inSIM

Changelog

5.2.0

• Rebuilt on the inSIM platform with the new design.
• Connect your store by API key or by QR-code pairing with the inSIM mobile app.
• Sends through your own paired mobile SIM — no cloud SMS credits or balance to buy; PREMIUM subscription unlocks automations, tracking URLs and abandoned-cart recovery.
• Campaigns, automations, abandoned-cart recovery, helpdesk and reports.

1.2.0

• Removed unused bundled third-party libraries (Bootstrap CSS & JS, FontAwesome) and dead legacy admin code, so the package ships only first-party, human-readable source with no minified vendor bundles and no remote asset calls.

1.1.9

• All plugin features (automations, abandoned-cart sequences, campaign setup) are fully functional and configurable with no account restriction; only the actual sending of an SMS uses your connected inSIM account.
• Security & standards: all admin scripts/styles are enqueued (no inline tags), request inputs are unslashed/sanitized, outputs escaped, and no remote assets are loaded (the interface uses inline SVG icons).
• Housekeeping: dropped an unused bundled library, removed dead legacy code, and translations now load automatically.

1.1.8

• Coding standards: full WordPress Plugin Check pass — date()→gmdate(), i18n placeholder ordering and translators comments, output escaping on a few admin views, unslash/sanitize on form inputs, and documented (phpcs-annotated) direct queries on the plugin’s own custom tables. No functional change.

1.1.7

• Housekeeping: removed unused legacy assets from the distributed package (leftover images, dead stylesheets, and internal API docs) — smaller download, no functional change.

1.1.6

• Removed the Customer ID field from the account view (the API does not provide it).
• Hardening: unslash/sanitize on server/request inputs, saved SMS message sanitized.
• Code quality: removed debug console logging; documented safe SQL/output for a clean Plugin Check run.

1.1.5

• New: one-click single sign-on to the inSIM web app — the Helpdesk “Open web app” button and the Balance “Buy SMS / See plans” buttons can drop you straight into your account, already signed in. Uses a secure, client-scoped one-time login link (your own credentials only; no shared secret shipped in the plugin). Activates automatically when the service enables the endpoint; until then the buttons open the web app as before.

1.1.4

• Fix (important): admin CSS and JavaScript were enqueued with a stale, hardcoded version, so browsers and caching plugins kept serving old files after every update — interface fixes never appeared. Plugin assets now use file-modification-time cache-busting and the correct plugin version, so updates take effect immediately. This is what was preventing the campaign-detail toolbar fix from showing.

1.1.3

• Fix: the campaign detail toolbar buttons (Refresh now / Export CSV / Retry failed) now render correctly on every setup — the layout rule moved into the always-loaded stylesheet so it no longer depends on a conditional file or page cache.

1.1.2

• Compatibility: declares support for WooCommerce High-Performance Order Storage (HPOS) and the block-based cart & checkout — removes the WooCommerce “incompatible” notice.
• Fix: campaign recipient targeting by order count and total spend now reads the correct order data on HPOS stores (previously it could return no matches when HPOS was enabled).
• Docs: rewritten plugin description, expanded FAQ, and added screenshots.

1.1.1

• Fix: account no longer appears disconnected a few minutes after connecting — the account state now re-hydrates when the short display cache expires and keeps you connected through brief API hiccups (only missing or revoked credentials show as disconnected).
• Fix: campaign detail toolbar buttons (Refresh now / Export CSV / Retry failed) no longer overlap — labelled action buttons now size correctly.
• UI: wider plugin canvas and a clearer distinction between the “Next” and “Launch campaign” buttons in the campaign wizard.

1.1.0

• Reach design refonte across all screens; multi-relance abandoned-cart engine; coupon tracking; full English/French i18n; accessibility & responsive improvements.

