# AB Veh Take — Full Plugin Audit Report
**Date:** 2026-10-12 | **PHP:** 8.0.30 (XAMPP) | **Auditor:** Antigravity

---

## ✅ PASSED (Verified Clean)

| Check | Result |
|---|---|
| UTF-8 BOM on all files | ✅ CLEAN — zero BOM bytes found in all 16 files |
| PHP syntax (`php -l`) all 10 PHP files | ✅ No errors on all files |
| JavaScript syntax (`node -c`) all 3 JS files | ✅ No errors |
| Old prefix `avt_` / `AVT_` / `avt-` in code | ✅ None found anywhere |
| Plugin constants use `ABVT_` prefix | ✅ `ABVT_VERSION`, `ABVT_DB_VERSION`, `ABVT_PLUGIN_FILE`, `ABVT_PLUGIN_DIR`, `ABVT_PLUGIN_URL`, `ABVT_TABLE_NAME` — all correct |
| Functions in main file use `abvt_` prefix | ✅ All 6 global functions: `abvt_boot`, `abvt_activate_plugin`, `abvt_load_textdomain`, `abvt_maybe_upgrade_db`, `abvt_register_elementor_widget`, `abvt_register_elementor_category` |
| Classes use `AB_Veh_Take_*` naming | ✅ All 8 classes correct |
| WordPress hooks registered correctly | ✅ `plugins_loaded`, `admin_menu`, `admin_enqueue_scripts`, `wp_enqueue_scripts`, `elementor/widgets/register`, `elementor/elements/categories_registered`, `register_activation_hook` — all correct |
| `ABVT_DATA` JS global localized on `abvt-frontend` | ✅ Correct in `class-ab-veh-take-shortcode.php` |
| AJAX nonces match between PHP and JS | ✅ `ab_veh_take_nonce` issued and verified; `ab_veh_take_availability_nonce` issued and verified |
| AJAX actions use `abvt_` prefix | ✅ `abvt_submit_booking`, `abvt_get_availability`, `abvt_set_availability`, `abvt_set_weekend_availability` |
| `admin_post_` hooks use `abvt_` prefix | ✅ `abvt_save_settings`, `abvt_reset_colors`, `abvt_reset_layout`, `abvt_send_test_email` |
| Text domain is `ab-veh-take` | ✅ Used consistently across all files with `__()`, `_e()`, `esc_html__()`, `esc_html_e()`, `esc_attr__()` |
| `load_plugin_textdomain()` called | ✅ On `plugins_loaded` hook in main file |
| Elementor widget `get_name()` returns `ab-veh-take` | ✅ |
| Elementor widget registered on correct hook | ✅ `elementor/widgets/register` (v3 API) |
| Elementor widget declares `get_style_depends()` / `get_script_depends()` | ✅ Returns `abvt-frontend` for both |
| Shortcode `[ab_veh_take_form]` registered | ✅ |
| Settings option key `ab_veh_take_settings` | ✅ |
| DB tables `ab_veh_take_bookings` / `ab_veh_take_availability` | ✅ |
| `ABSPATH` guard on every PHP file | ✅ All include files guarded |
| `WP_UNINSTALL_PLUGIN` guard in uninstall.php | ✅ |
| readme.txt has required WordPress.org fields | ✅ (after fix) |
| No development/utility scripts in plugin | ✅ (after deletion) |
| CSS custom properties use `--actb-` namespace | ✅ Intentional — these are internal CSS var names tied to HTML markup, not PHP/JS prefixes. HTML markup also uses `actb-` class/id names throughout — this is the plugin's internal UI namespace and is **consistent**. Not a prefix violation. |

---

## 🔴 ISSUES FOUND & FIXED

### 1. `uninstall.php` — Foreign plugin data (**CRITICAL**)
**Problem:** Contained `DROP TABLE` and `delete_option()` calls for three other plugins:
- `need_chauffeur_bookings`, `need_chauffeur_availability`
- `veloride_bookings`, `veloride_availability`
- Options: `need_chauffeur_booking_settings`, `ncb_db_version`, `ncb_theme_v2_migrated`, `veloride_settings`, etc.

**Why critical:** WordPress.org reviewers will reject any plugin that ships code affecting other plugins' data. This is an automatic rejection reason.

**Fix applied:** Removed all foreign table drops and `delete_option()` calls. `uninstall.php` now only cleans `ab_veh_take_*` tables and `ab_veh_take_settings`, `abvt_db_version`, `abvt_theme_v2_migrated`.

