Khedmatkar 1.6.4

=== Khedmatkar ===
Version: 1.6.4
Hierarchical service categories: parent archives show immediate subcategories plus direct-only services.
Requires WordPress: 6.0+
Compatibility target: WordPress 7.1
Requires PHP: 8.0+
Text Domain: khedmatkar



== Release 1.4.3 ==
* Rebuilt the distributable ZIP with POSIX `/` paths so DirectAdmin, cPanel and Linux unzip tools can extract the theme reliably.
* Theme updates no longer rewrite the complete `khedmatkar_options` record; customer settings are preserved and new defaults continue to merge at read time.
* Added a separate Elementor widget named «خدمتکار - سوالات متداول آکاردئونی» without changing the existing Q&A display widget used by older pages.
* The accordion supports editable open/closed icons, per-item initial-state choice, keyboard-native buttons and ARIA relationships, while enforcing exactly one open item at all times.
* Frontend/admin assets remain file-versioned to avoid stale CSS/JS after upgrades.

== Release 1.4.2 ==
* Refreshed theme update handling so saved Khedmatkar settings are normalized once after update and frontend/admin assets receive a clean 1.4.2 cache key.
* Flushes rewrite rules once after updating from older packages so custom theme routes and builder templates resolve cleanly.
* Keeps the package on the clean non-licensed theme runtime.

== Release 1.4.1 ==
* Restored the standard root screenshot.png so WordPress Theme Details shows the Khedmatkar preview image again.
* Commission policy is simplified: one global default for all servicemen plus optional overrides on service categories; per-serviceman commission editing has been removed.
* Nested service categories inherit commission from their closest configured category, while historical settled orders keep their existing financial snapshot.
* Added a manager report for completed jobs showing the exact assigned serviceman, customer, service, amount, completion date and accounting state, with filters and pagination.
* Added direct access to all service requests under the Khedmatkar admin menu; request lists now show a reliable serviceman link/status label and include status/serviceman filters.

== Release 1.4.0 ==
* Installer hardening: generated icon geometry is consolidated into three versioned data files and Form Smart public/admin assets live under the main assets tree, reducing filesystem copy operations on restrictive shared hosting without removing features.
* Version 1.3.10 is the codebase for this release; its installer-safe ZIP structure and frontend style files are preserved.
* Header widget template 3 now separates the account icon from the servicemen icon. Account defaults to the single-user icon and servicemen defaults to the users icon, and both are independently editable from the Elementor widget.
* Header fallback navigation content, links and icons are editable instead of being forced sample copy when no WordPress menu is assigned.
* Theme Settings includes a dedicated «متن‌های قالب» area for editable frontend content such as archive descriptions, service/serviceman CTAs, Q&A headings, default header/footer copy, blog labels and video labels.
* Elementor-facing content that belongs to a widget remains editable inside that widget; system/operational strings such as validation errors, pagination semantics and form-state messages are intentionally kept out of global content settings.
* Serviceman directory profile text now remains consistent after AJAX filtering, instead of reverting to a hardcoded label.
* The video carousel no longer contains a demo-domain fallback URL; its all-videos link resolves to the actual configured videos page.
* Forced demo footer menu links/social fallbacks were removed so intentionally empty widget values remain empty rather than being repopulated with sample content.


== Release 1.3.10 ==
* Global service coverage supports one or more provinces; fresh/default configuration still uses one province and legacy single-province data remains compatible.
* Services and servicemen can store province-specific city coverage, and the request modal, serviceman filters/cards and Elementor directory consume the same structured location data.
* A manager-only serviceman accounting screen tracks real paid sales, site commission, serviceman payable amounts and settlement status. Sandbox/test transactions are excluded.
* Commission supports a global default plus an optional per-serviceman override. Each assigned paid order stores an accounting snapshot so later setting changes do not rewrite historic figures.
* Blog and video index pages now expose standard URL pagination while retaining their existing AJAX filtering/load-more experience.
* Header templates 1, 2 and 3 now share login-state behavior: guests see login/register semantics and authenticated users are sent to the account panel.
* Service/serviceman archives, location filters, public AJAX endpoints, admin capabilities and common high-volume queries were reviewed for pagination, security and performance.

