=== Esaalat for WooCommerce ===
Contributors: esaalat
Tags: payments, woocommerce, esaalat, wallet, yemen
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept verified wallet payments through the Esaalat hosted checkout.

== Description ==

Adds an Esaalat payment method to WooCommerce. The buyer is redirected to a
standalone pay page that opens the Esaalat hosted checkout with the browser SDK
(vendored in `assets/esaalat.global.js`, MIT). When the payment is verified,
Esaalat calls this site's signed webhook and the order moves to processing.

**The order total is authoritative.** The gateway creates the checkout session
on the server with the merchant's client credentials and passes only the session
token to the page. A doctored `amount` in the browser has nothing to act on: the
session already carries the order total. The webhook compares the delivered
amount and currency with the order before completing it; a mismatch leaves the
order unpaid with an admin note.

The pay page renders the SDK's own `<esaalat-checkout-button>`, so the branded
button, its busy state and the window/modal presentation all come from the SDK
rather than from plugin CSS.

The browser result is used for messaging only. Fulfilment always waits for the
`payment.verified` webhook, which echoes the order id back as `order_id`.

Requires the Yemeni Rial (YER) as the store currency, because that is what
Esaalat settles in, in whole riyals.

**One-click setup.** The gateway settings have **Connect with Esaalat**: it
creates the API key, adds one webhook per receiving wallet, and fills the
credential fields.

== Installation ==

1. Copy the `esaalat-woocommerce` folder into `wp-content/plugins/`, or upload
   the zip through Plugins → Add New → Upload Plugin.
2. Activate it. WooCommerce must be active.
3. Go to WooCommerce → Settings → Payments → Esaalat and press **Connect with
   Esaalat**. Sign in, choose the receiving account, approve the store.
4. Tick **Enable**, then save.
5. Press **Test connection** and confirm your monitored wallets come back.
6. Tick "Testing wallet", place a test order, and pay from the testing wallet.
   Confirm the order becomes paid. Untick it before taking real orders.

Already have keys? The same screen has manual fields for the publishable key,
client ID, client secret and webhook secrets.

== Frequently Asked Questions ==

= Does the webhook need pretty permalinks? =

No. The settings screen prints the URL WordPress actually serves, which falls
back to `?rest_route=/esaalat/v1/webhook` when permalinks are plain.

= What happens if the webhook is late? =

The pay page polls the order for two minutes after a VERIFIED result. If the
webhook has still not arrived, the buyer is told the payment will be confirmed
shortly; the order updates whenever the delivery lands, and duplicates are
ignored by event id.

= Can the amount be tampered with in the browser? =

No. The session is created on the server with the order total, and the browser
only receives its token. The webhook also checks the delivered amount and
currency against the order before marking it paid.

= What does Connect create? =

One API credential for this store and one webhook endpoint per receiving wallet,
all pointing at this store's webhook URL. Reconnecting creates a fresh
credential and fresh endpoints; remove the old ones in the Esaalat dashboard if
they are no longer wanted.

== Changelog ==

= 0.2.0 =
* Checkout sessions are created on the server; the order total can no longer be
  changed in the browser.
* One-click Connect with Esaalat: API key and webhooks are set up for you.
* Webhook verifies amount and currency against the order; a mismatch keeps the
  order unpaid and adds a note.
* Whole-riyal validation before the portal opens.

= 0.1.0 =
* First version: redirect checkout, signed webhook, order status polling.
