=== dabadata ===
Contributors: dabadata
Tags: database, live, realtime, table, block
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 0.2.1
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Live data on your pages: a live table your visitors edit under rules you set, with WordPress users as the project's users.

== Description ==

dabadata connects your WordPress site to a dabadata project (a hosted
database with rules, live updates and a trace of every call).

* **Live table block** (and the `[dabadata_table]` shortcode): rows of a
  project table on any page, updated live for everyone. Logged-in visitors
  add, edit and delete rows when the block is editable; the project's rules
  decide who may, and a refused change shows why, next to the row.
* **WordPress users as project users**: a logged-in user acts in the project
  with the role you map their WordPress role to (Settings > dabadata > Roles).
  Logged-out visitors are anonymous.
* **Connect in two clicks**: "Connect to dabadata" signs you in to dabadata,
  lets you pick or create a project, and brings you back connected. No key is
  copied by hand.
* **Mirror** (optional): every add, update and removal of posts, users,
  comments, terms and WooCommerce orders is sent as a small event, and the
  dabadata admin page shows the flow live.

Shortcode: `[dabadata_table table="notes" columns="title,done" editable="1" orderby="created_at desc" limit="50" title="Notes"]`.

== External service ==

This plugin talks to a dabadata server: the hosted service at
https://dabadata.com, or a server you run yourself (Settings > dabadata >
Manual setup). Nothing is sent before you connect or enter a server address.

What is sent, and when:

* **Connecting**: your browser goes to the dabadata console with this site's
  address, the address of this settings page and a random state. The site
  then sends the one-time code it received, its address and a signing secret
  it generated to `/v1/connect/exchange`, and receives the project's keys.
* **Pages with a Live table**: visitors' browsers load the dabadata client
  from the dabadata server and read (and, when allowed, write) the table's
  rows there directly. For a logged-in visitor the page carries a token this
  site signed with their user id (`wp:<id>`), display name and mapped role.
  No email address or password is ever sent. The server sees the visitor's
  IP address and browser like any web request.
* **Server-side**: the site reads the table's rows to show them when
  JavaScript is off (cached for a minute), and the project's roles for the
  role mapping.
* **Mirror** (only once a secret key is set): posts (status, slug, author,
  dates, a 200-character excerpt, content length), users (login, display
  name, roles, registered date), comments (post, author name, status, type),
  terms and WooCommerce orders. Never sent: email addresses, password hashes,
  activation keys, IP addresses or full post bodies.

What the service keeps and for how long: https://dabadata.com/docs/wordpress/#privacy

== Installation ==

1. Upload the zip in Plugins > Add New > Upload Plugin, and activate.
2. Settings > dabadata > **Connect to dabadata**, sign in, pick or create a
   project (the WordPress template has a `notes` table ready), press Connect.
3. Add the **Live table** block to a page.

Self-hosted dabadata: enter the server URL and keys under Manual setup, and
register the site secret shown there as an HS256 issuer of your project.

== Frequently Asked Questions ==

= Where are the keys stored? =

In the `dabadata_settings` option. The secret key and the site secret are
encrypted (libsodium secretbox) with a key derived from your `AUTH_KEY` and a
random salt; the publishable key and the server address are plain (they are
not secret). Changing `AUTH_KEY` means connecting again.

= How do I disconnect? =

Settings > dabadata > Disconnect. The site's key is revoked on the server and
removed here. Uninstalling the plugin removes all of its options.

== Changelog ==

= 0.2.1 =
* Live table: typing in the add or edit form keeps its focus and caret when
  someone else changes a row (the live redraw no longer drops the field).

= 0.2.0 =
* Connect to dabadata from the settings page (no keys in URLs).
* The identity bridge: WordPress users act with mapped project roles.
* Live table block and `[dabadata_table]` shortcode.
* Settings export and import (without secrets). WordPress 6.5+, PHP 8.1+.

= 0.1.0 =
* First version: the mirror and the inspector.
