=== Scinet Booking System ===
Contributors: scinet
Donate link: https://www.scinet.eu/danke-sagen/
Tags: appointments, booking calendar, google calendar, scheduling, zoom
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 8.2
Stable tag: 0.31.0
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Self-hosted appointment booking with calendar sync, reminders, locations and optional video meetings.

== Description ==

Publisher: scinet studio - Denise Hollstein. https://www.scinet.eu/

Scinet Booking System provides a guided booking flow for WordPress. Visitors
choose an appointment type, available day, time and contact details in order.
Availability and booking rules are checked on the server.

Features include:

* appointment types, opening hours, exceptions and reusable locations;
* daily/weekly limits, minimum notice, buffers and cancellation deadlines;
* multiple Google or iCloud calendars for conflict checks;
* one selected Google or iCloud calendar for writing appointments;
* confirmations, reminders, cancellation and secure rescheduling;
* direct SMTP or the standard WordPress mail transport;
* optional Zoom meetings and extension hooks for additional spam protection;
* WordPress personal-data export and controlled erasure;
* dropdown or card selection and theme-compatible frontend styling.

All plugin features are free, without license keys, trials or paid unlocks.
External integrations are used only after deliberate configuration. Completing
a booking currently requires a configured Google or iCloud write calendar;
Zoom and direct SMTP are optional. German and English (UK) interface translations
are included, together with the translation template for other languages.

== Mobile companion ==

The optional scinet Booking iPhone companion connects directly to the website
chosen by the operator. The companion API requires an administrator account.
Use a dedicated, revocable WordPress Application Password over HTTPS; this
credential inherits its WordPress user's permissions and is not a booking-only
scope. No central scinet service receives appointment or contact data.
Only contact fields deliberately submitted in a booking are sent to WordPress.
Manual bookings retain existing calendar, Zoom and email workflows. A manual
quota exception never permits overlapping Booking appointments or buffers.
The iOS app is distributed separately; this plugin ZIP does not contain it.

== Installation ==

1. Upload the release ZIP via Plugins > Add New > Upload Plugin and activate it.
2. The ZIP includes all runtime dependencies; Composer is not needed.
3. Follow the setup assistant: create types, opening hours and a booking page.
4. Add the [scinet_booking] shortcode to the booking page.
5. Connect Google or iCloud and select one write calendar plus conflict calendars.
6. Configure notifications and send a test email. Optionally connect Zoom.

== Frequently Asked Questions ==

= Does the plugin work without external services? =

Not entirely. Administration and basic spam protection run locally, but completing
a booking currently requires a configured Google or iCloud write calendar.
Without a write target the plugin intentionally refuses new bookings. Zoom is
optional. Standard WordPress email delivery does not require the direct SMTP
feature. Additional spam protection is available through separate extensions.

= Does each installation need its own accounts? =

The website operator supplies their own Google, Apple, Zoom and mail accounts.
Google and Zoom offer optional managed connections through the Scinet connection
service. Advanced, independently configured integrations do not use that service.

= Where are personal data stored? =

Bookings are stored in tables in the website's WordPress database. Calendar and
mail integrations transmit the details needed for the selected purpose to the
configured providers. Use WordPress privacy exports and erasure tools or the
booking administration to handle individual requests.

= What happens on deactivation or deletion? =

Deactivation and uninstall remove the plugin's scheduled cron events. Uninstall
also removes temporary plugin database entries and rebuilds local rewrite rules.
Bookings, the notification queue, settings and encrypted credentials remain for
reinstallation. An external object cache expires its temporary entries normally.
There is no automatic full data deletion or universal retention period.

Before permanent removal, resolve open bookings and notifications, erase personal
bookings through the booking administration or WordPress privacy tools, and
disconnect integrations. Revoke Google/Zoom grants or iCloud app-specific passwords
at the provider if appropriate. Uninstall alone does not revoke external access or
delete external calendar events or Zoom meetings. After reactivation, pending due
notifications may resume. Database backups have their own retention policy.

