=== 5 Connect ===
Contributors: geraldguillou
Tags: woocommerce, invoices, ecommerce, seo, security
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

See what your public site reveals, then send compliant electronic invoices from WooCommerce or Easy Digital Downloads.

== Description ==

5 Connect is the WordPress plugin from CINQ, published by Gerald Guillou (https://5pour100.fr).

The administration screens are in French, because the invoicing service is built for France. Every string uses the text domain `5-connect`.

Start with a clear picture of the public site. When you are ready, connect a my5 account and let CINQ carry the electronic invoices. The plugin code is complete and licensed under GPLv2 or later. Nothing is locked inside the files. Services that need CINQ simply call CINQ after you connect.

= Who it is for =

Shop owners and publishers who sell with WooCommerce or Easy Digital Downloads and want a straight path to French electronic invoicing, plus a public reading of the site they can show a client.

== Features ==

* **Public review, free, no account.** An administrator checks a box and clicks. CINQ reads the public address and returns a score out of 100, shown as points to check: search visibility, mobile display, speed, HTTPS, and visible configuration. It never claims a confirmed flaw.
* **Dashboard and widget.** The score and the points stay on the 5 Connect home screen and on a WordPress dashboard widget.
* **Electronic invoices.** After a my5 account is connected, completed WooCommerce orders and Easy Digital Downloads payments are sent to CINQ. Credit notes follow refunds. You choose whether sending starts at “processing” or “completed”.
* **Received invoices and e-reporting.** The same connection lists supplier invoices and the e-reporting queue. Status text comes from CINQ. WordPress does not invent a tax decision.
* **Checkout details.** Optional company, SIRET, and EU VAT number on WooCommerce and Easy Digital Downloads checkout, so business buyers are identified.
* **Sentinelle and Bouclier.** The plugin shows whether the connected my5 account includes these CINQ offers, and links to them. The monitoring itself stays with CINQ.
* **Optional demo.** A Burger Queen sample customer can be created on purpose. A test invoice is a separate button. Nothing is sent on activation.
* **Your keys stay in WordPress, encrypted.** A random token is created locally. You can set `CINQ5_KEY` in `wp-config.php` if you prefer. The plugin never edits that file.

== Installation ==

1. Upload the `5-connect` folder to `/wp-content/plugins/`, or use Plugins → Add New.
2. Activate 5 Connect.
3. Open 5 Connect → Site review, or use the dashboard widget. Check the consent box, then start the review.
4. For electronic invoicing, open Settings. Paste the site key and secret from my5, or create a sandbox trial. Leave sync checked if you want status updates in the background.
5. WooCommerce and/or Easy Digital Downloads must be active to send invoices. The public review does not need them.

The optional constant `CINQ5_API_BASE` sets the service address, with no trailing slash. Default: `https://my.5pour100.fr`. The Settings screen can override it. Site keys are created in my5, under WordPress sites: https://my.5pour100.fr/wordpress.

== Frequently Asked Questions ==

= Does the review run by itself? =

No. It runs only after an administrator checks the consent box and clicks.

= Is an account required for the review? =

No. The score and the points to check are available before any my5 account exists.

= Where do the paid services live? =

In this plugin, as plain PHP. Invoicing, e-reporting, and the Sentinelle / Bouclier status call CINQ. Without a my5 account there is nothing to send. That is a service, not a locked feature.

= Is a demo invoice sent when I activate the plugin? =

No. The sample customer and the test invoice are two separate buttons in Settings.

= Does WordPress decide the tax treatment? =

No. The plugin forwards what the buyer typed. CINQ qualifies the invoice. The screen only displays the status CINQ returns.

= Can I point the plugin at another CINQ address? =

Yes. Set `CINQ5_API_BASE` for invoicing, or `CINQ5_SCAN_ENDPOINT` for the public review. Filters of the same name are available to developers.

== Screenshots ==

1. The 5 Connect home screen: public score, points to check, and the my5 connection.
2. The free public review, with the score and the points to check.
3. Settings to connect a my5 account and choose when WooCommerce invoices are sent.
4. Sentinelle and Bouclier: status from the connected account, and links to the offers.
5. Sent invoices, ready once the my5 account is connected.
6. The dashboard widget, so the score stays one click away.

== Changelog ==

= 1.0.0 =
* First directory release.
* Public site review with a score out of 100, started only by an administrator.
* WooCommerce and Easy Digital Downloads electronic invoicing, credit notes, received invoices, and e-reporting through a connected my5 account.
* Sentinelle and Bouclier status.
* Signing secret encrypted without editing wp-config.php.
* Demo data and the test invoice are never sent automatically.

== Upgrade Notice ==

= 1.0.0 =
First release.

== External services ==

This plugin connects to services operated by CINQ / AssistInfos (https://5pour100.fr) only in the cases below.

= Public site review (5pour100.fr) =

When: an administrator checks the consent box and clicks “Lancer le bilan” on the Site review screen or the dashboard widget. Never on a public page, and never from a background task.

What is sent: the public address typed in the form (the site address by default). No passwords, no admin content, no customers, and no cookies.

Where: `POST https://5pour100.fr/api/audit/start` with `{ "url": "..." }`, then `GET https://5pour100.fr/api/audit/{id}` until the result is ready. If the first call fails, the plugin tries `POST https://5pour100.fr/api/audit`. The path `/scan` does not exist. The same public review is the one on https://5pour100.fr/audit.

Those addresses can be replaced with the constants `CINQ5_SCAN_ENDPOINT`, `CINQ5_SCAN_POLL_BASE`, and `CINQ5_SCAN_FALLBACK_ENDPOINT`, or the filters `cinq5_scan_endpoint`, `cinq5_scan_poll_base`, and `cinq5_scan_fallback_endpoint`.

Terms: https://5pour100.fr/mentions-legales
Privacy: https://5pour100.fr/confidentialite

= my5 account and electronic invoicing (my.5pour100.fr) =

The plugin does not create a site key. An administrator generates `site_key` and `site_secret` in my5 → WordPress sites (https://my.5pour100.fr/wordpress) and pastes them into Settings.

When: the keys are saved and `GET /v1/account` reports `modules.einvoicing.active`. A WooCommerce order or an Easy Digital Downloads payment then reaches the chosen status, a refund is created, or an administrator clicks “Tester la liaison”, “Envoyer une facture test”, or refreshes e-reporting or received invoices. If the sync box is checked, a periodic call (every 5 minutes for invoice statuses, every hour for received invoices) asks my5 for updates. Invoices are not sent when `modules.einvoicing.active` is absent or false. Sentinelle, Bouclier and Intégral are read from `modules.securite_sentinelle`, `modules.bouclier` and `modules.integral` on the same account response. HTTP 402 means the account refuses the action (inactive module, subscription or quota). HTTP 501 means the function is not available on this account. Neither is retried automatically.

What is sent: billing identity (company, SIRET, VAT number, name, email, address), line items, totals, the order reference, and the signature headers `X-FB-Key`, `X-FB-Timestamp`, `X-FB-Nonce`, and `X-FB-Signature`.

Where: the saved address, without a trailing slash. Default `https://my.5pour100.fr` (constant `CINQ5_API_BASE`, or the Settings field).

Terms: https://5pour100.fr/mentions-legales
Privacy: https://5pour100.fr/confidentialite
Account: https://my.5pour100.fr

= Sentinelle and Bouclier =

No extra request. The status shown is whatever the account payload already returned (`GET /v1/account`). Offer links open in the browser when someone clicks them.

= What is not sent =

Nothing is sent on activation, on a public page view, or during the review until an administrator clicks.