1.0.16

• Expiry normalizer (Fix 1): PHP insim_format_expiry() and JS normalizeExpiry() now recurse through the double-nested Mongo extended-JSON shape {"$date": {"$numberLong": "<ms>"}} observed in real API responses. The old implementation only unwrapped one level, so the date rendered as “[object Object]” or “Array”. Both normalizers accept: null/empty → -, ISO string → first 10 chars, numeric ms → UTC date, {$date: …} / {date: …} → recurse, {$numberLong/Int/Double: …} → resolve to number then date.
• Balance refresh button (Fix 2): the click handler in admin.js now uses a delegated $(document).on(…) binding for both #insim-balance-refresh and .insim-balance-refresh so it fires regardless of DOM timing (e.g. when the Settings tab is revealed after initial page load). The handler restores the original button label after success/failure and updates both #insim-balance-value and .insim-current-balance elements simultaneously.
• History delivery column (Fix 3): every SMS log row now shows one of four states — Refresh button (Mongo ID present), Sent pill (HTTP 2xx, no error code), Failed pill (error_code set), or — (truly unknown). Previously rows without a Mongo ID always showed —. New .insim-status-pill, .insim-status-sent, .insim-status-failed CSS classes added to admin.css. Column header simplified to “Delivery” with tooltip (the ? character was removed from visible text).

1.0.15

• Campaign Wizard Step 4 “Current balance” (Fix 1): balance is now always populated from the freshly-localized ardarySms.balance value (set via InSIM_License_Gate::credits() in enqueue_scripts()). Previously, if the 5-minute account transient had expired before the page loaded, data-balance on the wizard container was empty and the balance cell showed “—” even when the account was connected.
• Refresh delivery button defensive guard (Fix 2): a JS-side check now validates the data-sms-id attribute against the Mongo ObjectId regex before firing AJAX. Buttons that slip through with a non-hex ID are replaced inline with a “—” span. Server-side, ajax_refresh_delivery() now returns error_code: NOT_TRACKED with HTTP 200 (not an unstructured error) so the UI can handle it gracefully.
• Refresh balance button (Fix 3): a “↻ Refresh” button now appears next to the balance value in both the Settings account card and the Help tab account snapshot. Clicking it calls a new insim_refresh_balance AJAX endpoint that hits the API, refreshes the transient, and updates the displayed balance without a page reload.

1.0.14

• Credits real-time update (Fix 1): after a successful send_sms() call the cached sms_credits transient is decremented immediately (optimistic local decrement), so the balance card in Settings / Help reflects the spend on the very next page load without waiting 5 minutes for the TTL to expire.
• Credits background refresh (Fix 1): after every send pipeline run, an Action Scheduler action (insim_refresh_account_cache) is enqueued to pull the authoritative balance from the inSIM API and overwrite the transient within ~10 seconds.
• History delivery Refresh button (Fix 2): the Refresh button in the Recent SMS log is now only rendered for rows whose id_sms_api value is a valid 24-hex Mongo ObjectId. Rows with internally-generated IDs (e.g. wp:automation:…) show a — with a tooltip instead, explaining that delivery tracking is not available and directing the user to ardary-insim.com. The Refresh button handler now always updates the row UI — it shows green/amber/red status on success and an inline error message on failure, and never silently ignores the response.
• Delivery column header: a small ? tooltip explains that live delivery status is only available for API-registered SMS.
• AJAX validation: ajax_refresh_delivery() now validates every submitted SMS ID against the Mongo ObjectId pattern server-side and returns a clear error if the ID is invalid, preventing wasteful API round-trips.

1.0.13

• Settings: the “Technical details” collapsible panel under failed test-connection cards was removed. Failure cards now show only the human-readable error message (“Check your email and access key on ardary-insim.com -> Settings -> API.”). The server still emits the debug block (URL, HTTP status, body snippet) for support log purposes; the merchant UI no longer surfaces it.
• Settings: the “API base URL (advanced)” input row in Step 4 was deleted. The API endpoint is controlled exclusively by the INSIM_API_BASE_URL constant in insim.php. The activator deletes any pre-existing insim_api_base_url option on upgrade so every install resolves to the constant. The api_base_url POST handler in ajax_save_and_test() and _post_process() was removed.
• Settings: the Test connection button spinner now has a visible gap before the “Testing connection…” label. The button uses display: inline-flex !important; gap: 10px !important; so the WP .button-primary rule cannot override it back to inline-block (which silently dropped the gap in v1.0.12). The spinner itself is now flex: 0 0 16px so themes that set flex: 1 on button children cannot squash it to zero width.
• Settings: success card no longer renders “Connected as Foo Bar ()” when the API account payload omits the login echo. The parenthesised login is only included when non-empty.
• Settings + Help: expiry_date is now normalised before display. The API returns it as a MongoDB extended-JSON object ({"$date": "2027-01-01T00:00:00.000Z"}) in some environments, which previously rendered as “[object Object]” (Settings) and “Array” (Help). A new shared helper file includes/class-insim-helpers.php adds insim_format_expiry() (PHP) and the matching normalizeExpiry() (JS) accept plain ISO strings, {$date}, {date} and {$numberLong} shapes and reduce each to YYYY-MM-DD. sms_credits is normalised via insim_format_credits() / parseFloat with a - fallback so a numeric-shaped object cannot leak through.

