=== VinGate for WooCommerce ===
Contributors: vingate
Tags: payments, gateway, stripe, square, checkout
Requires at least: 6.4
Tested up to: 6.8
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Card payments on VinGate's hosted checkout, completed by a signed webhook.

== Description ==

VinGate sends the buyer to a hosted card page and completes the order from a
signed webhook. There are no card fields in your theme, so nothing to style and
nothing that breaks when a theme changes.

Setup is one approval:

* Press **Connect with VinGate**. Your browser goes to the dashboard, you approve
  this store, and the key is minted and stored for you. Test or live is a choice
  on that screen.
* The method is switched on for you, and the settings a store usually leaves blank
  are filled in. A pasted key still works if you run VinGate yourself.
* The webhook endpoint is registered for you, at a URL carrying a random token,
  and its signing secret is stored on this site only.
* If the site changes address, or the endpoint is deleted, the plugin notices on
  the next check and replaces it.
* A five-minute reconcile pass completes orders whose webhook never arrived, so a
  host that blocks inbound requests cannot leave a charged order unpaid.

Refunds are issued from the WooCommerce order screen and settle through VinGate.

== Installation ==

1. Upload `vingate` to `/wp-content/plugins/`, or install the zip from Plugins > Add New.
2. Activate it.
3. Open WooCommerce > Settings > Payments > VinGate.
4. Press **Connect with VinGate** and approve the store in the dashboard it opens.
5. That is the setup: the method is on. Place a test order to see it through.

The plugin reports what it cannot fix itself on the same screen: a store currency
other than USD, an inactive plan, no processor that can take money, and the order
storage WooCommerce is moving away from. It switches that storage on for you on a
store with no orders, because there is nothing to migrate.

The site must be reachable over https: webhooks are https only.

Cloaking (the buyer's statement showing VinGate rather than your store) is a Stripe
destination charge. Square has no equivalent, so Square checkouts always show your
own name, and the settings screen says so when nothing can serve a cloak.

Cloaking hides the store from the buyer's bank, not from Stripe: the processor still
has the connected account and the site on it. To change what Stripe is shown, pair a
front site and pick the category before connecting an account, because an account keeps
what it was created with. Pairing is under WooCommerce, Settings, Payments, VinGate,
**Front site**: the other site runs this plugin, you approve from its own admin, and
its name and address become the business's. A front site that cannot run WordPress can
still be typed into the dashboard's Cloaking settings, unproven.

== Frequently Asked Questions ==

= Does it need a plan? =

A test key works with no plan and no processor. A live key needs an active plan
and at least one connected processor on the VinGate business.

= Which currency? =

USD. With another store currency the method hides itself rather than send an
amount that means something else.

= Where is the webhook secret kept? =

In the `vingate_connection` option on this site. It is never printed on screen.

== Changelog ==

= 1.0.0 =

* First release.
* A front site can be paired from its own admin, so what Stripe is shown is proven
  rather than typed, and its identity can stand in for the store's.
* Works on the block checkout as well as the classic one.
* A return URL can no longer complete an order with another order's session.
* Amounts are sent in cents whatever the store's display precision.
* An expired session no longer cancels an order the buyer moved to another
  payment method, and reconcile asks the API before cancelling.
* Refunds are idempotent, so a timed-out retry cannot pay out twice.
* A mistyped key no longer takes the live webhook down before it is checked.
* Uninstall runs on PHP 8.
* One-click connect: the plugin asks the dashboard to approve the store, and the
  key comes back through a one-time code instead of a paste. The method is
  switched on and blank settings are filled in as part of it.
* The statement row no longer promises cloaking on a store whose only processor is
  Square, which has no destination charges.
* A status row reports the order storage, and an empty store is moved to HPOS.