Watan User Panel

English | فارسی

A standalone WordPress plugin for a modern Persian RTL customer dashboard with subscriptions, movie requests, wishlists, support tickets, announcements, personalization, referrals, and income management.

This is the reviewable portfolio edition of the Watan Film user panel. It contains no payment credentials, production configuration, customer records, or redistributable proprietary fonts.

Overview

Watan User Panel brings the customer lifecycle into one responsive application-style interface. It creates the required public pages on activation, stores each user's data separately, and provides a dedicated WordPress administration area for the operational workflows.

• Version: 2.0.1
• WordPress: 6.0+
• PHP: 7.4+
• Interface: Persian (RTL)
• License: GPL-2.0-or-later
• Payment gateways: Zibal and Zarinpal

Features

User dashboard

• Responsive glassmorphism dashboard for desktop and mobile
• Subscription status and remaining-day display
• Request, wishlist, ticket, notification, and income metrics
• Animated statistic cards and mobile drawer navigation
• User-specific title, color, font stack, background, and icon preferences

Subscriptions and payments

• Fixed monthly and multi-month plans
• Duration, discount, movie-request quota, and referral-code quota per plan
• User-built custom plans with live price calculation
• Configurable unit prices and maximum quantities
• Manual subscription grants, extensions, freezes, unfreezes, and cancellation
• Zibal and Zarinpal purchase callbacks with gateway-response audit metadata
• Automatic active-subscriber role synchronization

Movie requests and wishlists

• Customer movie-request submission and status tracking
• Administrator review, notes, status changes, and published-content links
• Account-based movie and article wishlists
• Reusable favorite-button shortcode

Support and announcements

• Ticket creation, threaded replies, priorities, departments, and open/closed state
• Dedicated administrator ticket workflow with pagination
• Broadcast or user-specific announcements
• In-panel notification popups and read tracking

Personalization

• Per-user panel title and accent color
• System-safe font choices
• Custom background upload, compression, preview, and removal
• Six selectable SVG icon styles plus the default set
• Consistent icons across navigation, metrics, favorites, and actions

Referrals and income

• User referral codes and configurable registration rewards
• Movie-specific income links
• Registered-view and completion-event accounting
• Current balance, approved income, and referral metrics
• Cashout requests and administrator settlement workflow

Administration

• Dedicated Watan User Panel menu
• Overview charts and operational counters
• Plans, subscribers, orders, movie requests, tickets, income, and announcements
• Card-based responsive management interface
• Gateway, referral-reward, custom-pricing, and access settings

Security design

• Every state-changing form or AJAX action uses a WordPress nonce.
• Administrative actions require manage_options; customer records are scoped to the signed-in user.
• Login and registration failures are rate-limited, and authentication errors avoid account enumeration.
• Registration and profile updates validate Iranian mobile numbers, unique email/mobile ownership, and password strength.
• Avatar and background uploads validate upload state, size, extension, detected MIME type, dimensions, and pixel count before using random filenames.
• Managed-file deletion verifies that the resolved path remains inside the expected upload directory.
• Payment callbacks are bound to the stored gateway transaction identifier, use timing-safe comparison, verify with the gateway, and atomically claim a pending payment before granting access.
• A unique payment identifier prevents the same purchase from granting duplicate subscriptions.
• Subscription quota consumption and referral/income rewards use conditional or unique database operations to prevent race-condition overuse.
• Cashout amounts are atomically reserved when requested; rejection refunds the reservation, while legacy pending requests retain conditional settlement handling.
• External Chart.js is version-pinned and loaded with Subresource Integrity.
• The plugin never stores payment merchant identifiers in source code. Configure them only in WordPress administration.

See SECURITY.md for vulnerability reporting and deployment guidance.

Installation

1. Copy the watan-user-panel directory to wp-content/plugins/, or upload a release ZIP from Plugins → Add New → Upload Plugin.
2. Activate Watan User Panel.
3. Confirm that /panel/, /watan-login/, and /watan-subscription/ were created.
4. Configure plans and custom pricing under Watan User Panel → Subscriptions.
5. Configure one payment gateway under Watan User Panel → Settings.
6. Test registration, a sandbox payment, quota use, ticket replies, and uploads on a staging site before production.

Activation creates two sample subscription plans. Review their prices and quotas before accepting orders.

Shortcodes

[watan_auth]
[watan_user_panel]
[watan_subscription_plans]
[watan_favorite_button]

Favorite-button examples:

[watan_favorite_button post_id="123" type="movie"]
[watan_favorite_button post_id="456" type="article" label="Save"]

Only movie and article are accepted as favorite types.

Theme/content integration

The panel can run on a standard WordPress site. Movie search, movie-specific favorite buttons, and referral-view tracking expect the site to provide a public custom post type named movie. That post type belongs to the theme or content plugin and is intentionally not registered here.

The automatically created authentication and subscription pages request the elementor_canvas template when available. A different page template may be selected later; upgrades do not forcibly republish pages or overwrite a non-empty page body.

Project structure

watan-user-panel.php       Plugin bootstrap, domain logic, UI, and admin handlers
assets/css/                Frontend and administration styles
assets/js/                 Frontend and administration interactions
assets/icons/              Default SVGs and six alternate icon sets
assets/fonts/index.php     Directory guard; third-party font binaries are excluded
.github/workflows/ci.yml   PHP, JavaScript, and potential-secret checks

Data and privacy

The plugin stores profile fields, subscriptions, payments, requests, wishlists, tickets, notifications, referrals, income events, balances, personalization settings, and payout-account details in WordPress user metadata and custom database tables. Site operators are responsible for a lawful privacy notice, access policy, retention period, backups, and user-data export/deletion procedures appropriate to their jurisdiction.

Avatar and panel-background images are stored in public WordPress upload directories. Do not upload private documents or sensitive images. The plugin limits and validates images, but public media URLs should be treated as discoverable.

Referral attribution uses a first-party HttpOnly, SameSite=Lax cookie. Payment processing sends the required transaction data to the selected gateway. Disclose those data flows in the site's privacy policy.

Fonts and third-party assets

The original private package contained font binaries without clear redistribution evidence. They are intentionally excluded from this public repository, and the UI uses system font stacks. A site owner may load separately licensed fonts through the theme or another compliant integration.

Chart.js 4.4.4 is loaded from jsDelivr only on the plugin dashboard and protected with an integrity hash. The SVG icon assets are part of this project.

Development and verification

Lint every PHP file:

find . -type f -name '*.php' -print0 | xargs -0 -n1 php -l

Check JavaScript syntax:

node --check assets/js/admin.js
node --check assets/js/frontend.js

GitHub Actions performs the same syntax checks and scans tracked files for potential secrets.

Release notes

See CHANGELOG.md.

License

Released under GPL-2.0-or-later.