=== NxtPay ===
Contributors: nxtpay
Tags: woocommerce, payment-gateway, payments, hosted-checkout, subscriptions
Requires at least: 6.0
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 2.5.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept payments in WooCommerce through the NxtPay hosted checkout. No card data ever touches your site.

== Description ==

NxtPay is a hosted-redirect payment gateway for WooCommerce. When a customer
places an order, the plugin creates a secure NxtPay payment link and redirects
them to a hosted payment page. No card fields are rendered on your store, which
keeps your PCI scope to the minimum (SAQ A).

Orders are confirmed three ways for reliability:

* **Webhooks (primary):** NxtPay signs each webhook with an HMAC-SHA256
  signature. The plugin verifies the signature, enforces a 5-minute replay
  window, and de-duplicates deliveries before completing the order. The webhook
  is set up automatically when you save the settings with a valid API key —
  there is no secret to copy or paste.
* **Return-page poll (fallback):** on the WooCommerce thank-you page, the plugin
  queries the order status directly, so a delayed or misconfigured webhook does
  not leave a paid order stuck.
* **Background sync (safety net):** a WordPress cron task runs every few minutes
  and reconciles any recent, still-unpaid NxtPay orders directly against the
  NxtPay API — so payments settle even if the webhook is slow, blocked, or never
  arrives and the shopper never returns to your store.

= Features =

* Hosted redirect checkout — no card fields on your site.
* Classic checkout **and** the WooCommerce Cart/Checkout Blocks.
* HPOS (High-Performance Order Storage) compatible.
* Refunds from the WooCommerce order screen.
* WooCommerce Subscriptions support (monthly / yearly), when that plugin is active.
* Signed, replay-protected, de-duplicated webhooks, set up automatically.
* Background reconcile sync so orders settle even if webhooks are slow or blocked.
* "Test connection" button in settings.
* `[nxtpay_pay]` shortcode for one-off payments on non-WooCommerce pages.
* Self-hosted automatic updates.

== Installation ==

1. Upload the `nxtpay` folder to `/wp-content/plugins/`, or install the ZIP from
   **Plugins → Add New → Upload Plugin**.
2. Activate the plugin.
3. Go to **WooCommerce → Settings → Payments → NxtPay**.
4. Enter your **API Key** (begins with `npk_`), choose your **Environment**, and
   click **Test connection**.
5. Enable the gateway and **Save changes**. The webhook is set up automatically —
   there is no secret to copy or paste. You'll see a confirmation message telling
   you how many payment providers were connected.

== Frequently Asked Questions ==

= Do I have to set up the webhook myself? =

No. When you save the gateway settings with a valid API key, the plugin registers
its webhook with NxtPay automatically and stores the signing secret for you. The
webhook URL is still shown read-only in the settings (in the form
`https://your-site.com/wp-json/nxtpay/v1/webhook`) for reference.

= What if the webhook is slow or blocked on my host? =

Payments still settle. Besides the webhook, the plugin confirms orders when the
shopper returns to your store, and a background sync runs every few minutes to
reconcile any recent, still-unpaid NxtPay orders directly against the NxtPay API.

= Do I need WooCommerce Subscriptions? =

No. If it is installed and the order contains a subscription, NxtPay creates a
recurring payment link automatically. Otherwise it creates a one-time link.

== Changelog ==

= 2.5.4 =
* **More reliable retries.** If a checkout's payment route becomes permanently
  unavailable, the plugin now automatically starts a fresh checkout on the next
  attempt instead of getting stuck retrying a dead request. No effect on normal
  checkouts — a plain retry still safely replays without double-charging.

= 2.5.3 =
* **New NxtPay dashboard.** A top-level "NxtPay" menu now gives you a home for
  the plugin — connection, environment and instant-confirmation status, your
  recent NxtPay orders, and a quick link to settings.
* **Environment is now Automatic by default.** You no longer choose Sandbox vs
  Production — NxtPay routes each payment to whichever live processor your
  account has connected. (Force Sandbox/Production is still available for
  testing.)
* **Testing your key now sets up instant confirmation too.** Clicking "Test
  connection" registers the webhook right away, so you don't have to Save first.

= 2.5.2 =
* **Fixed a fatal error on the Cart/Checkout Blocks.** On PHP 8+ the blocks
  integration declared its settings property more strictly than the WooCommerce
  parent class, which crashed the block-based checkout as soon as it loaded.
  The property visibility now matches the parent, so the Blocks checkout works.

= 2.5.1 =
* **Fail-safe loading.** If any part of the plugin fails to load, WordPress now
  shows a clear admin notice and the rest of your site keeps working — a plugin
  fault can no longer take the whole site down.
* **Subscription renewals and cancellations now arrive automatically.** NxtPay
  now delivers `subscription.renewed` / `subscription.canceled` /
  `subscription.payment_failed` webhooks to the plugin. **After updating, open
  WooCommerce → Settings → Payments → NxtPay and click Save once** — the plugin
  refreshes its webhook registration to enable these events.
* The gateway now only offers itself on USD stores (the platform's supported
  currency) instead of failing at the payment page — and each order's own
  currency is re-checked at pay time.
* The webhook endpoint now rate-limits floods of unsigned requests.
* Saving unchanged settings no longer re-registers the webhook (faster saves);
  a version update or key/URL change still refreshes it automatically.

