=== MAK IT Solutions Store Access Manager ===
Contributors: makitsolutions
Tags: roles, capabilities, woocommerce, access control, audit log
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.0.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Granular WordPress and WooCommerce capability management with protected administration and audit logging.

== Description ==

MAK IT Solutions Store Access Manager is an administration-focused access-control plugin. It includes:

* A searchable role and capability editor.
* A user access screen for multiple role assignments and direct plugin-specific capabilities.
* Secure starter roles for store, products, inventory, orders, support, content, and auditing.
* Native WordPress and WooCommerce primitive capabilities.
* Direct URL restrictions for plugins, themes, users, WooCommerce settings, tools, analytics, coupons, and product taxonomies.
* Separate product price and inventory permissions, enforced during save.
* Separate order-status and refund permissions.
* Protected access super administrators and last-super-admin protection.
* Native WordPress plugin deactivation controls remain available to authorized administrators.
* Searchable audit logs and CSV export.
* HPOS compatibility declaration and WooCommerce CRUD usage for orders.

The plugin does not run content scanning or blocking checks on public storefront pages. Its access checks are focused on WordPress administration, authenticated REST responses, and WooCommerce management actions.

== Installation ==

1. Upload the plugin ZIP through Plugins > Add New > Upload Plugin.
2. Activate the plugin while logged in as an administrator.
3. Open Access Manager > Roles.
4. Review the included role templates before assigning them to staff.
5. Test every role on a staging website before production use.

== Frequently Asked Questions ==

= Does hiding a menu secure the URL? =

No. This plugin also performs server-side capability checks and returns HTTP 403 for protected administration routes.

= Is it compatible with WooCommerce HPOS? =

The plugin declares HPOS compatibility and uses WooCommerce order objects instead of querying legacy order post tables.

= Will it affect customer checkout or product pages? =

The access checks do not block or inspect normal public storefront requests.

= Can a role manager grant capabilities they do not have? =

No. Unless the current user has the protected super-admin capability, capabilities they do not possess are disabled and retained unchanged.

== Privacy ==

Audit records are stored locally in the WordPress database. They may include user IDs, usernames, roles, submitted usernames for failed logins, IP addresses, browser user agents, UTC timestamps, affected objects and changed settings. Credential fields with recognized sensitive keys are redacted, including nested settings. Review integration settings before enabling logging on a production site.

The plugin sends no data to external services and loads no remote fonts, scripts or analytics. Logs are retained for 180 days by default, configurable from 1 to 3650 days. Daily WP-Cron cleanup removes expired records when scheduled tasks run. Authorized staff may export up to 10,000 matching records as CSV; the screen displays the latest 100 matches. Treat exports as personal data.

Deactivation preserves data. Uninstall preserves data unless cleanup was enabled in settings. With cleanup enabled, included starter roles, plugin capabilities, options and audit records are deleted. Reassign affected staff to suitable roles first. Site-created roles are retained. Suggested privacy policy text is available in the WordPress Privacy settings.

== Limitations ==

WooCommerce is optional. Store controls require WooCommerce. Test staff workflows, HPOS, refunds, REST access and checkout on staging before production. Network-wide activation and network-wide cleanup have not been validated; use a single-site installation.

== Screenshots ==

1. Desktop role editor with grouped capabilities, role summaries and aligned action buttons.
2. Capability search showing product permissions and matching result counts.
3. Create a custom role and copy permissions from an existing starter role.
4. Assign multiple roles and individual capabilities from the user access screen.
5. Review audit events, expand event details and export matching records as CSV.
6. Configure audit-log retention and optional cleanup when uninstalling the plugin.
7. Responsive role editor with compact summaries and navigation on mobile.

== Changelog ==

= 1.0.2 =
* Preserve existing WordPress permissions on native Users screens after activation.

= 1.0.1 =
* Adopted the distinctive name MAK IT Solutions Store Access Manager and its matching translation domain.
* Added explicit nonce and permission verification before the refund-deletion AJAX guard.
* Added an ABSPATH guard alongside the uninstall-only guard.
* Removed self-deactivation blocking so authorized administrators retain normal WordPress controls.


= 1.0 =
* Refined button icon alignment and added seven WordPress.org listing screenshots.
* Updated the developer and company credit to MAK IT Solutions.
* Updated the submission name, package slug and translation domain to match the company branding.


= 0.1.4 =
* Prepared the submission name and text domain as MAK IT Solutions Store Access Manager.
* Used prepared table identifiers and queries for audit filtering, retention and uninstall.
* Removed object-specific meta capabilities from the editable permission catalogue.
* Improved compact mobile summaries and fixed text encoding in placeholders.
* Validated with WordPress 7.1.4, WooCommerce 10.6.2, legacy orders and HPOS.


= 0.1.3 =
* Unified navigation, page headings and styling across roles, user access, settings and activity logs.
* Improved responsive layouts, filter accessibility, keyboard focus and reduced-motion support.
* Fixed visibility of filtered capability cards.
* Redacted nested setting credentials and removed query strings from denied-request logs.
* Added privacy policy suggestions, privacy documentation and the GPL license.
* Hardened CSV exports against formulas with leading whitespace.


= 0.1.2 =
* Redesigned the role capability editor with a modern responsive interface.
* Added role search, capability state filters, group collapse controls, and per-group enable/disable actions.
* Added live enabled-capability totals, visible result counts, and unsaved-change protection.
* Added a sticky save bar, compact role summaries, improved locked-capability states, and mobile layouts.
* Added automatic role-slug suggestions when creating a role.

= 0.1.1 =
* Users with any meaningful backend capability can enter wp-admin without the Store Manager role.
* Product-only, inventory-only, order-only, and direct-capability staff are no longer redirected to My Account by WooCommerce.
* Added view_admin_dashboard migration for existing staff roles while keeping customers and subscribers outside wp-admin.

= 0.1.0 =
* Initial Phase 1 release.
* Role and capability manager.
* Multiple-role and user-specific access assignment.
* WooCommerce role templates.
* Direct admin URL restrictions.
* Product price and stock enforcement.
* Order status and refund enforcement.
* Protected administration.
* Audit logging and CSV export.

== Upgrade Notice ==

= 1.0.2 =
Preserves existing access to native Users screens for staff with WordPress user-management permissions.

= 1.0.1 =
Review fixes for naming, request security and uninstall access. Deactivate earlier builds before activating this renamed package. Existing wsam_ settings, roles and audit records are retained.

= 1.0 =
Updated MAK IT Solutions branding and submission metadata. Deactivate any earlier wp-store-access-manager or buychunk-store-access-manager build before activating this renamed package. Existing wsam_ roles, options and audit records are retained.
