Skipping an optional question on a profile form is no longer reported back to the member as an error.

Fixes​

• [RE:MEMBERS] A dropdown left on its prompt — "-- Select --" and the like — was submitted as though the prompt were the answer, so a member who left three optional questions alone was told their submission had three problems, naming values they had never chosen. The answers were never stored wrongly, because a value outside a field's own list is refused before it is sent, but the report has to be trustworthy for the problems that are real to be noticed. A form that words its prompt differently can say so through the amsc_gf_placeholder_pattern filter.

Closes two lookup endpoints that answered anyone who asked, gets members signed in after a password reset instead of showing them a login form, and fixes several ways accounts created from an AMS came out wrong.

Adds​

• Member/Non-Member role mapping can create a role by name, the same way every other mapping type already could. Previously it could only choose from roles that already existed.
• Member Lookup remembers your last few lookups and offers them back as shortcuts. Each administrator sees only their own, and a member reached by ID, record number or email is remembered once rather than three times.

Fixes​

• [SECURITY] Two lookup endpoints answered anyone who asked. The committee and membership type lists — read from re:Members, and spending the site's API allowance to do it — were reachable by any visitor who could reach the REST API. Both now require the same permission as the screens they serve, and a test refuses any future route in the namespace that does not declare one.
• [RE:MEMBERS] Members are signed in after completing a password reset, instead of being shown the WordPress login form and asked to log in again by a site they had just proved their identity to. The return address given to re:Members was losing part of itself on the way back; it no longer has a part to lose.
• Members created from the AMS get their first and last name. The plugin was writing them to property names WordPress does not save, so every AMS-created user had blank name fields regardless of what the AMS sent. Records carrying only a combined name now have it split.
• Two members whose names produce the same username can both sign in. The second was refused a WordPress account and could never get in; the username now gets a numeric suffix, as WordPress does elsewhere.
• A failure while creating a WordPress user is reported instead of ending the login in a PHP fatal error.
• [NOVI] A role granted in WordPress, that no mapping mentions, survives the next sign-in on Novi as well as on re:Members. The code to preserve it existed but had been commented out.
• The "Role to Apply to all SSO Users" setting no longer adds a blank role when saved without choosing one, and no longer adds a role the member already has twice.

Changes​

• Login and logout no longer append a cachebuster to the address members land on. Measured against a live site, the page cache already bypasses signed-in members on its own, while every login and logout was leaving behind a cache entry keyed on a timestamp nobody would request again. Members now land on a clean URL.
• The wording of the "Manage WP Roles on AMS" setting says what turning it on actually does to roles granted in WordPress.

Adds a trace that records what happens during an AMS sign-in or a profile form submission, so a member who ends up somewhere unexpected leaves something to look at. Also stops a paged read that a misbehaving tenant could keep going forever.

Covers 1.3.0 and 1.3.1.

Adds​

• A trace of AMS sign-ins and profile submissions. Start it from AMS Connect → SSO Trace, from wp amsc trace arm, or by adding define( 'AMSC_TRACE', true ); to wp-config.php on a host with no command line. The screen updates itself while a recording is running.
• [RE:MEMBERS] Every call the plugin makes to re:Members is recorded while a trace is running, with the response status, how long it took and how much came back — so "was it us, was it them, and was it slow" has an answer.
• Gravity Forms profile submissions are recorded too: the form, feed and entry, every field that was sent and its value, and what each individual write came back with.

Fixes​

• [RE:MEMBERS] The country list is no longer requested over and over. On a tenant that answers every page of a list with the same results, the code reading it had no way to tell it had reached the end, and kept asking — one site was seen past page 540, spending its API allowance on a list of about 250 countries. Committee and custom field lists were read the same way and had the same fault.
• [RE:MEMBERS] A country list that cannot be retrieved is remembered as unavailable for a few minutes. Only a successful read used to be remembered, so a tenant that could not answer was asked again by every single page view.

Changes​

• Nothing is recorded unless somebody switches the trace on, and a recording started from the screen or the command line stops on its own. Sign-in tokens are never written down, in a URL or anywhere else, and a successful response body — which is the member's own record — is never stored.
• On the SSO Trace screen, one control is offered at a time: start a recording, stop the one that is running, or discard what a finished one left behind.

The 1.1 line makes member-facing profile edits behave the way members expect: an answer they delete is deleted, and clearing one part of an address no longer throws the whole address away. It also adds an administrator-initiated refresh, and fixes several ways a refresh could take roles away from a member who should keep them.

Covers 1.1.0 and 1.1.1.

Adds​

• [RE:MEMBERS] A "Refresh AMS SSO Data" link on each member's row in the Users list. It pulls the member's current data from re:Members and re-applies their roles — the same thing the member can do for themselves with [amsc-refresh-button], which until now was the only way. Support can fix a member's access without asking them to sign in first, or reaching them at all. Offered to anyone allowed to edit that user.

