=== ServeWay Sermon App ===
Contributors: pauldfranklin
Tags: sermons, church, sermon archive, sermon notes, preaching
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.3.6
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Sermon archive and sermon notes form for church websites, running entirely in WordPress. The ServeWay Windows 11 app adds members, giving and alerts.

== Description ==

Display your church's live stream events from WordPress. Installing the paid ServeWay Windows 11 app, available at serveway.org, allows additional functionality. Used standalone, the plugin can replace paid sermon plugins such as Series Engine, the sermon filtering many churches use JetEngine for, and other sermon plugins.

Works in WordPress alone:

* Sermons: add each sermon in wp-admin with its date, preacher, scripture, series, video playback URL, sermon notes PDF and announcements PDF, and show a filterable sermon archive with two shortcodes.
* Sermon notes form: a Contact Form 7 form for the pastor's sermon notes.
* Visitor card: a public visitor form that emails the church's forms mailbox.

With the paid ServeWay Windows 11 app, the same plugin also gives your church:

* Member pages, directory, events, serving, groups, polls and canvassing.
* Online giving through the church's own Stripe account.
* Church alerts (browser push). Visitors sign up on the website, and the church sends alerts from Notifications in ServeWay.
* Prayer, facility, VBS and benevolence request forms, which save a pending request for staff.

Turn modules on or off under Settings > ServeWay, then place each shortcode where you want that part to show.

The website keeps its own WordPress database. The plugin does not keep a member list in WordPress and does not create a WordPress user for each person. Member pages sign in against the church's ServeWay database, look up member information when a member opens a page, and save that member's changes back. The member password is the same user name and password as the ServeWay app, stored once in the ServeWay database. It is not a WordPress password.

Staff create the person in ServeWay, check Church Member, and set a Website password. A person cannot sign up as a new member from the website. App roles stay in ServeWay.

= Member pages (sign-in required, needs the paid ServeWay Windows 11 app) =

* `[serveway_household]` signs a member in and shows that household, with contact details, children, directory choices and family change requests.
* `[serveway_directory]` shows the church directory.
* `[serveway_prayer_requests]` shows active prayer requests.
* `[serveway_groups]` shows the member's groups.
* `[serveway_events]` lets a member RSVP. Saving, changing or cancelling an RSVP emails the household.
* `[serveway_calendar]` shows public church events as a month, a week or a list, with calendar download and subscribe links.
* `[serveway_serving]` lets a member accept or decline a serving assignment.
* `[serveway_volunteer]` lets a member sign up for an open team, ask for a swap and accept a swap.
* `[serveway_polls]` lists open polls. Each vote is tied to that person and counted once. Polls are not anonymous.
* `[serveway_teams]` shows upcoming team schedules. Each team can be Public, Members only or Hidden. Phone numbers, email addresses and street addresses are not shown.
* `[serveway_canvass]` is a phone page for a neighborhood canvass team.
* `[serveway_giving_history]` and `[serveway_accountant]` show giving records to the right people.

= Public forms (prayer, facility, VBS and benevolence need the paid ServeWay Windows 11 app) =

* `[serveway_prayer_request]` saves a prayer request as pending for staff to approve.
* `[serveway_facility_request]` saves a facility request as pending. It can be set to Members only.
* `[serveway_vbs]` and `[serveway_vbs_volunteer]` are VBS and camp registration and volunteer sign-up.
* `[serveway_visitor]` is a visitor card with OK to email, OK to text and OK to call choices. It emails the forms mailbox and works in WordPress alone.
* `[serveway_benevolence]` is a benevolence request form.
* `[serveway_sermon_form]` is the sermon notes form, sent through Contact Form 7. It works in WordPress alone.

= Sermons and announcements (no ServeWay app needed) =

* Sermons are stored in this plugin as a custom post type, with date, title, preacher, scripture, series, thumbnail, video playback URL, sermon notes PDF and announcements PDF.
* `[serveway_sermons]` lists sermons as cards. `[serveway_sermon_filter]` filters by series, preacher, year, month and scripture.
* Sermons need no other plugin, no ServeWay app and no outside database.

= Online giving =

* `[serveway_giving]` is an online giving page for a church that connects its own Stripe account. The donor chooses a fund, an amount and a schedule (once, weekly, monthly or yearly), then pays on Stripe Checkout. Card numbers are never typed on the church page. A verified Stripe webhook records the gift.
* ServeWay takes nothing off the top. The church pays only Stripe's standard fees. The church is the merchant of record. Disputes and refunds are the church's responsibility.

