=== BDM Digital Payment Gateway ===
Tags: payments, pix, qr code, woocommerce, bdm  
Requires at least: 6.0  
Tested up to: 7.1  
Requires PHP: 7.4  
Stable tag: 1.3.13  
Contributors: bdmmercantil, bdmdigital  
Version: 1.3.13
License: GPLv2 or later  
License URI: https://www.gnu.org/licenses/gpl-2.0.html  

Accept BDM Digital payments in WooCommerce with QR Code, automatic validation, and easy integration.

== Description ==

This plugin allows you to accept payments with the BDM digital currency in your WooCommerce store. It generates QR codes for payments, performs automatic validations, and provides instant confirmations to the customer.

Main features:
* Automatic QR Code generation
* Real-time payment validation
* Compatible with BDM digital wallets
* Direct integration with WooCommerce
* Custom checkout page

== Installation ==

1. Upload the plugin files to the `/wp-content/plugins/` directory or install directly through the WordPress dashboard.
2. Activate the plugin via the "Plugins" menu in WordPress.
3. Make sure WooCommerce is installed and activated.
4. The plugin will automatically create a checkout page (`BDM Checkout`).
5. Configure your integration details under **Settings > BDM Gateway**.

== External services ==

This plugin relies on the BDM Digital partner API (operated by Dourado Cash) to quote the BDM price, issue the payment code (QR Code) and confirm payments. All calls are made from your server and authenticated with the API key you configure; the API key is never sent to the visitor's browser.

* Production: https://partner.douradocash.com.br/
* Sandbox (only when Sandbox Mode is enabled): https://dev-partner.dourado.cash/

What is sent and when:

* When the BDM checkout page loads and when an order is placed: the asset code (e.g. BDM), to fetch the current quotation.
* When an order is placed: your partner e-mail, the order amount in BDM and the order number (as the payment description).
* While the customer waits for the payment: your partner e-mail and the payment code of that order, to check whether it was paid.

No customer personal data (name, address, e-mail, phone) is sent to the API.

== Source JS/CSS ==

jquery.toast.min.js: https://github.com/kamranahmedse/jquery-toast-plugin  
bootstrap.min.css: https://getbootstrap.com/  

== Frequently Asked Questions ==

= Is WooCommerce required? =
Yes. This plugin depends on WooCommerce to function properly.

= Where can I find my BDM integration details? =
You can obtain the integration details from the BDM wallet service or the Dourado Cash platform.

== Screenshots ==

1. Payment screen with QR Code
2. Custom checkout page
3. Settings in the admin panel

== Changelog ==

= 1.3.13 =
* Security: payment confirmation is now verified on the server. The public REST route `bdm_digital_payment_gateway/v1/update-payment`, which allowed unauthenticated requests with empty credentials to mark any order as paid (or failed), was removed. An order is only marked as paid after the server confirms the payment with the BDM Digital API, using the payment code stored on that order, and the paid amount must match the order total. Thanks to the security researchers Enrico Marcolini, Claudio Marchesini and Dottor Marc for the responsible disclosure.
* Security: the partner API key and the REST key/secret are no longer exposed in the checkout page. Quotation, payment code creation and payment status checks now run on the server.
* Security: the order amount is calculated on the server from the WooCommerce cart and the server-side quotation, instead of being sent by the browser.
* Security: removed the AJAX action that allowed overwriting the payment code of any order. Payment status checks require the order key.
* Removed the unused "REST API Key" and "REST API Secret" settings and the unused main.min.js file.
* Paid orders now follow the standard WooCommerce flow (payment_complete): physical products go to Processing, virtual/downloadable ones to Completed.
* Tested up to WordPress 7.1.

= 1.3.12 =
* Added a new Debug Mode checkbox in gateway settings to control BDM frontend logs during troubleshooting.
* Suppressed plugin console.log, console.warn and console.error messages when Debug Mode is disabled, without changing checkout business rules.
* Localized debug_mode to both standard and custom checkout contexts and switched main.js enqueue version to dynamic filemtime cache-busting.

= 1.3.11 =
* Add support for resumable payment links on /bdm-checkout/ via a hashed billing code (bdm_code), without creating a new order.
* Persist billing code hash, QR code image (base64) and creation timestamp on the order to enable resume and status polling.
* Automatically start QR generation when redirected from the standard checkout (bdm_autostart=1) and update the URL to the resumable link once available.

= 1.3.10 =
* Persist the generated billing code on the WooCommerce order after the external API responds.
* Display the billing code on the WooCommerce admin order screen for BDM orders.

= 1.3.9 =
* Removed custom updater routines not allowed in WordPress.org hosted plugins.
* Added nonce validation for shipping method propagation in standard checkout redirect.
* Updated plugin metadata and readme compatibility headers for current WordPress version.
* Improved plugin review compliance with additional input validation and coding standards cleanup.

= 1.3.5 =
* Include shipping totals in the BDM checkout amount and display the shipping line.
* Preserve the selected shipping method when redirecting to the BDM checkout.
* Avoid deprecated warnings by sanitizing empty description/WYSIWYG fields.

= 1.3.4 =
* Restored BDM as a selectable payment method on the standard checkout and redirect users to the custom page only when it’s chosen.

* Improved the custom checkout loading experience with quotation fallback and immediate loading indicator.

= 1.3.3 =

* Standardized plugin changelog and metadata to Portuguese.

* Preparation for release 1.3.3.

= 1.3.2 =
* Adjusted the WYSIWYG field in the settings to enable the save button as soon as there are changes.

* Added a specific script in the admin to detect changes in the editor and notify WooCommerce.

= 1.3.1 =

* Added a WYSIWYG field in the settings to customize the checkout notification.

* The custom checkout template now displays the configured text.

= 1.3.0 =
* Added automatic update system from GitHub releases
* Fixed REST API permission issues for payment updates
* Improved WordPress coding standards compliance
* Enhanced security for API endpoints

= 1.2.7 =
* Fixed database AUTO_INCREMENT issues
* Improved order creation process
* Enhanced error handling

== License ==

This plugin is free software and is licensed under GPLv2 or later.

== Upgrade Notice ==

= 1.3.13 =
Security release: fixes unauthenticated order status manipulation. Update immediately.
