=== AgeOnce Verification ===

Contributors: ageonce
Tags: age verification, woocommerce, age gate, restricted content, checkout
Requires at least: 5.0
Tested up to: 6.9
Stable tag: 1.0.1
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Enterprise-grade Age Verification via AgeOnce API. Protects WooCommerce Checkout and Content.

== Description ==

AgeOnce Verification integrates with the AgeOnce API to provide enterprise-grade age verification for your WordPress site. Protect WooCommerce checkout for age-restricted products and gate content based on taxonomy rules (categories, tags) or manual overrides.

= Features =

* **WooCommerce Integration** - Require age verification before checkout when cart contains restricted products
* **Content Protection** - Restrict posts, pages, and custom post types by taxonomy (categories, tags)
* **Multi-Age Support** - Configure different rules for 16+, 18+, and 21+ content
* **Manual Override** - Lock individual items via metabox regardless of taxonomy rules
* **Product-Level Control** - Enable age verification per product in WooCommerce
* **Secure OAuth Flow** - One-time verification with CSRF protection
* **Production-ready** - Connects to AgeOnce cloud (app.ageonce.com, api.ageonce.com)

= Requirements =

* WordPress 5.0 or higher
* WooCommerce 5.0 or higher (for checkout protection)
* AgeOnce API account (client ID and secret)

= Getting Started =

1. Install and activate the plugin
2. Create an account at [AgeOnce](https://www.ageonce.com) to obtain API credentials
3. Go to AgeOnce Settings in the admin menu
4. Enter your Client ID and Client Secret
5. Configure Content Rules for post types and taxonomies
6. Enable the plugin and save

For detailed setup and API reference, see [Documentation](https://docs.ageonce.com/).

= Privacy =

This plugin sends data to the AgeOnce service (app.ageonce.com, api.ageonce.com) only when a user explicitly starts age verification (e.g. clicks "Verify Age" at checkout or on restricted content). No tracking or data collection occurs without that user action. See the [AgeOnce service](https://www.ageonce.com) for its privacy and terms.

== External services ==

This plugin relies on third-party services operated by AgeOnce (the verification provider). They are required for OAuth login and token exchange so the site can confirm age verification.

* **AgeOnce web app (app.ageonce.com)** — Used for the user-facing OAuth authorization screen when someone clicks "Verify Age". The browser is redirected here with your site’s OAuth client ID, redirect URI, a state value, and required minimum age. The user completes verification on AgeOnce; no WordPress account password is sent to AgeOnce.

* **AgeOnce API (api.ageonce.com)** — Used when the user returns to your site with an authorization code. The plugin sends a server-to-server request to exchange that code for an access token: it transmits the authorization code, redirect URI, OAuth state, and HTTP Basic authentication using your Client ID and Client Secret (stored in WordPress options). On success, the plugin may store a verification flag in the WooCommerce session or a cookie and optional transaction metadata for orders. This happens only during that callback after the user completes the flow.

* **Terms and privacy (AgeOnce)** — [Terms of service](https://app.ageonce.com/terms), [Privacy policy](https://app.ageonce.com/privacy).

== Installation ==

1. Upload the `age-verification-with-ageonce` folder to `/wp-content/plugins/`
2. Activate the plugin through the 'Plugins' menu in WordPress
3. Go to AgeOnce in the admin menu to configure
4. Enter your AgeOnce API credentials (Client ID and Client Secret)
5. Configure content rules for each post type

== Frequently Asked Questions ==

= Do I need an AgeOnce account? =

Yes. You need to sign up at www.ageonce.com to obtain your Client ID and Client Secret.

= Does it work without WooCommerce? =

The plugin loads without WooCommerce, but checkout protection requires WooCommerce. Content protection (posts, pages) works independently.

= Can I restrict content by category? =

Yes. In Content Rules, expand a post type (e.g., Posts) and select categories/tags that require verification for each age group (16+, 18+, 21+).

== Screenshots ==

1. AgeOnce Settings - API credentials and content rules
2. Checkout age gate - verification required before placing order
3. Restricted content gate - age verification for protected posts

== Changelog ==

= 1.0.1 =
* WordPress.org review: document external services in readme; sanitize nested content rules; align text domain with plugin slug; validate OAuth state (nonce) and redirect URL on callback; harden metabox saves with capability checks.

= 1.0.0 =
* Initial release for WordPress.org
* WooCommerce checkout protection
* Content rules by post type and taxonomy
* Manual locking via metabox
* Product-level age verification

== Upgrade Notice ==

= 1.0.1 =
Maintenance release for WordPress.org guidelines (security, documentation, i18n).

= 1.0.0 =
Initial release. Configure your API credentials and content rules in AgeOnce Settings.