=== XenForo Integration Suite ===
Contributors: kyami
Tags: xenforo, forum, sync, passkeys, webauthn
Requires at least: 5.6
Tested up to: 7.0
Stable tag: 1.7.11
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Bi-directional WordPress ↔ XenForo user sync, latest-threads widget, passwordless passkey login, and one-click SSO between WP and your XF forum.

== Description ==

XenForo Integration Suite connects a WordPress site to a XenForo forum without installing anything on the XF side — everything runs from WordPress using XF's standard REST API and webhooks.

= What it does =

* **Bi-directional user sync** — register on WordPress, the matching XenForo account is auto-created; register on XF, the WordPress account is auto-created via webhook. Existing users link automatically by email or username on first login.
* **Single sign-on** — when a user logs into WordPress (password OR passkey), they bounce through XenForo's login-token API and land logged into the forum at the same time.
* **WebAuthn / Passkey login** — passwordless authentication using device biometrics, PIN, or security keys. Includes a token-redirect mechanism that works reliably behind aggressive cache layers (Cloudflare, LiteSpeed).
* **Latest threads widget** — Elementor widget, shortcode, and sidebar widget. Four modes: Latest created, Latest active (bumped by replies), Latest replies, Latest activity (mixed feed of new threads + replies). Auto-refreshes every 30 seconds via AJAX — new posts and deletions surface within seconds without page reload.
* **Per-user XenForo Profile section** in the WP user-edit screen — shows live XF username, email, group memberships, sync timestamps. Includes a manual "Link by XF user ID" input as fallback.
* **Users list integration** — adds a sortable, filterable "XenForo" column to the standard WP Users list so admins can see sync status at a glance.
* **Webhook signature verification** — handles both XF 2.2 HMAC signatures and XF 2.3 plaintext-secret authentication transparently.
* **Smart fallback chain** — widget never goes empty even on low-activity forums; broadens its query progressively until something shows.

= XenForo-side requirements =

* A XenForo API key. Super-user type is recommended for full functionality. User-type keys work for read-only widget features but block user creation, find-email lookups, and SSO bounces.
* Optional: two webhooks (one for `/sync-user`, one for `/sync-content`) subscribed to user_* and post_*/thread_* events. Enables real-time updates instead of cron-driven polling.

= Built with =

This plugin was designed and developed with Claude Max (Anthropic's AI agent), including the architectural decisions, the WebAuthn integration, the token-based auth-cookie delivery that survives cache layers stripping `Set-Cookie` from REST responses, and the multi-version-tolerant webhook signature verification.

Use at your own risk. Test on staging before deploying. The plugin is open code — feel free to fork, modify, or rip out features you don't need.

== Installation ==

1. Upload the plugin ZIP via Plugins → Add New → Upload Plugin in WordPress admin.
2. Activate.
3. Go to Settings → XenForo Bridge → Connection tab.
4. Paste your XenForo Board URL (public URL, e.g. `https://forum.example.com`).
5. Paste your XenForo API key (Super-user type recommended).
6. Click Generate next to Webhook Secret, save changes, copy the secret.
7. In XenForo Admin CP → Setup → Webhooks → add two webhooks pointing to:
   * `https://yoursite.com/wp-json/wp-xenforo-bridge/v1/sync-user` (subscribe user_insert, user_update, user_delete)
   * `https://yoursite.com/wp-json/wp-xenforo-bridge/v1/sync-content` (subscribe post_insert, post_update, post_delete, thread_insert, thread_update, thread_delete)
8. Paste the webhook secret into both XF webhooks.
9. On the Passkeys tab, tick "Enable passkey login" if you want WebAuthn login.
10. Drop the Elementor widget "XenForo Latest Topics" or the shortcode `[xf_latest_threads]` on any page.

The Guides tab inside the plugin contains step-by-step recipes for every feature.

== Frequently Asked Questions ==

= Does this require modifying my XenForo installation? =

No. Everything runs from WordPress. The plugin uses XenForo's standard REST API and webhook system, both built into XF 2.x — no XF add-on or code changes required.

= I'm getting "permission denied" errors from XF =

Your API key type is User instead of Super user. User keys are scoped to a specific user's permissions and lack access to find-email lookups, user creation, and SSO login tokens. Switch to a Super-user key in XF Admin CP → Setup → API keys.

= Auto-link by email isn't working =

`/users/find-email` requires admin-level permissions in XenForo. Auto-link by username via `find-name` works with any User key — make sure your WP username matches the XF username exactly.

= The widget shows stale data =

The widget caches results for 60 seconds, then auto-refreshes via AJAX every 30 seconds. If you're behind LiteSpeed or Cloudflare page cache, the initial render may briefly show cached data — the JS replaces it with fresh content within ~1 second of page load.

= Passkey button does nothing =

WebAuthn requires HTTPS. Check your site is loaded over `https://`. If using Cloudflare, ensure Rocket Loader isn't deferring the plugin's JS (it's marked `data-cfasync="false"` so it should be exempt). Check browser console for any `[wp-xf-bridge]` lines.

= "Invalid signature" on webhook attempts =

The webhook secret in WordPress and XenForo must match exactly. Re-generate in WP, paste fresh into each XF webhook. Old failed webhook jobs in XF's queue will keep retrying for up to 24 hours — they're harmless and clear themselves.

= Can I run this with just a regular User-type API key? =

Yes, for read-only features (threads widget, viewing linked XF user data). But user creation, automatic linking by email, and WP→XF SSO bounces require Super-user privileges. You can keep your existing User key for another plugin and create a separate Super-user key just for this one.

== Screenshots ==

1. Settings → XenForo Bridge → Connection tab with status indicator, generate webhook secret, API config.
2. XenForo Profile section on the WordPress user-edit screen showing live XF data and sync history.
3. Elementor widget "XenForo Latest Topics" with mode dropdown (Latest created / active / replies / activity).
4. WordPress Users list with the XenForo column showing synced user IDs.
5. Passkey registration UI on the user profile page.
6. Latest activity widget rendered on a frontend page.

== Changelog ==

= 1.7.5 — Release =
* Initial public release of XenForo Integration Suite.
* Bi-directional WordPress ↔ XenForo user sync with auto-link by email/username.
* WordPress login → XenForo SSO bounce via login-token API.
* WebAuthn / Passkey passwordless authentication with token-redirect that survives aggressive cache layers (Cloudflare, LiteSpeed).
* Latest threads widget (Elementor + shortcode + sidebar) with four modes: created, active, replies, mixed activity. AJAX live refresh every 30 seconds.
* Per-user XenForo Profile section on the WP user-edit screen with live API data and manual link fallback.
* "XenForo" column on the WordPress Users list, sortable and filterable.
* Webhook signature verification supporting both HMAC and plaintext-secret modes across XF 2.2 / 2.3.
* Smart fallback cascade so the widget never goes empty on quiet forums.

== Upgrade Notice ==

= 1.7.5 =
Initial public release.

== Credits ==

Built with [Claude Max](https://www.anthropic.com/claude) by Anthropic.

Uses the [lbuchs/WebAuthn](https://github.com/lbuchs/WebAuthn) PHP library for FIDO2 / WebAuthn operations.
