=== Esaalat Pay Button ===
Contributors: esaalat
Tags: payments, esaalat, donations, wallet, yemen
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Put a "Pay with Esaalat" button on any page. No shop or WooCommerce needed.

== Description ==

For donations, invoices, services and one-off payments. Paste `[esaalat_pay]` on
a page and the button appears; the visitor pays in the Esaalat portal.

The amount is fixed on the server. A click asks this site to create the checkout
session with the merchant's client credentials, and the browser receives only
the session token. Editing the page cannot change a fixed price, and the
publishable key alone can no longer start a session.

Nothing is created until the money is verified: a signed `payment.verified`
webhook marks the payment paid, and the page polls that record before it says
"Payment confirmed". The webhook amount is checked against the amount the
server asked for, so an underpayment stays unpaid and is flagged for review.

**One-click setup.** The settings screen has a **Connect with Esaalat** button.
It creates the API key, adds one webhook per receiving wallet, and fills the
credential fields. No copy-pasting is required.

Works alongside the WooCommerce gateway if a site runs both; the two use
different webhook routes.

== Installation ==

1. Upload the `esaalat-pay` folder to `wp-content/plugins/`, or upload the zip
   through Plugins → Add New → Upload Plugin, then activate.
2. Open **Esaalat** in the admin menu and press **Connect with Esaalat**.
3. Sign in, choose the receiving account, and approve the store. The key and
   webhooks are created and stored automatically.
4. Put `[esaalat_pay amount="5000"]` on a page for a fixed amount, or
   `[esaalat_pay]` to let the visitor type the amount.
5. Under **Button → Style** pick the SDK's gold (default), dark or light
   button. The branded lockup is always used; the plugin does not offer a
   custom label.
6. Press **Test connection** and confirm your monitored wallets come back.
7. Switch on the testing wallet, make one test payment, then switch it off.

Already have keys? The same screen has manual fields for the publishable key,
client ID and client secret, plus the webhook endpoint and secrets.

== Shortcode ==

`[esaalat_pay amount="5000" note="Every riyal helps."]`

The button is always the SDK's own branded lockup; there is no label attribute,
so the appearance cannot drift from Esaalat's.

All attributes are optional. With no `amount`, an amount field is shown and the
visitor chooses what to give. With `amount`, the price is signed server-side and
the browser cannot change it.

Currency is fixed to YER, in whole riyals; a fractional amount is rounded so it
never reaches the API as an invalid request.

== Frequently Asked Questions ==

= Do I need WooCommerce? =

No. This plugin works on a plain WordPress site. It also works on a shop site,
next to the WooCommerce gateway, because the two webhook addresses differ.

= Where can I see payments? =

**Esaalat → Payments**, one row per verified payment with the amount, the state
and the Esaalat intent id.

= What happens if the webhook is late? =

The button says the payment is being confirmed and polls for two minutes. The
payment still records whenever the delivery lands.

= Can the visitor change a fixed price? =

No. The session is created on the server with the signed amount; the browser
only holds a session token, and that token ignores any amount sent with it. For
a donation button (no `amount`), the visitor chooses the amount, and the webhook
still has to match what the server asked for.

= What does Connect create? =

One API credential for this site and one webhook endpoint per receiving wallet,
all pointing at this store. Reconnecting creates a fresh credential and fresh
endpoints; remove the old ones in the Esaalat dashboard if you no longer want
them.

== Changelog ==

= 0.2.0 =
* Checkout sessions are created on the server, so a fixed amount cannot be
  changed in the browser.
* One-click Connect with Esaalat: API key and webhooks are set up for you.
* Webhook verifies the paid amount against the session and flags mismatches.
* Connector creates one endpoint per receiving wallet; multiple secrets are
  accepted.

= 0.1.0 =
* First version: shortcode, fixed or visitor-entered amount, webhook records,
  payments list.
