=== FlexiLay Gateway for WooCommerce ===
Contributors: flexilay
Tags: layby, laybuy, payment plan, installment payments, woocommerce payment gateway, buy now pay later, stripe payment plan
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.3.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept FlexiLay lay-by / instalment plans via WooCommerce. Customers pay a deposit and complete instalments before goods are supplied.

== Description ==

FlexiLay is a **lay-by / instalment scheduling platform** for WooCommerce.

This plugin adds FlexiLay as a payment option at checkout, allowing customers to:
- Pay an upfront deposit
- Schedule the remaining balance over time
- Complete all payments **before order fulfilment**

FlexiLay is **not a credit product** and **does not provide lending or Buy Now Pay Later (BNPL)** services. Orders should only be fulfilled once payment is completed in full.

### Key features

- Native WooCommerce payment gateway
- Secure merchant registration and pairing
- Deposit + instalment scheduling
- Order placed on hold until payment completion
- Native FlexiLay merchant admin screens inside WordPress
- Works alongside existing payment methods
- No funds held by FlexiLay
- GPL-compatible and translation-ready

== Privacy ==

This plugin connects your store to FlexiLay to create and manage lay-by payment plans.

### Data sent to FlexiLay
When customers choose FlexiLay at checkout, the plugin sends the order and customer details required to create a payment plan (for example: order totals, line items, and contact details) to your configured FlexiLay API endpoint.

### Support Chat (Crisp)
If you enable Support Chat (Crisp) in the FlexiLay Settings screen, the plugin loads Crisp’s script on FlexiLay admin pages only. The plugin tags the Crisp session with your store shop domain for support context. No personal customer data is sent to Crisp by the plugin.

Please ensure your store’s privacy policy discloses any third-party services you enable.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/`
2. Activate the plugin through **Plugins → Installed Plugins**
3. Ensure **WooCommerce** is installed and active
4. Go to **WooCommerce → Settings → Payments**
5. Enable **FlexiLay Gateway**
6. Enter your FlexiLay API URL and Shop Identifier
7. Save settings and wait for store approval
8. Once approved, save again to complete pairing

A **FlexiLay** menu item will appear in WooCommerce admin once installed.

== Frequently Asked Questions ==

= What is FlexiLay? =
FlexiLay is a **lay-buy / instalment scheduling platform** that allows customers to pay a deposit and complete the remaining payments over time **before goods are supplied**.

FlexiLay does not provide credit and is not a BNPL service.

---

= Does FlexiLay hold or process customer funds? =
No. FlexiLay **does not hold, store, or move customer funds**.

FlexiLay facilitates payment scheduling only. Payments are processed directly by the merchant’s connected payment gateway (such as Stripe).

---

= How does the WooCommerce checkout flow work? =
1. Customer selects **FlexiLay** at checkout
2. WooCommerce creates the order and places it **on hold**
3. Customer is redirected to FlexiLay to:
   - Choose a deposit
   - Select instalment frequency
   - Confirm their payment plan
4. Customer completes all payments externally via FlexiLay
5. Merchant fulfils the order once payment is complete

---

= What order status does FlexiLay use? =
Orders are placed into **“On hold”** while the FlexiLay plan is active.

This prevents fulfilment until payment is completed.

---

= Does FlexiLay support deposits and partial payments? =
Yes. Customers can:
- Pay a flexible deposit
- Schedule instalments weekly, fortnightly, or monthly
- Complete the plan early if supported by the merchant configuration

---

= Why is my store waiting for approval? =
When you first save the FlexiLay settings, your store is registered with FlexiLay and marked as **pending approval**.

Once approved in the FlexiLay admin, saving the settings again will automatically retrieve your API key.

---

= Why is the payment method disabled after saving settings? =
The gateway disables itself automatically if:
- Required settings are missing
- The FlexiLay server cannot be reached
- The store is not yet approved
- An API key has not been issued

This prevents broken checkout experiences.

---

= Where do I manage my FlexiLay account? =
After installation, a **FlexiLay** menu appears in WooCommerce admin.

This opens the FlexiLay merchant admin screens inside WordPress, where you can:
- Complete onboarding
- Connect a payment gateway
- View plans and balances
- Manage merchant settings

---

= Is customer data sent to FlexiLay? =
Only the minimum data required to create a payment plan is sent, including:
- Customer name
- Email address
- Phone number (if provided)
- Order totals and line items
- Shipping address (for reference only)

No WordPress credentials are shared.

---

= Does FlexiLay work with subscriptions? =
No. FlexiLay is designed for lay-buy style purchases where goods are supplied **after payment completion**.

