Sentio License Manager – Sell Digital Products with WooCommerce

Änderungsprotokoll

2.0.0 – 2026-09-02

• AI authorization and metering. If the software you sell has an AI feature, you can now meter its usage against the same license record that grants access to it. A license carries a monthly generation allowance; a client plugin claims one generation before it runs and reports the outcome afterwards, so a generation that fails is not charged. A new AI screen configures the whole thing, covering three execution modes: your customers‘ plugins call a provider directly with their own keys, they call a gateway you run (this site signs a short-lived token your gateway verifies offline), or this site forwards the request to OpenAI or Anthropic itself. Only the last of those makes an outbound request from your server — see „External Services“ for the disclosure.
• Self-registration for free-tier client plugins. A plugin with no paying customer behind it can register itself for a free allowance without a WooCommerce order, and re-registering after a reinstall returns the registration it already had rather than minting a second one, so an allowance is a genuine monthly figure rather than something that resets on every reinstall.
• Revoke, restore and delete AI access per site, from the licenses screen. Revocation is immediate and terminal: a revoked site is told so once and stops contacting this server entirely, rather than retrying an authorization that will never succeed. Restoring puts it straight back.
• An AI usage screen showing consumption per license and per activated site, with each license’s allowance and what has been drawn against it.
• Metering is keyed to the license, not the site, so several sites activated against one license draw on one shared allowance — matching how the seat limit already works.
• „Bring your own key“ mode is never metered. When your customers pay their own provider, there is nothing for this server to count, and it no longer counts it.
• Fixed: POST /auth returned a fatal 500 for every request carrying a password, from 1.8.3 onwards. Login-based activation — the plugin’s headline feature — was broken for anyone running this plugin without the premium edition installed alongside it. The REST argument validator declared for the password parameter in 1.8.3 could not accept the arguments WordPress passes it.
• Fixed: re-activating a site that had previously been deactivated now reuses its existing activation row instead of adding a second one, so the seat count reflects reality.
• The connection test on the AI screen now sends the same request shape a real client sends and reports the result in place rather than reloading the screen. It previously reported failure against correctly configured endpoints, and never charges a customer’s allowance.
• Hardened the AI settings form against browser autofill, which could silently overwrite the model and endpoint fields with a saved email address. Values that cannot be what the field is for are now refused on save rather than stored.
• Authentication failures are logged with the reason the authentication actually returned, instead of recording every failure as a wrong password. A login blocked by another plugin on your site no longer reads as a bad credential in your logs. The response to the client is unchanged and stays deliberately generic.

1.8.5 – 2026-07-28

• The anonymous-usage telemetry checkbox on the welcome screen now renders unchecked. Telemetry is strictly opt-in: nothing is transmitted, no email is stored, and no scheduled task is created unless you tick the box and save.
• Global identifier prefix lengthened from slm to sentiolm to prevent conflicts with other plugins, per the directory guidelines. This covers option and user-meta keys, transients, scheduled-task hooks, action and filter names, form and AJAX action names, nonce actions, script and style handles, admin page slugs, and plugin constants. Existing installs carry their schema-tracking data forward automatically; other stored settings reset to defaults on upgrade.

1.8.4 – 2026-07-24

• The bundled example-integration reference code has been removed from the package in favor of hosted developer documentation (linked from the Integration Guide and overridable via the sentiolm_example_integration_url filter). The guide’s inline code snippets are unchanged.
• The licenses-table per-page preference is now persisted only on a nonce-verified filter-form submit by a user with manage_options — plain pagination links can no longer write the stored preference.
• Every admin action handler (admin-post forms, AJAX endpoints, WooCommerce save hooks) now carries an explicit inline capability check followed by its nonce verification as the first statements of the handler, replacing the shared verification helper so the checks are visible at every read site.

1.8.3 – 2026-07-20

• All admin inline <script>/<style> blocks moved into enqueued asset files (Integration Guide, Settings, Products, and the WooCommerce product panel/variation fields), loaded only on their owning screens via admin_enqueue_scripts.
• Input-sanitization hardening: the licenses-table pagination now builds its links from an allowlisted, pre-sanitized parameter set instead of the raw request; API credential secrets from HTTP Basic Auth are sanitized at every intake point.
• Output-escaping hardening: white-label values interpolated into inline CSS are now type-sanitized (hex colors, font allowlist, tag-stripped custom CSS), and the My Account endpoint title filter escapes the substituted label.
• REST security: the LMFWC/DLM compatibility shims now require a consumer key with write permission for license activation and deactivation (matching create/update/delete); telemetry opt-out deletion now requires a per-site deletion token (returned on each ping, stored server-side only as a hash) so third parties cannot delete another site’s telemetry row.
• Example-integration reference code renamed to a unique sentiolm_example_ prefix throughout.
• Admin screens now derive the REST base URL via rest_url(); fixed an unclosed output buffer in the license-update handler.
• Exhaustive follow-up audit across every shipped file: remaining inline onclick handlers replaced by a shared enqueued confirm helper, a declared sanitize_callback added to every REST route argument, and uniform unslash-plus-sanitize applied to every remaining request-variable read.

1.8.2 – 2026-06-18

• First WordPress.org release, revised for the directory. Self-hosted plugin/theme update-delivery — which served downloadable packages and fed WordPress native update checks for externally hosted plugins — has been completely removed: the public REST update endpoint, the „Plugin Releases“ admin screen, the release-metadata database table, and all supporting code are deleted. This addresses the storefront/update-delivery classification; the plugin no longer installs, updates, or distributes any code from outside WordPress.org.
• Sentio License Manager is now strictly a license-management plugin: it issues and validates license keys for WooCommerce products and tracks per-site activations via a REST API — the same scope as other licensing plugins in the directory (License Manager for WooCommerce, Digital License Manager). It does not deliver software updates.
• Unchanged: license issuance on WooCommerce purchase, per-site activation management, the license-validation REST API (activate/validate/deactivate), LMFWC and DLM migration tools, the REST API compatibility shim, and consent-gated anonymous telemetry.