=== YoDon Connector ===
Contributors: autopress
Tags: rest api, publishing, automation, content, seo
Requires at least: 5.6
Tested up to: 6.8
Requires PHP: 7.2
Stable tag: 2.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connects your WordPress site to YoDon so articles, images, categories and SEO metadata can be published to it over the REST API.

== Description ==

YoDon Connector gives your site a single connection token that YoDon uses to publish
content for you. It is an alternative to WordPress Application Passwords, and is useful when
Application Passwords are unavailable or inconvenient.

The plugin adds a small set of REST endpoints under `autopress/v1`:

* `GET /ping` — connection check: reports the publishing user, WordPress version, detected SEO plugin and what the connection is allowed to do.
* `POST /media` — upload an image into the media library.
* `POST /post` — create a post (draft, scheduled or published), with categories, tags, excerpt, slug and featured image.
* `GET /categories` — list categories.
* `POST /categories` — create a category, or return the matching one if it already exists.
* `GET /posts` — a compact list of recent published posts, used for internal linking.
* `POST /seo` — write the SEO title, meta description and focus keyword for a post.

Requests carrying a valid token are also accepted on the standard WordPress endpoints for
posts, media, categories, tags and `users/me`, so both styles of integration work. No other
route on your site is affected.

**Security**

* Only a SHA-256 hash of the token is stored. The token itself is displayed once, when it is created.
* Tokens are compared in constant time.
* All work is done as a publishing user you choose in the settings, so posts get a real author and never gain more permissions than that user has.
* Requests with no token, or with a token that does not match, are treated exactly as they were before the plugin was installed.

== Installation ==

1. Upload the `autopress-connector` folder to `/wp-content/plugins/`, or go to Plugins → Add New → Upload Plugin and choose the ZIP file.
2. Activate the plugin.
3. Go to Settings → YoDon. A connection token is created the first time you open the page — copy it straight away, it is not shown again.
4. Choose the user posts should be published as, then click Save settings.
5. In YoDon, add the site using the REST API URL shown on the settings page and the token you copied.

== Frequently Asked Questions ==

= What permissions does the plugin need? =

The plugin acts as the user selected in Settings → YoDon under "Publish as". That user needs
to be able to publish posts, upload files and manage categories. Any administrator, and usually
any editor, already can. The connection can never do more than that user is allowed to do, and it
only applies to posts, media, categories, tags and the current-user endpoint.

= How do I rotate the token? =

Settings → YoDon → Regenerate. The previous token stops working immediately, and the new one
is shown once on that screen. Paste it into YoDon to reconnect. Rotate the token if you think
it has been exposed, or when someone who had access to it leaves.

= I lost the token. Can I look it up? =

No. Only a hash of it is stored, so it cannot be recovered — generate a new one instead. The
settings page shows the last four characters so you can tell which token a site is using.

= What data leaves my site? =

Nothing is sent anywhere on its own. The plugin has no scheduled jobs and makes no outbound
requests. It only answers requests that arrive with a valid token, and it answers with exactly
what was asked for: the connection status, the categories and recent post titles/links on the
site, and the IDs and URLs of content it just created.

= Which SEO plugins are supported? =

Yoast SEO and Rank Math are written to directly. If neither is active, the SEO title, description
and focus keyword are stored as post meta (`_autopress_seo_title`, `_autopress_seo_desc`,
`_autopress_seo_keyword`) so a theme or another plugin can pick them up.

= Connections fail with "Missing connection token" even though a token is set =

Some servers strip the `Authorization` header before PHP sees it. The plugin also accepts the
token in an `X-AutoPress-Token` header, which is not affected. If you would rather fix the header,
add this to your `.htaccess` above the WordPress rules:

`SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1`

= Does it work with a security plugin that restricts the REST API? =

Usually, yes: the connector authenticates the request before those restrictions are evaluated. If
a plugin blocks the REST API outright, allow the `autopress/v1` routes in its settings.

= Can I limit what the connection can do? =

Yes — point "Publish as" at a user with a narrower role. For example, an Author can create and
publish their own posts and upload images but cannot create categories, so category creation will
be refused while everything else keeps working.

== Changelog ==

= 2.0.0 =
* Added dedicated endpoints for publishing: `POST /post`, `POST /media`, `GET`/`POST /categories` and `GET /posts`.
* Connection tokens now also authenticate the standard WordPress endpoints for posts, media, categories, tags and `users/me`, so publishing works on sites that use those routes. All other routes are untouched.
* Added a "Publish as" setting. Content is created as a real user of your choosing instead of an anonymous request, so posts have a proper author.
* Tokens are now stored as a SHA-256 hash and shown only once when created. Tokens from 1.0.0 keep working and are converted automatically the first time they are used.
* `GET /ping` now reports the publishing user, the plugin version and whether the connection can publish, upload media and manage categories.
* Uploads are limited to JPEG, PNG, GIF, WebP and AVIF, and are verified against their actual contents.
* Categories and tags can be sent by name as well as by ID; missing ones are created.
* Added a fallback `X-AutoPress-Token` header for servers that strip `Authorization`.
* Rewritten settings screen: connection status, token hint, publishing user, detected SEO plugin and the REST API URL to paste into YoDon.

= 1.0.0 =
* First release: token authentication, `GET /ping` health check and `POST /seo` metadata push.

== Upgrade Notice ==

= 2.0.0 =
Publishing endpoints, a configurable publishing user and hashed token storage. Existing tokens
keep working; no reconnection needed.