Fixes​

• [RE:MEMBERS] Clearing a text answer on a profile form clears it in re:Members. A blank answer was skipped, so the previous one stayed on the record and reappeared the next time the member opened the form — there was no way to delete information through a form at all.
• [RE:MEMBERS] A member who clears one part of their address no longer loses the whole update. re:Members rejects an address whose City, State, ZIP or Country is blank, and that took the street line the member did change down with it. The cleared component keeps the value already on the record, and the entry notes that it could not be removed.
• [RE:MEMBERS] A profile form no longer has to ask for City, State, ZIP and Country in order to save an address. A form mapping only some of them could never save one, on any submission.
• [RE:MEMBERS] Addresses outside the United States save. A country with no state or province was rejected every time.
• [RE:MEMBERS] Refreshing a member's AMS data grants the role their membership entitles them to. A member with a current membership was being given the non-member role.
• [RE:MEMBERS] Security Role mapping works on a refresh. A member's re:Members security roles were dropped before role mapping ever saw them.
• [RE:MEMBERS] A refresh no longer blanks a member's first name, last name and display name.
• [RE:MEMBERS] Members keep their committee-based roles on a refresh, on tenants whose per-member committee list is not published as its own endpoint.

Changes​

• [RE:MEMBERS] When an address genuinely cannot be saved, the entry names the field the feed needs to map instead of repeating re:Members' list of all four required ones.
• [RE:MEMBERS] Changing a member's country no longer carries any part of their previous address forward, so a state from where they used to live cannot end up on where they live now.
• [RE:MEMBERS] A refresh and the Member Lookup tool ask re:Members the identical question about a member, including asking it to calculate membership in real time, so the two can no longer disagree.
• [RE:MEMBERS] With debugging enabled, a refresh logs which per-member lists a tenant did not return, and logs when a member arrives at role mapping with no membership data.

The 1.0 line takes the new admin dashboard out of beta, brings every re:Members role mapping type into the plugin core, and rewrites the Gravity Forms profile write so a partly-failed update can no longer be reported as a success. It also fixes logging out, which could leave members on a WordPress screen they read as an error.

Covers 1.0.0, 1.0.1, 1.0.2 and 1.0.3.

Adds​

• [RE:MEMBERS] Membership Type, Committee, Certification, Security Role, Purchase and Event role mapping are part of the plugin core. They no longer require the BETA tester option.
• Role Mapping is fully editable in the new admin interface, with searchable Membership Type and Committee pickers, custom role creation, and a Refresh AMS Data action.
• A Member Lookup page: search by AMS ID, record number, or the email of an existing user, and see which roles the current configuration would grant and which mapping produced each one. Read-only — it creates no user and assigns no role.
• Automatic updates. The plugin checks for new releases and can update itself from the admin, the way a wordpress.org plugin does. Sites managing deployments through Composer or git can switch this off with the amsc_update_metadata_url filter.
• [RE:MEMBERS] An opt-in mock of the re:Members API for development, so the plugin runs without credentials. It refuses to run on production and is stripped from release builds.
• Pull requests and releases publish a WordPress Playground preview — a disposable site, in the browser, with the branch installed and role mapping configured against demo data.

Changes​

• The new admin dashboard is no longer a beta. Turning it on replaces the AMS Connect menu rather than adding a second one beside it, and a "Switch back to v1" link returns the classic screens at any time.
• [RE:MEMBERS] A feed setting controls what happens when a member changes their address: add a new one and make it primary, keeping the previous address, or update the existing one. Updating remains the default, because re:Members implements it as a replace and that is how existing feeds behave.
• [RE:MEMBERS] An updated address keeps the type of the address it supersedes instead of always being filed as Home.
• [RE:MEMBERS] The plugin no longer records a primary-affiliation relationship of its own after setting a member's primary organization. re:Members already does it, and the relationship type names differ per tenant. Sites that need it can switch it back on with the amsc_gf_remembers_sync_primary_affiliation_relationship filter.
• [RE:MEMBERS] Membership Type role mapping respects the same grace, effective and join dates as Member/Non-Member, including the Honor Effective Date setting. A role mapped to a membership type is granted only while that membership is current.