= Is Multisite supported? =

Network-wide operation is not currently certified. Uninstall cleanup is
multisite-aware, but the release test matrix covers single-site installations.

= What external services are used? =

No telemetry or advertising is included. The integrations below are triggered
only by deliberate configuration or use of an enabled feature.

= Google Calendar =

The Google connection handles OAuth authorization, calendar lists, free/busy
queries and creating, updating or deleting selected calendar events. Written
events may contain the customer's name, email, phone, appointment type, time,
location and personal management link. Direct integration communicates with
accounts.google.com, oauth2.googleapis.com and www.googleapis.com.

Privacy: https://policies.google.com/privacy
Terms: https://policies.google.com/terms

= Apple iCloud / CalDAV =

The server contacts caldav.icloud.com and discovered iCloud calendar endpoints
to read calendars/conflicts and to write appointments if selected. This uses the
Apple account identifier, app-specific password, calendar data and booking
details included in written events.

Privacy: https://www.apple.com/legal/privacy/
Terms: https://www.apple.com/legal/internet-services/icloud/

= Zoom =

When an appointment type uses Zoom, the integration creates a meeting through
zoom.us and api.zoom.us. It sends the host identifier, time, duration and a
pseudonymous booking reference. Customer name, email and phone are not sent to
the Zoom Meeting API. The returned participant link is encrypted in storage and
included in calendar events and notifications.

Privacy: https://www.zoom.com/en/trust/privacy/privacy-statement/
Terms: https://www.zoom.com/en/trust/terms/

= Scinet connection service =

The optional managed Google and Zoom setup uses https://api.booking.scinet.eu.
The service processes installation identifiers, public signing keys, signed API
requests, OAuth tokens and data needed for calendar/Zoom operations. Google
writes may therefore include the booking details described above. Independently
configured advanced integrations work without this service.

Google privacy: https://api.booking.scinet.eu/google/privacy
Google terms: https://api.booking.scinet.eu/google/terms
Zoom privacy: https://api.booking.scinet.eu/zoom/privacy
Zoom terms: https://api.booking.scinet.eu/zoom/terms

= SMTP and WordPress email =

Direct SMTP sends credentials, sender/recipient and email content to the SMTP
server chosen by the operator. The default transport passes messages to wp_mail;
further processing depends on the host and installed mail plugins. Operators
must review their selected mail provider's privacy policy and terms.

= License and source =

The plugin and bundled Scinet Booking Core are licensed under GPL-2.0-or-later.
Bundled fonts retain SIL OFL 1.1 and Composer's runtime retains MIT. See
LICENSE.txt and THIRD-PARTY-NOTICES.txt. The plugin includes readable PHP,
JavaScript and CSS sources and the PO source for its binary translation.

== Changelog ==

= 0.31.0 =
* Mobile administrator actions to reschedule or cancel existing appointments, with confirmation, stale-detail protection and safe retries.
* Rescheduling reuses the existing calendar, conference and notification workflow.

= 0.30.0 =
* Added an authenticated companion API for appointment lists, details, types, slots and manual bookings.
* Added a separate manual override for daily, weekly and appointment-type quotas; existing bookings and buffers remain protected.
* Added HTTPS WordPress Application Password authentication alongside nonce-protected browser administration.
* Added durable, user-bound booking request receipts to safely replay mobile submissions after connection failures.
* Mobile responses exclude customer management tokens and use private, no-store caching rules.


= 0.29.0 =
* Add a collapsible manual booking form for administrators under Bookings.
* Choose regular availability or a free future date and time; optionally ignore external conflict calendars.
* Retain local overlap, buffer and booking-limit protection, calendar writes and notifications.
* Record administrator overrides without fabricating customer online consent. No database migration required.

= 0.28.7 =
* Fix simple Google and Zoom authorization when connection names contain spaces, accented characters or URL punctuation.
* Encode nested callback URLs without changing strict redirect validation, permissions or existing calendar roles.

