Countersign – Proof your team was told — without the paperwork

Changelog:

Version 1.0.0
Initial release

• Share documents, notices and links (guidelines, SOPs, etc.) with your team.
• Per-doctor access codes — doctors sign in with a code, no WordPress login needed.
• Recipient targeting: send to everyone or to specific doctors; each doctor sees only what is addressed to them.
• One-tap acknowledgement of receipt with a confirmation step.
• Audit trail of every acknowledgement (name, item, date, statement) with CSV export.
• "Shared" overview showing acknowledged-of-total counts per item.
• Admin area protected by the normal WordPress login; doctor page added via the [countersign] shortcode.

Version 1.1.0
Appearance settings

• Added: Appearance tab to change colours (brand, text, page and card backgrounds, "awaiting" status colour) and heading and body fonts.
• Added: Live preview that updates as you choose colours and fonts.
• Added: Reset to defaults option.
• Changed: Colour and font choices apply to both the doctor-facing page and the admin screens for a consistent look.

Version 1.2.0 — 24 June 2026
Security & private attachments

• Added: Uploaded files are now stored in a protected folder instead of the public Media Library, with randomised, unguessable filenames.
• Added: Doctors receive a signed, time-limited download link (expires after one hour) rather than a direct file URL. Every download is verified against the doctor's access code and the document's recipient list before the file is served.
• Added: Upload restrictions — only common document and image types are accepted; script and executable files are rejected.
• Changed: File handling moved off the Media Library; the share form now uploads directly into the protected store.
• Changed: Removing a shared item now also deletes its stored file from the server.
• Maintenance: Database updates automatically on activation to support secure file storage.

Version 1.3.0

• Flexible access codes
• Added: Set the length of auto-generated codes (4–16 characters) from the Doctors tab.
• Added: Give any doctor a custom access code, either when adding them or later via "Change code".
• Added: Regenerate a random code for an existing doctor, and a Copy button next to each code.
• Custom codes accept letters and numbers (4–20 characters), are not case-sensitive, and are checked to be unique before they are saved.
• Maintenance: Added an author link to the plugin header.

Version 1.4.0 — 25 June 2026 

Hardening, translation readiness & privacy = Security :

• Per-IP rate limiting + short lockout on access-code attempts.
• Minimum access-code length raised to 8 (existing shorter codes still work).
• Uploads rejected if the real file type can't be verified (no extension fallback).
• Fixed :
• "Specific doctors" with none selected no longer silently shares with Everyone.
• Audit :
• Each acknowledgement now records code used, IP address and device (user-agent), shown in the Audit tab and CSV export.
• Privacy :
• Google Fonts off by default; system fonts used unless enabled in Appearance.
• i18n :
• All interface text translatable; languages/countersign.pot included.
• Admin :
• New "Advanced" tab: opt-in "delete all data on uninstall" + security/privacy notes.
• Added uninstall.php to remove tables, options and private files when opted in.

Version 1.5.0

Added

• Groups: countersign_groups and countersign_group_members tables; Groups admin tab with create, rename, membership and delete.
• Recipient targeting extended to groups. Stored as {"people":[…],"groups":[…]}; the legacy flat-array format is still read, so pre-1.5.0 items are unaffected.
• Group membership chips on the Employees tab; optional group assignment when adding an employee.
• includes/updater.php: self-hosted update manifest, site_transient_update_plugins injection, plugins_api details, "Check for updates" link on the plugin row, Updates card in Advanced with a configurable manifest URL (12-hour cache, force-refresh button, empty URL disables checks).
• Update URI plugin header, so wordpress.org can never serve a different plugin sharing the "countersign" slug.

Changed

• Doctors tab → Employees; all user-facing strings rewritten. Database columns, table names and admin_post action names retain their original "doctor" naming for upgrade compatibility. ?tab=doctors redirects.
• Acknowledged/total counts now resolve the union of an item's groups and individuals, de-duplicated.
• REST /documents returns a person object (the doctor key is retained for cached front-end scripts).
• Translation template regenerated (~178 strings).

Fixed

• Database migrations ran only on the activation hook, so upgrading the plugin in place left the schema stale. Migrations now run on plugins_loaded and on upgrader_process_complete. This is what makes in-place updating safe.

Version 1.6.0

Added

• PDF export of the audit trail
• Export the audit trail as a PDF, grouped by employee, from the Audit trail tab.
• Choose everyone or only selected employees; "all" also includes removed employees.
• Rendered on-server with a bundled FPDF; picks up the Appearance brand colour.
• No schema change (DB ver stays 4); upgrading only replaces files.