=== Klamra Paycal for Aspaclaria ===
Contributors: klamra22
Tags: apple pay, woocommerce, checkout, payments, payment gateway
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 1.4.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect WooCommerce to PayCal branded checkout, Apple Pay readiness, payment-management tools and approved payment providers.

== Description ==

**PayCal** is a branded checkout and payment-management platform for WooCommerce stores built for creative businesses.

The plugin connects a merchant's WooCommerce store to PayCal Platform, where WooCommerce checkout, hosted checkout sessions, merchant settings, License Token validation and approved payment-provider connections are managed.

### Features

* Connect WooCommerce checkout to PayCal
* Prepare Apple Pay and hosted checkout experiences
* Use PayCal branded hosted checkout
* Manage merchant connection and License Token validation
* Connect to approved payment-provider configurations
* Support payment-management workflows for creative businesses

PayCal helps merchants manage checkout and payment context. It does not replace the merchant's payment provider, does not act as a bank or seller of record, and does not store card details.

External service disclosure: this plugin connects the merchant's WooCommerce store to PayCal Platform, an external PayCal service required for hosted checkout, payment verification, connector synchronization, optional license validation, connector event diagnostics and the read-only merchant payments dashboard. The plugin sends order/payment context needed to create or verify PayCal checkout sessions, merchant connector identifiers, public key/access token authentication headers, plugin/site metadata for connector health, optional license token data, and read-only dashboard requests for the authenticated merchant. It connects to the PayCal Platform URL configured in the plugin settings and to PayCal hosted checkout domains such as `https://paycal.online` and merchant-specific PayCal checkout domains configured by the store. PayCal service details are available in the PayCal Privacy Policy and Regulations / Terms:

* Privacy Policy: https://paycal.online/privacy-policy/
* Regulations / Terms: https://paycal.online/regulations/

== Installation ==

1. Upload the plugin files to `/wp-content/plugins/klamra-paycal-for-aspaclaria`
2. Activate the plugin through the **Plugins** menu in WordPress
3. Go to **WooCommerce → Payments**
4. Enable **PayCal**
5. Configure your PayCal settings

== Frequently Asked Questions ==

= Does this plugin require WooCommerce? =

Yes. WooCommerce must be installed and activated.

= What payment methods are supported? =

The plugin connects WooCommerce to PayCal Platform and approved payment-provider configurations. Available payment methods, including Apple Pay where enabled, depend on the merchant's approved provider setup.

= Is the plugin easy to configure? =

Yes. The plugin integrates directly with WooCommerce and requires minimal setup.

== Screenshots ==

1. PayCal settings inside WooCommerce
2. PayCal payment option at WooCommerce checkout
3. Guided merchant connection and License Token setup
4. PayCal Payments read-only Merchant Dashboard with recent payments and settlement totals
5. WooCommerce admin menu entry for PayCal Payments

== Changelog ==

= 1.4.2 =
* WordPress.org compliance release candidate: tightened escaping, request sanitization, debug logging and external-service disclosure.
* Displays PayCal Payments dashboard timestamps in the WordPress site timezone.
* Keeps hosted checkout, payment verification, order status handling, connector credentials and merchant dashboard API behavior unchanged.

= 1.4.1 =
* Hardened PayCal Payments refresh so manual Refresh always performs a fresh Platform fetch and replaces the previous dashboard cache.
* Added no-cache request headers and a refresh cache-buster for the read-only merchant dashboard fetch.
* Keeps Platform-unavailable fallback limited to the last successful fetch and leaves checkout/payment flow unchanged.

= 1.4.0 =
* Added WooCommerce → PayCal Payments read-only merchant dashboard.
* Pulls Ledger, Settlement and Reconciliation data from PayCal Platform through the authenticated merchant dashboard API.
* Adds short-lived dashboard caching and last-good fallback when PayCal Platform is temporarily unavailable.
* Does not create local Ledger or Settlement tables and does not change checkout, payment verification, refunds or money movement.