== Release 1.3.8 ==
* Support tickets now use a dedicated accessible modal instead of keeping the new-ticket form permanently open in the account panel.
* The service-request modal includes a lightweight searchable service selector with no third-party JavaScript dependency.
* Request-modal data generation was reduced from per-service serviceman queries to one shared serviceman query and a short-lived invalidated cache for better behavior on modest shared hosting.
* Ticket creation has server-side length checks, nonce validation and per-user rate limiting.
* Direct mbstring calls used by key frontend paths now have safe fallbacks for hosts where the extension is unavailable.

Khedmatkar is an RTL service-company theme with native WordPress templates,
Elementor widgets, optional Elementor Pro Theme Builder locations, WooCommerce
support, native service ordering and direct payment, serviceman/customer panels,
mobile authentication, tickets and an internal form builder.

== Compatibility ==
* Elementor: the theme registers its own widgets without overwriting the user's Elementor CPT preference.
* Elementor Pro: Header, Footer, Single and Archive Theme Builder locations are registered and rendered with graceful fallbacks.
* WooCommerce: native WooCommerce support and gallery features are declared. The theme does not bundle WooCommerce template overrides, reducing update maintenance.
* Third-party plugins: generic Elementor/WooCommerce typography and container-width overrides have been removed or scoped to Khedmatkar-owned components.
* Form Smart: if the standalone Form Smart plugin is present, the bundled module does not unregister or replace the plugin's hooks/shortcodes.

== Security notes ==
* Public authentication and service-request endpoints are nonce protected and rate limited.
* Mobile OTP codes are stored as keyed hashes, not plaintext, and failed verification is attempt-limited with temporary lockout.
* Fixed-code OTP test mode is OFF by default and can be explicitly enabled by an administrator for staging tests. When enabled, an admin warning remains visible; when disabled, only the normal OTP/SMS path is accepted.
* Mobile numbers are normalized and duplicate account assignment is prevented.
* Font and Lottie upload MIME extensions are capability scoped.
* Navigation-menu custom metadata saving checks capability and the WordPress menu nonce.
* The internal smart form includes honeypot, nonce validation and submission rate limiting.

== Developer note for reverse proxies/CDNs ==
Rate limiting uses REMOTE_ADDR by default instead of trusting spoofable forwarding headers. Trusted hosting/CDN integrations can provide a verified client IP through the `khedmatkar_request_ip` filter when the hosting stack terminates requests behind a trusted proxy.




== Serviceman automation and neighborhood coverage in 1.3.0 ==
* Serviceman single pages use a compact request CTA instead of the previous detailed request card.
* Manual trust badge, experience and completed-jobs fields were removed from serviceman editing.
* Work experience is calculated from the serviceman membership/profile date.
* Completed-job count is calculated from assigned service requests whose status is completed.
* Serviceman profiles are linked one-to-one with WordPress accounts. Theme-created accounts are removed when the profile is permanently deleted; pre-existing user accounts are preserved safely.
* FAQ support was removed from the serviceman post type.
* Activity coverage now uses city-aware neighborhood checkboxes from the theme location dataset, with a city-wide fallback when detailed neighborhoods are unavailable.
* Legacy free-text activity-area data remains readable for filtering/migration but new saves use structured neighborhood metadata.

== Forms / serviceman account refinements in 1.2.8 ==
* Service requests are mirrored into the Forms module as a protected system form, so unread requests contribute to the red Forms badge and can be opened for request management from the submissions screen.
* The Theme Settings received-forms shortcut has been removed; Form Smart is the single inbox for public form submissions and native service requests.
* One global serviceman form shortcode can be configured for all serviceman profile pages; per-serviceman form IDs were removed.
* Saving a serviceman automatically creates or reuses a WordPress account whose username is the normalized mobile number and adds the serviceman role without deleting existing roles.
* Serviceman mobile numbers are private and are not rendered in the public profile.
* The Form Smart editor now has AJAX status/delete/read actions, autosave for existing forms, save-state feedback, live preview and Persian admin typography.
* The fixed contact CTA is larger and offers lightweight float/ring motion with reduced-motion support.

== Admin help / profile CTA refinements in 1.2.7 ==
* Contextual question-mark help uses native details/summary, so the help bubble opens even if the theme admin JavaScript is delayed or blocked.
* Help is intentionally selective: short necessary notes remain visible and only genuinely explanatory guidance is hidden behind the question mark.
* Persian admin typography is forced across Khedmatkar settings and native service/serviceman/request editor screens while Dashicons retain their own font.
* Customer-panel request CTA uses a dedicated class plus inline-important text color so aggressive global link rules cannot turn the navy button text black.

