Context Navigation

← Previous Changeset
Next Changeset →

Changeset 3493820

Timestamp:

03/29/2026 12:38:18 PM (3 days ago)

Author:

klimentp

Message:

Version 1.1.3 - Parallel Image Scheduler, Connection Timeout Fix, Disconnection Hooks Fix

Location:

draftseo-ai

Files:

: 230 added
: 6 edited

Legend:

: Unmodified
: Added
: Removed

draftseo-ai/trunk/README.md

-                      r3491200
+                      r3493820
 The plugin intelligently handles images based on blog size:
 - **1-5 images**: Direct import (10-20 seconds)
+- **1-5 images**: Direct import — all images downloaded in parallel and imported immediately (typically 5–15 seconds)
 - **6+ images**: Hybrid approach
   - Featured image imported immediately
   - Remaining images processed in background via WordPress Cron
+  - Remaining images downloaded in parallel and imported in the background via Action Scheduler (no page visit needed)
 All images are downloaded directly from DraftSEO.ai to your WordPress Media Library.
 …
 ## Changelog
+### 1.1.3
+Reliability improvements, faster image loading, and cleaner background processing.
+- **Images now load reliably on quiet sites** — Images were sometimes not appearing on published posts on low-traffic websites because background download jobs weren't starting until the next page visit. They now start immediately regardless of site traffic.
+- **Clean deactivation** — Switching the plugin off while a publish was in progress could leave background tasks running after deactivation. The plugin now cleanly stops all background jobs when it is turned off.
+- **Proper uninstall disconnect** — Removing the plugin now correctly notifies DraftSEO.AI and closes the connection before all plugin data is deleted.
+- **Translations fixed** — Plugin text was not translating correctly on WordPress sites running in a language other than English. Translation files now load properly.
+- **Action Scheduler for background jobs** — Background image jobs now run via Action Scheduler instead of WP Cron. Action Scheduler does not need a page visit to start — it runs as a true background process — and retries jobs automatically if a download fails. Pending and completed jobs are visible in the WordPress admin at **Tools > Scheduled Actions**.
+- **Parallel image downloads** — Images in background jobs are now downloaded simultaneously before being imported into the Media Library. For a blog with 20 images this cuts total download time from roughly 60–100 seconds (sequential) to 5–15 seconds (parallel).
+- **No duplicate images on republish** — Republishing a post was creating a duplicate Media Library entry for every image that had not changed since the previous publish. Only new or replaced images are now downloaded and imported — unchanged images are reused from the existing entry, keeping the Media Library clean.
 ### 1.1.2
 …
 ### 1.1.0
+- **Image Replacement** — When a new image is generated and republished from DraftSEO.ai, replace the image inside the blog automatically.
+- **Assets Cleanup** — The old now-unused image is auto-deleted from the Media folder in Wordpress. Saves storage space, cleans up unused media assets.
+Automatic cleanup when republishing with a new image.
+- **Image replacement** — When you republish a post with a new AI-generated image, the new image is swapped in automatically
+- **Media cleanup** — The previous image is removed from your WordPress Media Library — keeps your media folder clean and saves storage space
 ### 1.0.5
 …
 - **In-text citations** — `[1]`, `[2]` markers now render as clickable superscript links that scroll to the matching reference in the References section
 - **References section** — Converted to a styled numbered list with anchor IDs (`#ref-1`, `#ref-2`) for citation linking; supports all reference styles (url_title, harvard_apa6, mla9, etc.)
 - **External links** — All external links now open in a new tab with `target="_blank"` and `rel="noopener noreferrer"` for security and better UX
 - **FAQ Schema (JSON-LD)** — FAQ question-answer pairs are extracted from blog content and injected as structured data in the WordPress post `<head>` for Google FAQ rich results
 - **Front-end CSS** — Plugin now injects lightweight CSS for consistent styling of citations, references, and tables across all WordPress themes
 - **Content sanitization** — Updated `wp_kses` allowlist to support `<sup>`, `<ol>`/`<li>` with `id`/`value`/`class`, and `<a>` with `target`/`rel` attributes
+- **External links** — All external links now open in a new tab with `target="_blank"` and `rel="noopener noreferrer"`
+- **FAQ structured data (JSON-LD)** — FAQ question-answer pairs are extracted from blog content and injected into the post `<head>` for Google FAQ rich results
+- **Theme-consistent styling** — CSS is injected for citations, references, and tables so they display correctly across all WordPress themes
+- **HTML element support** — `<sup>` for citations, `<ol>`/`<li>` with `id` attributes, and `<a>` with `target`/`rel` are now preserved in published post content
 - **Active sites filter** — WordPress site dropdown now only shows active/connected sites
 …
 Hotfix for content rendering in published posts.
+- **YouTube video embeds** — Now render correctly using WordPress oEmbed (previously stripped by sanitization)
+- **Data tables** — Now display as formatted HTML tables instead of raw markdown text
+- **Content processor** — Updated to use custom sanitization allowlist with full table tag support
+- **Removed legacy markdown-to-HTML converter** — All content conversion now handled on the platform side before sending
+- **YouTube embeds** — Were being stripped during publishing; now render as embedded players on your site
+- **Data tables** — Were displaying as raw Markdown text; now output as formatted HTML tables
 ### 1.0.0
+Major release with 30+ improvements across security, stability, performance, and API architecture.
+#### Security (6 improvements)
+- **HMAC-SHA256 webhook authentication** — Deactivation and disconnect webhooks now sign payloads with HMAC-SHA256 using the API key as the secret; the API key is never transmitted over the wire. Headers: `X-DraftSEO-Signature`, `X-DraftSEO-Timestamp`
+- **Replay protection** — Webhook requests include a Unix timestamp; requests older than 5 minutes are rejected to prevent replay attacks
+- **Timing-safe comparisons** — All API key and signature comparisons use `hash_equals()` (PHP) and `crypto.timingSafeEqual` (Node.js) to prevent timing-based side-channel attacks
+- **AES-256-CBC encryption** — API keys stored at rest using AES-256-CBC with a random IV per encryption, derived from WordPress auth salt (site-specific, not hardcoded)
+- **Improved deactivation hook** — Now reads the API key via `DraftSEO_Settings::get_api_key()` (properly decrypted) for more reliable key handling
+- **Enhanced key validation** — `verify_api_key()` now explicitly validates both stored and provided keys with specific, actionable error codes
+#### API & REST Endpoint Improvements (7 improvements)
+- **New `/tags` endpoint** — Added `GET /wp-json/draftseo/v1/tags` for tag synchronization, matching the existing `/users` and `/categories` endpoints
+- **Unified endpoint architecture** — All three sync resources (users, categories, tags) now use the same plugin-first-then-fallback pattern via `fetchWithPluginFallback()`
+- **Structured error responses** — All error responses now use proper `WP_Error` objects with specific error codes (`rest_forbidden`, `rest_missing_param`, `rest_publish_error`, `rest_update_error`, `rest_post_not_found`, `rest_tags_error`) for better debugging and integration
+- **`rest_ensure_response()`** — All success responses now use `rest_ensure_response()` per WordPress REST API Handbook, allowing WordPress filters to process responses through the standard pipeline
+- **Input validation arguments** — `/publish` and `/update` routes now define `args` with `validate_callback` and `sanitize_callback` for server-side input validation before the handler runs
+- **Remote disconnect endpoint** — `/remote-disconnect` properly clears stored API key and connection settings when triggered from DraftSEO.ai platform
+- **Bidirectional disconnect sync** — When a user disconnects from DraftSEO.ai, the platform now calls the plugin's `/remote-disconnect` endpoint before local deletion, keeping both sides in sync
+#### Stability & Error Handling (6 improvements)
+- **Non-JSON response resilience** — Gracefully handles HTML maintenance pages, WAF blocks, and 503 errors from WordPress instead of failing silently
+- **Sync endpoint timeout & abort** — Added configurable timeout with AbortController to prevent hanging sync requests
+- **Error isolation** — Per-card Error Boundaries in the WordPress site list ensure individual site issues don't affect other connected sites
+- **Guarded data access** — All connection data property accesses use optional chaining with fallbacks for maximum reliability
+- **Response validation** — API responses are validated as proper arrays/objects before processing for robust data handling
+- **Health check hardening** — Health check response parsing improved with dedicated error paths for edge cases
+#### Performance & Optimization (4 improvements)
+- **Parallel sync** — Users, categories, and tags are fetched simultaneously via `Promise.all()` instead of sequentially
+- **Smart retry logic** — 4xx client errors (401, 403, 400, 422) skip retry entirely; only 5xx server errors are retried, reducing wasted API calls
+- **Optimized cache invalidation** — Streamlined cache invalidation strategy; added health check invalidation after sync for immediate UI updates
+- **Image import strategy** — Intelligent strategy selection: 1-5 images use direct import (fast), 6+ images use hybrid approach (featured image immediate, rest via WordPress Cron background processing)
+Major release — security hardening, reliability improvements, and full tag management.
+#### Security
+- **Webhook signatures** — Disconnect and deactivation notifications are signed with HMAC-SHA256 (`X-DraftSEO-Signature`, `X-DraftSEO-Timestamp` headers); the API key is the signing secret and is never transmitted in plain text
+- **Replay protection** — Signed requests include a Unix timestamp; requests older than 5 minutes are rejected
+- **API keys encrypted at rest** — AES-256-CBC with a unique IV per key, derived from the WordPress site's auth salt
+#### Publishing & REST API
+- **Tags endpoint** — `GET /wp-json/draftseo/v1/tags` added for tag sync, matching the existing `/users` and `/categories` endpoints
+- **Server-side input validation** — `/publish` and `/update` routes validate and sanitise all params before the handler runs
+- **Structured error responses** — All errors return specific codes (`rest_forbidden`, `rest_missing_param`, `rest_publish_error`, etc.) for better debugging
+- **Bidirectional disconnect** — Disconnecting from DraftSEO.AI calls `/remote-disconnect` to clear connection settings on the plugin side automatically
+#### Reliability
+- **Non-JSON response handling** — Gracefully handles HTML maintenance pages, WAF blocks, and 503 responses instead of failing silently
+- **Sync timeouts** — All sync requests have a configurable timeout; no more indefinitely hung connections
+- **Error isolation** — Individual site connection errors in the multi-site view do not affect other connected sites
+#### Performance
+- **Parallel sync** — Users, categories, and tags are fetched simultaneously instead of sequentially
+- **Smart retries** — 4xx errors (401, 403, 400, 422) fail immediately without retrying; only 5xx server errors trigger retries
+#### Tag Management
+- Auto-create WordPress tags from AI-generated keywords at publish time (configurable, 1–10 tags)
+- Select from existing WordPress tags, or create new ones on the fly during publishing
+#### Image Handling
+- All images downloaded directly to your WordPress Media Library
+- Alt text from DraftSEO.AI preserved as WordPress image alt text
+- Featured image set automatically; post content image URLs updated from DraftSEO.AI CDN to local Media Library URLs
 #### Usability
+- **Settings link on Plugins page** — Added "Settings" quick-access link on the Plugins page (next to Deactivate) for one-click access to plugin configuration
+#### WordPress Best Practices
+- Requires WordPress 6.2+ and PHP 7.4+
+- Follows WordPress Coding Standards (WPCS)
+- Uses `wp_kses_post()` for content sanitization
+- Nonces for admin AJAX security
+- Capability checks (`manage_options`) for settings access
+- Content cleanup: responsive table wrapping, blockquote formatting
+- Publication logging to custom database table
+- Image duplicate detection via URL hash with WordPress object cache
+#### Tag Management
+- Auto-create tags from AI-generated keywords (configurable 1-10 count)
+- Manual tag selection from existing WordPress tags
+- Custom tags: create new tags on-the-fly during publishing
+#### Image Handling
+- Direct download from DraftSEO.ai to WordPress Media Library
+- Alt text and heading text metadata preserved
+- Featured image setting with URL replacement in post content (Nebius URLs → local WordPress URLs)
+- Background processing via WordPress Cron for large image sets (6+ images)
+- "Settings" quick-link added to the Plugins page for faster access to plugin configuration
 ### 0.2.0 (Initial Beta)