1.0.12

• API base URL updated to production endpoint https://ardary-insim.com/api/v2/. Existing installs that had the old URL saved as an option override are automatically cleared on next plugin load.
• Debug log feature removed. The “Technical Details” collapsible panel on test-connection failures is retained.
• Test-connection spinner: added margin-right and inline-flex alignment to the button so the spinner and label are properly spaced.

1.0.11

• Settings — Diagnostics: new “API base URL (advanced)” field in Step 4. Leave empty to use the built-in default (INSIM_API_BASE_URL); enter a full URL to override it per-site without a code change. The active URL (option or constant) is displayed below the debug-log toggle with an “Override active” badge when an override is in effect. The override is persisted as the insim_api_base_url option and honoured by every API call. Cleared field deletes the option so the default reapplies. The Test Connection button and AJAX save path both respect the new value immediately.

1.0.10

• Settings: the “your inSIM account” anchor on Step 1 now points to https://ardary-insim.com/ (the actual web app) with a visible external-link SVG icon. Every WP-admin URL that takes the merchant to the account dashboard, billing or API page now uses ardary-insim.com — see html-help.php, class-insim-help-tab.php, class-insim-send-tab.php (upgrade_hint), class-insim-settings.php (humanize_error + WC_Admin_Settings notice), class-insim-news.php and admin/assets/js/campaign-wizard.js. Marketing-domain mentions (ardary-insim.com pricing, support email, status, the company brand reference) are intentionally kept.
• Postman collection: a Postman v2.1 collection covering the 8 endpoints the plugin uses (account, sendsms, sms, sms/detail, sms/conversation, sms/delivery_status, stats/overview, stats/clicks) ships at docs/insim-api.postman_collection.json (and inside the dist ZIP at docs/insim-api.postman_collection.json). Each request has Content-Type/Accept headers, a raw JSON body referencing {{login}} / {{accessKey}} collection variables and a link back to the matching api/endpoints/*.md spec.
• Test connection loader: the spinner is now 18px / 3px stroke / WP-admin blue on a #dcdcde track so it is visible on the green-ish button. The button is disabled while pending, its label is replaced with <spinner> Testing connection…, and the original label is restored on completion (stored in data-original-label). A min-width: 200px rule prevents layout jump.
• Diagnostics: every API response now carries a debug block (url, http_status, transport_message, body_snippet). ajax_save_and_test returns it on both success and failure, and settings.js renders a collapsible “Technical details” section under the error card so the merchant sees the exact URL hit, HTTP status and the first 200 chars of the error body without enabling any log.
• Diagnostics — debug log: a new opt-in setting (insim_debug_log, off by default) writes one JSON line per API call to wp-content/uploads/insim-debug.log. The file is truncated to ~1 MB on every write. A “Diagnostics” row was added to Step 4 of the Settings accordion with the checkbox and a panel showing the live INSIM_API_BASE_URL value so the merchant can verify which environment is being hit.