= 1.3.1 =
* Tested with WordPress 7.1.
* Reviewed admin UI, JavaScript, media picker and editor compatibility with WordPress 7.1.
* Verified existing PayCal connections, License Token data and connector settings remain unchanged during update.
* Verified WooCommerce hosted checkout, payment verification and HPOS admin-link compatibility.
* No changes to existing merchant credentials, terminal IDs, tokens, API endpoints or payment protocol.

= 1.3.0 =
* Security hardening release: strengthened hosted checkout sessions, server-side verification, merchant isolation, webhook idempotency, sanitized logs, and safer customer-facing errors.
* Improved WooCommerce order completion by passing the verified PayCal payment ID as the WooCommerce transaction ID after successful hosted checkout verification.
* Added cleaner private order notes for successful verification, failed verification, and expired sessions.

= 1.2.9 =
* Improved WooCommerce order completion by passing the verified PayCal payment ID as the WooCommerce transaction ID after successful hosted checkout verification.
* Hardened hosted checkout return handling so the success confirmation is shown only after server-to-server verification confirms the order is paid.
* Sanitizes hosted return request values and keeps failed verification details in private order notes or logs only.
* No UI/admin design, merchant connection, license behavior, checkout.paycal.online session flow, WooCommerce email logic, or payment status rules changed.

= 1.2.8 =
* Fixed old hosted checkout customer return after successful Apple Pay payment.
* wc-api=paycal_hosted_return now serves a no-cache HTML transition page after successful verification.
* Prevents legacy template_redirect handler from interfering with the dedicated wc-api return handler.
* Removes pending Location headers and returns HTTP 200 before outputting the transition page.
* Adds response mode diagnostics for hosted return: html_transition.
* No payment verification, payment_complete, order status, checkout.paycal.online, capture logic, or forced completed status changed.

= 1.2.7 =
* Improved successful old hosted checkout return experience.
* After successful verification, wc-api=paycal_hosted_return serves a no-cache confirmation transition page from the store domain.
* The transition page redirects customers to the WooCommerce order-received URL using window.location.replace(), with meta refresh and fallback link.
* Preserves existing merchant connection and license data across plugin updates/replacements.
* uninstall.php now preserves PayCal connection/license/invoice data by default.
* Data is removed only when paycal_remove_data_on_uninstall is explicitly set to yes.
* Adds connection persistence diagnostics for settings, license data, merchant ID, terminal ID, public key, sync state, and plugin basename changes.
* Avoids marking license invalid on temporary API/HTTP/malformed-response failures.
* No payment verification, checkout.paycal.online session flow, capture logic, or forced completed status changed.

= 1.2.6 =
* Added explicit order save after successful PayCal hosted checkout verification and payment_complete().
* Confirmed hosted return redirects to the WooCommerce order-received URL after verification.
* Keeps WooCommerce email hooks intact and does not suppress order emails.
* No checkout.paycal.online session flow, capture logic, or forced completed status changed.

= 1.2.5 =
* Added explicit order save after successful PayCal hosted checkout verification and payment_complete().
* Confirmed hosted return redirects to the WooCommerce order-received URL after verification.
* Keeps WooCommerce email hooks intact and does not suppress order emails.
* No checkout.paycal.online session flow, capture logic, or forced completed status changed.

= 1.2.4 =
* Fixed old pay.aspaclaria.co.il hosted checkout return bridge.
* Added dedicated WooCommerce API return endpoint for PayCal hosted checkout returns.
* Old hosted checkout now returns through wc-api=paycal_hosted_return so server-to-server verification runs reliably.
* Redirects customers to the clean WooCommerce order-received URL after successful verification.
* Preserves backward compatibility with existing template_redirect return handling.
* No new checkout.paycal.online session flow, capture logic, or forced completed status changed.

