=== Cleo Payments for WooCommerce ===
Contributors: cleodevs
Tags: woocommerce, payments, bnpl, buy now pay later, chile
Requires at least: 6.9
Tested up to: 7.1
Requires PHP: 8.1
Requires Plugins: woocommerce
WC requires at least: 8.2
WC tested up to: 8.2
Stable tag: 1.1.12
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html

Adds Cleo as a Buy Now, Pay Later (BNPL) payment method to your WooCommerce checkout.

== Description ==

Cleo Payments for WooCommerce integrates Cleo/Sweetpay's BNPL payment method into your
WooCommerce checkout. It lets your customers pay in 14 days, 30 days, or 3 installments,
without a credit card.

The plugin creates a checkout session with the Cleo API, redirects the customer to complete
payment off-site, and automatically updates the order status in WooCommerce via confirmation
callbacks.

= Supported markets and currencies =

* Chile — CLP

This version only supports Chile (CLP). The payment method is only enabled when the store's
configured currency is CLP.

= Features =

* Test mode and live mode with independent credentials.
* Optional HMAC signature verification for payment confirmation callbacks (see the security
  section below).
* "Payment Method" column in the admin order list.

= Callback security =

Payment confirmation callbacks can be verified with an HMAC signature shared with Cleo. This
verification is **enabled by default** on new installs. Confirm the signature header name and
shared secret for your account with your Cleo integration contact under Settings → Cleo →
"Enforce Webhook Signature".

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/`, or install it from the WordPress admin
   (Plugins → Add New → Upload Plugin).
2. Activate the plugin from the 'Plugins' menu.
3. Go to WooCommerce → Settings → Payments → Cleo te fía! to configure your credentials.
4. Enter your MerchantID and Auth Token (test or live, depending on the mode) and select your
   country.
5. Enable the payment method.

== Frequently Asked Questions ==

= Which currencies does Cleo support? =

CLP. The payment method is automatically hidden if your store's currency isn't CLP.

= How do I test checkout before going live? =

Enable "Test mode" in the gateway settings and enter your test credentials (Test MerchantID /
Test Auth Token). Test mode transactions don't process real payments.

= The confirmation callback isn't updating the order status =

Check that `https://your-site.com/wc-api/sweetpay_payment_success` is publicly reachable (no
firewall/WAF blocking it), and that, if you enabled "Enforce Webhook Signature", the configured
header and secret match exactly what Cleo sends.

== Screenshots ==

1. Checkout with Cleo as a payment method.
2. Installing the plugin by uploading the .zip file.
3. Order detail for an order paid with Cleo (use case 1).
4. Order detail for an order paid with Cleo (use case 2).

== External services ==

This plugin connects to the Cleo API to offer Buy Now, Pay Later as a payment method at checkout.

It sends order data to Cleo (amount, order items, and the customer's billing contact/address
details from checkout) when the customer selects Cleo and starts the checkout session. Cleo then
redirects the customer back to your store and sends a payment confirmation callback to update the
order status — no data is sent to Cleo outside of these two moments.

This service is provided by Cleo (Chile): [Terms and Conditions](https://cleo.cl/terminos-y-condiciones),
[Privacy Policy](https://cleo.cl/politicas-de-privacidad-del-sitio).

== Changelog ==

= 1.1.12 =
* Added a local fallback for the payment method icon, used automatically if the remote logo
  doesn't load, in both classic checkout and the Cart/Checkout Block.
* Adjusted the checkout icon sizing so it reads clearly without stretching the payment row.
* Order notes now include installment details (amounts, due dates) when Cleo confirms a payment.

= 1.1.11 =
* Added extra integrity checks so payment confirmation callbacks are verified against the order
  before being applied.
* Never mark an already-paid order as failed from a late or duplicate Cleo failure callback.
* Enforce webhook signatures by default on new installs.
* Send the order total to Cleo as an integer CLP amount.
* Set `has_fields` to false (redirect-only checkout, no empty payment box).
* Delete `woocommerce_cleo_settings` (live/test tokens and webhook secrets) on uninstall.

= 1.1.10 =
* Failed checkout now redirects to the same order's pay page (`order-pay`) instead of an empty checkout.
* Session-status fallback runs on `woocommerce_before_thankyou` so the thank-you page already shows the paid status.
* Success/failure callbacks always return HTTP 200 and exit, so Cleo does not retry against a rendered HTML page.
* Paid orders are completed with `payment_complete()` only (no manual `reduce_order_stock()`).
* Treat `order_already_paid` as success and send the shopper to the thank-you page.
* Surface real Cleo API errors (HTTP status, timeout vs `detail`/`error`, invalid phone).
* Reject checkouts below the CLP $1.000 minimum before calling the API.
* Title and description are editable in gateway settings.
* Warn in admin when a `sk_test_` / `sk_live_` token does not match Test mode.
* Updated the payment method icon URL shown at classic checkout.
* Simplified the Cart/Checkout Block payment method row to a text label (removed the custom icon rendering there).

