=== YoDon Connector ===
Contributors: yodon
Tags: rest api, publishing, automation, ai content, seo
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 3.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Lets YoDon publish articles, images, categories and SEO metadata to your site with a single connection token you can revoke at any time.

== Description ==

[YoDon](https://yodon.com/) is an article automation service: it researches a topic on the live web, writes and designs the article, and publishes it to your site on a schedule. This plugin is the WordPress side of that connection.

It is an alternative to WordPress Application Passwords, for sites where those are hidden, switched off by a security plugin, or stripped by the host. Instead of a username and password, your site gets one connection token that YoDon presents with each request.

= What the plugin does =

* Creates a single connection token in **Settings → YoDon**. Only a SHA-256 hash of it is stored; the token itself is shown once.
* Publishes as a real user of your choosing (**Publish as**), so every article has a proper author and the connection can never do more than that user is allowed to.
* Adds a small set of REST endpoints under `autopress/v1`:
    * `GET /ping` — connection check: publishing user, WordPress version, detected SEO plugin, upload limit and what the connection may do.
    * `GET /theme` — the site's colours, fonts and content width from the active theme and Site Editor, so generated articles match your design.
    * `POST /media` — upload a JPEG, PNG, GIF, WebP or AVIF image into the media library.
    * `POST /post` — create a post (draft, pending, scheduled, private or published), or update one it already created.
    * `GET` / `POST /categories` — list categories; create one, or return the matching one if it already exists.
    * `GET /posts` — a compact list of recent published posts, used for internal linking.
    * `POST /seo` — write the SEO title, meta description and focus keyword into Yoast SEO or Rank Math.
    * `POST /translations` — link posts as translations of one another on sites running Polylang.
* Also accepts the token on the standard WordPress endpoints for posts, media, categories, tags and `users/me`. No other route on your site is affected.

= Security =

* Only a hash of the token is stored, and tokens are compared in constant time.
* A request without a valid token is treated exactly as it would be without the plugin installed.
* The token only works on the routes listed above, never on the rest of your site.
* The plugin never makes outbound requests and has no scheduled jobs.

= How this plugin works with YoDon (third-party service) =

This plugin only *answers* requests. It does not send anything to YoDon on its own, and it does nothing at all until a request arrives carrying the token you created. When YoDon does connect, it reads your categories, recent post titles and links, and your theme's design tokens, and it writes the articles and images you asked it to publish. That exchange is governed by YoDon's [Terms of Service](https://yodon.com/terms) and [Privacy Policy](https://yodon.com/privacy). Deleting the plugin, or regenerating the token, ends the connection immediately.

== Installation ==

1. Install the plugin from **Plugins → Add New** (search for "YoDon Connector"), or upload the ZIP file, then activate it.
2. Go to **Settings → YoDon**. A connection token is created the first time you open the page — copy it straight away, it is not shown again.
3. Choose the user posts should be published as, then click **Save settings**.
4. In YoDon, add the site using your site address and the token you copied.

== Frequently Asked Questions ==

= What permissions does the plugin need? =

The plugin acts as the user selected under **Publish as**. That user needs to be able to publish posts, upload files and manage categories; any administrator, and usually any editor, already can. The connection can never do more than that user is allowed to, and it only applies to posts, media, categories, tags and the current-user endpoint.

= How do I rotate the token? =

**Settings → YoDon → Regenerate.** The previous token stops working immediately and the new one is shown once. Paste it into YoDon to reconnect. Rotate the token if you think it has been exposed, or when someone who had access to it leaves.

= I lost the token. Can I look it up? =

No. Only a hash of it is stored, so it cannot be recovered — generate a new one instead. The settings page shows the last four characters so you can tell which token a site is using.

= What data leaves my site? =

Nothing leaves on its own. The plugin has no scheduled jobs and makes no outbound requests. It only answers requests that arrive with a valid token, and it answers with exactly what was asked for: the connection status, your categories, recent post titles and links, your theme's design tokens, and the IDs and URLs of content it just created.