1.0.9

• Save as draft: the success redirect now lands the merchant on the Campaigns list as intended. The wizard previously resolved a relative admin.php?... URL onto whichever route the wizard was rendered through, occasionally landing on Settings. ajax_send_campaign now returns a canonical redirect_url and the JS uses it (with ardarySms.adminUrl as a fallback). A 1.5s success toast precedes the redirect.
• Auth lockdown (server + client). Tracking URL field and every Automations checkbox + textarea now ship with the disabled attribute when connection_state() is not connected, plus a lock hint pointing at Settings. _post_process short-circuits unconfigured POSTs so DevTools tampering still cannot persist activation. ajax_save_abandoned_settings now returns HTTP 412 NOT_CONFIGURED with an Open Settings link before falling back to feature-flag gating. connectionState and settingsUrl are localized into window.ardarySms on every plugin admin page.
• Helpdesk tab: stripped down to a single CTA opening https://ardary-insim.com/ (the actual web app) in a new tab with a visible external-link SVG icon. The legacy in-WP test-SMS form was removed (Settings already exposes the same form). ajax_send_test, helpdesk.js and the wp_ajax_insim_helpdesk_send_test registration were deleted.
• Action button polish: the Campaign list row actions are now an inline row of 30×30 icon-only buttons (View / Edit / Delete) with Feather-style SVG icons, hover + focus states, and a red-tinged hover variant for Delete. The “Create new campaign” button uses an inline SVG + so the icon sits cleanly on the button baseline regardless of theme overrides.
• Tab order: the “Settings first until configured” logic now reads from InSIM_License_Gate::connection_state() directly so all surfaces (tab order, wizard banner, lock hints) agree on a single source of truth.

1.0.8

• Campaign wizard: fixed a state-sync bug where the first click of “Next” on Step 2 silently re-rendered the same step. The wizard now exposes window.insimWizard.showStep(n) and the filter manager uses it, so one click always advances. Per-field inline error messages were added.
• Authentication vs license messaging: new InSIM_License_Gate::connection_state() helper returns one of unconfigured / unverified / inactive / connected. The wizard, ajax_send_campaign and ajax_save_message now distinguish “credentials not entered yet” (412 NOT_CONFIGURED with an “Open Settings” link) from “feature not on plan” (403 LICENSE_REQUIRED, neutral copy). Step 4 of the wizard surfaces the right banner and disables Launch while keeping Save as Draft available.
• Campaign name persistence: ajax_send_campaign now accepts an existing draft campaign_id and updates that row instead of inserting a fresh one. The temporary CAMPAIGN-<timestamp> placeholder no longer leaks into the campaign list when the merchant typed a real name.
• Save as Draft: new third action on Step 4 of the wizard between Back and Launch. Saves the campaign with status='draft' and redirects to the campaign list. The list shows a Draft badge, an Edit button that re-opens the wizard at Step 2 pre-filled, and a Delete button. A daily Action Scheduler job insim_drafts_cleanup removes drafts untouched for more than 30 days.
• UX polish pass: campaign detail page now groups “Refresh now” and “Export CSV” in a single right-aligned toolbar with Dashicons icons. “Back to campaigns”, filter chips, wizard nav buttons and “Create new campaign” use a consistent icon+label spec. Wizard fields show a red border and inline error message on invalid input. Campaign list rows have a hover state and a standardised status-badge spec.

1.0.7

• Helpdesk tab: simplified to a portal page. SMS conversations are managed in the inSIM web app; the in-WP inbox / conversation viewer / reply form was removed. Helpdesk now shows a description, an “Open inSIM web app” button, and a “Send test SMS” form (phone + message) that reuses the existing Sender pipeline. The ajax_load_inbox, ajax_load_conversation, ajax_send_reply, ajax_add_optout endpoints were removed.
• Reports tab: module-not-enabled gate dropped. Reports always attempt stats/overview and degrade gracefully: stat cards on success, “Statistics are not available for your account.” on LICENSE_REQUIRED, “Could not load statistics. Try again later.” on any other error.
• Help tab: “Modules enabled” row removed from the account snapshot. The LICENSE_REQUIRED error card was rephrased to a neutral “Some features require a higher plan.” text with no mention of specific module names.
• Settings tab order: Settings is now the first tab until the account is configured, then moves to last. When the merchant lands on the admin page without a ?tab= query argument and the account is not yet configured, the default tab is Settings.
• Tab styling: every tab shares the same green top border so the visual treatment is consistent.
• “Create new campaign” button: the + icon is a centred round badge to the left of the label.
• License-gate UI surface neutralised: no more “Some automations require the X module” banners or per-row “Upgrade required” badges; the Tracking URL field is no longer gated in the UI. Server-side license checks still run but their error messages are a neutral “Not available on your current account.”

