=== Sign by MPTY ===
Contributors: mpty-projects
Requires at least: 6.4
Requires PHP: 8.3
Tested up to: 7.1
Stable tag: 2.0.0
License: GPLv2 or later

Digital visitor registration, consent, simple electronic signature evidence, PDF generation, and staff verification for activity venues.


== Quick Start ==
Requirements: WordPress 6.4 or newer; PHP 8.3 or newer. Sign Pro requires Core 2.0.0 or newer.
For PDFs, Imagick is not universally required: Sign can use an available Dompdf/mPDF/TCPDF renderer, or GD/FreeType with a readable Unicode TrueType font. Latin and Cyrillic are supported; unsupported scripts or missing font glyphs must not be silently replaced. There is no lossy last-resort writer. Check PDF appearance on your host.
Sign 2.0 RC Pro updates are manual: back up, upload the approved ZIP in WordPress, then choose Replace current with uploaded. Supported replacement preserves data, settings and license state; do not uninstall first. Automatic Pro updates are not available in this RC.

1. In WordPress Admin, go to Plugins > Add New > Upload Plugin.
2. Upload the sign-by-mpty.zip file and click Install Now.
3. Click Activate Plugin.
4. Go to Sign by MPTY > Settings for installation-wide settings. Under Consent forms, choose Edit form to configure languages, participant options, consents, Rules, Form fields and Form texts for that form.
5. Create or edit a public WordPress page and add this shortcode: [signbympty_consent_form].
6. Open that page in a private browser window and submit a test adult consent before using the plugin with real visitors.


== Enable the Public Form ==
After activation, create or edit a normal WordPress page and add this shortcode:

[signbympty_consent_form]

Publish the page and open it in a private browser window. Submit a test adult consent before using the form with real visitors.

== Email OTP Delivery ==
When Email OTP is enabled, the plugin sends a separate 4-digit email OTP through WordPress mail using wp_mail(). The plugin does not include built-in SMTP-provider configuration. Email reliability depends on the site hosting mail setup or a separate WordPress SMTP/mail plugin. Test delivery before using OTP operationally.

== Installation Troubleshooting ==
If WordPress says plugin installation failed:
* Confirm the ZIP contains a top-level sign-by-mpty folder with sign-by-mpty.php inside it.
* Confirm your local site runs PHP 8.3 or newer.
* Remove any previous broken copy of wp-content/plugins/sign-by-mpty before installing again.
* If activation fails, enable WP_DEBUG_LOG and check wp-content/debug.log.
* Do not upload development folders, reports, or partial ZIPs. Use the clean runtime ZIP only.

== Installation ==
1. Upload the sign-by-mpty folder to wp-content/plugins or install the ZIP.
2. Activate the plugin.
3. Create a WordPress page and add the shortcode [signbympty_consent_form].
4. Go to Sign by MPTY > Consent forms > Edit form > Rules and replace the starter rules with your approved operational/legal text.
5. Assign staff users the Sign by MPTY Staff or Sign by MPTY Manager role.

== Notes ==
Legal/content responsibility: each venue/operator must review and adapt legal, privacy, data-processing, rules, consent, and retention wording before live use. This plugin provides configurable workflows and evidence records; it does not provide legal advice.

PDF and signature files are stored in a private uploads subfolder with .htaccess protection by default. For stricter hosting, configure folders outside public web root in Settings.

== First-use note ==

The plugin creates starter active rules during activation. Before going live, open Sign by MPTY > Consent forms > Edit form > Rules and replace the starter content with your approved rules for every enabled language and registration flow.

= Email OTP validation =

When Email OTP is enabled, the visitor must enter the emailed 4-digit OTP back into the success screen. Until the OTP is validated, the record is saved but remains pending email OTP validation.


= 1.0.157 =
* Production copy and terminology cleanup across the public form, admin, fallbacks, and fresh-install defaults.
* Simplified form titles, submit text, errors, phone helpers, and success wording.
* Removed generic Optional helper defaults; Required / Optional / Hidden remains controlled by Form Fields and required fields use *.
* Clarified admin terminology, including registration flow versus optional consent type.
* Added an upgrade-safe text migration that changes only exact legacy defaults and preserves customized wording.

= 1.0.156 =
* Hardening: documented and narrowly suppressed static-analysis false positives for generated integer IN-list placeholders and fixed internal report WHERE fragments.
* No database schema, storage, consent-flow, or public-form behavior changes.

= 1.0.154 =
* Hardening release based on Plugin Check review.
* Updated WordPress compatibility metadata to 7.1.
* Tightened prepared SQL identifier handling for selected dynamic queries and documented safe generated IN placeholders.
* Clarified intentional raw-input helper nonce boundaries and private-file streaming exceptions.
* Cleaned uninstall variable naming without changing legacy data/table namespaces.

= 1.0.36 =
* Added OTP resend/manual validation, incomplete cleanup, future DOB prevention, custom CSS, and clearer submit states.

* Fixed OTP resend fatal error, added explicit resend limit helpers, and compacted the OTP confirmation/resend layout.

= 1.0.160 =
* Fresh installs now start with English only and the Adult participant flow only; Minor/guardian and Family/group are opt-in.
* Setup now requires deliberate review of the major configuration areas instead of treating starter defaults as completed setup.
* Added secure Mark reviewed actions for flows, languages, rules, form configuration, privacy/consents, and email verification; publishing remains automatically detected.
* Rebuilt Registration flow controls to prevent labels/helper text from touching card edges and normalized inner Settings card spacing across desktop and mobile.