draftseo-ai/trunk/draftseo-ai.php

-                      r3491200
+                      r3493820
  * Plugin Name: DraftSEO.AI
  * Plugin URI: https://draftseo.ai/wp-plugin
  * Description: Publish AI-generated blogs from DraftSEO.AI platform directly to WordPress. Transfers images from Nebius CDN to WordPress media library while maintaining SEO optimization.
  * Version: 1.1.2
+ * Description: Publish AI-generated blogs from DraftSEO.AI platform directly to WordPress. Transfers images to WordPress media library while maintaining SEO optimization.
+ * Version: 1.1.3
  * Author: DraftSEO.AI
  * Author URI: https://draftseo.ai
 …
 // Define plugin constants
 define('DRAFTSEO_VERSION', '1.1.2');
+define('DRAFTSEO_VERSION', '1.1.3');
 define('DRAFTSEO_PLUGIN_DIR', plugin_dir_path(__FILE__));
 define('DRAFTSEO_PLUGIN_URL', plugin_dir_url(__FILE__));
 define('DRAFTSEO_PLUGIN_BASENAME', plugin_basename(__FILE__));
+// Load Action Scheduler (bundled in vendor/action-scheduler/).
+// AS self-initialises via plugins_loaded — no manual init call needed.
+// When multiple plugins bundle AS, WordPress loads the newest version automatically.
+if (file_exists(DRAFTSEO_PLUGIN_DIR . 'vendor/action-scheduler/action-scheduler.php')) {
+    require_once DRAFTSEO_PLUGIN_DIR . 'vendor/action-scheduler/action-scheduler.php';
+}
 /**
 …
      */
     private function init_hooks() {
+        // Load plugin text domain for translations
+        add_action('plugins_loaded', array($this, 'load_textdomain'));
         // Activation and deactivation hooks
         register_activation_hook(__FILE__, array($this, 'activate'));
 …
+    }
+    /**
+     * Load plugin text domain for i18n/translations
+     */
+    public function load_textdomain() {
+        load_plugin_textdomain(
+            'draftseo-ai',
+            false,
+            dirname(plugin_basename(__FILE__)) . '/languages/'
+        );
+    }
     /**
      * Add action links to the plugin listing on the Plugins page
 …
         // Notify DraftSEO.AI platform about plugin deactivation
         $this->notify_draftseo_deactivation('deactivated');
+        // Clear scheduled cron events (if any)
+        $timestamp = wp_next_scheduled('draftseo_process_images_background');
+        if ($timestamp) {
+            wp_unschedule_event($timestamp, 'draftseo_process_images_background');
+        }
+        // Cancel all pending Action Scheduler jobs for this plugin.
+        // as_unschedule_all_actions() removes every queued occurrence of a hook,
+        // not just the next one — correct approach for full cleanup.
+        if (function_exists('as_unschedule_all_actions')) {
+            as_unschedule_all_actions('draftseo_process_images_background', array(), 'draftseo-ai');
+            as_unschedule_all_actions('draftseo_process_images_with_callback', array(), 'draftseo-ai');
+        }
+        // Also clear any legacy WP Cron events from plugin versions < 1.1.3
+        // that may still be sitting in the wp_options cron queue.
+        wp_clear_scheduled_hook('draftseo_process_images_background');
+        wp_clear_scheduled_hook('draftseo_process_images_with_callback');
         // Flush rewrite rules
         flush_rewrite_rules();

