Membership Sync Pro

Syncs WooCommerce Memberships (status, dates, plan, role) between two WordPress sites over a signed REST API call. Install the same plugin on both sites; each one can send, receive, or both.

---

✨ Features

• Sends membership grant/update/cancel events to a remote site in real time
• Hourly safety-net check that only re-sends memberships whose state actually changed (not a full re-sync of everything every hour)
• HMAC-signed requests covering the full payload (status, dates, action - not just email/plan name), with a 5-minute replay window
• Admin settings page (WooCommerce → Membership Sync) for the remote URL, shared secret, and plan/role mapping - no editing PHP to configure a site
• Refuses to overwrite a user's role if they hold a staff-level role (administrator, shop manager, editor, etc.)
• Logs failures via the WooCommerce logger (WooCommerce → Status → Logs)

---

📦 Installation

1. Upload the plugin folder to /wp-content/plugins/membership-sync-pro on both sites
2. Activate on both (requires WooCommerce Memberships active - the plugin will show a notice and do nothing if it isn't)
3. Go to WooCommerce → Membership Sync on each site and configure:
   • The shared secret key (identical on both sites - prefer a MEMBERSHIP_SYNC_SECRET_KEY constant in wp-config.php over storing it in the database)
   • The remote site's sync URL (https://other-site.example.com/wp-json/membership-sync-pro/v1/update)
   • Plan/role mapping, one per line: Remote Plan Name|Local Plan ID|WP Role

A site can be sending-only, receiving-only, or both, via the checkboxes on the settings page.

---

🔒 Security notes

• Requests are authenticated with an HMAC-SHA256 signature covering the email, plan name, status, action, dates, and a timestamp - tampering with any of those invalidates the signature, and requests older than 5 minutes are rejected.
• Signature comparison uses hash_equals() (timing-safe).
• Incoming membership_status values are checked against WooCommerce Memberships' actual set of valid statuses.
• New user accounts (created only if enabled in settings) get a real "set your password" email via wp_new_user_notification() instead of a silent, inaccessible account.
• Role assignment refuses to touch users holding a staff-level role.

---

🧠 Technical Overview

Architecture

• Msync_Settings - settings page and option access (secret key, remote URL, plan/role mapping)
• Msync_Sync - sender hooks, hourly cron safety net, REST receiver, and the re-entrancy guard that stops a site from re-broadcasting a change it just received

Key Hooks Used

wc_memberships_grant_membership_access_from_purchase
wc_memberships_user_membership_saved
wc_memberships_cancelled_user_membership
rest_api_init  (membership-sync-pro/v1/update)

Compatibility

Requirement	Version
WordPress	≥ 5.0
PHP	≥ 7.4
WooCommerce	≥ 5.0
WooCommerce Memberships	required

---

🚀 Future Improvements

• Proper repeater UI for plan/role mapping instead of a pipe-delimited textarea
• In-admin log viewer instead of relying on WooCommerce's own log screen
• Support syncing more than a two-site pair

---

🤝 Contributing

Contributions are welcome! Please open an issue first to discuss what you'd like to change, then submit a pull request.

---

📄 License

This plugin is licensed under the GPL-2.0 License.