=== Ordrivo Booking Super Pro ===
Contributors: ordrivo
Tags: booking, appointment, terminal, services, calendar
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 7.0.15
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Editable appointment booking with 10 industry categories, 200 service examples, a live administrator terminal and private customer rescheduling.

== Description ==

Ordrivo Booking Super Pro adds appointment requests and administrator acceptance to a WordPress website. Customers choose a service, date and available time, then follow the decision using a private mobile-friendly booking link.

* Verified customer accounts: email/password registration with email verification, plus configurable Google, Microsoft and Facebook sign-in.
* Customer My appointments page; ownership checks protect status and rescheduling.
* Ten editable service categories with twenty editable service examples per category.
* Realistic category imagery selected from the WordPress Media Library; preview, replace or remove category images. Each service can use its own Media Library photo.
* Editable titles, descriptions, prices, durations, opening hours, weekdays and currency label.
* Administrator terminal with Accept, Reject, Start, Complete and Cancel controls. Status filtering is applied server-side before pagination; a changed appointment stays available in a focused detail card so the next permitted action can be taken.
* Date view and all-pending-requests queue; automatic updates every five seconds while visible.
* Optional user-enabled sound alerts for newly detected requests.
* Private customer status page and rescheduling. Rescheduled requests require new administrator acceptance.
* Optional postcode-prefix allowlist, honeypot, signed arithmetic challenge, replay protection and submission throttling.
* Duration-aware overlap checking and database named locks to serialize competing requests.
* Notification emails and WordPress personal-data export/erasure.

This release uses one shared appointment resource per website. It does not schedule several employees or rooms independently. The ten industries are editable example content, not ten independent business accounts. Category photos are shared by default across their twenty services; 200 unique service photos are not included.

Demo prices/descriptions are examples, not recommended medical or professional service prices. Edit or draft unused services before launch. Currency changes do not convert numeric prices. The plugin records booking requests and consent, not medical records or payments.

Provider app IDs/secrets and HTTPS are required for social sign-in. Customers without these providers can create a verified email/password account. WordPress mail delivery must work for email verification. Social sign-in identifies an account, not a government identity.

English is the source language. A gettext translation template is included; translated UI language packs are not included. Service/catalog content is editable WordPress content.

== Installation ==

1. Back up the website. Deactivate Ordrivo Booking Lite if installed; do not run Lite and Super Pro together.
2. Upload this plugin ZIP through Plugins > Add New > Upload Plugin and activate it.
3. Existing Lite services and appointments are retained. On first Pro activation, the 200 service examples are added.
4. Open Ordrivo Booking Super Pro > Settings to configure hours, weekdays, currency and postcodes. Save a real, monitored notification email before accepting online bookings; placeholder or reserved example addresses are rejected, and the plugin pauses booking requests until a usable address is configured.
5. Open Ordrivo Booking → Service Categories to create or edit categories and manage images with the Media Library picker. Open Services to edit service images, descriptions, prices and durations; draft services you do not offer.
6. Use the generated Book an appointment page or add [ordrivo_booking] to a page.
7. Open the Booking Terminal in wp-admin. An optional staff page can contain [ordrivo_booking_terminal]; it requires an administrator login.
8. The generated My appointment page contains [ordrivo_booking_status]. Keep this page published. Customers use the unique link shown after booking or sent by email.
9. Configure Social sign-in app IDs/secrets if offering Google/Microsoft/Facebook. Without providers, customers can create an email/password account and verify their email.
10. Exclude booking/status pages from page caches. Test the site on desktop, Android and iOS before production use.

== Service areas ==

Settings accept postcode prefixes separated by commas. For example, 97,98 permits normalized postcodes beginning with either prefix. An empty setting permits all postcodes; * also permits all. This is operator-configured prefix checking, not an official postcode or address database.

== Privacy and notifications ==

Customer booking links require a signed-in verified account matching the appointment owner (or an administrator). Token-based links and account-owned booking IDs are supported. Keep email verification links private. Token hashes are stored instead of plaintext tokens. Customer status responses omit telephone, email and notes. Customers have a My appointments page showing their latest 100 records. Administrators can view the appointment contact details. Privacy erasure permanently removes matching appointments and token metadata.

Notifications use WordPress wp_mail. Configure a real, monitored notification email in Settings before accepting appointments; reserved example and known placeholder addresses are rejected, administrators are warned, and online bookings stay paused until a usable destination is saved. Test actual email delivery on the site host. Automatic updates use polling, not WebSockets. Sound requires a user gesture and a visible browser page.

== Validation ==

For 7.0.15, the delivered ZIP structure and archive integrity were checked. PHP lint and live WordPress/database/email/browser tests were not run in this packaging environment.

The earlier end-to-end WordPress results in this project were collected on releases 7.0.1 through 7.0.6; they are historical and do not verify 7.0.15. Before production use, run the request-replay, concurrent registration, notification-failure, and full customer/admin workflow scenarios in the accompanying 7.0.13 test report. Live Google, Microsoft and Facebook consent flows and external email delivery also remain unverified without real provider credentials and an external inbox.