draftseo-ai/trunk/includes/class-image-handler.php

-                      r3478117
+                      r3493820
  * Image Handler Class
+ *
+ * Handles image import from Nebius CDN to WordPress Media Library
+ * Implements 3 strategies: Direct, Async, and Hybrid
+ * Handles image import from cloud storage CDN to WordPress Media Library.
+ * Implements 3 strategies: Direct, Async, and Hybrid.
+ *
+ * Background jobs are scheduled via Action Scheduler (bundled in vendor/)
+ * instead of WP Cron. Action Scheduler provides true background processing
+ * (no page-visit dependency), built-in retry on failure, and an admin UI
+ * at Tools > Scheduled Actions for visibility into queued jobs.
+ *
+ * Within each background job, images are downloaded in parallel using
+ * curl_multi before being imported sequentially into the WordPress Media
+ * Library. Parallel downloads reduce total download time from 60–100 s
+ * (sequential) to ~5–15 s (parallel) for a typical 20-image blog.
+ *
  * @package DraftSEO_Publisher
 …
 class DraftSEO_Image_Handler {
     /**
      * Import images from Nebius CDN
+    /**
+     * Import images from DraftSEO CDN
+     *
      * Automatically selects best strategy based on image count:
      * - 1-5 images: Direct (media_sideload_image)
      * - 6+ images: Hybrid (featured immediate + rest async)
+     * - 1-5 images: Direct (curl_multi parallel download + sequential import)
+     * - 6+ images: Hybrid (featured immediate + rest via Action Scheduler)
+     *
      * @param array $images Array of image objects from DraftSEO.AI
 …
             );
+        }
         $image_count = count($images);
         // Strategy selection based on image count
         if ($image_count <= 5) {
             // Strategy 1: Direct import
+            // Strategy 1: Direct import (curl_multi parallel download)
             return self::import_images_direct($images, $post_id, $set_featured);
         } else {
             // Strategy 3: Hybrid (featured immediate + rest async)
+            // Strategy 3: Hybrid (featured immediate + rest via Action Scheduler)
             return self::import_images_hybrid($images, $post_id, $set_featured);
+        }
+    }
+    /**
+     * Strategy 1: Direct import using media_sideload_image()
+     *
+     * Best for 1-5 images - fast and reliable
+    /**
+     * Queue ALL images to Action Scheduler immediately and return, then fire
+     * the DraftSEO callback URL when the background job completes.
+     *
+     * Used when DraftSEO sends a signed callbackUrl in the publish request.
+     * The server gets an HTTP 200 response right away instead of waiting for
+     * every image download — eliminating the connection-timeout error that
+     * occurs when large image sets keep the request open for minutes.
+     *
+     * @param array  $images       Array of image objects from DraftSEO.AI
+     * @param int    $post_id      WordPress post ID
+     * @param bool   $set_featured Whether to set first image as featured
+     * @param string $callback_url Signed DraftSEO webhook URL for completion report
+     * @return array Minimal result with queued_count (imported_count is always 0)
+     */
+    public static function import_images_async($images, $post_id, $set_featured, $callback_url) {
+        if (empty($images) || !is_array($images)) {
+            // Nothing to import — fire callback immediately
+            self::fire_callback($callback_url, true, 0, 0);
+            return array('imported_count' => 0, 'queued_count' => 0, 'url_mapping' => array(), 'strategy' => 'async');
+        }
+        // Schedule ALL images (including featured) as a single Action Scheduler job.
+        // Args are wrapped in an outer array so the handler receives them as one
+        // $args array, matching the existing function signature.
+        if (function_exists('as_schedule_single_action')) {
+            as_schedule_single_action(
+                time(),
+                'draftseo_process_images_with_callback',
+                array(
+                    array(
+                        'post_id'      => $post_id,
+                        'images'       => $images,
+                        'set_featured' => $set_featured,
+                        'callback_url' => $callback_url,
+                    )
+                ),
+                'draftseo-ai'
+            );
+        } else {
+            // Fallback to WP Cron if Action Scheduler is unavailable
+            wp_schedule_single_event(
+                time(),
+                'draftseo_process_images_with_callback',
+                array(
+                    'post_id'      => $post_id,
+                    'images'       => $images,
+                    'set_featured' => $set_featured,
+                    'callback_url' => $callback_url,
+                )
+            );
+            spawn_cron();
+        }
+        return array(
+            'imported_count' => 0,
+            'queued_count'   => count($images),
+            'url_mapping'    => array(),
+            'strategy'       => 'async'
+        );
+    }
+    /**
+     * Strategy 1: Direct import using curl_multi parallel download
+     *
+     * Downloads all images simultaneously, then imports each into the WordPress
+     * Media Library sequentially. Best for 1-5 images — fast and reliable.
+     *
+     * Sequential import is required: WordPress generates multiple image sizes
+     * (thumbnails via GD/ImageMagick) per attachment — a CPU-bound step that
+     * cannot be parallelized safely on shared hosting.
+     *
      * @param array $images Array of image objects
 …
         require_once(ABSPATH . 'wp-admin/includes/file.php');
         require_once(ABSPATH . 'wp-admin/includes/image.php');
         $imported_count = 0;
+        $url_mapping = array();
+        $url_mapping    = array();
+        // Phase 1: Download all images in parallel using curl_multi
+        $tmp_map = self::parallel_download_images($images);
+        // Phase 2: Import each downloaded file into the Media Library sequentially
         foreach ($images as $index => $image) {
             if (empty($image['url'])) {
                 continue;
+            }
+            // Download from Nebius CDN
+            $attachment_id = media_sideload_image(
+                $image['url'],
+                $post_id,
+                isset($image['altText']) ? $image['altText'] : '',
+                'id'
+            );
+            $url = esc_url_raw($image['url']);
+            if (!isset($tmp_map[$url])) {
+                continue; // Download failed for this URL — skip
+            }
+            // Skip re-import if already in the Media Library — avoids duplicate entries on republish
+            $existing_id = self::find_existing_image($url);
+            if ($existing_id) {
+                @unlink($tmp_map[$url]); // Temp file not needed — clean up immediately
+                if ($set_featured && 0 === $index) {
+                    set_post_thumbnail($post_id, $existing_id);
+                }
+                $wp_url = wp_get_attachment_url($existing_id);
+                if ($wp_url) {
+                    $url_mapping[$url] = $wp_url;
+                    $imported_count++;
+                }
+                continue;
+            }
+            $attachment_id = self::import_from_temp($tmp_map[$url], $url, $post_id, $image);
             if (is_wp_error($attachment_id)) {
                 continue;
+            }
+            // Update alt text
+            if (isset($image['altText'])) {
+                update_post_meta($attachment_id, '_wp_attachment_image_alt', sanitize_text_field($image['altText']));
+            }
+            // Store heading text if provided
+            if (isset($image['headingText'])) {
+                update_post_meta($attachment_id, 'draftseo_heading_text', sanitize_text_field($image['headingText']));
+            }
             // Set as featured image (first image only)
             if ($set_featured && $index === 0) {
+            if ($set_featured && 0 === $index) {
                 set_post_thumbnail($post_id, $attachment_id);
+            }
+            // Store URL hash for future lookup (enables deletion on republish)
+            self::store_image_hash($attachment_id, $image['url']);
+            // Store URL mapping for replacement
             $wp_url = wp_get_attachment_url($attachment_id);
+            $url_mapping[$image['url']] = $wp_url;
+            $url_mapping[$url] = $wp_url;
             $imported_count++;
+        }
         return array(
             'imported_count' => $imported_count,
             'url_mapping' => $url_mapping,
             'strategy' => 'direct'
+            'url_mapping'    => $url_mapping,
+            'strategy'       => 'direct'
         );
+    }
+    /**
+     * Strategy 3: Hybrid approach (PRODUCTION DEFAULT)
+     *
+     * Downloads featured image immediately, queues rest for background processing
+     * Best for 6+ images
+    /**
+     * Strategy 3: Hybrid approach (PRODUCTION DEFAULT for >= 6 images)
+     *
+     * Downloads featured image immediately so the post thumbnail is visible
+     * right away, then queues remaining images to Action Scheduler for true
+     * background processing — no page-visit required to start the job.
+     *
+     * Best for 6+ images without a callbackUrl.
+     *
      * @param array $images Array of image objects
 …
         require_once(ABSPATH . 'wp-admin/includes/file.php');
         require_once(ABSPATH . 'wp-admin/includes/image.php');
         $url_mapping = array();
         $featured_id = null;
         // Download ONLY featured image immediately (first image)
         if ($set_featured && !empty($images[0])) {
             $featured_image = $images[0];
+            $featured_id = media_sideload_image(
+                $featured_image['url'],
+                $post_id,
+                isset($featured_image['altText']) ? $featured_image['altText'] : '',
+                'id'
+            );
+            $featured_url   = esc_url_raw($featured_image['url']);
+            // Skip download if already in the Media Library — avoids duplicate entries on republish
+            $existing_featured_id = self::find_existing_image($featured_url);
+            if ($existing_featured_id) {
+                $featured_id = $existing_featured_id;
+            } else {
+                // Single-image download via WordPress's built-in helper
+                $featured_id = media_sideload_image(
+                    $featured_url,
+                    $post_id,
+                    isset($featured_image['altText']) ? $featured_image['altText'] : '',
+                    'id'
+                );
+            }
             if (!is_wp_error($featured_id)) {
-                // Set as featured image
                 set_post_thumbnail($post_id, $featured_id);
+                // Update alt text
                 if (isset($featured_image['altText'])) {
                     update_post_meta($featured_id, '_wp_attachment_image_alt', sanitize_text_field($featured_image['altText']));
+                }
+                // Store heading text
                 if (isset($featured_image['headingText'])) {
                     update_post_meta($featured_id, 'draftseo_heading_text', sanitize_text_field($featured_image['headingText']));
+                }
+                // Store URL hash for future lookup (enables deletion on republish)
+                self::store_image_hash($featured_id, $featured_image['url']);
+                // Store URL mapping
+                self::store_image_hash($featured_id, $featured_url);
                 $wp_url = wp_get_attachment_url($featured_id);