---

### 2. `abvt_AVAIL_DATA` — Mixed-case JS global name (**Medium**)
**Problem:** `wp_localize_script()` was emitting a JS global called `abvt_AVAIL_DATA` — a mixed-case name combining a lowercase prefix with an uppercase suffix. WordPress Plugin Check requires JS-localized object names to follow a consistent all-caps convention.

**Fix applied:** Renamed to `ABVT_AVAIL_DATA` (all-caps) in both `class-ab-veh-take-admin.php` and `assets/js/availability-admin.js`.

---

### 3. Duplicate/legacy `ACTB_DATA` and `ACTB_AVAIL_DATA` localize calls (**Medium**)
**Problem:** The shortcode was calling `wp_localize_script()` twice — once for `ABVT_DATA` (correct) and once for `ACTB_DATA` (legacy old-prefix global). Same for availability: both `abvt_AVAIL_DATA` and `ACTB_AVAIL_DATA` were being emitted.

Emitting variables with a different plugin's prefix (`ACTB_`) pollutes the global JS namespace and could cause WP.org rejection for "unique prefix" violations.

**Fix applied:** Removed the `ACTB_DATA` duplicate localize call from shortcode. Removed the `ACTB_AVAIL_DATA` duplicate localize call from admin. Simplified `frontend.js` to not reference dead `ACTB_DATA` fallback.

---

### 4. Admin script/style handles used `actb-` prefix (**Low**)
**Problem:** `wp_enqueue_script('actb-admin', ...)` and `wp_enqueue_script('actb-availability-admin', ...)` used the old `actb-` prefix as the handle name. While WordPress doesn't technically block this, it's inconsistent with the plugin's new `abvt-` prefix and could confuse reviewers.

**Fix applied:** Renamed handles to `abvt-admin` and `abvt-availability-admin`.

---

### 5. Development utility scripts present (**CRITICAL for submission**)
**Problem:** `rename.php` and `fix-upper.php` were left in the plugin root. These are one-off refactoring scripts that should never ship with a plugin. Any reviewer or user who runs them could corrupt plugin files.

**Fix applied:** Deleted both files.

---

### 6. `readme.txt` missing `License URI:` field (**Low**)
**Problem:** The readme header had no `License URI:` line. WordPress.org readme validator requires it. Also, `Tested up to: 7.1` was set to a non-existent WordPress version (latest stable is 6.7 at time of audit).

**Fix applied:** Added `License URI: https://www.gnu.org/licenses/gpl-2.0.html`. Corrected `Tested up to: 6.7`.

---

## ⚠️ REQUIRES MANUAL TESTING (Cannot verify without a live WP environment)

| Item | How to test |
|---|---|
| **Elementor editor loads without JS errors** | Open a page in Elementor editor → Check browser console for errors |
| **AB Veh Take Form widget appears in panel** | Elementor panel → search "AB Veh Take" → should appear under "AB Veh Take" category |
| **Widget renders correctly in editor preview** | Drag widget to canvas → form should render with all 3 steps |
| **Shortcode `[ab_veh_take_form]` renders on frontend** | Create page → add shortcode → preview → check form appears |
| **Booking submission works end-to-end** | Fill form → submit → check booking appears in admin → check emails sent |
| **Availability calendar shows correct dates** | Set some dates in Manage Availability → verify colors on frontend calendar |
| **Settings save correctly** | Save settings → verify changes persist and apply to form |
| **Plugin activate/deactivate/delete cycle** | Install fresh → activate → check DB tables created → deactivate → re-activate → delete → verify clean uninstall |
| **WP Plugin Check tool** | Run from WP admin: Tools → Plugin Check (requires plugin installed on live WP) |

---

## Final Plugin Structure (Clean)

```
ab-veh-take/
├── ab-veh-take.php                           (main, ABVT_ constants, abvt_ functions)
├── uninstall.php                             (FIXED: only ab_veh_take_ cleanup)
├── readme.txt                                (FIXED: License URI, Tested up to)
├── assets/
│   ├── css/admin.css
│   ├── css/frontend.css
│   ├── js/admin.js
│   ├── js/availability-admin.js              (FIXED: uses ABVT_AVAIL_DATA)
│   └── js/frontend.js                        (FIXED: removed dead ACTB_DATA fallback)
└── includes/
    ├── class-ab-veh-take-admin.php           (FIXED: abvt- handles, ABVT_AVAIL_DATA)
    ├── class-ab-veh-take-ajax.php
    ├── class-ab-veh-take-db.php
    ├── class-ab-veh-take-elementor-widget.php
    ├── class-ab-veh-take-emails.php
    ├── class-ab-veh-take-list-table.php
    ├── class-ab-veh-take-settings.php
    └── class-ab-veh-take-shortcode.php       (FIXED: removed ACTB_DATA duplicate)
```