Fixes​

• [RE:MEMBERS] A profile update submitted through Gravity Forms is no longer reported as successful when part of it failed. Every API call the submission makes is recorded separately on the entry, naming what saved and what did not.
• [RE:MEMBERS] Custom field values are checked against the field's own definition before they are sent, and read back afterwards. re:Members answers a custom field write with success whatever it is given and silently discards what it does not recognise, so an answer could disappear with nothing reported anywhere.
• [RE:MEMBERS] One rejected part of a profile update no longer prevents the rest from saving. A rejected affiliation used to stop the address, phone and email from being written at all.
• [RE:MEMBERS] Addresses are sent with all of city, state, ZIP and country, even when a member clears one. Omitting them was accepted and then filled in from the street line, which produced nonsense values.
• [RE:MEMBERS] Profile forms prefill from the member's primary address, phone and email rather than whichever record the API returned first — the two are not the same, and a member could be shown, and correct, an address they never use.
• Logging out returns the member to the site's home page instead of the WordPress login screen, which members read as an error or as having been signed straight back in.
• Every logout link on the site is safe to click, not only the ones this plugin renders — the admin bar's "Log Out", a theme's own link, and any other plugin's. A site wanting WordPress's original behaviour can return false from the amsc_replace_wp_logout_url filter.
• Signing in again through the AMS keeps the session the member already has instead of adding another beside it. The old session was never ended, so nothing was gained, while every security token already rendered into an open tab or a cached page stopped working.
• SSO login works over plain HTTP. The auth cookie was hard-coded as Secure, so on any non-HTTPS site the user was created and then immediately seen as logged out.
• Turning on the new dashboard no longer hides pages other plugins add to the AMS Connect menu. Those screens were still reachable by URL, but their menu items disappeared.
• WordPress's own admin notices no longer appear squashed inside the new dashboard's header panel.
• [RE:MEMBERS] Custom fields are listed alphabetically when choosing which re:Members field a Gravity Forms field maps to. The list runs to a couple of hundred entries on a real tenant.
• [RE:MEMBERS] Requesting the AMS login before valid credentials are saved redirects home instead of causing a fatal error.
• [RE:MEMBERS] Role mapping rows saved incomplete no longer stay in the stored settings, where they caused a PHP warning on every login, and saving role mapping twice no longer clears the additional mapping types.

Introduces the Honor Effective Date setting for re:Members membership access control. Improves NOVI AMS credential validation, login redirect handling, and PHP 7.4 compatibility. Fixes a number of admin UI and error-handling issues.

Adds​

• [RE:MEMBERS] Adds an Honor Effective Date setting on the re:Members Settings page. When enabled, member role access begins only when the membership effectiveDate has been reached.

Changes​

• [RE:MEMBERS] Member access now defaults to the earlier of effectiveDate or joinDate (unless Honor Effective Date is enabled). This means members who join before their official term start date will receive access immediately by default.
• [NOVI] is_connected() now validates that all required credentials (Base URL, Client ID, and Client Secret) are present before reporting a connected state.
• [NOVI] Login redirect validation now uses wp_validate_redirect() and wp_sanitize_redirect() to correctly support both absolute and relative URLs (e.g. /my-page).

Fixes​

• [NOVI] Fixes a PHP parse error on PHP 7.4 caused by a named argument (callback:) passed to add_filter().
• [NOVI] Removes unreachable code after wp_die() in the login exception handler; login errors now redirect to the home page with a cache-buster.
• [NOVI] check_response() and get_parsed_response() now handle WP_Error and non-array HTTP responses gracefully instead of masking the original failure.
• [ADMIN] Fixes disabled AMS <select> not submitting its value by injecting a hidden input when the field is disabled via the AMSC_CONNECTED_AMS constant.
• [ADMIN] Select2 multi-role selector initialization is now guarded so it only runs on screens where the Select2 library is enqueued, preventing JS errors on other admin screens.

Adds methods to re:Members client to retrieve organizations.

Adds​

• [re:Members] Adds methods to retrieve organizations by ID and all organizations by page.

Improves the accuracy of re:Members expiration dates by using a fallback option. Provides post-logout routing options. Adds initial NOVI AMS SSO oAuth2.0 flow integration.

Adds​

• [RE:MEMBERS] Retrieves inactive memberships from re:Members (if there are no active ones) to use in setting the expiration date meta data.
• [RE:MEMBERS] Creates an option to route users to the WordPress homepage after logging them out of re:Members.
• [NOVI] Adds NOVI AMS SSO integration via oAuth2.0 flow. Currently only available by setting the AMSC_CONNECTED_AMS constant to novi.

Resolves bug in which WP users were not created upon a SSO login attempt when having user_login longer than 60 characters. Adds missing documentation.

Fixes​

• Resolves bug in which WP users were not created upon a SSO login attempt when having user_login longer than 60 characters.

Adds​

• Missing documentation for re:Members role mapping through Security Roles, Purchases and Events.

Adds support to re:Members purchases, events and security roles for role mapping as beta feature. Fixes re:Members name and styling across the code and replaces hard-coded amsc_ hook prefixes with AMSC_PREFIX constant.

Adds​

• Support to re:Members purchases, events and security roles for role mapping as beta feature.

Changes​

• Replaces hard-coded amsc_ hook prefixes with AMSC_PREFIX constant.

Fixes​

• re:Members name and styling across the code.