+                $url_mapping[$featured_image['url']] = $wp_url;
+            }
+        }
+        // Queue remaining images for background processing
+                $url_mapping[$featured_url] = $wp_url;
+            }
+        }
+        // Queue remaining images for background processing via Action Scheduler.
+        // AS runs the job as a proper background process — no page visit required.
         $remaining_images = $set_featured ? array_slice($images, 1) : $images;
         if (!empty($remaining_images)) {
+            // Schedule background processing using WordPress Cron
+            wp_schedule_single_event(
+                time(),
+                'draftseo_process_images_background',
+                array(
+                    'post_id' => $post_id,
+                    'images' => $remaining_images
+                )
+            );
+        }
+            if (function_exists('as_schedule_single_action')) {
+                // Args wrapped in outer array so handler receives them as one $args array
+                as_schedule_single_action(
+                    time(),
+                    'draftseo_process_images_background',
+                    array(
+                        array(
+                            'post_id' => $post_id,
+                            'images'  => $remaining_images,
+                        )
+                    ),
+                    'draftseo-ai'
+                );
+            } else {
+                // Fallback to WP Cron if Action Scheduler is unavailable
+                wp_schedule_single_event(
+                    time(),
+                    'draftseo_process_images_background',
+                    array(
+                        'post_id' => $post_id,
+                        'images'  => $remaining_images,
+                    )
+                );
+                spawn_cron();
+            }
+        }
         return array(
             'imported_count' => $featured_id ? 1 : 0,
             'url_mapping' => $url_mapping,
             'queued_count' => count($remaining_images),
             'strategy' => 'hybrid'
+            'imported_count' => $featured_id && !is_wp_error($featured_id) ? 1 : 0,
+            'url_mapping'    => $url_mapping,
+            'queued_count'   => count($remaining_images),
+            'strategy'       => 'hybrid'
         );
+    }
+    /**
+     * Background image processing handler
+     *
+     * Processes images queued for async download
+     * Hooked to 'draftseo_process_images_background' action
+     *
+     * @param array $args Arguments (post_id, images)
+    /**
+     * Background image processing handler (with callback)
+     *
+     * Processes ALL images queued via import_images_async(), replaces URLs in
+     * post content, then POSTs the result to the DraftSEO callback URL.
+     *
+     * Hooked to 'draftseo_process_images_with_callback' action.
+     * Scheduled via Action Scheduler — runs as a true background process.
+     *
+     * Action Scheduler retry behaviour: if this handler throws or times out,
+     * AS will retry it automatically. Import is idempotent — find_existing_image()
+     * detects already-imported URLs so retries skip completed work.
+     *
+     * @param array $args Arguments: post_id, images, set_featured, callback_url
+     */
+    public static function process_images_with_callback($args) {
+        if (!isset($args['post_id']) || !isset($args['images']) || !isset($args['callback_url'])) {
+            return;
+        }
+        $post_id      = intval($args['post_id']);
+        $images       = $args['images'];
+        $set_featured = !empty($args['set_featured']);
+        $callback_url = $args['callback_url'];
+        require_once(ABSPATH . 'wp-admin/includes/media.php');
+        require_once(ABSPATH . 'wp-admin/includes/file.php');
+        require_once(ABSPATH . 'wp-admin/includes/image.php');
+        $post_content   = get_post_field('post_content', $post_id);
+        $url_mapping    = array();
+        $imported_count = 0;
+        $failed_count   = 0;
+        // Phase 1: Download all images in parallel using curl_multi.
+        // This reduces download time from ~60-100 s (sequential) to ~5-15 s
+        // for a typical 20-image blog.
+        $tmp_map = self::parallel_download_images($images);
+        // Phase 2: Import each downloaded file into the Media Library sequentially.
+        // Sequential import is required because WordPress thumbnail generation
+        // (GD/ImageMagick) is CPU-bound and not safe to parallelise.
+        foreach ($images as $index => $image) {
+            if (empty($image['url'])) {
+                continue;
+            }
+            $url = esc_url_raw($image['url']);
+            if (!isset($tmp_map[$url])) {
+                $failed_count++;
+                continue; // Download failed for this URL
+            }
+            // Skip if already imported — idempotent, safe on Action Scheduler retry
+            if (self::find_existing_image($url)) {
+                @unlink($tmp_map[$url]); // phpcs:ignore WordPress.PHP.NoSilencedErrors
+                continue;
+            }
+            $attachment_id = self::import_from_temp($tmp_map[$url], $url, $post_id, $image);
+            if (is_wp_error($attachment_id)) {
+                $failed_count++;
+                continue;
+            }
+            // Set featured image (first image when requested)
+            if ($set_featured && 0 === $index) {
+                set_post_thumbnail($post_id, $attachment_id);
+            }
+            $wp_url = wp_get_attachment_url($attachment_id);
+            $url_mapping[$url] = $wp_url;
+            $imported_count++;
+        }
+        // Replace CDN URLs with WordPress local URLs in content
+        if (!empty($url_mapping)) {
+            $updated_content = self::replace_image_urls($post_content, $url_mapping);
+            wp_update_post(array(
+                'ID'           => $post_id,
+                'post_content' => $updated_content
+            ));
+        }
+        // Report result back to DraftSEO
+        self::fire_callback($callback_url, true, $imported_count, $failed_count);
+    }
+    /**
+     * Background image processing handler (no callback)
+     *
+     * Processes images queued by the hybrid strategy for async download.
+     * Hooked to 'draftseo_process_images_background' action.
+     * Scheduled via Action Scheduler — runs as a true background process.
+     *
+     * Action Scheduler retry behaviour: if this handler throws or times out,
+     * AS will retry it automatically. Import is idempotent — find_existing_image()
+     * detects already-imported URLs so retries skip completed work.
+     *
+     * @param array $args Arguments: post_id, images
      */
     public static function process_images_background($args) {
 …
             return;
+        }
         $post_id = intval($args['post_id']);
         $images = $args['images'];
+        $images  = $args['images'];
         require_once(ABSPATH . 'wp-admin/includes/media.php');
         require_once(ABSPATH . 'wp-admin/includes/file.php');
         require_once(ABSPATH . 'wp-admin/includes/image.php');
         $post_content = get_post_field('post_content', $post_id);
+        $url_mapping = array();
+        $url_mapping  = array();
+        // Phase 1: Download all images in parallel using curl_multi.
+        // This reduces download time from ~60-100 s (sequential) to ~5-15 s
+        // for a typical 20-image blog.
+        $tmp_map = self::parallel_download_images($images);
+        // Phase 2: Import each downloaded file into the Media Library sequentially.
+        // Sequential import is required because WordPress thumbnail generation
+        // (GD/ImageMagick) is CPU-bound and not safe to parallelise.
         foreach ($images as $image) {
             if (empty($image['url'])) {
                 continue;
+            }
+            // Download from Nebius CDN
+            $attachment_id = media_sideload_image(
+                $image['url'],
+                $post_id,
+                isset($image['altText']) ? $image['altText'] : '',
+                'id'
+            );
+            $url = esc_url_raw($image['url']);
+            if (!isset($tmp_map[$url])) {
+                continue; // Download failed for this URL — skip
+            }
+            // Skip if already imported — idempotent, safe on Action Scheduler retry
+            if (self::find_existing_image($url)) {
+                @unlink($tmp_map[$url]); // phpcs:ignore WordPress.PHP.NoSilencedErrors
+                continue;
+            }
+            $attachment_id = self::import_from_temp($tmp_map[$url], $url, $post_id, $image);
             if (is_wp_error($attachment_id)) {
                 continue;
+            }
+            // Update alt text
+            if (isset($image['altText'])) {
+                update_post_meta($attachment_id, '_wp_attachment_image_alt', sanitize_text_field($image['altText']));
+            }
+            // Store heading text
+            if (isset($image['headingText'])) {
+                update_post_meta($attachment_id, 'draftseo_heading_text', sanitize_text_field($image['headingText']));
+            }
+            // Store URL hash for future lookup (enables deletion on republish)
+            self::store_image_hash($attachment_id, $image['url']);
+            // Store URL mapping
             $wp_url = wp_get_attachment_url($attachment_id);
             $url_mapping[$image['url']] = $wp_url;
+        }
         // Replace Nebius URLs with WordPress local URLs in content
+            $url_mapping[$url] = $wp_url;
+        }
+        // Replace CDN URLs with WordPress local URLs in content
         if (!empty($url_mapping)) {
             $updated_content = self::replace_image_urls($post_content, $url_mapping);
             wp_update_post(array(
                 'ID' => $post_id,
+                'ID'           => $post_id,
                 'post_content' => $updated_content
             ));
+        }
+    }
+    /**
+     * Download multiple images in parallel using curl_multi.
+     *
+     * Opens one cURL handle per image URL, runs all transfers simultaneously,
+     * and writes each response body directly to a temp file. Returns a map of
+     * url => temp_file_path for every URL that downloaded successfully.
+     *
+     * Falls back to sequential download via WordPress's download_url() on servers
+     * where the cURL multi extension is unavailable (rare but possible).
+     *
+     * Only download is parallelised here. The subsequent Media Library import
+     * (thumbnail generation via GD/ImageMagick) must remain sequential because
+     * it is CPU-bound and not safe to parallelise on shared hosting.
+     *
+     * @param array $images    Array of image objects (each must have a 'url' key)
+     * @param int   $timeout   Per-transfer timeout in seconds (default 30)
+     * @return array           Map of url => temp_file_path for successful downloads
+     */
+    private static function parallel_download_images($images, $timeout = 30) {
+        if (!function_exists('curl_multi_init')) {
+            // cURL multi unavailable — fall back to sequential download via WordPress's
+            // download_url(), which uses the WP HTTP API under the hood.
+            return self::sequential_download_images($images, $timeout);
+        }
+        $mh      = curl_multi_init();
+        $handles = array(); // keyed by (int) curl handle resource
+        $results = array(); // url => temp_file_path (successful downloads only)
+        foreach ($images as $image) {