= 0.28.6 =
* Clarify the GPL version 2 or later grant directly in the adapter and core license files.
* Extend isolated release QA for browser bookings, token renewal and mail failure handling. No booking or schema changes.

= 0.28.5 =
* Standardize publisher metadata and translations: scinet studio - Denise Hollstein.
* Add source and release-package checks for outdated personal author names.
* No booking, calendar, schema or configuration changes.

= 0.28.4 =
* Complete the English (UK) catalogue and ship the translation template.
* Restrict OAuth redirects to the expected Google or explicitly configured broker endpoints.
* Remove exception payloads from debug logs and notification error records.
* Reject non-finite notice periods and invalid display prices.
* Fix day and time requests on WordPress installations using plain permalinks.
* Keep booking errors visible after refreshing available times; remove a German-only time suffix.
* Add regression checks for administrative permissions, nonces and release security.
* Document the individual Plugin Check warning assessment and release verification.

= 0.28.3 =
* Plugin und mitgelieferter PHP-Kern unter GPL-2.0-or-later; Lizenz- und Herkunftshinweise ergänzt.
* Datenerhaltende Deinstallation bereinigt Cron, temporäre Datenbankeinträge und URL-Regeln.
* Verhalten bei dauerhafter Entfernung und erneuter Installation dokumentiert.
* Shortcode ohne Attribute auf älteren WordPress-Versionen korrigiert.
* Voraussetzung eines Schreibkalenders in der Dokumentation richtiggestellt.
* Übersetzungshinweise, nummerierte Platzhalter und Schutz direkter Template-Aufrufe ergänzt.
* Fehlercodes und Kontakt-IDs vor Verwendung entslasht; Rate-Limit-Adresse validiert.
* Ungültige OAuth-Rückrufe verwerfen keine laufenden Google-/Zoom-Verbindungsversuche mehr.

= 0.28.2 =
* Fix booking type direct links when language plugins filter the home URL. Existing unprefixed booking page settings remain valid; rewrite rules refresh automatically.

= 0.28.1 =

* Keep one managed Zoom host per website and prevent concurrent shared authorizations.
* Renew access for the same Zoom host in place without changing existing booking references.
* Explain explicit host changes; retain the independent advanced Server-to-Server setup.

= 0.28.0 =

* Move Cloudflare Turnstile into the separate, optional Scinet Booking Turnstile add-on.
* Keep the account-free local honeypot, signed-slot checks, rate limits, availability validation and booking lock in the main plugin.
* Add stable extension hooks for frontend fields and assets, booking validation, settings links and diagnostics.
* Preserve legacy extension settings for a lossless add-on migration.

= 0.27.0 =

* Prepare complete WordPress.org readme metadata, FAQ and external-service disclosures.
* Add the optional Scinet "DANKE sagen" link without changing or limiting plugin functionality.
* Exclude embedded development tests from future release archives.

= 0.26.0 =

* Use the customer name followed by the booking type as the calendar event title.
* Add structured invitee, service, location, video and confidential management details to written calendar events.
* Add a ten-minute Google and iCloud calendar reminder and an administrator-protected vCard contact download.

= 0.25.0 =

* Keep the local honeypot, signed-slot validation and per-IP rate limits active without requiring an external account.
* Add optional Cloudflare Turnstile protection with encrypted installation-owned credentials and strict server-side hostname and action verification.
* Add a guided Turnstile setup, safe outage policy, privacy-policy suggestion and read-only system diagnosis.

= 0.24.0 =

* Align the complete administration with the shared Scinet plugin design language.
* Replace heavy black surfaces, condensed all-caps typography and hard edges with calm cards, compact headings and accessible rounded controls.
* Keep Scinet red as a focused brand accent for primary actions, navigation and important states.