= Church alerts (browser push, needs the paid ServeWay Windows 11 app) =

* `[serveway_church_alerts]` lets a visitor choose topics and turn on browser push alerts. The church sends alerts from Notifications in ServeWay. The site must use HTTPS.

= Requirements =

* PHP 8.1 or newer with the curl, openssl, mbstring, json and mysqli extensions.
* Sermons, the sermon notes form and the visitor card need only WordPress. Member pages, giving, alerts and the request forms need the paid ServeWay Windows 11 app, and the web server must be able to reach the church's database that the app uses, with a separate database login for the website.
* Contact Form 7 (free) for Website Forms and the sermon form. Voice Audio Widgets (free) for the voice message field. Settings > ServeWay can install or activate them from the WordPress.org directory, but only when an administrator presses the button.

Spanish, Brazilian Portuguese and Korean versions of the member sign-in steps are in languages/readme-es.txt, languages/readme-pt-BR.txt and languages/readme-ko.txt.

== External services ==

This plugin connects to the following services. Each one is used only when the related feature is set up and turned on.

= Your church's ServeWay database =
Member pages, giving, teams, events, forms and check-in read and write the church's own ServeWay database over MySQL, using the host, database name and login entered under Settings > ServeWay. Data sent: the member's user name and password at sign-in, and the information a member or visitor types into a form (for example name, email, phone, household details, prayer requests, RSVPs). The database belongs to the church. A host other than localhost is reached over TLS. Churches using Hosted by ServeWay connect to hosted.serveway.org.
Terms and privacy: provided by the church that runs the database. Hosted by ServeWay: https://serveway.org/terms/ and https://serveway.org/privacy/

= Stripe =
Used by `[serveway_giving]`. When a donor continues to pay, the plugin creates a Stripe Checkout session (api.stripe.com) with the fund, amount, schedule, donor name and email, and sends the donor to Stripe Checkout. Stripe sends webhook events back to /wp-json/serveway/v1/stripe/webhook.
Terms: https://stripe.com/legal/ssa  Privacy: https://stripe.com/privacy

= Cloudflare Turnstile =
Used on public forms and member sign-in when Turnstile keys are saved in Contact Form 7. The plugin enqueues the challenge script from challenges.cloudflare.com. The visitor's browser loads that script, and the site sends the token and visitor IP to Cloudflare to verify it.
Terms: https://www.cloudflare.com/website-terms/  Privacy: https://www.cloudflare.com/privacypolicy/

= Twilio =
Used by check-in text messages when the church saves Twilio credentials. The phone number and message text are sent to api.twilio.com.
Terms: https://www.twilio.com/legal/tos  Privacy: https://www.twilio.com/legal/privacy

= MUX.com =
Sermon videos play in the MUX player (player.mux.com) when a visitor opens a sermon.
Terms: https://www.mux.com/terms  Privacy: https://www.mux.com/privacy

= OpenStreetMap =
The canvass map loads map tiles from tile.openstreetmap.org in the member's browser.
Terms and privacy: https://osmfoundation.org/wiki/Terms_of_Use and https://osmfoundation.org/wiki/Privacy_Policy

= Browser push services =
Church alerts are delivered through the push service of the visitor's browser (for example Google, Mozilla or Apple). Only the encrypted alert and the subscription address are sent.

== Privacy ==

* Member information stays in the church's ServeWay database. The plugin does not copy the member list into WordPress or create WordPress users for members.
* Member sign-in uses a session cookie for the Member Area.
* Polls are not anonymous. Staff can see who voted for what.
* Directory listings follow each household's choices for email, phone and picture.
* Public forms store what the visitor types as a pending request for church staff.
* Campaign email open and click tracking links can land on the site. The ServeWay app copies those events into the church database.
* Card numbers are entered only on Stripe Checkout.
* Database errors are shown only to administrators on the settings screen, never to visitors.
* Site owners should describe these uses in their own privacy policy.

== Installation ==

1. Install the plugin from Plugins > Add New, or upload the zip under Plugins > Add New > Upload Plugin, then activate it.
2. Open Settings > ServeWay and turn on the modules the church uses.
3. For the member pages, enter the database login the website uses to reach the church's ServeWay database: host, port, database name, user and password. Use a separate login for the website, not the one the ServeWay app uses. Save, then press Test connection. Test connection checks each privilege the website needs and names every gap. The settings screen lists the GRANT statements to run for that login.
4. Place each shortcode on the page where you want that part to show.
5. In ServeWay, open People, check Church Member, and set a Website password for each member who should sign in.
6. For giving, connect the church's Stripe account in ServeWay, turn on Giving under Settings > ServeWay, and register the webhook https://your-site/wp-json/serveway/v1/stripe/webhook in Stripe.
7. Optional: install Contact Form 7 and save Cloudflare Turnstile keys under Contact > Integration to protect public forms.

