=== CEC Feedback ===
Contributors: cec
Tags: feedback, review, staging, annotations, screenshots
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.0.0
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Adds the CEC Feedback widget to your site, so reviewers can pin comments and screenshots to the page they are looking at.

== Description ==

CEC Feedback is CEC's visual website-feedback tool. This plugin adds the CEC Feedback widget to your site's front-end pages without editing your theme. The widget always loads from CEC Feedback itself; the plugin bundles none of it.

* Show the widget to every visitor, or only to signed-in users with chosen roles, such as staging reviewers.
* Optionally identify signed-in users, so their feedback carries their name and email without the widget asking.
* Themes and plugins can decide in code with the `cec_feedback_should_load` filter.

== Installation ==

1. In WordPress, go to **Plugins → Add New → Upload Plugin**, choose `cec-feedback-wordpress.zip` (download it from the project's **Installation → Plugins & Tools → WordPress** page), click **Install Now**, then **Activate**.
2. Go to **Settings → CEC Feedback**.
3. Paste the **Project key**. Find it in the CEC Feedback dashboard: open the project, then **Install**. It starts with `pk_`.
4. Leave **Edge origin** as `https://feedback-api.cec.dev` unless CEC gives you another one.
5. Click **Save Changes**, then clear any page cache.

The site's address must be on the project's allowed origins in the CEC Feedback dashboard.

= Who sees the widget =

The project's **Settings → Widget → Visibility** in the CEC Feedback dashboard picks one of three modes:

* **Show widget to everyone:** every visitor gets the widget.
* **Only show widget to members:** only CEC team members who have signed in from the widget. Guests see nothing. Open the page once with `?cecfb=1` to get the locked widget and its **Sign in as team member** button.
* **Show widget with secret query parameter:** the widget shows only after a visit with `?cecfb=<secret key>` in the address, then stays on for the rest of that browser tab's session. The key is on the same settings page.

The plugin's role and filter settings below decide whether the page gets the script at all; the visibility mode then decides who sees the widget.

= Restricting the widget to roles =

Under **Restrict to roles**, check one or more roles. Only signed-in users with one of those roles then get the widget. Logged-out visitors and other users get nothing from CEC Feedback, not even the script tag. With no role checked, every visitor gets the widget.

To decide in code, filter `cec_feedback_should_load`. It receives whether the settings allow loading, and the signed-in `WP_User` or `null` for a logged-out visitor:

`add_filter( 'cec_feedback_should_load', fn ( $load, $user ) => $load && ! is_page( 'checkout' ), 10, 2 );`

= Content Security Policy =

If the site or a security plugin sends a Content Security Policy, add the edge origin to `script-src` and `connect-src`, and `data: blob:` to `img-src`. The full list and the reasons are in [Installing CEC Feedback, section 3](https://github.com/Cutting-Edge-Concepts/cec-feedback/blob/main/docs/install.md#3-content-security-policy).

== Privacy ==

Feedback a reviewer sends goes to the CEC Feedback service: their comment, a screenshot of the page, recent browser console and network logs, and page details. Mark sensitive elements with `data-cecfb-mask` or `data-cecfb-ignore` to keep them out of screenshots.

The plugin sends a signed-in user's display name and email to CEC Feedback only when **Identify signed-in users** is on. It sends no telemetry and makes no requests from your server.

== Frequently Asked Questions ==

= The widget doesn't show =

Check that the project key is set and **Load the widget on this site** is ticked, that the site's address is on the project's allowed origins, and the project's visibility mode: members only needs a signed-in team member, and secret query parameter needs a visit with `?cecfb=<secret key>`. Then filter the browser console and network tab for `cec-feedback`.

= What happens when I delete the plugin? =

Deleting it from **Plugins** also deletes its settings.

== Changelog ==

= 1.0.0 =
* First release.