+            if (empty($image['url'])) {
+                continue;
+            }
+            $url = esc_url_raw($image['url']);
+            // Create a unique temp file for this download
+            $tmp = wp_tempnam('draftseo-img-' . substr(md5($url), 0, 8));
+            // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen
+            $fp  = fopen($tmp, 'wb');
+            if (!$fp) {
+                @unlink($tmp); // phpcs:ignore WordPress.PHP.NoSilencedErrors
+                continue;
+            }
+            $ch = curl_init($url);
+            curl_setopt_array($ch, array(
+                CURLOPT_FILE           => $fp,
+                CURLOPT_HEADER         => false,
+                CURLOPT_FOLLOWLOCATION => true,
+                CURLOPT_MAXREDIRS      => 5,
+                CURLOPT_CONNECTTIMEOUT => 10,
+                CURLOPT_TIMEOUT        => $timeout,
+                CURLOPT_SSL_VERIFYPEER => true,
+                // Identify as WordPress so CDNs don't block bot-like requests
+                CURLOPT_USERAGENT      => 'WordPress/' . get_bloginfo('version') . '; ' . get_bloginfo('url'),
+            ));
+            curl_multi_add_handle($mh, $ch);
+            // Store metadata by integer handle id for later lookup
+            $handles[(int) $ch] = array(
+                'ch'  => $ch,
+                'url' => $url,
+                'fp'  => $fp,
+                'tmp' => $tmp,
+            );
+        }
+        if (empty($handles)) {
+            curl_multi_close($mh);
+            return array();
+        }
+        // Non-blocking event loop — process transfers until all finish
+        do {
+            $status = curl_multi_exec($mh, $running);
+            if ($running > 0) {
+                // Block until activity on one of the sockets (reduces CPU spin)
+                curl_multi_select($mh);
+            }
+        } while ($running > 0 && CURLM_OK === $status);
+        // Collect results: close file handles, check for errors, build result map
+        foreach ($handles as $meta) {
+            // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose
+            fclose($meta['fp']);
+            $errno     = curl_errno($meta['ch']);
+            $http_code = curl_getinfo($meta['ch'], CURLINFO_HTTP_CODE);
+            if (0 === $errno && $http_code >= 200 && $http_code < 300
+                && file_exists($meta['tmp']) && filesize($meta['tmp']) > 0
+            ) {
+                // Download succeeded — include in results
+                $results[$meta['url']] = $meta['tmp'];
+            } else {
+                // Download failed — discard temp file
+                @unlink($meta['tmp']); // phpcs:ignore WordPress.PHP.NoSilencedErrors
+            }
+            curl_multi_remove_handle($mh, $meta['ch']);
+            curl_close($meta['ch']);
+        }
+        curl_multi_close($mh);
+        return $results;
+    }
+    /**
+     * Download images sequentially using WordPress's download_url().
+     *
+     * Fallback for servers where curl_multi_init() is unavailable.
+     * Returns the same url => temp_file_path map as parallel_download_images()
+     * so callers are unaware of which path was taken.
+     *
+     * @param array $images  Array of image objects (each must have a 'url' key)
+     * @param int   $timeout Per-transfer timeout in seconds
+     * @return array         Map of url => temp_file_path for successful downloads
+     */
+    private static function sequential_download_images($images, $timeout = 30) {
+        $results = array();
+        foreach ($images as $image) {
+            if (empty($image['url'])) {
+                continue;
+            }
+            $url = esc_url_raw($image['url']);
+            $tmp = download_url($url, $timeout);
+            if (!is_wp_error($tmp) && file_exists($tmp) && filesize($tmp) > 0) {
+                $results[$url] = $tmp;
+            } elseif (!is_wp_error($tmp) && file_exists($tmp)) {
+                @unlink($tmp); // phpcs:ignore WordPress.PHP.NoSilencedErrors
+            }
+        }
+        return $results;
+    }
+    /**
+     * Import a pre-downloaded temp file into the WordPress Media Library.
+     *
+     * Wraps media_handle_sideload() with metadata updates (alt text,
+     * heading text, URL hash) so all callers share one consistent import path.
+     *
+     * @param string $tmp_path   Absolute path to the temp file on disk
+     * @param string $url        Original CDN URL (used for hash storage)
+     * @param int    $post_id    WordPress post to attach the image to
+     * @param array  $image      Image object from DraftSEO (may contain altText, headingText)
+     * @return int|WP_Error      Attachment ID on success, WP_Error on failure
+     */
+    private static function import_from_temp($tmp_path, $url, $post_id, $image) {
+        $path_info = pathinfo(parse_url($url, PHP_URL_PATH));
+        $filename  = sanitize_file_name(isset($path_info['basename']) ? $path_info['basename'] : 'image.jpg');
+        $file_info = wp_check_filetype($filename);
+        // Reject non-image MIME types before handing off to WordPress
+        if (empty($file_info['type']) || 0 !== strpos($file_info['type'], 'image/')) {
+            @unlink($tmp_path); // phpcs:ignore WordPress.PHP.NoSilencedErrors
+            return new WP_Error('draftseo_invalid_mime', 'Not a valid image MIME type: ' . $url);
+        }
+        $file_array = array(
+            'name'     => $filename,
+            'type'     => $file_info['type'],
+            'tmp_name' => $tmp_path,
+            'size'     => filesize($tmp_path),
+            'error'    => 0,
+        );
+        $title         = isset($image['altText']) ? $image['altText'] : '';
+        $attachment_id = media_handle_sideload($file_array, $post_id, $title);
+        if (is_wp_error($attachment_id)) {
+            @unlink($tmp_path); // phpcs:ignore WordPress.PHP.NoSilencedErrors
+            return $attachment_id;
+        }
+        // Persist alt text as WordPress image alt
+        if (!empty($image['altText'])) {
+            update_post_meta($attachment_id, '_wp_attachment_image_alt', sanitize_text_field($image['altText']));
+        }
+        // Persist heading text for DraftSEO internal use
+        if (!empty($image['headingText'])) {
+            update_post_meta($attachment_id, 'draftseo_heading_text', sanitize_text_field($image['headingText']));
+        }
+        // Store URL hash for duplicate detection and deletion on republish
+        self::store_image_hash($attachment_id, $url);
+        return $attachment_id;
+    }
+    /**
+     * Fire the DraftSEO image-callback webhook.
+     *
+     * @param string $callback_url Signed DraftSEO callback URL
+     * @param bool   $success      Whether image import succeeded overall
+     * @param int    $imported     Number of images successfully imported
+     * @param int    $failed       Number of images that failed to import
+     */
+    private static function fire_callback($callback_url, $success, $imported, $failed) {
+        if (empty($callback_url)) {
+            return;
+        }
+        $body = wp_json_encode(array(
+            'success'         => $success,
+            'images_imported' => intval($imported),
+            'images_failed'   => intval($failed),
+        ));
+        wp_remote_post($callback_url, array(
+            'headers'  => array('Content-Type' => 'application/json'),
+            'body'     => $body,
+            'timeout'  => 15,
+            'blocking' => false, // Fire-and-forget
+        ));
+    }
     /**
      * Replace image URLs in content
+     *
      * @param string $content Post content
      * @param array $url_mapping Array of Nebius URL => WordPress URL mappings
+     * @param array $url_mapping Array of CDN URL => WordPress URL mappings
      * @return string Updated content
      */
 …
             return $content;
+        }
         foreach ($url_mapping as $nebius_url => $wp_url) {
             $content = str_replace($nebius_url, $wp_url, $content);
+        }
+        foreach ($url_mapping as $cdn_url => $wp_url) {
+            $content = str_replace($cdn_url, $wp_url, $content);
+        }
         return $content;
+    }
     /**
      * Check if image already exists in media library (duplicate detection)
+     *
      * @param string $image_url Nebius CDN URL
+     * @param string $image_url CDN URL
      * @return int|false Attachment ID if exists, false otherwise
      */
     public static function find_existing_image($image_url) {
         global $wpdb;
         // Generate hash of URL for comparison
         $url_hash = md5($image_url);
         // Try to get from cache first
         $cache_key = 'draftseo_img_' . $url_hash;
+        $cache_key     = 'draftseo_img_' . $url_hash;
         $attachment_id = wp_cache_get($cache_key, 'draftseo_images');
         if (false === $attachment_id) {
             // Not in cache, query database
 …
             $attachment_id = $wpdb->get_var(
                 $wpdb->prepare(
                     "SELECT post_id FROM {$wpdb->postmeta}
                     WHERE meta_key = 'draftseo_image_url_hash'
                     AND meta_value = %s
+                    "SELECT post_id FROM {$wpdb->postmeta}
+                    WHERE meta_key = 'draftseo_image_url_hash'
+                    AND meta_value = %s
                     LIMIT 1",
                     $url_hash
+                )
             );
             // Store in cache (cache even if not found to avoid repeated queries)
             wp_cache_set($cache_key, $attachment_id ? $attachment_id : 0, 'draftseo_images', 3600);
+        }
         return $attachment_id ? intval($attachment_id) : false;
+    }
     /**
      * Delete WordPress media attachments by their original CDN source URLs
 …
             return;
+        }
         global $wpdb;
         foreach ($urls as $url) {
             if (empty($url)) {
                 continue;
+            }
             $url = esc_url_raw($url);
             // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
             $attachment_id = $wpdb->get_var(
                 $wpdb->prepare(
                     "SELECT post_id FROM {$wpdb->postmeta}
                     WHERE meta_key = 'draftseo_original_url'
                     AND meta_value = %s
+                    "SELECT post_id FROM {$wpdb->postmeta}
+                    WHERE meta_key = 'draftseo_original_url'
+                    AND meta_value = %s
                     LIMIT 1",
                     $url
+                )
             );
             if ($attachment_id) {
                 // Delete attachment and its files from disk
                 wp_delete_attachment(intval($attachment_id), true);
                 // Clear the URL hash cache entry
                 $cache_key = 'draftseo_img_' . md5($url);
 …
+        }
+    }
     /**
      * Store image URL hash for duplicate detection
+     *
      * @param int $attachment_id WordPress attachment ID
      * @param string $image_url Nebius CDN URL
+     * @param string $image_url CDN URL
      */
     public static function store_image_hash($attachment_id, $image_url) {
 …
+}
+// Register background image processing hook
+// Register background image processing hooks.
+// Action Scheduler uses the standard WordPress add_action() system — these
+// registrations work for both AS-dispatched and WP Cron-dispatched calls.
 add_action('draftseo_process_images_background', array('DraftSEO_Image_Handler', 'process_images_background'));
+add_action('draftseo_process_images_with_callback', array('DraftSEO_Image_Handler', 'process_images_with_callback'));

