=== BluPay for WooCommerce ===
Tags: woocommerce, cryptocurrency, payments, bitcoin, usdt
Requires at least: 6.2
Tested up to: 7.0
Requires PHP: 7.4
WC requires at least: 7.0
WC tested up to: 11.0
Stable tag: 0.3.7
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept cryptocurrency payments in your WooCommerce store via BluPay — a custodial crypto payment gateway.

== Description ==

BluPay for WooCommerce lets you accept cryptocurrency payments at checkout with no on-chain expertise required. Funds are credited to your BluPay merchant balance after blockchain confirmation, with shop-level conversion and fee settings handled by BluPay.

Features:

* Crypto payments at WooCommerce checkout (BTC, ETH, USDT, USDC, and more)
* Sandbox and Production environments
* Webhook-driven order status updates
* HPOS (High-Performance Order Storage) compatible
* Logs all gateway events to WooCommerce → Status → Logs

This release implements end-to-end checkout: invoice creation against the BluPay API, HMAC-verified webhook handling, automatic WooCommerce order status mapping, and support for both classic and block checkout.

== Installation ==

1. Upload the `blupay` folder to `/wp-content/plugins/`, or install via wp-admin → Plugins → Add New → Upload Plugin.
2. Activate the plugin through the "Plugins" menu in WordPress.
3. Make sure WooCommerce is installed and active.
4. Go to WooCommerce → Settings → Payments → BluPay (Crypto) and configure your API key, Shop ID, and environment.
5. Copy the Webhook URL shown on the settings screen and paste it into your BluPay merchant dashboard.

== Frequently Asked Questions ==

= Which cryptocurrencies are supported? =

BluPay supports the major cryptocurrencies (Bitcoin, Ethereum, USDT, USDC, and others). The exact list is determined by your merchant account configuration in the BluPay dashboard.

= Where do I get an API key? =

Sign up for a merchant account at https://blupay.me/ and generate an API key from the BluPay merchant dashboard.

= Is BluPay custodial or non-custodial? =

BluPay is a custodial gateway. Customer funds are received by BluPay, optionally converted, and settled to your merchant balance.

= Is HPOS supported? =

Yes — this plugin declares compatibility with WooCommerce custom order tables (HPOS).

= Does the plugin support Cart and Checkout blocks? =

Yes. BluPay registers a payment method for WooCommerce Cart and Checkout blocks and also supports the classic checkout.

== External services ==

This plugin connects to the BluPay API at https://blupay.me/api/v1 to create payment invoices and test the merchant's API connection. These requests occur only when a store administrator tests the connection or a customer chooses BluPay at checkout.

When an invoice is created, the plugin sends the order amount, currency, WooCommerce order ID, store name, customer billing email (when available), return URL, and webhook URL to BluPay. The API key is sent in the X-API-Key request header. BluPay sends signed payment status webhooks back to the store so the WooCommerce order can be updated.

BluPay terms of service: https://blupay.me/terms
BluPay privacy policy: https://blupay.me/privacy

== Changelog ==

= 0.3.7 =
* Serialize checkout, admin order saves and refunds with signed BluPay callbacks on the same durable order claim.
* Reject stale order edits before status and stock side effects, while preserving a legitimate refund after the claim clears.

= 0.3.6 =
* Ignore stale, signed invoice-status callbacks after a newer revision and keep confirmed payments from regressing.
* Require reconciliation for unversioned non-paid callbacks after an order has entered the versioned status stream.

= 0.3.5 =
* Allow 60 minutes for new checkout invoices so Bitcoin payments have a usable broadcast window.

= 0.3.4 =
* Verify checkout pending status in the authoritative WooCommerce order table before requesting a BluPay invoice. Fail safely when status persistence fails.

= 0.3.3 =
* Verify that non-paid webhook status changes persist before acknowledging the event, so a failed WooCommerce order save remains retryable and quarantined for review.

= 0.3.2 =
* Serialize signed webhook callbacks across PHP workers so delayed or duplicate events cannot race WooCommerce order updates.
* Return a retryable response when the database processing lock is busy or unavailable.

= 0.3.1 =
* Preserve confirmed WooCommerce orders when older invoice webhooks arrive.
* Prevent a second checkout invoice on a paid order and flag unresolved payment completion for review.

= 0.3.0 =
* Added and declared compatibility with WooCommerce Cart and Checkout blocks.
* Fixed block checkout availability when the optional Shop ID setting is blank.
* Declared WooCommerce as a plugin dependency.
* Tested with WordPress 7.0, WooCommerce 11.0, and PHP 8.3.
* Updated WordPress.org metadata and documented the external BluPay API service.

= 0.2.0 =
* Initial working payment flow + webhook receiver.
* Implemented `BluPay_API::create_invoice` against `POST /v1/invoices/` with idempotency key support.
* Implemented `BluPay_Gateway::process_payment` — creates an invoice, persists `_blupay_invoice_link`, redirects buyers to BluPay.
* Implemented `BluPay_Webhook::handle` — verifies HMAC-SHA256 signature, enforces 5-minute clock-skew window, idempotency by event id, ring-buffered to last 1000 events.
* Mapped BluPay invoice statuses to WC order statuses (spec §16.4). Admin choice between `processing` and `completed` on Paid.
* Added `Webhook Secret` and `Order status on Paid` gateway settings.
* Added WC Cart/Checkout Blocks support (minimal label + edit + canMakePayment shim).
* Surfaced last received webhook + timestamp on the settings screen.

= 0.1.0 =
* Initial skeleton release: admin settings page, gateway registration, webhook route stub, HPOS compatibility declaration.

== Screenshots ==

1. Settings page in WooCommerce → Settings → Payments → BluPay (Crypto).
2. Test Connection button on the settings screen.
3. Customer-facing payment option at checkout.

== Upgrade Notice ==

= 0.3.7 =
Install to prevent a simultaneous checkout or admin edit from overwriting a confirmed BluPay callback. Existing order metadata is retained.

= 0.3.6 =
Install before enabling BluPay's versioned invoice-status webhook stream; existing checkout and legacy paid callbacks remain supported.

= 0.3.5 =
New checkout invoices use a 60-minute payment window. Existing invoices keep their original deadline.

= 0.3.4 =
Prevents creating a BluPay invoice when checkout pending status was not persisted. Existing orders and webhook behavior are retained.

= 0.3.3 =
Prevents a failed WooCommerce status save from being acknowledged as a successful BluPay webhook. Existing checkout and paid-order behavior is preserved.

= 0.3.2 =
Prevents concurrent signed callbacks from racing payment completion and order status changes. Requires a shared MySQL or MariaDB writer for the WordPress site.

= 0.3.1 =
Protects paid order status and inventory from delayed invoice callbacks. Review any unresolved payment-completion notice before retrying.

= 0.3.0 =
Adds current WooCommerce compatibility metadata and fixes availability in block checkout when Shop ID is left blank.

= 0.2.0 =
First functional release — checkout + webhook receiver. Paste your shop's webhook secret in BluPay settings before going live.

= 0.1.0 =
Initial release.