= 1.2.3 =
* Added return verification support for generic PayCal checkout sessions.
* Connector now sends the latest pcs_ checkout session ID to server-to-server verification.
* Avoids duplicate failed verification notes on repeated return handling.
* No old hosted checkout behavior, capture logic, or forced completed status changed.

= 1.2.2 =
* Improved PayCal Apple Pay private WooCommerce approval notes using existing verification values.
* Added cleaner payment evidence summary for approved PayCal orders.
* Avoids duplicate approval notes for the same PayCal payment ID.
* No checkout flow, capture logic, or order status logic changed.

= 1.2.1 =
* Added planned PayCal Order Evidence Log roadmap UI to the Marketplace/Bundles admin page.
* Reframed shipping evidence as a synchronized order evidence layer between merchant, customer, and PayCal.
* Added planned timeline/status copy for order handling, customer updates, delivery proof, and digital/service fulfillment.
* Improved Hebrew PayCal connector wording using ל־PayCal / ו־PayCal / ב־PayCal.
* No payment flow, checkout logic, capture logic, provider sync, persistence, uploads, or order status logic changed.

= 1.2.0 =
* Demo-ready merchant wording.
* Generic merchant positioning.
* License Token wording consistency.
* Test connection / sync wording.
* Connector event reporting for merchant onboarding.
* Safe provider wording.
* No payment flow changes.

= 1.1.9 =
* Added an opt-in checkout.paycal.online session redirect with safe fallback to the existing hosted checkout flow.
* Clarified demo-ready admin wording for PayCal checkout, payment-management and approved provider connections.
* Existing Apple Pay, payment processing, return handling, verification, and WooCommerce order status behavior remain unchanged.

= 1.1.8 =
* UI polish release.
* Refined PayCal dashboard hero, cards, badges, stats, and quick actions.
* Improved Dragon Shield artwork placement.
* Polished Marketplace / Bundles page layout.
* Improved ornate golden lock artwork placement.
* Preserved checkout, payment processing, Apple Pay, licensing, sync, connector behavior, and WooCommerce order status logic.

= 1.1.7 =
* Design fixes release.
* Added PayCal dashboard hero artwork with an updated transparent Dragon Shield brand image.
* Added Marketplace / Bundles hero artwork with an updated transparent ornate golden lock illustration.
* Refined dashboard and bundles page visuals for a cleaner premium branded experience.
* Switched dashboard artwork to cache-busting clean asset filenames.


= 1.1.6 =
* Added License Token validation against the configured PayCal Platform endpoint.

= 1.1.5 =
* Security: Restricted invoice downloads to the owning customer or authorized shop managers. Added nonce validation, invoice post type validation, linked order validation, and capability checks for the PayCal invoice download endpoint.

= 1.1.4 =
* WordPress 7 safety hardening release: guarded loading, safer API failure handling, admin visibility, sanitized logging, and tested with PHP 8.3.31 / hardened for PHP 8.3.31 without payment-flow changes.

= 1.1.2 =
* Production release based on the live WordPress.com plugin export.
* Version bump for WordPress.org update distribution.

= 1.0.6 =
* Hardening release: safe loading for missing files and fallback permissions module.

= 1.0.4 =
* Added a permissions management screen for PayCal administrators
* Kept plugin structure aligned with version 1.0.3 for WordPress.org consistency
* Enforced saved permissions across Dashboard, Bit, Invoices, License and Setup screens
* Improved README version consistency
* Locked the permissions screen to a single owner admin with an extra access code

= 1.0.3 =
* Tested with WordPress 6.9.4
* Improvements and small fixes

= 1.0.2 =
* Initial improvements

== PayCal Connector ==
This version is the customer-side connector. Merchant and terminal administration is handled in the PayCal platform.


== Hosted Checkout Gateway ==
Version 1.3.1 includes the customer-side hosted WooCommerce gateway. Apple Pay provisioning remains in PayCal Platform and is synced by Merchant ID, Terminal ID, Public Key and Token.
