=== Mail OAuth & Email Log ===
Contributors: catcodestudio
Tags: oauth, smtp, email log, gmail, microsoft 365
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Send WordPress email through Microsoft 365 or Gmail with OAuth 2.0 and keep a log of every email your site sends. Works on any site.

== Description ==

Microsoft is switching off password (Basic) authentication for SMTP AUTH in Exchange Online; OAuth 2.0 is the supported way. A site that sends from a Microsoft 365 mailbox with a user name and password stops sending — and nobody notices until someone asks why the contact form went quiet.

This plugin sends every WordPress email through your own mailbox with OAuth 2.0 — no password is stored — or through any SMTP server, and keeps a log of every email: contact forms, password resets, comment notifications, anything that goes through wp_mail(). It works on any WordPress site.

= Sending =

* **Microsoft 365 / Outlook.com** with OAuth 2.0: through the Microsoft Graph API (HTTPS — works when the host blocks SMTP ports) or SMTP AUTH with XOAUTH2. Business mailboxes and personal Outlook.com accounts, shared mailboxes in SMTP mode.
* **Google Workspace / Gmail** with OAuth 2.0 through the Gmail API, with the narrowest Gmail permission ("send email on your behalf").
* **Any SMTP server**: your hosting mailbox, Brevo, Mailgun, Amazon SES, Postmark and others.
* You register the app in your own Microsoft Entra / Google Cloud account and sign in once. Tokens go straight from Microsoft or Google to your site; client secrets and tokens are stored encrypted.
* Bcc copies are kept on every connection (Microsoft Graph gets them as real Bcc recipients).
* The From address is aligned with the signed-in mailbox, so Microsoft does not refuse the email and Gmail does not rewrite it. Optional fixed From address and name.
* Send a test email through the saved connection and see the exact error when it fails.

= The connection keeps working =

* Tokens are refreshed once a day even when no email goes out — Microsoft refresh tokens lapse after 90 days without use, Google's after six months.
* Enter the expiry date of the Microsoft client secret and get a warning 14 days before it runs out.
* When a Google connection dies about a week after the sign-in, the plugin tells you why: the Google Cloud app is still in "Testing", where Google ends the sign-in after 7 days.
* Admin notice and a Site Health test when a connection lost its sign-in.

= Email log =

* Every email: date, from, to, Cc, Bcc, subject, which plugin or theme sent it, the connection, the result and the exact error, every attempt.
* View the email as it was sent (HTML in a sandboxed frame, or plain text).
* Filters by result and by sender, search by recipient or subject.
* Retention in days, optional "do not keep the content", a size indicator, "delete the whole log".
* Personal data: Tools → Export Personal Data and Erase Personal Data include the emails addressed to a person, and the privacy policy guide gets a suggested text.
* Only administrators open the log: it holds password-reset links.

// @pro-start
= Pro =

* **Retry queue**: an email that could not be delivered is sent again automatically after 5 min, 15 min, 1 h, 3 h, 12 h… While a connection waits for a new sign-in the emails wait too, and go out the moment you sign in again. The queue runs on WP-Cron: on a site with few visitors an attempt starts with the next visit.
* **Backup connection**: when the main connection fails, the email goes through the backup one (for example your hosting SMTP behind Microsoft 365) — also an email whose attachments are larger than Microsoft Graph (3 MB) or the Gmail upload (5 MB) takes.
* **Alerts by e-mail and Telegram** when an email was not delivered (which email, the error, next attempt), when the queue gives up, when a connection needs a new sign-in or the client secret expires soon. Alerts never go through the broken connection; recipient addresses are masked.
* **Resend** any logged email to the same recipients or to another address.
* 7-day trial on request; licence for 1 to 5 years of updates and support.
// @pro-end

Microsoft, Microsoft 365, Outlook, Microsoft Graph and Microsoft Entra are trademarks of the Microsoft group of companies. Google, Gmail and Google Workspace are trademarks of Google LLC. WooCommerce is a trademark of Automattic Inc. This plugin is an independent integration and is not affiliated with or endorsed by them.

== Installation ==

1. Install and activate the plugin.
2. Open Settings → Mail & Email Log → Connection.
3. Choose Microsoft 365 / Outlook.com, Google Workspace / Gmail or SMTP. For Microsoft and Google, follow the short guide on the screen to register the app, paste the client ID and secret, then click "Save and sign in".
4. Send a test email.