== Frequently Asked Questions ==

= Do I need the ServeWay app? =

Not for sermons, the sermon notes form or the visitor card, which work in WordPress alone. Member pages, giving, teams, church alerts and the prayer, facility, VBS and benevolence forms need the paid ServeWay Windows 11 app, because they read and write the church database that the app manages. Church alerts are sent from Notifications in the ServeWay app.

= Does the plugin create WordPress users for members? =

No. Members sign in with their ServeWay user name and password. WordPress users are not created.

= Does ServeWay take a share of donations? =

No. The church pays only Stripe's standard fees. The church is the merchant of record.

= Are card numbers stored on the website? =

No. Donors enter card details on Stripe Checkout. The website only receives Stripe's verified webhook.

= Why does Test connection report a missing privilege? =

The website login needs specific SELECT, INSERT and UPDATE grants on the ServeWay tables. Settings > ServeWay lists the exact GRANT statements. Replace the user and database name with your own.

= Can the website reach a database on a church office PC? =

Usually not. The web server must be able to reach the database host.

= Are polls anonymous? =

No. Each vote is tied to the member and staff can see who voted for what.

== Screenshots ==

1. Settings > ServeWay: shortcode list and sermon list settings.
2. Required plugins (Contact Form 7, Voice Audio Widgets) and module switches.
3. Member pages: the website's database login to the church's ServeWay database.
4. Cloudflare Turnstile status and church alert timing.
5. Sermons admin list with preacher, series and year filters, CSV export, and CSV import.
6. Member Area household page (sample data).
7. Online giving page with Stripe Checkout and giving drives (sample data).
8. Member church calendar (sample data).
9. Sermon archive with filters and sermon cards (sample data).
10. Public facility request form (sample data).

== Changelog ==

= 1.3.6 =
* A signed-in staff member can show or clear a short ProPresenter stage alert from the member page. ServeWay stores every alert and shows a website alert when ProPresenter is selected and the urgent switch is on. A missed alert stays in the log.
* Hosted member fields are encrypted with the church key, which stays on the church PC. Sign-up returns the database login once.

= 1.3.5 =
* Sermons in wp-admin can import a CSV. Download blank sermon CSV uses the same columns as Export CSV, except Item ID. Match each column, or apply Series Engine's bulk-upload columns, then preview the first rows. A sermon with the same date and title can be skipped or updated. Thumbnails and PDFs are copied into the Media Library when the file can be fetched, and the original address is kept when it cannot. The summary counts sermons created, updated, and skipped, and lists row numbers that need attention. Those row errors are written to the log and are not emailed.

= 1.3.4 =
* Prepared for the WordPress.org plugin directory. Output is escaped, form input is checked, and each PHP file blocks direct access. serveway.zip is that package and leaves out website backup. When the app asks it for a backup, the site says the backup feature is in the full version from serveway.org. serveway-full-1.3.4.zip includes website backup.

= 1.3.2 =
* Settings > ServeWay fills the database GRANT statements from the host, database name, and user saved for this church. When one of those is not saved yet, that part stays a placeholder.

= 1.3.1 =
* Member sign-in asks for the user name and password first. When that person has two-step sign-in, the authenticator code is the next screen. It is the same authenticator as ServeWay. A person without two-step sign-in does not see the code. A wrong code or an expired step is written to the log and is not emailed.
* A shortcode for a module that is turned off, including Giving and Sermons, shows "This feature isn't turned on for this church."

= 1.3.0 =
* `[serveway_canvass]` is the signed-in phone page for a neighborhood canvass. A team member sees only the streets assigned to that team, a class teacher, or a group leader. Each door can record Talked, Left a card, Not home, Do not return, a prayer request, or wants a visit, plus phone, email, people in the home, has a church home, and consent to contact. Save this prospect keeps the typed name. The same person is reused when the phone, email, or name already matches. A prayer request waits in the Approval Queue and on that street's class or group list. The street address stays off both. Wants a visit opens a visitor follow-up and a visit task. Nobody is added to the member directory. The same facts are at `/wp-json/serveway/v1/canvass/stops`.

