=== S4D Payment Gateway with Thawani for WooCommerce ===
Contributors: phpawcom, s4d
Tags: woocommerce, payment-gateway, thawani, oman, omr
Requires at least: 6.2
Tested up to: 7.0
Requires PHP: 8.1
Stable tag: 2.0.4
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept Visa and MasterCard payments on WooCommerce stores via Thawani Pay.

== Description ==

Originally a paid plugin developed by The Source for Development (https://www.s4d.om), rewritten with Claude Code and released as open source.

Features:

* Hosted Thawani checkout — customers redirect to Thawani's secure checkout page; PCI scope stays with Thawani.
* Saved cards — logged-in customers can tokenize cards on Thawani and reuse them at checkout.
* Refunds — full refunds from the WooCommerce admin (Thawani does not support partial refunds).
* Webhooks — optional server-to-server endpoint so payment status syncs even if the customer closes the page before redirect. Optional HMAC-SHA256 signature verification.
* WooCommerce Blocks support and HPOS compatibility.
* Currency conversion hook (thawani_gateway_convert_to_omr) for non-OMR stores.

== Installation ==

1. Upload the plugin folder to /wp-content/plugins/ or install via the Plugins screen.
2. Activate the plugin.
3. Go to WooCommerce > Settings > Payments > Thawani Gateway and enter your Thawani API keys.
4. (Optional) Copy the Webhook URL shown in the settings into your Thawani portal under Webhooks.

== Frequently Asked Questions ==

= Does Thawani support partial refunds? =

No. Refund attempts that don't match the order total are rejected with a clear error.

= Will my legacy settings carry over? =

Yes. The settings option key (woocommerce_thawani_settings) and the legacy mapping table ({prefix}thawani_invoice_map) are preserved.

= How do I test? =

Enable Test mode in the gateway settings. The form ships with public Thawani UAT credentials.

== External services ==

This plugin connects to Thawani Pay, the payment gateway operated by Thawani Technologies LLC (https://thawani.om), to process card payments for your WooCommerce store. Using this plugin requires a Thawani merchant account and API keys, which you enter in the gateway settings. Thawani is a third-party service and is not affiliated with this plugin's authors.

The plugin communicates with Thawani's API endpoints (`https://checkout.thawani.om` in live mode and `https://uatcheckout.thawani.om` in test mode) in the following situations:

* When a customer places an order with this gateway, a checkout session or payment intent is created. The data sent includes the order amount and currency, product/line-item names, a client reference derived from the order ID, and your merchant API key (sent as a request header). The customer is then redirected to Thawani's hosted checkout page to enter their card details — no card data is handled or stored by your site.
* When a logged-in customer reuses or deletes a saved card, the plugin creates/retrieves a Thawani customer record and its stored payment methods. The data sent is a customer identifier and your merchant API key.
* When a store administrator issues a refund, the plugin looks up the payment and sends a refund request containing the payment ID, amount, and reason.
* If you configure the optional webhook, Thawani sends payment-status notifications back to your site, which the plugin verifies (optionally via HMAC-SHA256) and uses to update the order.

No data is sent to Thawani except as part of these payment operations.

* Thawani Terms and Conditions: https://thawani.om/terms/
* Thawani Privacy Policy: https://thawani.om/privacy-policy-2/

== Changelog ==

= 2.0.4 =
* Removed the remote jQuery Confirm script/stylesheet loaded from cdnjs.cloudflare.com; the saved-card delete confirmation now uses a native browser dialog so no external assets are requested.
* Webhook payloads decoded from the request body are now recursively sanitized before being logged or written to order meta.
* Documented the Thawani external service in the readme, including Terms of Service and Privacy Policy links.
* Added the `Requires Plugins: woocommerce` header and an `ABSPATH` guard to the blocks asset manifest.

= 2.0.3 =
* Renamed plugin constants from `WC_GATEWAY_THAWANI_*` to `THAWANI_*` to clear Plugin Check warnings about the WooCommerce-reserved `WC_` prefix.
* Added a `phpcs.xml.dist` declaring the plugin's accepted prefixes and text domain so coding-standard scans recognize correctly-prefixed hooks.

= 2.0.2 =
* Aligned the plugin's text domain with the WordPress.org slug `thawani-payment-gateway-for-woocommerce`. Translation files have been renamed accordingly.

= 2.0.1 =
* Activation no longer emits "unexpected output" warnings; the invoice-map table is now created via a direct query that bypasses dbDelta's reserved-word column parser.
* Plugin Check findings addressed: removed the discouraged `load_plugin_textdomain()` call (WP auto-loads bundled translations), tightened input casts at checkout and in the saved-card AJAX handler, and prefixed the currency conversion filter as `thawani_gateway_convert_to_omr` (the legacy `thawani_convert_to_omr` continues to work via `apply_filters_deprecated`).
* Bumped tested-up-to header to WordPress 6.9.

= 2.0.0 =
* First open-source release. Rewrite of the paid plugin against Thawani's v1 API.
* Refunds now resolve the real payment_id via GET /payments before calling /refunds.
* Added a server-to-server webhook endpoint with optional HMAC signature verification.
* WooCommerce Blocks and HPOS compatibility.

== Upgrade Notice ==

= 2.0.3 =
Renames the plugin's public constants from `WC_GATEWAY_THAWANI_*` to `THAWANI_*` (the `WC_` prefix is reserved by WooCommerce). If you reference these constants from third-party code, update the names.

= 2.0.2 =
Aligns the plugin text domain with the WordPress.org slug. Required for translation loading on WordPress.org listings.

= 2.0.1 =
Fixes a "1610 characters of unexpected output during activation" warning and clears all Plugin Check findings. The legacy `thawani_convert_to_omr` filter is preserved via a deprecation shim; please migrate to `thawani_gateway_convert_to_omr`.

= 2.0.0 =
First open-source release. Existing settings and historical data are preserved without manual migration.
