=== OasisPay Checkout for WooCommerce ===
Contributors: maviwurd
Tags: woocommerce, payments, checkout, nigeria, oasispay
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 7.4
Requires Plugins: woocommerce
WC requires at least: 7.0
WC tested up to: 10.8.1
Stable tag: 0.1.6
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept WooCommerce payments through OasisPay Hosted Checkout.

== Description ==

OasisPay Checkout for WooCommerce lets merchants start a Hosted Checkout payment from WooCommerce and complete the order only after OasisPay confirms the payment.

This first version supports Hosted Checkout only. Virtual account checkout can be added in a later version without changing this payment flow.
It works with both the classic WooCommerce checkout shortcode and the WooCommerce Checkout Block.

Security features:

* Server-side API calls only.
* OasisPay secret keys are not sent to browsers.
* Browser returns are verified through OasisPay before an order is marked paid.
* Server-to-server webhooks are verified using X-OasisPay-Signature and X-OasisPay-Timestamp.
* Duplicate webhooks are idempotent because orders are matched by stored OasisPay payment reference.
* Logs are sanitized and do not include secret keys or webhook secrets.

== Installation ==

1. Upload the `oasispay-checkout` folder to `/wp-content/plugins/`.
2. Activate "OasisPay Checkout for WooCommerce" from WordPress plugins.
3. Go to WooCommerce > Settings > Payments > OasisPay Checkout.
4. Enable the gateway.
5. Select Test or Live.
6. Add the matching OasisPay secret key.
7. Copy the displayed Webhook URL.
8. In your OasisPay merchant dashboard, create a webhook endpoint with that URL and enable:
   * payment.success
   * payment.failed
9. Paste the webhook secret generated by OasisPay into the plugin settings.

== Frequently Asked Questions ==

= Does this version support virtual account checkout? =

No. This version uses OasisPay Hosted Checkout only. Virtual account checkout can be added later as a separate mode.

= Can a customer redirect mark an order as paid? =

No. The return handler verifies the payment status with OasisPay before completing the WooCommerce order.

= What webhook events should be enabled? =

Enable `payment.success` and `payment.failed`. The plugin safely acknowledges `transaction.created` but does not use it to complete orders.

== External Services ==

This plugin connects to the OasisPay API to create hosted checkout sessions, verify payments, process transactions, and receive payment status updates.

The OasisPay service is required for this plugin to function.

Data sent to OasisPay may include:

* Merchant API credentials.
* Order reference.
* Order amount.
* Currency.
* Customer name.
* Customer email address.
* Customer phone number.
* Transaction metadata.

Data is sent only when a customer initiates a payment, when payment verification is performed, or when OasisPay sends a payment status webhook to the merchant site.

OasisPay service: https://oasispayhq.com

Terms of Service: https://oasispayhq.com/legal/terms

Privacy Policy: https://oasispayhq.com/legal/privacy

== Changelog ==

= 0.1.6 =

* Update - Bump WooCommerce tested-up-to header to 10.8.1 for QIT validation.

= 0.1.5 =

* Update - Bump WordPress and WooCommerce tested-up-to headers for QIT validation.

= 0.1.4 =

* Security - Restrict API Base URL to the official OasisPay HTTPS API host.
* Security - Document signed webhook raw-body handling for marketplace scanners.
* Update - Add complete WooCommerce Marketplace metadata and Checkout Blocks compatibility declaration.

= 0.1.3 =

* Update checkout payment badge shown in WooCommerce checkout.

= 0.1.2 =

* Fix WooCommerce Checkout Block compatibility on sites where the parent Blocks integration exposes protected settings.

= 0.1.1 =

* Add WooCommerce Checkout Block support.
* Add bundled OasisPay logo for gateway listings and checkout labels.

= 0.1.0 =

* Initial Hosted Checkout gateway for WooCommerce.
