=== LearnDash After Login ===
Contributors:      wellington-duarte
Tags:              learndash, login, redirect, roles, i18n
Requires at least: 5.8
Tested up to:      6.5
Requires PHP:      7.4
Stable tag:        1.0.0
License:           GPL-2.0+
License URI:       https://www.gnu.org/licenses/gpl-2.0.html

Redirect users to custom pages after login, based on their LearnDash or WordPress role.

== Description ==

**LearnDash After Login** lets you configure per-role redirect URLs that take effect immediately after a user logs in. No code required — go to **Tools > After Login Redirects** and fill in the URLs.

**Supported roles (in priority order):**

1. Administrator
2. Editor
3. LearnDash Manager (`ld_manager`)
4. Group Leader (`group_leader`)
5. Author
6. Contributor
7. Student / Subscriber

If a user has multiple roles, the role with the **highest priority** (closest to #1) wins. A **Default Fallback URL** can be set for any user that does not match a specific rule.

**Features:**

- Per-role redirect URL configuration
- Enable/disable toggle per role
- Default fallback URL for unmatched roles
- Priority-based matching (first enabled match wins)
- Secure redirect validation via `wp_validate_redirect()` — prevents open-redirect attacks by blocking external URLs unless explicitly allowed
- Administrator bypass — if no URL is configured for Administrators, WordPress handles the redirect normally (typically `/wp-admin`)
- Fully internationalised — all strings wrapped with `__()` / `_e()` under the `learndash-after-login` text domain
- Clean admin UI under Tools, with no external dependencies

== Security ==

All redirect targets are validated using WordPress's `wp_validate_redirect()` function before being applied. This function rejects URLs pointing to external domains unless those domains are explicitly whitelisted via the `allowed_redirect_hosts` filter, which prevents the plugin from being used as an open redirector.

URLs are stored via `esc_url_raw()` on save and sanitised again at redirect time.

== Internationalisation ==

The plugin is translation-ready. All user-facing strings use the `learndash-after-login` text domain. To provide a translation:

1. Generate a `.pot` file with WP-CLI: `wp i18n make-pot . languages/learndash-after-login.pot`
2. Create a `.po` file for your locale (e.g. `learndash-after-login-pt_BR.po`) and compile it to `.mo`.
3. Place the files in `wp-content/languages/plugins/` or the plugin's own `languages/` folder.

== Installation ==

1. Upload the `learndash-after-login` folder to `/wp-content/plugins/`.
2. Activate the plugin through **Plugins > Installed Plugins**.
3. Go to **Tools > After Login Redirects** to configure your redirect rules.

== Frequently Asked Questions ==

= Does this require LearnDash to be active? =

No. The plugin works with standard WordPress roles too. LearnDash-specific roles (Group Leader, LD Manager) will simply not exist in your system if LearnDash is not installed — those fields are safely ignored.

= What happens if a user has two roles? =

The rule with the highest priority (lowest number in the list) wins. For example, if a user is both a Group Leader and a Subscriber, the Group Leader redirect takes effect.

= What if I leave the Administrator URL blank? =

The plugin skips all redirect logic for that user, including the Default Fallback URL, and lets WordPress send them to `/wp-admin` as usual. This is intentional — administrators should not be redirected unexpectedly.

= What if I leave a non-admin URL field blank? =

That role is skipped. The plugin continues to the next matching role or falls through to the Default Fallback URL.

= Will this break the WordPress default login redirect? =

No. If no rule matches and no Default Fallback URL is set, WordPress handles the redirect as normal. If a URL fails `wp_validate_redirect()` validation (e.g. an external domain), it is silently skipped and the next rule is evaluated.

= Can I redirect users to an external domain? =

By default, `wp_validate_redirect()` only allows same-site URLs. To permit a specific external domain, add it via the `allowed_redirect_hosts` filter in your theme's `functions.php`:

    add_filter( 'allowed_redirect_hosts', function( $hosts ) {
        $hosts[] = 'app.example.com';
        return $hosts;
    } );

== Changelog ==

= 1.0.0 =
* Initial release.
* Per-role redirect URL configuration with enable/disable toggle.
* Secure redirect validation using `wp_validate_redirect()`.
* Administrator bypass — empty URL defers to WordPress default.
* Fully internationalised with `learndash-after-login` text domain.
* Default Fallback URL for unmatched roles.

== Credits ==

Developed by Wellington Duarte (https://learndashdev.com/) — LearnDash Dev.