draftseo-ai/trunk/includes/class-rest-api.php

-                      r3491200
+                      r3493820
+        }
+        // Store custom metadata (before image import so it's available even if images queue async)
+        if (isset($params['wordCount'])) {
+            update_post_meta($post_id, 'draftseo_word_count', intval($params['wordCount']));
+        }
+        if (isset($params['aiModel'])) {
+            update_post_meta($post_id, 'draftseo_ai_model', sanitize_text_field($params['aiModel']));
+        }
+        if (isset($params['id'])) {
+            update_post_meta($post_id, 'draftseo_blog_id', intval($params['id']));
+        }
+        // Store FAQ Schema data if provided
+        if (isset($params['faqItems']) && is_array($params['faqItems']) && !empty($params['faqItems'])) {
+            $faq_schema = self::build_faq_schema($params['faqItems']);
+            update_post_meta($post_id, 'draftseo_faq_schema', wp_json_encode($faq_schema));
+        }
         // Handle images
         $images_imported = 0;
+        $has_callback_url = isset($params['callbackUrl']) && !empty($params['callbackUrl']);
+        $set_featured = isset($params['options']['setFeaturedImage']) && $params['options']['setFeaturedImage'];
         if (isset($params['images']) && is_array($params['images']) && !empty($params['images'])) {
+            $set_featured = isset($params['options']['setFeaturedImage']) && $params['options']['setFeaturedImage'];
+            if ($has_callback_url) {
+                // Async path: queue ALL images to WP Cron and return immediately.
+                // DraftSEO's callback webhook will be fired when WP Cron finishes.
+                // This prevents the connection-timeout error caused by long image
+                // sideload operations blocking the HTTP response.
+                $callback_url = esc_url_raw($params['callbackUrl']);
+                DraftSEO_Image_Handler::import_images_async(
+                    $params['images'],
+                    $post_id,
+                    $set_featured,
+                    $callback_url
+                );
+                self::log_publication($post_id, $params['id'] ?? null, 'success');
+                return rest_ensure_response(array(
+                    'success'      => true,
+                    'status'       => 'images_queued',
+                    'post_id'      => $post_id,
+                    'post_url'     => get_permalink($post_id),
+                    'images_count' => count($params['images']),
+                ));
+            }
+            // Synchronous path (legacy / old plugin behaviour):
+            // Process images inline, then update post content with local URLs.
             $result = DraftSEO_Image_Handler::import_images($params['images'], $post_id, $set_featured);
 …
+        }
-        // Store custom metadata
-        if (isset($params['wordCount'])) {
-            update_post_meta($post_id, 'draftseo_word_count', intval($params['wordCount']));
+        }
-        if (isset($params['aiModel'])) {
-            update_post_meta($post_id, 'draftseo_ai_model', sanitize_text_field($params['aiModel']));
+        }
-        if (isset($params['id'])) {
-            update_post_meta($post_id, 'draftseo_blog_id', intval($params['id']));
+        }
-        // Store FAQ Schema data if provided
-        if (isset($params['faqItems']) && is_array($params['faqItems']) && !empty($params['faqItems'])) {
-            $faq_schema = self::build_faq_schema($params['faqItems']);
-            update_post_meta($post_id, 'draftseo_faq_schema', wp_json_encode($faq_schema));
+        }
         // Log publication
         self::log_publication($post_id, $params['id'] ?? null, 'success');