= 0.23.1 =

* Detect expired or revoked Google authorizations instead of reporting a generic broker failure.
* Add a one-click reauthorization action for managed Google accounts while preserving calendar roles.
* Keep the existing account and calendars intact when a reauthorization attempt is cancelled or fails.

= 0.23.0 =

* Replace permanently visible creation forms for booking types, locations and blocked dates with focused add panels.
* Present existing booking types as responsive administration cards with status, details, direct links and actions.
* Add optional booking type images through the WordPress media library.
* Add a configurable frontend choice between the existing dropdown and responsive service cards with image, description, duration, price and location.
* Keep direct links, preselection, accessibility and rescheduling compatible with both frontend layouts.

= 0.22.0 =

* Add optional field-level translation hooks for booking types, locations and booking terms.
* Preserve and validate the customer locale submitted by the public booking form.
* Render queued notifications, dates and email language attributes in the customer locale.
* Remove remaining hard-coded German labels from the frontend JavaScript.

= 0.21.1 =

* Keep the self-managed Google OAuth setup collapsed in the empty first-run state.

= 0.21.0 =

* Add a guided six-step setup assistant with automatic first-activation redirect.
* Add a read-only system diagnosis for platform, database, broker, calendars, mail and cron.
* Add public Google integration, privacy, terms, support and setup pages for OAuth publication.
* Narrow Google conflict access to the dedicated events free/busy scope.

= 0.20.0 =
* Added direct SMTP delivery with encrypted credentials and secure STARTTLS/SMTPS defaults.
* Kept wp_mail as the backward-compatible WordPress transport and optional SMTP fallback.
* Added an integrated test email with readable delivery status and sanitized error details.

= 0.19.0 =
* Added managed Zoom OAuth, protected broker credentials and production review support.
* Added complete Zoom deauthorization and meeting lifecycle handling.

= 0.18.0 =
* Added immediate, accessible validation messages for customer email addresses and phone numbers.
* Added matching server-side validation so direct REST requests cannot bypass the form rules.
* Moved reusable contact validation into the framework-independent booking core.

= 0.17.0 =
* Replaced generated booking-type query links with readable WordPress routes such as `/termin-buchen/massage-120/`.
* Kept existing `scinet_booking_type` query links fully backward compatible.
* Rebuilds WordPress rewrite rules only when the configured booking route changes.

= 0.16.0 =
* Added configurable sender names and sender addresses for all booking emails.
* Added explicit light-mode safeguards for Apple Mail, Outlook and other dark-mode email clients.
* Added copyable Calendly-style direct URLs that preselect an individual booking type.

= 0.15.0 =
* Changed the public booking form to inherit typography and visual language from the active WordPress theme by default.
* Added optional frontend colors, border radius and content width with an immediate settings preview.
* Added documented CSS custom properties for advanced theme-level adjustments.
* Reorganized booking settings and fixed cramped forms, tables and editor layouts throughout the admin area.

= 0.14.0 =
* Added a guided booking flow that reveals type, day, time and customer details in sequence.
* Replaced the native date picker with an accessible month calendar that marks bookable days.
* Added month-level availability endpoints with batched Google and iCloud conflict reads.
* Added the same availability calendar to secure customer rescheduling.

= 0.13.0 =
* Replaced minute-based minimum-notice and cancellation-deadline inputs with hour/day controls.
* Existing values remain compatible and are displayed automatically in the most practical unit.

= 0.12.1 =
* Fixed iCloud conflict checks by using Apple's supported CalDAV calendar query.
* Added correct handling of all-day, timed, transparent, cancelled and duration-based iCloud events.

= 0.12.0 =
* Added secure Calendly-style self-service rescheduling from the personal booking link.
* Added prefilled booking details, booking-limit exclusion and management-token rotation.
* Added in-place calendar updates, replacement notifications and auditable reschedule history.

= 0.11.0 =
* Added centrally managed, reusable physical meeting locations.
* Added structured addresses and arrival instructions to booking types, calendars and emails.
* Added immutable location snapshots to preserve the original address of every booking.
* Added automatic migration of existing on-site address text.