= 2.5.0 =
* **Fixed: `[nxtpay_pay]` quick-pay buttons could hand two different shoppers
  the same payment link.** Each button click now gets its own signed,
  single-use identifier, so the payment link created for one visitor can never
  be reused for — or block — another. This only affected the `[nxtpay_pay]`
  shortcode on non-WooCommerce pages; the WooCommerce checkout was unaffected.
* Hardening: the auto-updater now only installs update packages served from the
  NxtPay domain over HTTPS.

= 2.4.0 =
* **Free trials and sign-up fees are now supported.** A subscription's free
  trial is honoured (the first recurring charge waits until the trial ends), and
  a sign-up/setup fee — plus any one-time products bought alongside the plan — is
  charged once on the first invoice. The recurring amount continues to bill each
  cycle as normal.
* Now blocked instead: more than one subscription in a single order, and a
  discount that makes the first payment smaller than one billing cycle (each with
  a clear message at checkout).

= 2.3.0 =
* **More subscription billing schedules.** Daily, weekly, monthly, and yearly
  plans are now supported, including "every N" intervals (e.g. every 2 weeks,
  every 3 months), up to Stripe's one-year maximum. Schedules beyond that, free
  trials, and sign-up fees are still blocked at checkout with a clear message
  rather than mis-billed.

= 2.2.0 =
* **Full WooCommerce Subscriptions lifecycle.** Provider-billed renewals now
  create a matching WooCommerce renewal order and keep the subscription active;
  a failed renewal puts the subscription on hold; and cancelling in WooCommerce
  cancels at the provider (and vice-versa) so billing and WooCommerce never
  diverge.
* The gateway now declares `gateway_scheduled_payments` (the provider schedules
  the renewals) and only advertises the subscription features it actually
  supports. Subscription schedules it can't bill faithfully (anything other than
  a simple monthly/yearly plan, free trials, or sign-up fees) are blocked at
  checkout with a clear message instead of being mis-billed.
* Refunds reported by webhook are de-duplicated by the provider refund id, so a
  single refund (including one issued from the WooCommerce order screen) is
  recorded exactly once.
* An order whose payment couldn't be confirmed immediately is left pending (not
  failed) so the background sync can settle it, and the shopper is told not to
  pay twice.

= 2.1.0 =
* **Automatic webhook setup.** Saving the gateway with a valid API key now
  registers this site's webhook across your payment providers and stores the
  signing secret automatically — no more copying a `whsec_` secret out of the
  dashboard. The settings confirm how many providers were connected.
* **Background reconcile sync.** A new WordPress cron task runs every 5 minutes
  and reconciles recent, still-unpaid NxtPay orders directly against the NxtPay
  API, so orders settle even if a webhook is slow, blocked, or never arrives and
  the shopper never returns to your store.
* Webhook, return-page poll, and background sync now share one idempotent
  confirmation path, so an order is never double-completed.

= 2.0.0 =
* Rebuilt for the NxtPay v2 hosted-redirect API (`/v1/payment-links`,
  `/v1/subscriptions`, `/v1/orders`, `/v1/refunds`).
* New signed webhook scheme (`X-Nxtpay-Signature: t=,v1=`) with replay and
  de-duplication protection.
* Return-page status poll as a webhook fallback.
* WooCommerce Cart/Checkout Blocks integration.
* HPOS compatibility.
* Refunds and WooCommerce Subscriptions support.
* `[nxtpay_pay]` shortcode for non-WooCommerce pages.

== Upgrade Notice ==

= 2.5.3 =
Adds a NxtPay dashboard page, an Automatic environment default, and webhook
setup on Test connection.

= 2.5.2 =
Fixes a fatal error that crashed the WooCommerce Cart/Checkout Blocks on PHP 8+.
Recommended for all stores using the block-based checkout.

= 2.5.1 =
Adds fail-safe loading, subscription renewal/cancellation delivery, and
supported-currency checks. After updating, open the NxtPay settings and click
Save once to refresh the webhook registration.

= 2.5.0 =
Fixes a bug where `[nxtpay_pay]` shortcode buttons could share one payment link
between different shoppers. Recommended for anyone using the shortcode on
non-WooCommerce pages.

= 2.4.0 =
Free trials and sign-up fees are now supported for subscriptions. One
subscription per order; first-payment discounts aren't supported.

= 2.3.0 =
Adds daily/weekly/monthly/yearly and "every N" subscription billing schedules
(up to one year). Free trials and sign-up fees remain unsupported for now.

= 2.2.0 =
Completes WooCommerce Subscriptions support: provider renewals now post as
renewal orders, dunning and cancellations stay in sync both ways, and refunds
are de-duplicated. Recommended for anyone selling subscriptions.

= 2.1.0 =
The webhook now sets itself up automatically — just re-save your gateway settings
once after upgrading. A new background sync settles orders even if webhooks are
slow or blocked.

= 2.0.0 =
Major release on the NxtPay v2 API. Re-enter your API key, environment, and
webhook signing secret after upgrading.
