=== Auto Poster - REST Publishing Bridge ===
Contributors: studio1live
Tags: rest api, publishing, automation, content, webhook
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.3.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Securely create, update, schedule, and publish WordPress posts from authorized external applications through a protected REST endpoint.

== Description ==

Auto Poster provides a small authenticated REST publishing bridge for WordPress. It is intended for site owners who operate their own publishing, automation, editorial, or AI-assisted content tools and want those tools to create or update WordPress posts without exposing wp-admin credentials.

Features include:

* Random shared API key generated inside WordPress.
* Authentication through the `X-AutoPoster-Key` request header.
* Draft, publish, and scheduled post states.
* Idempotent updates using an external `article_id`.
* Categories and tags.
* Configurable post author and default category.
* Featured-image sideloading with WordPress safe-URL checks, file-size limits, and image-type validation.
* Optional image/video embedding in post content.
* Optional SEO metadata compatibility with Yoast SEO and Rank Math.
* Optional language metadata and Polylang support.
* Optional HMAC-signed outgoing webhook after publication.

The plugin does not include an AI service, social-network account, or external SaaS account. Connections are configured by the site administrator. Remote requests occur only when the administrator configures a publishing client, supplies a media URL in an authorized request, or configures an outgoing webhook.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/` or install the ZIP through Plugins > Add New > Upload Plugin.
2. Activate **Auto Poster - REST Publishing Bridge**.
3. Open Settings > Auto Poster.
4. Copy the Publish Endpoint and API Key into your authorized publishing application.
5. Prefer the `X-AutoPoster-Key` HTTP header for authentication.
6. Leave remote webhook fields empty if you do not use that feature.

== Frequently Asked Questions ==

= Does this plugin send my WordPress content to an external service? =

Not by itself. It receives authenticated publishing requests. It only makes an outgoing webhook request when you explicitly configure a webhook URL, and it only fetches a remote image when an authenticated publishing request supplies an image URL.

= Can a repeated request create duplicate posts? =

If the client supplies the same numeric `article_id`, Auto Poster updates the existing matching post instead of creating another one.

= How should a client authenticate? =

Send the key shown under Settings > Auto Poster in the `X-AutoPoster-Key` request header. Older clients that send `api_key` in the JSON body remain supported for compatibility, but the header is preferred.

= What image formats are accepted? =

The default allowed remote image MIME types are JPEG, PNG, GIF, WebP, and AVIF. Remote image URLs are checked with WordPress safe-URL validation and a default 12 MB size limit.

== Changelog ==

= 1.3.0 =
* Hardened remote image importing with WordPress safe-URL validation, size limits, and image MIME validation.
* Added image-alt handling for imported featured images.
* Improved REST authentication errors and made header-based authentication the documented default.
* Generalized directory copy for use with authorized publishing clients.
* Added WordPress.org-ready plugin metadata and GPL licensing information.

= 1.2.0 =
* Added resolved featured-image data to REST responses.
* Added retry-safe embedded media blocks.
* Added safe featured-image replacement when an article's source image changes.

= 1.1.0 =
* Added author/category configuration, idempotent article updates, optional SEO/language metadata, and signed outgoing webhooks.
