=== Inventive Share Preview ===
Contributors: ratherinventive
Tags: post preview, share preview, draft, client review, workflow
Requires at least: 6.2
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Create secure, expiring links for easily sharing unpublished WordPress post previews.

== Description ==

Inventive Share Preview lets editors share draft, pending-review and scheduled
content with clients or colleagues who do not have a WordPress login. Password
protected, private, published and trashed content is not eligible for new share
preview links.

Each post receives a random 48-character link token. Links expire automatically
and can be regenerated or revoked from the post editor. Links are only created
after an editor explicitly selects Create Share Preview.

= Features =

* Share unpublished posts, pages and selected registered post types.
* Choose a link lifetime of 1, 7, 30 or 90 days, defaulting to 90 days on new installs.
* Customise the private-preview banner message.
* Review active links from the settings screen.
* Record who created each new link and when.
* Expire every generated link immediately when required.
* Automatically revoke links when content is made private, trashed or moved to another unavailable state.
* Redirect old share URLs to the public permalink after publication.
* Copy or open the link from the Share Preview editor panel.
* Open a preview directly from the Posts or Pages list.
* Revoke a link or replace it with a new one.
* Show a clear private-preview banner to visitors.
* Send noindex, nofollow and noarchive directives.
* Prevent preview responses from being cached.
* Receive checksum-verified updates from Rather Inventive.

== Installation ==

1. Upload the plugin zip through Plugins > Add Plugin > Upload Plugin.
2. Activate Inventive Share Preview.
3. Open Settings > Share Preview.
4. Select the post types that should support share links and choose a link lifetime.
5. Save an item as a draft, pending-review or scheduled post.
6. Open the Share Preview panel, select Create Share Preview if needed, then copy the link.
7. Publish the content when approved; old share URLs will then send visitors to the live page, including expired or revoked links.

If `/share-preview/` links return a 404 immediately after activation, open
Settings > Permalinks and click Save Changes once.

== Security ==

Share links are bearer credentials. Anyone who has a valid link can view that
unpublished post until the link expires or is revoked. Send links only to the
people who should see the content.

For drafts, well-formed expired, revoked or non-matching share links redirect
to the ordinary post URL (?page_id=ID for pages, ?p=ID for posts, and
?p=ID&post_type=TYPE for custom post types).
This does not grant access to the draft: normal WordPress permissions apply.
Other invalid links return a 404 response. When content is published, its old
share preview URL redirects to the public permalink.

Exclude `/share-preview/` from server, page and CDN caches. The plugin sends
private no-store headers, `X-Accel-Expires: 0` and the WordPress
`DONOTCACHEPAGE` constant, but an upstream cache must be configured to respect
or bypass protected preview URLs.

Analytics and session-recording tools can collect the full browser URL,
including its preview token. Configure the site or theme not to load those tools
on valid share-preview requests. Themes and plugins can check
`Inventive_Share_Preview::is_valid_preview()` during `wp_head` or later.

== Privacy ==

The plugin does not set cookies, load third-party scripts or send preview data
to Rather Inventive. WordPress makes a periodic HTTPS request to the update
manifest when checking for plugin updates.

== Updates ==

Updates use an HTTPS JSON manifest and require a matching SHA-256 checksum
before WordPress installs the downloaded package.

== Changelog ==

= 1.2 =
* Prevent revision and autosave status changes from deleting parent preview credentials.
* Add opt-in, token-free PHP error logging for status transitions, credential changes and preview validation.
* Redirect expired, revoked or replaced draft links to the normal content URL, including custom post types, without granting preview access.
* Preserve live permalink redirects after publication, including expired or revoked links.
* Clarify link creation, save behaviour and redirects in the settings instructions.

= 1.1 =
* Preserve share preview links when drafts, pending-review posts and scheduled posts are edited after link creation.
* Keep published share preview links redirecting to the live permalink while still revoking links for private, trashed or unavailable content.
* Hide Share Preview controls for published and private content.
* Prevent Share Preview links from being created for password protected content.
* Default new installations to 90-day preview links.

= 1.0 =
* Initial production release.
* Added explicit, random and expiring per-post preview links.
* Added registered post-type, link-lifetime and banner-message settings.
* Added reload-free create, regenerate and revoke controls.
* Added creator tracking, active-link management and global expiry.
* Added safe redirects to published content.
* Added cache prevention, robots protection and invalid-link 404 responses.
* Added checksum-verified plugin updates.