= 0.10.0 =
* Added encrypted Zoom Server-to-Server OAuth connections.
* Added automatic per-booking Zoom meetings, calendar links and email join buttons.
* Added Zoom cleanup for cancellation, permanent deletion and privacy erasure.

= 0.9.0 =

* Automatische Sperrung deutscher Feiertage für alle Bundesländer.
* Kommunales Augsburger Friedensfest separat konfigurierbar.
* Feiertagsberechnung ohne externen Dienst im framework-unabhängigen Booking Core.

= 0.8.1 =

* Dashboard-Zählung auf die aktuelle Buchungstabelle korrigiert.
* Persönlicher Stornierungslink wird nur der Kundenbestätigung beigefügt.
* Verschlüsselter Stornierungslink wird nach erfolgreichem E-Mail-Versand aus der Warteschlange entfernt.
* Buchungsseiten für Stornierungslinks werden auf die eigene WordPress-Website beschränkt.

= 0.8.0 =

* Buchungsverwaltung mit anstehenden Terminen, Verlauf und sicheren Statusaktionen.
* Stornierungen entfernen den Termin aus seinem ursprünglichen Schreibkalender.
* DSGVO-Löschaktion für abgeschlossene und stornierte Buchungen.
* E-Mail-Bestätigung für Kunde und Betreiber mit fehlertoleranter Warteschlange.
* Konfigurierbare Erinnerungen 24 Stunden und optional 2 Stunden vor dem Termin.
* Framework-unabhängige Planung der Benachrichtigungszeitpunkte im Booking Core.
* Persönliche, hash-geschützte Stornierungslinks mit Fristprüfung und Absage-E-Mails.
* Integration in die WordPress-Werkzeuge für Datenschutzexport und -löschung.

= 0.7.1 =

* Adminbereich und Buchungsformular an die schwarz-weiße Scinet-CI mit roter Akzentfarbe angepasst.
* Open Sans Condensed wird lokal und unter der SIL Open Font License ausgeliefert.
* Abgebrochene oder fehlgeschlagene Google-Verbindungen hinterlassen keine unvollständigen Konten.
* HTTP-Anfragen des Kalenderdienstes senden bei körperlosen Requests kein unnötiges POST-Feld mehr.

= 0.7.0 =

* Google-Konto mit einem Klick über den optionalen Scinet-Verbindungsdienst verbinden.
* Eigene Google-Cloud-Zugangsdaten bleiben als vollständig selbst verwalteter Modus verfügbar.
* Installationsbezogene Ed25519-Signaturen, Replay-Schutz und verschlüsselte zentrale Tokens.
* Managed-Verbindungen widerrufen und löschen ihren zentral gespeicherten Google-Zugriff beim Entfernen.

= 0.6.3 =

* Deutlicher Sicherheitshinweis, dass Calendar API und OAuth-Client im selben Google-Projekt liegen müssen.

= 0.6.2 =

* Google-Einrichtung um den vollständigen Klickpfad für API, Zustimmungsbildschirm und OAuth-Client ergänzt.

= 0.6.1 =

* Geführte Einrichtung für Google Calendar und iCloud mit offiziellen Bezugsquellen.
* Moderneres, responsives Design für alle Plugin-Adminseiten.
* Einrichtungsfortschritt, verständliche Statusanzeigen und kopierbare Google-Rücksprungadresse.

= 0.6.0 =

* Beliebig viele Google- und iCloud-Kalender als Konfliktquellen.
* Genau ein Google- oder iCloud-Kalender als Schreibziel.
* Verschlüsselte Zugangsdaten sowie Google OAuth 2.0 und iCloud CalDAV.

= 0.5.0 =

* Preisinfo, Ortsangabe, Informationslink und Pflicht-Telefonnummer je Termintyp.
* Konfigurierbare Tages- und Wochenlimits.
* Separate Zustimmung zu verlinkten Buchungsbedingungen.