draftseo-ai/trunk/readme.txt

-                      r3491200
+                      r3493820
 Tested up to: 6.9
 Requires PHP: 7.4
 Stable tag: 1.1.2
+Stable tag: 1.1.3
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 …
 == Description ==
 DraftSEO.AI connects your WordPress site to the DraftSEO.AI platform, enabling you to publish AI-generated blog posts directly to your website with a single click.
+Publish complete, AI-generated blog posts from DraftSEO.AI to your WordPress site in one click. Images are automatically transferred to your Media Library, meta descriptions and keywords are preserved, and categories and tags are applied — no copy-pasting, no manual uploads.
 = Key Features =
 * **One-Click Publishing** - Publish AI-generated blogs from DraftSEO.AI to WordPress instantly
 * **Automatic Image Import** - Images are automatically transferred from DraftSEO.ai to your WordPress Media Library
 * **SEO Optimization** - Maintains all SEO metadata, keywords, and meta descriptions
 * **Category & Tag Management** - Sync WordPress categories and automatically create tags from keywords
+* **Automatic Image Import** - Images are automatically transferred from DraftSEO.AI to your WordPress Media Library
+* **SEO Optimization** - All SEO metadata, meta descriptions, and keywords are transferred and applied
+* **Category & Tag Management** - Sync WordPress categories and automatically create tags from blog keywords
 * **Multiple Publishing Options** - Save as draft, publish immediately, or schedule for later
 * **Content Cleanup** - Automatic HTML cleanup and formatting for WordPress compatibility
 * **Secure API Connection** - Encrypted API key storage using WordPress native encryption
 * **HMAC-SHA256 Webhook Security** - Industry-standard signature verification for deactivation and disconnect notifications
+* **Clean HTML Output** - Published posts use proper heading tags, responsive table markup, and `rel="noopener noreferrer"` on all external links
+* **Secure Connection** - Account credentials are encrypted at rest using AES-256-CBC and are never sent in plain text
+* **Signed Disconnect Notifications** - When you deactivate or remove the plugin, your DraftSEO.AI account is notified via an HMAC-SHA256 signed request — no ghost connections left behind
 = How It Works =
 . Install and activate the plugin on your WordPress site
 . Click "Connect with DraftSEO.ai" in plugin settings while you are logged in your DraftSEO.ai account
 . Automatically connect using OAuth (no manual API key needed)
 . Toggle Wordpress Auto-publish ON when generating blogs or click "Publish to WordPress" on already generated blogs
+. Click "Connect with DraftSEO.ai" in plugin settings while you are logged in to your DraftSEO.ai account
+. Connection completes automatically via OAuth — no API key needed
+. Toggle WordPress Auto-publish ON when generating blogs, or click "Publish to WordPress" on any previously generated blog
 = Image Import =
+The plugin intelligently handles image import based on blog size:
 * **1-5 images**: Direct import (fast, 10-20 seconds)
 * **6+ images**: Hybrid approach - featured image imported immediately, remaining images processed in background via WordPress Cron
 All images are downloaded from DraftSEO.ai directly to your WordPress Media Library, ensuring full ownership and no external dependencies.
+All images are downloaded directly from DraftSEO.AI to your WordPress Media Library — giving you full ownership with no ongoing external dependencies.
+* **1–5 images**: All images are downloaded in parallel and transfer immediately (typically 5–15 seconds)
+* **6+ images**: The featured image is set right away; remaining images are downloaded in parallel and transferred in the background via Action Scheduler — no page visit required to start the background job
+**Requires an active DraftSEO.AI account.** Visit [draftseo.ai](https://draftseo.ai) to sign up.
 …
 == Changelog ==
+= 1.1.3 =
+Reliability improvements, faster image loading, and cleaner background processing.
+* Fixed: Images on published posts were sometimes not appearing on low-traffic websites — they were queued to download in the background but the background job wasn't starting until the next page visit. They now start immediately regardless of site traffic.
+* Fixed: Switching the plugin off while a publish was in progress could leave background tasks running after deactivation. The plugin now cleanly stops all background jobs when it is deactivated.
+* Fixed: Removing the plugin (uninstall) now properly disconnects your site from DraftSEO.AI — the connection is closed on the DraftSEO side before all plugin data is removed.
+* Fixed: Plugin text was not translating correctly on WordPress sites running in a language other than English. Translation files now load properly.
+* Improved: Background image jobs now use Action Scheduler instead of WP Cron. Action Scheduler runs as a true background process without requiring a page visit, retries failed jobs automatically, and shows pending and completed jobs in the WordPress admin at Tools > Scheduled Actions.
+* Improved: Images in background jobs are now downloaded in parallel before being imported. For a blog with 20 images this reduces total download time from roughly 60–100 seconds (sequential) to 5–15 seconds (parallel).
+* Fixed: Republishing a post was creating duplicate images in the Media Library for any image that had not changed. Only new or replaced images are now downloaded and imported — unchanged images are reused from the existing Media Library entry.
 = 1.1.2 =
 …
 = 1.1.0 =
+When a new image is generated and republished from DraftSEO.ai, the old now-unused image is auto-deleted from the Media folder in Wordpress. Saves storage space, cleans up unused media assets.
+Automatic cleanup when republishing with a new image.
+* When you republish a post with a new AI-generated image, the new image is swapped in automatically and the previous image is removed from your WordPress Media Library — keeps your media folder clean and saves storage space.
 = 1.0.5 =
 …
 = 1.0.2 =
+Content formatting and SEO structured data hotfix release.
+* In-text citations `[1]`, `[2]` now render as clickable superscript links that scroll to the matching reference
+* References section converted to a styled numbered list with anchor IDs for citation linking
+* All external links now open in a new tab with `rel="noopener noreferrer"` for security
+* FAQ Schema (JSON-LD) structured data extracted from content and injected into WordPress post `<head>` for Google rich results
+* WordPress plugin now injects front-end CSS for consistent styling of citations, references, and tables across themes
+* Updated content sanitization allowlist to support `<sup>`, `<ol>`/`<li>` with IDs, and `<a>` with `target`/`rel` attributes
+* WordPress site dropdown now only shows active/connected sites
+Citation links, external link handling, and FAQ structured data for rich results.
+* In-text citations — `[1]`, `[2]` markers now render as clickable superscript links that jump to the matching reference in the References section
+* References section — Converted to a numbered list with anchor IDs (`#ref-1`, `#ref-2`) for smooth in-page navigation
+* External links — All external links now open in a new tab with `rel="noopener noreferrer"`
+* FAQ structured data — FAQ question-answer pairs from blog content are injected as JSON-LD into the post `<head>` for Google FAQ rich results
+* Theme-consistent styling — CSS is injected for citations, references, and tables so they display correctly across all WordPress themes
+* Active sites filter — The WordPress site dropdown now shows only connected, active sites
 = 1.0.1 =
+* Hotfix: YouTube video embeds now render correctly using WordPress oEmbed
+* Hotfix: Data tables now display as formatted HTML tables instead of raw markdown text
+Hotfix for content rendering in published posts.
+* Fixed: YouTube embeds were being stripped during publishing — they now render as embedded players on your site
+* Fixed: Data tables were displaying as raw Markdown text instead of formatted HTML tables
 = 1.0.0 =
 Major release with 30+ improvements across security, stability, performance, and API architecture.
 **Security (6 improvements)**
 * HMAC-SHA256 webhook authentication — Deactivation and disconnect webhooks now sign payloads with HMAC-SHA256 using the API key as the secret; the API key is never transmitted over the wire
 * Replay protection — Webhook requests include a Unix timestamp in `X-DraftSEO-Timestamp` header; requests older than 5 minutes are rejected
 * Timing-safe comparisons — All API key and signature comparisons use `hash_equals()` (PHP) and `crypto.timingSafeEqual` (Node.js) to prevent timing-based side-channel attacks
+* AES-256-CBC encryption — API keys stored at rest using AES-256-CBC with a random IV per encryption, derived from WordPress auth salt (site-specific, not hardcoded)
 * Improved deactivation hook — Now reads the API key via `DraftSEO_Settings::get_api_key()` (properly decrypted) for more reliable key handling
+* Enhanced key validation — `verify_api_key()` now explicitly validates both stored and provided keys with specific, actionable error codes
 **API & REST Endpoint Improvements (7 improvements)**
 * New `/tags` endpoint — Added `GET /wp-json/draftseo/v1/tags` for tag synchronization, matching the existing `/users` and `/categories` endpoints
+* Unified endpoint architecture — All three sync resources (users, categories, tags) now use the same plugin-first-then-fallback pattern via `fetchWithPluginFallback()`
 * Structured error responses — All error responses now use proper `WP_Error` objects with specific error codes (`rest_forbidden`, `rest_missing_param`, `rest_publish_error`, `rest_update_error`, `rest_post_not_found`, `rest_tags_error`) for better debugging and integration
+* `rest_ensure_response()` — All success responses now use `rest_ensure_response()` per WordPress REST API Handbook, allowing WordPress filters to process responses through the standard pipeline
 * Input validation arguments — `/publish` and `/update` routes now define `args` with `validate_callback` and `sanitize_callback` for server-side input validation before the handler runs
 * Remote disconnect endpoint — `/remote-disconnect` properly clears stored API key and connection settings when triggered from DraftSEO.AI platform
 * Bidirectional disconnect sync — When a user disconnects from DraftSEO.AI, the platform now calls the plugin's `/remote-disconnect` endpoint before local deletion, keeping both sides in sync
 **Stability & Error Handling (6 improvements)**
 * Non-JSON response resilience — Gracefully handles HTML maintenance pages, WAF blocks, and 503 errors from WordPress instead of failing silently
 * Sync endpoint timeout & abort — Added configurable timeout with AbortController to prevent hanging sync requests
+* Error isolation — Per-card Error Boundaries in the WordPress site list ensure individual site issues don't affect other connected sites
 * Guarded data access — All connection data property accesses use optional chaining with fallbacks for maximum reliability
+* Response validation — API responses are validated as proper arrays/objects before processing for robust data handling
 * Health check hardening — Health check response parsing improved with dedicated error paths for edge cases
+**Performance & Optimization (4 improvements)**
+* Parallel sync — Users, categories, and tags are fetched simultaneously via `Promise.all()` instead of sequentially
 * Smart retry logic — 4xx client errors (401, 403, 400, 422) skip retry entirely; only 5xx server errors are retried, reducing wasted API calls
 * Optimized cache invalidation — Streamlined cache invalidation strategy; added health check invalidation after sync for immediate UI updates
 * Image import strategy — Intelligent strategy selection: 1-5 images use direct import (fast), 6+ images use hybrid approach (featured image immediate, rest via WordPress Cron background processing)
+Major release — security hardening, reliability improvements, and full tag management.
+**Security**
+* Webhook signatures — Disconnect and deactivation notifications are signed with HMAC-SHA256 (`X-DraftSEO-Signature`, `X-DraftSEO-Timestamp` headers); the API key is the signing secret and is never transmitted in plain text
+* Replay protection — Signed requests include a Unix timestamp; requests older than 5 minutes are rejected
+* API keys encrypted at rest — AES-256-CBC with a unique IV per key, derived from the WordPress site's auth salt
+**Publishing & REST API**
+* Tags endpoint — `GET /wp-json/draftseo/v1/tags` added for tag sync, matching the existing `/users` and `/categories` endpoints
+* Server-side input validation — `/publish` and `/update` routes validate and sanitise all params before the handler runs
+* Structured error responses — All errors return specific codes (`rest_forbidden`, `rest_missing_param`, `rest_publish_error`, etc.) for better debugging
+* Bidirectional disconnect — Disconnecting from DraftSEO.AI calls `/remote-disconnect` to clear connection settings on the plugin side automatically
+**Reliability**
+* Handles security plugin blocks and maintenance pages gracefully — no silent failures when a WAF or caching layer intercepts requests
+* Sync requests now have a timeout so connections never hang indefinitely
+* Multi-site view: individual site connection errors are isolated so one broken connection does not affect others
+**Performance**
+* Users, categories, and tags are now fetched in parallel instead of sequentially
+* Retries only fire on server errors (5xx) — client errors (4xx) fail immediately without wasting retry attempts
+**Tag Management**
+* Auto-create WordPress tags from AI-generated keywords at publish time (configurable, 1–10 tags)
+* Select from existing WordPress tags, or create new ones on the fly during publishing
+**Image Handling**
+* All images downloaded directly to your WordPress Media Library
+* Alt text from DraftSEO.AI preserved as WordPress image alt text
+* Featured image set automatically; all image URLs in post content updated from DraftSEO.AI CDN to your local Media Library URLs
 **Usability**
+* Added "Settings" quick-access link on the Plugins page (next to Deactivate) for one-click access to plugin configuration
+**WordPress Best Practices**
+* Requires WordPress 6.2+ and PHP 7.4+
+* Follows WordPress Coding Standards (WPCS)
+* Uses `wp_kses_post()` for content sanitization
+* Nonces for admin AJAX security
+* Capability checks (`manage_options`) for settings access
+* Content cleanup: Markdown-to-HTML conversion, responsive table wrapping, blockquote formatting
+* Publication logging to custom database table
+* Image duplicate detection via URL hash with WordPress object cache
+**Tag Management**
+* Auto-create tags from AI-generated keywords (configurable 1-10 count)
+* Manual tag selection from existing WordPress tags
+* Custom tags: create new tags on-the-fly during publishing
+**Image Handling**
+* Direct download from DraftSEO.ai to WordPress Media Library
+* Alt text and heading text metadata preserved
+* Featured image setting with URL replacement in post content (DraftSEO.ai URLs → local WordPress URLs)
+* Background processing via WordPress Cron for large image sets (6+ images)
+* "Settings" quick-link added to the Plugins page for faster access to plugin configuration
 = 0.2.0 =
+* Initial beta release
+Initial beta release.
 * One-click blog publishing from DraftSEO.AI
 * Automatic image import from DraftSEO.ai
 …
 == Upgrade Notice ==
+= 1.1.3 =
+Reliability improvements. Fixes images not appearing on low-traffic sites, background tasks not stopping cleanly on deactivation, and translations on non-English installs. Recommended for all users.
 = 1.1.2 =
 Security update. Fixes API authentication failures on certain WordPress configurations that prevented DraftSEO.AI from syncing disconnect and deactivation events with your site.
 = 1.1.0 =
 When a new image is generated and republished from DraftSEO.ai, the old now-unused image is auto-deleted from the Media folder in Wordpress. Saves storage space, cleans up unused media assets.
+When you republish a post with a new AI-generated image, the previous image is automatically removed from your WordPress Media Library. Saves storage space and keeps your media folder clean.
 = 1.0.5 =
 Youtube Player styles for blogs.
+YouTube videos now display as embedded players on published WordPress posts.
 = 1.0.4 =
 Fixes YouTube videos not rendering on WordPress by correcting pipeline order and preserving Gutenberg block markers. Also fixes headings appearing as raw markdown after images.
+Fixes headings appearing as plain text after images in published posts. Also removes unwanted image captions that were displaying as visible text below every image.
 = 1.0.3 =