== Frequently Asked Questions ==

= Do I need WooCommerce? =

No. The plugin works on any WordPress site. On a WooCommerce shop it logs and delivers the shop's emails like any others; for an email list on each order there is a separate plugin, Mail OAuth & Email Log for WooCommerce. Use one of the two, not both.

= Do I need a Microsoft 365 or Google Workspace admin? =

Not always. Any user can register an app in their own Microsoft Entra tenant unless the organisation forbids it, and a personal Gmail account can create a Google Cloud project. Some organisations require an administrator to grant consent to the app.

= Graph or SMTP for Microsoft 365? =

Graph is recommended: it uses HTTPS (port 443), needs no "Authenticated SMTP" switch in Exchange and keeps Bcc copies. Use SMTP AUTH (XOAUTH2) when your organisation does not allow the Mail.Send permission, or to send as a shared mailbox.

= Microsoft refuses the email with "SendAsDenied" =

The From address differs from the signed-in mailbox and the account has no "Send As" right for it. Keep "Keep From addresses that differ from the signed-in mailbox" off, or grant the right in Exchange.

= Google stops sending after a week =

Your Google Cloud app is in "Testing". Google ends sign-ins of such apps after 7 days. Publish the app ("In production") and sign in again.

= Is the content of my emails stored? =

Only in your own WordPress database, in the log table, for the number of days you choose — and you can switch keeping the content off. Nothing is sent anywhere except to the mail service you connected. A person's copies are included in Tools → Export Personal Data and removed by Tools → Erase Personal Data.

= Does it work with other SMTP plugins? =

Two mail plugins cannot both deliver WordPress email. The settings screen names any other active mail plugin; keep one of them.

== External services ==

This plugin connects to the services below, and only to the ones you set up.

= Microsoft identity platform (login.microsoftonline.com) =

Used to sign in to Microsoft 365 / Outlook.com and to refresh access tokens: when you click "Save and sign in with Microsoft", when an email is sent with an expired access token, and once a day to keep the sign-in alive. Sent: the application (client) ID and secret you entered, the authorization code, the refresh token and the requested permissions. Terms: https://www.microsoft.com/en-us/servicesagreement/ — Privacy: https://privacy.microsoft.com/en-us/privacystatement

= Microsoft Graph (graph.microsoft.com) and Microsoft 365 SMTP (smtp.office365.com, smtp-mail.outlook.com) =

Every email is sent through Microsoft when a Microsoft connection is selected: recipients, subject, body, attachments and headers of the email. Same terms and privacy statement as above.

= Google OAuth 2.0 (accounts.google.com, oauth2.googleapis.com) =

Used to sign in to Google and to refresh access tokens (sign-in, an expired access token, once a day), and to revoke the token when you sign out. Sent: the client ID and secret you entered, the authorization code, the refresh token and the requested permissions. Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy

= Gmail API (gmail.googleapis.com) =

Every email is sent through the Gmail API when a Google connection is selected: the complete message (recipients, subject, body, attachments, headers). Terms: https://developers.google.com/terms — Privacy: https://policies.google.com/privacy

= Your SMTP server =

With an SMTP connection every email goes to the SMTP server you entered, with the user name and password you entered. Its terms are those of your mail provider.

// @pro-start
= Telegram Bot API (api.telegram.org) — Pro =

Only when Telegram alerts are switched on: the alert text (site name, email subject, masked recipient address, error text and a link to your admin) is sent to the chat you entered, with your bot token. Terms: https://telegram.org/tos — Privacy: https://telegram.org/privacy

= CatCode licence and update server (catcode.com.ua) — Pro =

Checks the licence key (on activation and periodically) and offers updates of the Pro version. Sent: the licence key, the site address and, for the 7-day trial, the e-mail address you entered. Terms and privacy: https://catcode.com.ua/
// @pro-end

== Screenshots ==

1. Email log with filters by result and sender.
2. One email: details, attempts and the content as it was sent.
3. Microsoft 365 connection with the setup guide.

== Changelog ==

= 1.0.0 =
* First release: Microsoft 365 / Outlook.com (Graph or SMTP XOAUTH2) and Google (Gmail API) with OAuth 2.0, SMTP, email log with filters by sender, daily token keep-alive, client secret expiry warning, Site Health test.
// @pro-start
* Pro: retry queue, backup connection, alerts by e-mail and Telegram, resend, licence and updates from catcode.com.ua.
// @pro-end
