentation

= 2.0.0 =
* Added ACF Integration with Settings page (Settings > Vectoron)
* Auto-detect WYSIWYG fields from ACF field groups
* Support for Flexible Content, Repeaters, and Groups
* Auto-sync post_content to configured ACF field on save
* ACF info added to /status endpoint

= 1.7 =
* Improved input sanitization for API authentication
* Code quality improvements for WordPress Plugin Directory compliance

= 1.6 =
* Added comprehensive security hardening
* Added rate limiting for API endpoints
* Added SSRF protection for URL-based media uploads
* Added capability-based permission checks
* Added file size limits for uploads
* Improved input validation and sanitization
* Fixed authentication bypass vulnerability

= 1.5 =
* Added media upload endpoint with multiple upload methods
* Added base64 and URL upload support

= 1.4 =
* Added category creation endpoint
* Improved error handling

= 1.3 =
* Added post update endpoint
* Added custom meta field support

= 1.2 =
* Added GA4 tracking to shortcode
* Improved measurement ID detection

= 1.1 =
* Initial REST API implementation
* Basic authentication support

= 1.0 =
* Initial release with shortcode functionality

== Upgrade Notice ==

= 2.11.2 =
Schema Sync: JSON-LD FAQ schema is now extracted from post content and injected into `<head>`, fixing visible JSON text in WPBakery, Elementor, and Divi page builders. No configuration needed. Existing posts auto-migrate on first view.

= 2.9.9 =
CSS styling fix for page builders: Elementor, Beaver Builder, DIVI, and WP Bakery now properly wrap content so FAQ accordions, headings, and other Vectoron styles work correctly.

= 2.9.8 =
New feature: WP Bakery (Visual Composer) Page Builder integration for automatic content sync. Content is converted to WP Bakery shortcodes with row/column/column_text structure. Configure sync mode under Settings > Vectoron.

= 2.9.0 =
New feature: DIVI Theme and Builder integration for automatic content sync. Content is converted to DIVI shortcodes with section/row/column/text module structure. Configure sync mode under Settings > Vectoron.

= 2.8.0 =
New feature: Rank Math SEO integration for automatic metadata sync. Supports meta description, SEO title, and focus keyword.

= 2.7.0 =
Code refactoring release: Plugin structure reorganized into modular files for better maintainability. No functional changes - all features work identically.

= 2.6.0 =
New feature: Beaver Builder integration for automatic content sync. Configure sync mode under Settings > Vectoron.

= 2.5.0 =
Security update: Proper output escaping for third-party version constants and WordPress coding standards compliance.

= 2.4.0 =
WordPress Plugin Review compliance: Improved REST API permission callbacks and removed unprefixed shortcode.

= 2.1.0 =
ACF sync now requires explicit Vectoron identification. Add X-Vectoron-Sync: true header when using native WP REST API.

= 2.0.0 =
New ACF Integration feature. Configure under Settings > Vectoron to auto-sync content to ACF fields.

= 1.7 =
Improved input sanitization and code quality for WordPress Plugin Directory compliance.

= 1.6 =
Important security update. All users should upgrade immediately. This version adds rate limiting, capability checks, and fixes a potential authentication bypass.