draftseo-ai/trunk/uninstall.php

-                      r3423447
+                      r3493820
  * Plugin Uninstall Handler
+ *
+ * Fires when the plugin is uninstalled via WordPress admin
+ * Fires when the plugin is deleted via WordPress admin.
+ *
+ * IMPORTANT ORDER OF OPERATIONS:
+ *   1. Notify DraftSEO FIRST (while credentials still exist so the webhook is authenticated)
+ *   2. Delete all plugin data second
+ *
+ * Unlike deactivation (which is triggered inside a running page request and can
+ * safely use blocking => false), uninstall.php runs in a short-lived process.
+ * Non-blocking requests may not flush before PHP exits, so the notify call here
+ * uses blocking => true with a short timeout.
+ *
  * @package DraftSEO_Publisher
  * @since 1.0.0
+ * @since 1.1.3
  */
 // Exit if accessed directly or not uninstalling
 if (!defined('WP_UNINSTALL_PLUGIN')) {
+if ( ! defined( 'WP_UNINSTALL_PLUGIN' ) ) {
     exit;
+}
+// Load the settings class so we can access encrypted credentials without
+// including the full plugin bootstrap (which is not loaded in uninstall context).
+require_once plugin_dir_path( __FILE__ ) . 'includes/class-settings.php';
 /**
+ * Clean up plugin data on uninstall
+ * Send a signed disconnect webhook to DraftSEO before credentials are deleted.
+ *
+ * Uses blocking => true with a short timeout to guarantee the HTTP request
+ * completes before the uninstall process wipes the credentials. A failed
+ * request (network error, timeout) is silently ignored — the uninstall
+ * continues regardless.
+ */
+function draftseo_notify_uninstall() {
+    $api_key      = DraftSEO_Settings::get_api_key();
+    $platform_url = DraftSEO_Settings::get_platform_url();
+    // Plugin was never connected — nothing to notify.
+    if ( empty( $api_key ) || empty( $platform_url ) ) {
+        return;
+    }
+    $timestamp   = time();
+    $payload     = array(
+        'site_url'  => get_site_url(),
+        'reason'    => 'uninstalled',
+        'timestamp' => $timestamp,
+    );
+    $body_json   = wp_json_encode( $payload );
+    $signature   = hash_hmac( 'sha256', $body_json, $api_key );
+    $webhook_url = rtrim( $platform_url, '/' ) . '/api/wordpress/deactivate-webhook';
+    // blocking => true: ensures the HTTP data is fully sent before PHP exits.
+    // timeout => 5: short enough not to delay the uninstall noticeably.
+    wp_remote_post( $webhook_url, array(
+        'timeout'   => 5,
+        'blocking'  => true,
+        'sslverify' => true,
+        'headers'   => array(
+            'Content-Type'         => 'application/json',
+            'X-DraftSEO-Signature' => $signature,
+            'X-DraftSEO-Timestamp' => (string) $timestamp,
+        ),
+        'body'      => $body_json,
+    ) );
+}
+/**
+ * Clean up all plugin data on uninstall.
  */
 function draftseo_publisher_uninstall() {
     global $wpdb;
+    // Delete plugin options
+    delete_option('draftseo_settings');
+    delete_option('draftseo_api_key_encrypted');
+    delete_option('draftseo_platform_url');
+    // Delete custom database table
+    // 1. Notify DraftSEO BEFORE deleting credentials so the webhook can be authenticated.
+    draftseo_notify_uninstall();
+    // 2. Delete plugin options.
+    delete_option( 'draftseo_settings' );
+    delete_option( 'draftseo_api_key_encrypted' );
+    delete_option( 'draftseo_platform_url' );
+    delete_option( 'draftseo_activation_redirect' );
+    // 3. Drop publication logs table.
     $table_name = $wpdb->prefix . 'draftseo_logs';
     // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.SchemaChange
     $wpdb->query("DROP TABLE IF EXISTS " . esc_sql($table_name));
     // Delete all post meta created by the plugin
+    $wpdb->query( 'DROP TABLE IF EXISTS ' . esc_sql( $table_name ) );
+    // 4. Delete all post meta created by the plugin.
     // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
+    $wpdb->query($wpdb->prepare("DELETE FROM {$wpdb->postmeta} WHERE meta_key LIKE %s", 'draftseo_%'));
+    // Clear scheduled cron events
+    $timestamp = wp_next_scheduled('draftseo_process_images_background');
+    if ($timestamp) {
+        wp_unschedule_event($timestamp, 'draftseo_process_images_background');
+    $wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->postmeta} WHERE meta_key LIKE %s", 'draftseo_%' ) );
+    // 5. Cancel all pending Action Scheduler jobs (added in 1.1.3).
+    // as_unschedule_all_actions() removes every queued occurrence of a hook.
+    if ( function_exists( 'as_unschedule_all_actions' ) ) {
+        as_unschedule_all_actions( 'draftseo_process_images_background', array(), 'draftseo-ai' );
+        as_unschedule_all_actions( 'draftseo_process_images_with_callback', array(), 'draftseo-ai' );
+    }
+    // Optional: Remove imported images (DANGEROUS - commented out by default)
+    // Uncomment the following lines ONLY if you want to delete all imported images on uninstall
+    /*
+    $attachment_ids = $wpdb->get_col(
+        "SELECT post_id FROM {$wpdb->postmeta} WHERE meta_key = 'draftseo_image_url_hash'"
+    );
+    foreach ($attachment_ids as $attachment_id) {
+        wp_delete_attachment($attachment_id, true);
+    }
+    */
+    // Also clear any legacy WP Cron events from plugin versions < 1.1.3.
+    // wp_clear_scheduled_hook removes every pending occurrence of a hook,
+    // not just the next one — correct approach for full cleanup.
+    wp_clear_scheduled_hook( 'draftseo_process_images_background' );
+    wp_clear_scheduled_hook( 'draftseo_process_images_with_callback' );
+    // NOTE: Do NOT delete published WordPress posts or imported media attachments.
+    // Those belong to the site owner, not to the DraftSEO plugin.
+}
 // Run uninstall
+// Run uninstall.
 draftseo_publisher_uninstall();

Note: See TracChangeset for help on using the changeset viewer.

Trac UI Preferences

Plugin Directory