See the accompanying `docs/TEST-RESULTS-7.0.15.md` for exact checks and remaining runtime verification.

== Changelog ==

= 7.0.15 =
* Read post type, publication state, ownership, appointment status, original date/time, service and postcode directly from the database after the booking lock is acquired.
* Repeat the direct database read after acquiring the requested date lock, and use that snapshot for reschedule validation and writes.
* Preserve the administrator decision and original schedule with HTTP 409 when an appointment is rejected, cancelled, started, completed, no longer published, or no longer owned by the requester.
* Keep administrator status changes serialized through the same booking lock.


= 7.0.14 =
* Reload appointment data after acquiring the booking lock so customer rescheduling validates the current status, original time and ownership instead of cached values.
* Return a conflict and preserve the administrator's decision and original schedule when an appointment changed while a reschedule request was waiting.
* Reload appointment state in the administrator status handler after locking, so concurrent start-treatment and rescheduling requests cannot overwrite each other.

= 7.0.13 =
* Atomically reserve one-use booking and registration challenges while enforcing their request limits under database named locks.
* Report notification delivery failures accurately after booking creation and during account verification.
* Update the installation guide and release-specific verification checklist.

= 7.0.12 =
* Reject notification email addresses at reserved example domains and common placeholder destinations.
* Show a clear administrator warning and pause online bookings until a usable business notification email is configured.
* Keep rejected values visible for correction and add release-specific settings and booking checks.

= 7.0.11 =
* Preserve keyboard focus on the same appointment action through automatic polling when that action remains available.
* When an action disappears, focus the next permitted action on the same appointment, then the appointment card.
* If an appointment leaves the current result set, focus the next card at its former position, then the previous card; focus the status filter if no appointments remain.
* After a successful status change, focus the updated appointment card. Filtering controls retain their own focus because they are outside the refreshed grid.
* Add release-specific focus regression checks and keyboard acceptance steps.

= 7.0.10 =
* Display the customer's postcode with a translatable label in normal and focused administrator appointment cards.
* Render the postcode using the existing textContent-based element helper.
* Add static regression coverage; live WordPress/browser acceptance testing remains required.

= 7.0.9 =
* Apply status filters server-side before pagination; validate filter values and reset pagination when the filter changes.
* Show full matching totals and clearly label status counts as page counts.
* Keep the changed appointment focused and actionable after status updates, preserving the selected view/filter during polling.
* Clamp pagination after results shrink and add regression checks for the reviewer scenarios.

= 7.0.8 =
* Include the GPL-2.0-or-later license text in the installable package.
* Do not render empty image `src` attributes for categories or services without custom images.
* Align the plugin header, runtime constant, stable tag, changelog, and translation template to 7.0.8.
* Add static release regression checks; fresh WordPress runtime verification remains required.

= 7.0.7 =
* Scope customer admin-toolbar hiding to verified subscriber accounts only.
* Omit missing category images, paginate terminal data (100 per page), and use bounded pending-count polling.
* Preserve unrelated book-appointment pages and store the plugin booking page ID for verification redirects.
* Retain the prior 7.0.6 WordPress runtime evidence; 7.0.7 requires fresh WordPress integration/performance verification.

= 7.0.6 =
* Add a discoverable Service Categories submenu under Ordrivo Booking, linking directly to the obp_category taxonomy screen.
* Source-check the submenu capability and target URL; the WordPress menu and category image workflow were verified in the supplied 7.0.6 runtime evidence.

= 7.0.5 =
* Add a WordPress Media Library picker with preview, replace and remove controls for new and existing service categories.
* Preserve compatible category image URL term meta for existing frontend displays.

= 7.0.4 =
* Replace salon-specific customer, email and administrator copy with neutral business and appointment wording.
* Update the English translation template.

= 7.0.3 =
* Add All appointments and Selected date terminal views.
* Keep recently updated future appointments visible and highlighted after status changes.
* Verify future booking, acceptance, refresh, rescheduling and rejection on desktop/mobile.

= 7.0.2 =
* Fix Social sign-in admin menu routing.
* Correct Tested up to to WordPress 7.1.
* Render terminal HTML through a shared template with escaped dynamic values.
* Extend actual browser tests to administrator settings and repeat desktop/mobile booking workflows.

= 7.0.1 =
* Replace four inherited photos with newly generated originals and document all asset permissions/checksums.
* Complete desktop/mobile Chrome tests of registration, verification, booking, admin decisions and customer rescheduling.
* Scroll directly to the selected booking form.

= 7.0.0 =
* Introduce the separate Super Pro package based on the supplied Booking Lite 1.0.0 source.
* Add ten editable categories and 200 editable service examples.
* Add administrator accept/reject terminal, date filtering and a pending-request queue.
* Add verified email/password customer accounts, configurable social account sign-in, an owned-booking dashboard, and private status/rescheduling with fresh acceptance.
* Add duration-aware availability, serialized booking requests, postcode rules and layered spam checks.
* Initial catalog imagery was superseded by the fully documented generated assets in 7.0.1.
* Add user documentation, translation template and actual integration test results.
