=== Aura Login ===
Contributors: fropt
Tags: login, authentication, passwordless, biometric, two-factor
Requires at least: 6.2
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.2.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Passwordless visual login for WordPress using a mobile app — users scan animated bars on screen and confirm with biometrics.

== Description ==

Aura Login replaces the traditional username and password with a secure, visual authentication flow:

1. A visitor arrives at your login page and sees a set of animated bars — a unique visual session token.
2. They open the Aura mobile app, point their camera at the screen, and the app reads the bar pattern.
3. The app prompts for biometric confirmation (fingerprint or face recognition).
4. The user is logged in to WordPress — no password ever typed.

**Key features**

* Passwordless login via animated visual pattern and mobile biometrics
* Classic username/password login always available as a fallback
* Optional two-factor authentication (email code) for the classic login path
* Graceful degradation: if the backend is unreachable, animated bars still display and the classic login button is prominently shown
* Configurable login page URL (default: `/aura-login`)
* Login records page in the WordPress admin
* wp-login.php and wp-admin are blocked for non-logged-in visitors — the Aura login page is the only entry point

**How it works**

The plugin communicates with the Aura API. Your site must be registered at [app.auralogin.com](https://app.auralogin.com) to receive a site token. Once configured, the plugin handles all authentication locally via polling — no callbacks or webhooks from the API to your server are required.

**Requirements**

* A free Aura Login account at app.auralogin.com
* The Aura mobile app (Android / iOS — links available at auralogin.com)
* PHP 8.1 or higher
* WordPress 6.0 or higher

**External services**

This plugin communicates with the Aura API to:

* Create and poll visual login sessions
* Finalize authentication once the mobile app confirms biometric approval

Data sent to the API includes: your site's token (a UUID), a temporary session ID, and the sequence that drives the bar animation. No personally identifiable information is sent during the visual login flow. User identity is resolved by the mobile app using credentials the user has stored locally.

API terms of service: https://auralogin.com/terms
API privacy policy: https://auralogin.com/privacy

== Installation ==

1. Upload the `aura-login` folder to the `/wp-content/plugins/` directory, or install via the WordPress plugin screen.
2. Activate the plugin through the **Plugins** screen.
3. You will be redirected to the **Aura Login** settings page.
4. Register your site at [app.auralogin.com](https://app.auralogin.com) and copy your site token.
5. Paste the token into the **Site Token** field and click **Save Token**.
6. Download the Aura mobile app and scan the QR code shown in your site dashboard on app.auralogin.com to register your device.
7. Visit your login page (default: `yoursite.com/aura-login`) to test the flow.

== Frequently Asked Questions ==

= What happens if the Aura Login service is unavailable? =

The login page continues to display the animated bars using a built-in fallback sequence, and a prominent **Sign in with username & password** button is shown. Users can always access the classic login form.

= Can I change the login page URL? =

Yes. Go to **Aura Login → Settings** and change the Login page URL field. The default is `/aura-login`.

= Does this replace wp-login.php? =

The plugin intercepts GET requests to `wp-login.php` for non-logged-in visitors and redirects them to the Aura login page. POST requests (used by the classic login form submission) are not intercepted. `wp-admin` is also blocked for visitors who are not logged in.

= Is the classic login (username/password) still available? =

Yes, always. There is a link at the bottom of the visual login page (`?classic=1`). You can also optionally require two-factor authentication for the classic path in the plugin settings.

= Where do I get the mobile app? =

Visit [auralogin.com](https://auralogin.com) for download links for Android and iOS.

= What data does the plugin send to external servers? =

During normal operation, the plugin sends your site token (a UUID) and a temporary session ID to the Aura Login API. No usernames, passwords, or email addresses leave your server during the visual login flow. See the External Services section above.

== Screenshots ==

1. The visual login page — animated bars display immediately on page load.
2. The Aura Login settings page in the WordPress admin.
3. Login records — a log of all authentication events.

== Changelog ==

= 1.2.4 =
* Show red warning in Settings when plugin is not yet connected, replacing the misleading green security notice.

= 1.2.3 =
* Add setting to keep wp-login.php and wp-admin accessible alongside the custom Aura login URL, with inline security notice.
* Remove non-functional Classic login 2FA feature (API endpoints did not exist in the backend).

= 1.2.2 =
* Fix remaining WordPress Plugin Check warnings: wp_safe_redirect() on one missed call, sanitize_text_field() on SERVER REQUEST_URI in LoginRedirector, absint() on $_POST['aura_2fa_step'] (PHPCS does not treat PHP int cast as sanitization), and isset() guard on $_SESSION['aura_2fa_remember'].

= 1.2.1 =
* WordPress Plugin Check compliance: wp_safe_redirect() throughout, wp_unslash() on all superglobal reads, nonce fields added to classic login forms, phpcs annotations for trusted direct DB calls and template-scoped variables.
* Fixed mismatched Requires at least / Requires PHP / Tested up to between plugin header and readme.
* Sync AURA_LOGIN_VERSION constant to match plugin header.

= 1.2.0 =
* Site Token and Site Key fields on the Connection tab are now masked (password field) instead of shown in plaintext, matching Site Secret.
* Added an explicit "Disconnect this site" checkbox — previously, submitting the Connection form with all fields blank was the only way to disconnect, which no longer works safely now that blank fields mean "keep current value".

= 1.1.0 =
* Added 3-digit short code fallback for when bar scanning is not possible.
* Short code is hidden behind a toggle button with eye open/closed icon for privacy.
* Added Aura Login brand badge above the login animation.
* Redesigned admin onboarding with two tabs: Get Started and Connection.
* QR code on Get Started tab for easy mobile app pairing (generated client-side, no external service).
* Safety guardrail: plugin does not intercept logins until a site token is configured.

= 1.0.0 =
* Initial release.
* Visual login page with animated bar sequence.
* Graceful degradation when backend is unreachable.
* Classic login fallback with optional 2FA.
* Configurable login page URL.
* Login records admin page.
* Blocks wp-login.php and wp-admin for non-logged-in visitors.

== Upgrade Notice ==

= 1.2.4 =
Fixes a misleading green security notice shown before the plugin is connected to the backend.

= 1.2.3 =
Adds option to keep canonical WordPress login URLs accessible. Removes the non-functional Classic login 2FA setting.

= 1.2.2 =
Remaining plugin-check compliance fixes. No functional changes.

= 1.2.1 =
Security hardening and WordPress Plugin Check compliance fixes. No functional changes.

= 1.2.0 =
Site Token and Site Key are now masked on the Connection tab. If you need to disconnect the site, use the new "Disconnect this site" checkbox instead of leaving the fields blank.

= 1.1.0 =
Adds a 3-digit fallback code for users who cannot scan the animated bars, with a privacy toggle. Also adds an improved onboarding experience.

= 1.0.0 =
Initial release.