= 1.2.0 =
* `[serveway_church_alerts]` sends church alerts from the church website. The person chooses topics, including All church news. iPhone users on iOS 16.4 or newer add the site to the Home Screen, then open that icon. ServeWay™ queues the alert from Notifications. The website sends it about every five minutes, and when ServeWay™ asks it to send. An urgent alert stays on screen until it is dismissed. Event reminders and the MUX.com livestream alert are switches on Website alert counts. PHP 8.1 or newer, with curl, openssl, mbstring, and json. The site must use HTTPS.

= 1.1.11 =
* `[serveway_polls]` is a Member Area poll. A signed-in member taps an answer. The vote is tied to that person and counted once. The person can change it until the poll closes. Staff will see who voted for what. The poll is not anonymous.
* `[serveway_volunteer]` lets a signed-in member sign up for an open team, ask for a swap, and accept a swap. The household page shows the same section. A swap needs UPDATE on team_week_servers, nursery_week_servers, and security_week_servers.

= 1.1.10 =
* Stripe Connect returns to the ServeWay server. The church computer does not keep the platform secret. Stripe stays in test mode until the EIN arrives and the platform profile is finished. The church is the merchant of record. Disputes and refunds are the church's responsibility. ServeWay records the full amount the donor gave. Stripe's fee is not subtracted. ServeWay takes nothing off the top. The church pays only Stripe's standard fee, currently 2.9% + 30¢ per transaction, with no additional ServeWay charge. Cards are the default. ACH stays off until the church turns it on. Stripe's standard ACH fee is currently 0.8% capped at $5 (https://stripe.com/pricing/local-payment-methods). `[serveway_accountant]` is off until the church turns it on. The accountant signs in and downloads a CSV or PDF. There is no Monday email.


= 1.1.9 =
* Giving adds the shortcode `[serveway_giving]`. The church connects its own Stripe account. Tithe.ly remains available. ServeWay takes nothing off the top. The church pays only Stripe's standard fee, currently 2.9% + 30¢ per transaction, with no additional ServeWay charge. A verified webhook records the gift. The return from Checkout does not.
* The monthly newsletter can be posted to the blog, to a page on this church site, or both. Remove from website undoes every place it was posted. [serveway_newsletter_signup] and [serveway_signup id=...] email the forms mailbox. ServeWay adds the person when it reads that mail. A pretty address /signup/name/ shows the same page. A signed-in member can change their own newsletter box. [serveway_newsletters] is an optional public list. The website login needs INSERT on people and families. Press Test connection so the newsletter columns are added. Nothing on the live site changes until you install this plugin.
* An email poll link records one answer per person on the church website. The answer can be changed until the close date. The website stores the question and the votes in WordPress. It does not write the church database. The app publishes the question and reads the votes on serveway/v1/polls with the announcements key. The confirmation page says thanks and names the answer. AMP for Email is not used.

= 1.1.8 =
* Test connection checks each sign-in privilege on its own and lists every gap in one message, for example "Missing privilege: users SELECT, INSERT, UPDATE; member_access_sessions UPDATE". Team tables that already exist are included. Visitors still see only the short unavailable sentence.

= 1.1.7 =
* An administrator signed in with an application password can build a church website backup. The archive is the WordPress database, built in steps with mysqldump when that program is available and with the WordPress database connection otherwise, plus wp-content. A full site backup also includes wp-config.php and marks that file sensitive. Ask for status, then download the archive in pieces. Temporary files are removed.

= 1.1.6 =
* An active team appears in Notifications as "Team: " plus its name. The people are that team's roster. Groups saved in Notifications stay as they are.
* Ask availability stores Yes, No, or Maybe. The message includes a personal link (`/?serveway_avail=`). A signed-in member also sees those asks, and the teams they are on, in the Member Area. Hidden teams stay off the schedule. The page shows the team name, dates, and message only.
* The website login needs SELECT on team_availability_requests and SELECT, INSERT, UPDATE on team_availability_responses. Test connection checks those privileges when the tables already exist.

= 1.1.5 =
* `[serveway_teams]` shows upcoming team schedules: names, dates, and posts. Optional team=slug shows one team. Public is for anyone. Members only requires a ServeWay™ Member Area sign-in. Hidden is never shown. The Member Area page adds a Teams section for a signed-in member.
* The website login needs SELECT only on teams, team_posts, team_members, team_week_servers, nursery_week_servers, security_week_servers, deacon_month_rotation, trustee_assignments, staff_assignments, and military_members. Test connection reads those tables when they already exist.