1.0.6

• Send Campaign tab: removed four unregistered (dead) AJAX handlers including one that echoed $_REQUEST['callback'] (potential reflected XSS if ever wired). ajax_send_campaign now pre-checks SMS credits before inserting any DB row, returning HTTP 402 INSUFFICIENT_CREDITS if short.
• Automations: on_status_changed() now honors both the global “Order status update” toggle and the per-status checkbox (ardary_sms_isactive_action_order_status_update_wc-<status>), and uses the per-status message body when one was customised.
• Settings and Automations forms: added wp_nonce_field and wp_verify_nonce to the two POST handlers. Posts without a valid nonce are silently dropped.
• Campaign detail: ajax_retry_failed cancels any in-flight insim_campaign_batch actions for the campaign before re-queuing, to prevent duplicate sends. admin_post_export_csv streams in 500-row pages with fflush between pages.
• Uninstall: sweep now removes legacy ardary_sms_* option keys and their transient timeouts in addition to the insim_* prefix.
• _ajax_process_countRecipientsFromQuery now requires manage_woocommerce.

1.0.5

• Send Campaign tab: “Add to Campaign” button now adapts to selection. When no rows are ticked it reads “Add all (N) to campaign” and submits the whole filtered result via insim_add_recipients_from_query. When rows are ticked it reads “Add N selected to campaign” and uses the per-ID insim_add_recipients_by_ids path.

1.0.4

• Send Campaign tab: recipient cards now expose a tickable checkbox plus a “Select all on this page” header row. A new insim_add_recipients_by_ids AJAX endpoint persists only the chosen rows into the draft campaign.
• SMS Campaigns tab: default view is now a paginated list of existing campaigns (newest first) with status badges, recipient/progress columns and a “Create new campaign” CTA. Each row links to a new analytics detail page (?action=view&id=N) with counters (Sent / Delivered / Failed / Clicks / CTR / Credits used), per-recipient table, 10-second auto-refresh polling while sending (paused via Page Visibility API), CSV export, and a “Retry failed (N)” button that re-queues failed rows through Action Scheduler. History tab campaign names also link to the detail page.

1.0.3

• Automations tab: server-side license gating. AJAX endpoints reject attempts to activate any automation whose required feature flag is missing on the account. Disabling an automation is always allowed.
• Campaign wizard: Step 2 gains a Tracking URL field and a Priority radio (Normal / High). Both values are forwarded into the per-message url and priority fields on POST /sendsms. New columns tracking_url and priority added to wp_insim_campaigns via an idempotent schema upgrade (no manual re-activation needed).
• Help tab: the LICENSE_REQUIRED entry now lists the feature flags the plugin gates against and the recovery path.

1.0.2

• Send Campaign tab redesigned as a 4-step wizard (Recipients > Message > Schedule > Review) with progress stepper, live SMS preview, GSM-7 segment counter, and cost vs balance check before launch.
• Settings: Step 3 (“Test SMS”) input and button share a single inline row with status icons and spinner outside the button label.
• Settings Step 4: Default country code is now a searchable dropdown of 73 countries (was a 2-letter text input). Defaults to FR.
• New “Help” tab: full reference of every API error_code returned by the inSIM v2 API, with HTTP status, trigger, recovery action and example response. Includes a live account-snapshot panel.
• API audit: confirmed all endpoints used by the plugin match the documented payload and response shapes.

1.0.1

• Maintenance release.

1.0.0

• Initial release.
• Five automation hooks: order confirmation, status update, new account, low stock, abandoned cart.
• Visual campaign filter engine with guest-cart inclusion.
• Scheduled campaigns and rate-limit-aware batch sending via Action Scheduler.
• Abandoned-cart recovery with configurable delay, expiry, and recent-order exclusion.
• Delivery status polling from the History tab.
• STOP keyword opt-out list.
• 8 dedicated database tables; full uninstall sweep.
• i18n ready, .pot file included.