= 1.1.8 =
* Fixed the Chile session-creation endpoint path (`/checkout/v1/sessions`).
* Added a fallback on the thank-you page (`woocommerce_thankyou`): if the payment confirmation
  webhook hasn't arrived yet, the order status is confirmed by querying the session directly.
* Updated the payment method icon URL.

= 1.1.7 =
* Fixed a fatal error in Store API / Cart-Checkout Block checkout: `process_payment()` returned
  null on several failure paths (missing credentials, unresolved API host, non-OK API response,
  failed request) instead of the array WooCommerce expects, crashing `array_merge()` inside
  `StoreApi\Legacy` on PHP 8.
* Declared several gateway properties explicitly (`testmode`, `merchant_id`, `auth_token`,
  `country_code`, `api_host`, etc.) to remove PHP 8.2+ "dynamic property" deprecation warnings.

= 1.1.6 =
* Fixed a packaging issue from the 1.1.4 build that left a stray `require_once` pointing at a
  file not included in the release, causing a fatal error on `wp-admin` right after upgrading.

= 1.1.4 =
* Sanitized webhook callback data before storing it in order meta.
* Scoped supported markets to Chile (CLP) only.
* Added the `Requires Plugins: woocommerce` header.
* Fixed the `Contributors` field to match the WordPress.org account.
* Documented the Cleo API as an external service, with links to its Terms and Privacy Policy.

= 1.1.3 =
* Removed the `Plugin URI` header (was identical to `Author URI`, flagged by the WordPress.org
  submission form as an error — both must be different or only one provided).

= 1.1.2 =
* Removed a hardcoded fallback API key. The gateway is now disabled at checkout if no real
  merchant credentials are configured, instead of falling back to a generic embedded key.

= 1.1.1 =
* Renamed the plugin (name and slug) to comply with the WordPress.org trademark policy.
* Removed the unused `i18n` class (`load_plugin_textdomain()` is discouraged since WP 4.6).
* Fixed remaining Plugin Check warnings: unescaped output, missing translators comments,
  missing direct-access guards, non-prefixed global function names, and nonce-verification
  false positives on webhook callbacks (documented with `phpcs:ignore`, not worked around with
  a fake nonce).

= 1.1.0 =
* High-Performance Order Storage (HPOS) compatibility.
* Support for the WooCommerce Cart/Checkout Block.
* Fixed HMAC callback signature verification to match the API's real format and enabled
  `sign_callback` when creating a session.
* Fixed the `Authorization` header (was missing the `Bearer` prefix).
* Deduplication of callbacks retried by Cleo (avoids reprocessing the same confirmation).
* Removed unused code and fixed non-translatable strings.

= 1.0.0 =
* Initial integration of Cleo/Sweetpay's BNPL payment method into WooCommerce.
* Test/live mode support with independent credentials per mode.
* Optional HMAC signature verification for payment confirmation callbacks.

== Upgrade Notice ==

= 1.1.12 =
Checkout icon reliability and payment detail improvements: the payment method icon now falls
back to a bundled image if the remote logo doesn't load, and paid orders show installment
details in their notes. No action required.

= 1.1.11 =
Security hardening: added extra integrity checks on payment confirmation callbacks, webhook
signatures are enforced by default on new installs, and uninstalling now removes saved
credentials. Update recommended.

= 1.1.10 =
Improves checkout reliability: confirms payment status on the thank-you page if the webhook is
delayed, sends failed checkouts back to the order-pay page instead of an empty cart, surfaces
real Cleo API errors, and rejects checkouts below the $1.000 CLP minimum. Update recommended.

= 1.1.8 =
Fixes the Chile session-creation endpoint and adds a fallback that confirms payment status
directly if the confirmation webhook is delayed or never arrives.

= 1.1.7 =
Fixes a fatal error on checkout when using the Cart/Checkout Block (Store API): failed payments
returned null instead of an array, crashing on PHP 8. Update recommended for all Block checkout users.

= 1.1.6 =
Fixes a fatal error that could break wp-admin after upgrading to 1.1.4 (a stray require pointed
at a file missing from that release). Update recommended if you upgraded to 1.1.4.

= 1.1.4 =
Scopes supported markets to Chile (CLP) only, sanitizes webhook callback data, and adds
external-services documentation required by WordPress.org.

= 1.1.2 =
Removes a hardcoded fallback API key. If the gateway was enabled without configuring real
credentials, it will now stay hidden at checkout until you enter them.

= 1.1.1 =
Plugin renamed to comply with the WordPress.org trademark policy. If upgrading from 1.1.0,
deactivate and delete the old plugin folder, then install this one — your settings are kept.

= 1.1.0 =
Fixes a possible API authentication bug (Authorization header) and adds HPOS and
Cart/Checkout Block compatibility. Update recommended.

= 1.0.0 =
First published version.
