=== HiRizzi Onboarding ===
Plugin Name:  HiRizzi Onboarding
Version:      0.1.2
Author:       HiRizzi
Author URI:   https://hirizzi.com
Plugin URI:   https://hirizzi.com/free-downloads/
License:      GPL v2 or later
License URI:  https://www.gnu.org/licenses/gpl-2.0.html
Requires WP:  5.3
Tested up to: 6.8
Requires PHP: 7.4

== Description ==

Force new members to complete their profile before they can access the rest of your WordPress site. You define which fields are required — anything at all, since it's backed by standard WordPress user meta — and members are routed through a multi-step form until every required field (and an optional terms agreement) is filled in.

This works regardless of how someone logged in — password, Google, Facebook, or anything else. The guard only checks whether they're authenticated and whether their profile is complete; it has no opinion on login method.

= Core Features =

* Admin-defined required fields — no fixed field list, you decide what "complete" means for your site
* Multi-step wizard, grouped by a "step" number you assign per field
* Optional terms/consent agreement as the final step
* Redirect guard that sends incomplete profiles to your onboarding page, with configurable exempt roles and URL patterns
* Login-method agnostic — works the same for password, Google, Facebook, or any other auth
* Existing members are automatically grandfathered in on activation — nobody already on your site gets suddenly locked out; only new registrations going forward are required to complete onboarding
* No new database tables — everything is stored as standard WordPress user meta

= How It Works =

1. Create a page containing the `[hirizzi_onboarding]` shortcode.
2. Go to Settings → HiRizzi Onboarding, paste that page's URL into "Onboarding Page URL," and define your required fields.
3. New members who haven't completed the fields you require are redirected to that page on every page load (except wp-admin, login, and anything you've explicitly exempted) until they finish.
4. Field definitions use a simple one-per-line format:

```
key|Label|type|required(yes/no)|step|options
```

Example:
```
phone|Phone Number|text|yes|1|
bio|Short Bio|textarea|yes|1|
gender|Gender|select|yes|2|Male,Female,Other,Prefer not to say
age_confirm|I confirm I am 18 years or older|checkbox|yes|2|
```

Allowed types: `text`, `textarea`, `email`, `url`, `date`, `number`, `select`, `checkbox`. Fields sharing the same step number appear together on one screen of the wizard. The `options` column (comma-separated) only applies to `select`.

== Installation ==

1. Upload and activate the plugin.
2. On activation, every existing user is automatically marked as onboarding-complete — this does not affect anyone already on your site.
3. Create a page with the `[hirizzi_onboarding]` shortcode and configure the plugin under Settings → HiRizzi Onboarding.

== Frequently Asked Questions ==

= Will this lock out my existing members when I activate it? =
No. Activation automatically grandfathers in every existing user. Only members who register after activation are required to complete the fields you've defined.

= Does this work with Google/Facebook login plugins? =
Yes — the redirect guard only checks `is_user_logged_in()` and the completed-profile flag. It has no dependency on, or awareness of, which authentication method was used to log in.

= What happens if I add a new required field later? =
Members who already completed onboarding are not retroactively relocked out. The "completed" status is a one-time flag set when someone finishes the flow (or is grandfathered in), not something recalculated against the current field list on every page load. If you need existing members to also fill in a newly added field, use the "Reset a User" tool on the settings page to clear an individual member's completed flag and route them through onboarding again.

= Can I require a terms/consent checkbox without any other fields? =
Yes — leave the required fields list empty and enable "Require Terms Agreement." The onboarding flow will consist of just the terms step.

= Where is field data stored? =
As standard WordPress user meta, keyed by whatever field key you choose. No custom database tables are created by this plugin.

== Changelog ==

= 0.1.2 =
* Added a review-request banner at the top of the settings page.

= 0.1.1 =
* Prevented redirect lockout when a page URL is configured but no valid fields or terms step exist.
* Changed onboarding-page detection from substring matching to exact path/query matching.
* Restricted configured redirects to safe local WordPress URLs.
* Rejected protected, reserved, and duplicate user-meta field keys.
* Sanitized select options before storage and rendering.
* Reworked activation grandfathering into one set-based database query for large sites.

= 0.1.0 =
* Initial release: admin-defined required fields, multi-step wizard, optional terms agreement, login-method-agnostic redirect guard, automatic grandfathering of existing users on activation, and a manual per-user reset tool for testing.