= 1.1.4 =
* A failed member sign-in keeps the short sentence for visitors. The database error is written to the PHP error log and shown on Settings, ServeWay™ as Last sign-in error.
* Test connection reads users, people, ChurchMembers, families, and familyportraits, and inserts and updates a session row that it then rolls back. A missing privilege shows up there.
* Sign-in columns on users, including lockout and must-change, are added when you press Test connection. A member page does not run ALTER.
* The readme and Settings list the GRANT statements for the website database login.

= 1.1.3 =
* The sermon form reads the same format definitions ServeWay™ stores. A format the church adds appears in the Format list, and its sections are mailed with the English labels ServeWay™ reads. The six built-in formats stay the usual choices.

= 1.1.2 =
* The sermon form has one Format list at the top: Points, Expository verse-by-verse, Narrative/story, Topical, Series, and Short devotional. Points stays the usual choice. Choosing a format shows that format's sections. The mailed sermon still uses the English labels ServeWay™ reads, and a sermon with no format line stays Points.

= 1.1.1 =
* Sermon cards follow the previous list: date, thumbnail, title, scripture, preacher, and series. The sermon window shows the title, scripture, MUX.com player, preacher, Sermon Notes, Announcements, and Back. The player loads when that window opens. Twelve sermons show on a page.
* Settings, ServeWay™ sets Columns and Sermons per page. The shortcode attributes columns and per_page replace those saved numbers.
* Sermons in wp-admin labels the video column MUX.com Embed Code and shows it as a play button. Sermon Notes and Announcements show a first-page preview. Preacher, series, and year filters sit above the list, with search, Export CSV, Quick Edit, Duplicate, and View on site. Preacher and Series offer names already used. A misspelled Bible book such as Galations is marked, and Fix spelling updates it when chosen.

= 1.1.0 =
* Sermons and weekly announcements are stored in this plugin. Sermon fields are Sermon Date, Title, Preacher, MUX.com video, Scripture, Sermon Series, Thumbnail, sermon notes PDF, and announcements PDF.
* Upload to Church Website posts to /wp-json/serveway/v1/sermons with the WordPress application password. An older plugin still accepts the previous sermons route.
* `[serveway_sermons]` lists sermons. `[serveway_sermon_filter]` filters by sermon series, preacher, date, and scripture. Neither shortcode asks for another plugin.
* Sermons, Copy existing sermons, copies rows from jet_cct_sermons. Running it again updates the same sermons. Old /sermons/ addresses redirect to the new sermon page. The JetEngine rows are left in place.

= 1.0.2 =
* Settings, ServeWay™ installs or activates Contact Form 7 and Voice Audio Widgets from the WordPress plugin directory only after an administrator presses the button. JetEngine stays a link to Crocoblock because it is paid.
* Public forms use Contact Form 7's Cloudflare Turnstile keys. The Turnstile key boxes are gone. The check still draws when Contact Form 7 has already loaded its Turnstile script.
* Test connection keeps its green or red result on the page until the next test.

= 1.0.1 =
* Public facility and prayer forms save a pending request, email the church administrator and the forms mailbox, and return to the form with a success or error message. A failed redirect or a fatal error is logged and still shows that message. Both forms show Cloudflare Turnstile from the Contact Form 7 keys.

= 1.0.0 =
* Optional Cloudflare Turnstile. Public ServeWay forms reuse the Contact Form 7 Turnstile keys. Settings, ServeWay™ overrides that pair only when both boxes are filled in.
* Facility requests are open to anyone until Settings, ServeWay™ sets Facility requests to Members only. A public request is saved as pending with the requester's name, email, and phone.
* One plugin with Member Access, Announcements, Voice Message MP3, Notification Copy MP3, Sermon Filter, and Website Forms.
* Test connection shows the MySQL error. A table that already exists is not created again. A password with a quote or backslash is saved as typed.
* Forms mailbox sync accepts a WordPress application password when the host drops the Authorization header. An active RockIT Member Access plugin asks to be deactivated.

== Upgrade Notice ==

= 1.3.6 =
Staff can send an urgent ProPresenter stage alert from the member page, and hosted member fields are encrypted.

= 1.3.5 =
Sermons can be imported from a CSV. The blank template uses the same columns as Export CSV.

= 1.3.4 =
serveway.zip is the WordPress.org package and does not include website backup. The full package with website backup is serveway-full-1.3.4.zip from serveway.org.


= 1.3.2 =
Database grants on Settings > ServeWay use this church's saved database host, name, and user.

= 1.3.0 =
Adds the neighborhood canvass page. The website database login needs the new canvass grants listed under Settings > ServeWay. Press Test connection after updating.