---

= Can FlexiLay be used for digital products or services? =
FlexiLay is best suited to goods or services delivered **after payment completion**.

Merchants are responsible for ensuring their usage complies with local consumer law.

---

= What currencies are supported? =
FlexiLay uses the store currency configured in WooCommerce.

Supported currencies depend on the connected payment gateway.

---

= Does FlexiLay replace my existing payment gateway? =
No. FlexiLay runs alongside other WooCommerce payment methods.

---

= What happens if FlexiLay is unavailable? =
If the FlexiLay API cannot be reached:
- Checkout will display an error
- The order will not proceed
- No payment will be taken

---

= Is FlexiLay a Buy Now Pay Later (BNPL) service? =
No. FlexiLay is a **lay-buy platform**, not a lending product.

---

= Is this plugin compliant with WordPress.org guidelines? =
Yes. This plugin:
- Is licensed under GPL v2 or later
- Uses WordPress APIs and security best practices
- Escapes output correctly
- Supports translation
- Does not bundle third-party SDKs improperly

---

= Where can I get support? =
Support is available at:
https://flexilay.com/

== Screenshots ==

1. Welcome to Flexilay
2. FlexiLay Onboarding View
3. FlexiLay payment option at WooCommerce checkout
4. Customer Payment Success Page
5. FlexiLay Merchant Admin Plan View
6. Customer Plan Details in Admin View

== Changelog ==

= 1.3.1 =
* **Compatibility:** Verified against WordPress 7.0 ("Tested up to" bumped to 7.0).
* No functional changes from 1.3.0.

= 1.3.0 =
* **Security:** Added HMAC-SHA256 webhook signature verification for all incoming plan status updates from FlexiLay backend
* **Security:** Enforced HTTPS for API base URL in production environments
* **Security:** Added rate limiting on onboarding registration and pairing endpoints
* **Security:** Stripe URL extraction now validates URL starts with https://connect.stripe.com/
* **Security:** Removed deprecated order_set_status endpoint — order status now managed exclusively via verified webhooks
* **Improvement:** Added comprehensive security event logging (WP_DEBUG_LOG)
* **Improvement:** Enhanced error handling in payment flow — HTTP status codes now properly handled
* **Improvement:** Added X-Flexilay-Api-Key header to draft plan creation for proper API authentication
* **Improvement:** Added merchant pairing check before checkout — prevents customer confusion if merchant not configured
* **Improvement:** Order lifecycle now mirrors Shopify flow: on-hold → processing → completed/cancelled
* **Improvement:** Plan status webhooks add order notes for full audit trail
* **Improvement:** Added WooCommerce minimum version check at runtime (8.0+)
* **Fix:** Refund endpoint now calls correct backend path (/api/plans/{id}/refund)

= 1.2.6.6 =
* Improved legal acceptance save validation in the WooCommerce admin.
* Shows a clear error when FlexiLay accepts the request but does not persist acceptedDocs server-side.
* Version bump for admin onboarding diagnostics.

= 1.2.6.5 =
* Fix onboarding completing before legal documents are saved
* Require Save acceptance before legals count as complete
* Prevent final legal checkbox from jumping to the completion screen before save


= 1.2.6.4 =
* Clear stale local pairing state when a merchant has been deleted and onboarding is started again.
* Stop legal document acceptance from being restored from old browser local storage on a fresh install.
* Normalise onboarding status so Register & Pair, Stripe, and Legals only show complete when the current merchant state supports it.

= 1.2.6.2 =
* Fix onboarding status incorrectly showing as complete
* Fix stale API key causing false registration state
* Improve onboarding step validation (Register & Pair)
* WooCommerce 10.6.2 compatibility update

= 1.2.6.1 =
* Initial onboarding state fix

= 1.2.6.0 =
* Replaced raw admin footer Crisp injection with a proper enqueued admin script.
* Expanded REST plan ID route patterns to support hyphens, underscores, and mixed-case identifiers.
* Prevented signed requests from falling back to an empty secret.
* Added API base URL sanitization and normalization.
* Removed inline admin app container styling from render output.
* Updated readme wording to describe native WordPress admin screens.
* Added an explicit WooCommerce dependency admin notice.
* Removed duplicate ABSPATH guard in the gateway class.
* Refreshed readme metadata and changelog for the current release.

= 1.2.5.0 =
* Previous release.

== Upgrade Notice ==

= 1.2.6.0 =
Maintenance release improving WordPress.org readiness, admin script handling, route compatibility, and configuration hardening.