== Commercial service workflow / editor UX in 1.2.5 ==
* At that release, Theme Settings defined one operating province for the whole site; 1.3.10 extends this to multiple provinces while preserving compatibility. Service, serviceman, modal and advanced-search location choices are constrained to cities in that province.
* Servicemen can manage their own covered cities and provided services from their panel; administrators can edit the same data from the serviceman edit screen.
* Free-text serviceman skills/specialty UI has been replaced by linked published services so frontend cards, profiles and advanced search use one authoritative source.
* Service and serviceman edit screens use the theme admin font and reorganized searchable/checkable cards. Service single-page sections are collapsed accordions by default and can be reordered with drag-and-drop.
* Paid-service price editing has one dedicated formatted amount field with an explicit currency badge; paid services with zero price show an administrator warning and cannot start payment.
* ZarinPal Merchant ID and payment mode are organized under the service/payment settings tab. Test/Sandbox mode is OFF by default and a successful test transaction is stored as non-real paid_test, cannot be dispatched and does not send real payment-success SMS.
* A payment transaction pins the Merchant ID, currency and live/sandbox environment used when it starts so later setting changes do not alter callback verification.

== Installer compatibility in 1.2.4 ==
* The supplied icon library no longer contains standalone .svg files or generated PHP icon payloads.
* All 532 supplied icons are stored as structured path geometry in small JSON data packs and rebuilt at runtime from a strict SVG attribute allow-list.
* This avoids file-copy blocks on hosts that reject SVG uploads while preserving the same icon keys, labels and appearance.
* Generated icon data files use only ASCII filenames and JSON content; no executable code, XML/SVG markup, scripts or remote references are stored in the data packs.

== Request UX / city coverage in 1.2.2 ==
* Theme Settings now chooses the global request experience: simple request form or native online ordering/payment.
* Paid services visibly expose their configured price and payment behavior on the service page.
* Each service can be restricted to selected provinces and cities; once coverage is configured, requests outside that area are rejected server-side.
* Service editing includes formatted prices plus searchable province, city and serviceman assignment controls.
* The serviceman request action is placed in the upper hero area instead of duplicating a large sidebar box.
* Sticky phone contact is compact, light by default and has configurable colors, radius, size and animation.
* ZarinPal and request-event SMS settings are grouped in the main Theme Settings screen.

== Native orders/payment in 1.2.0 ==
* Two service modes: serviceman booking (accept/reject) and direct paid service order.
* Direct payment is implemented natively through ZarinPal and does not use WooCommerce cart, checkout, products or orders. WooCommerce compatibility remains optional and separate from this module.
* Event SMS messages use configured Kavenegar lookup templates or Melipayamak Body IDs; customer/company notifications are logged per request without storing provider credentials in request metadata.
* Customers can store province, city, exact address and postal code in their profile.
* Paid requests receive an invoice number and payment reference; the company can assign a serviceman after successful payment.
* Default request CTAs open the native modal; editors can replace them with manual URLs.

== Validation performed for 1.2.4 ==
* Final ZIP integrity and clean extraction validation.
* File-by-file PHP copy simulation on the extracted final package.
* PHP syntax validation for every PHP file and JavaScript syntax validation for every JavaScript file.
* 532/532 icon manifest/data lookups validated; every reconstructed icon was XML-parsed and compared semantically with the 1.2.3 source icon geometry.
* Package scan confirms zero standalone .svg files and zero generated PHP icon chunks.
* Generated icon JSON packs are bounded in size and contain no SVG/XML tags, PHP tags, script tags or remote URLs.

== Validation performed for 1.2.2 ==
* PHP syntax validation for every PHP file on the package CLI runtime.
* JavaScript syntax validation for every theme JavaScript file using Node.js.
* CSS parser validation using PostCSS.
* Static scan for high-risk PHP primitives and unintended external plugin hook removal.
* ZIP integrity validation after packaging.

A full end-to-end browser test against every possible third-party plugin combination is outside the scope of a static package audit. Keep a staging site for regression testing before marketplace releases.