= Which SEO plugins are supported? =

Yoast SEO and Rank Math are written to directly. If neither is active, the SEO title, description and focus keyword are stored as post meta (`_autopress_seo_title`, `_autopress_seo_desc`, `_autopress_seo_keyword`) so a theme or another plugin can pick them up.

= Connections fail with "Missing connection token" even though a token is set =

Some servers strip the `Authorization` header before PHP sees it. YoDon also sends the token in an `X-AutoPress-Token` header, which is not affected, so this is rare. If you would rather fix the header, add this to your `.htaccess` above the WordPress rules:

`SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1`

= Does it work with a security plugin that restricts the REST API? =

Usually, yes: the connector authenticates the request before those restrictions are evaluated. If a plugin blocks the REST API outright, allow the `autopress/v1` routes in its settings.

= Can I limit what the connection can do? =

Yes — point **Publish as** at a user with a narrower role. For example, an Author can create and publish their own posts and upload images but cannot create categories, so category creation will be refused while everything else keeps working.

= Why do the endpoints and settings say "autopress"? =

YoDon was previously called AutoPress. The REST namespace, header and option names kept the old identifier so that sites connected before the rename keep working without reconnecting.

= I had the older "autopress-connector" plugin installed. What happens? =

This version replaces it. Activate YoDon Connector and the old copy is deactivated automatically; your token and settings carry over, and you can delete the old plugin.

= Does it work on multisite? =

Yes. Each site in the network has its own token and publishing user under its own **Settings → YoDon**.

== Screenshots ==

1. Settings → YoDon: connection status, the token shown once, the publishing user and the detected SEO plugin.

== Changelog ==

= 3.0.1 =
* Media uploads load only the WordPress admin helpers they call (`file.php` for the temporary file and sideload, `image.php` for attachment metadata); the unused `media.php` include is gone.

= 3.0.0 =
* The plugin folder and text domain are now `yodon-connector`, matching the plugin's name. An installed `autopress-connector` copy is deactivated automatically and its token keeps working.
* `POST /post` can now update a post it created: send `id` with any of `title`, `content`, `status`, `excerpt`, `slug`, `date`, `categories`, `tags` or `featured_media`. Publishing a draft and refreshing internal links no longer need the core endpoints.
* New `GET /theme` endpoint: the site's palette, fonts and content width from the active theme and Site Editor global styles, so "match my site" works through the token alone.
* `GET /ping` now reports the upload size limit, locale, timezone, site languages (Polylang) and whether the publishing user may post unfiltered HTML.
* `POST /post` responses include the stored `content`, so the caller can tell whether anything was filtered out.
* Image uploads larger than the server's limit are refused with a clear message instead of a generic failure.
* The settings screen now processes its forms through `admin-post.php` and redirects, so refreshing the page can no longer regenerate a token by accident. Notices are dismissible.
* Removed the permissive CORS headers; the connector is not called from browsers.
* Added `uninstall.php`: deleting the plugin removes its options and transients.
* Requires WordPress 6.0 and PHP 7.4.

= 2.1.0 =
* Added `POST /translations` for Polylang sites, and a `lang` parameter on `POST /post`.
* `GET /ping` reports whether the site is multilingual.

= 2.0.0 =
* Added dedicated endpoints for publishing: `POST /post`, `POST /media`, `GET`/`POST /categories` and `GET /posts`.
* Connection tokens also authenticate the standard WordPress endpoints for posts, media, categories, tags and `users/me`. All other routes are untouched.
* Added a "Publish as" setting.
* Tokens are stored as a SHA-256 hash and shown only once. Tokens from 1.0.0 keep working and are converted automatically.
* Uploads are limited to JPEG, PNG, GIF, WebP and AVIF, and verified against their contents.
* Categories and tags can be sent by name as well as by ID; missing ones are created.
* Added the `X-AutoPress-Token` fallback header.

= 1.0.0 =
* First release: token authentication, `GET /ping` health check and `POST /seo` metadata push.

== Upgrade Notice ==

= 3.0.0 =
New folder name. Activate this version and the older autopress-connector copy is deactivated for you; the token keeps working, no reconnection needed.
