=== Chargedeck for WooCommerce ===
Contributors: chargedeck
Tags: woocommerce, payments, checkout, stripe, paypal, non-custodial
Requires at least: 5.6
Tested up to: 6.6
Requires PHP: 7.2
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept payments through Chargedeck — a non-custodial white-label checkout. Money settles directly to your own connected processor; Chargedeck records the order and confirms it via a signed webhook.

== Description ==

Chargedeck for WooCommerce adds a "Chargedeck" payment gateway to your store.

When a buyer checks out:

1. The plugin asks the Chargedeck API to create a hosted checkout session for the
   order total (sent in minor units, e.g. 4999 = 49.99).
2. The buyer is redirected to the hosted Chargedeck page and pays there.
3. Because Chargedeck is **non-custodial**, the money settles straight into YOUR
   own connected processor (Stripe Connect / PayPal / Square). Chargedeck never
   holds your funds — it only records the order and its total.
4. When the payment succeeds, Chargedeck sends a signed `order.paid` webhook to
   your store. The plugin verifies the signature (HMAC-SHA256), checks the amount
   and currency, and marks the WooCommerce order complete.

The order is ONLY marked paid by the verified webhook — never by the buyer's
browser return. This is the secure, tamper-proof design.

== Installation ==

1. In the Chargedeck dashboard, go to **Developers**:
   * **Reveal** your API secret key (starts with `cdk_live_`).
   * **Reveal / rotate** your webhook signing secret (starts with `whsec_`).
   * Set your **Webhook URL** to this store's receiver:
     `https://YOUR-SITE.com/wp-json/chargedeck/v1/webhook`
     (You can find the exact URL shown in the plugin settings screen.)

2. Install the plugin:
   * Upload the `chargedeck-woocommerce` folder to `/wp-content/plugins/`, OR
   * In WordPress admin go to **Plugins → Add New → Upload Plugin** and upload
     `chargedeck-woocommerce.zip`.
   * Activate **Chargedeck for WooCommerce**.

3. Configure the gateway:
   * Go to **WooCommerce → Settings → Payments → Chargedeck** (or click
     **Settings** on the plugin row).
   * Tick **Enable Chargedeck**.
   * Set the **Title** and **Description** buyers will see.
   * Leave **API base URL** as the default
     (`https://checkout.2.25.199.135.nip.io`) unless told otherwise.
   * Paste your **API secret key** (`cdk_live_...`).
   * Paste your **Webhook signing secret** (`whsec_...`).
   * Save.

4. Confirm the **Webhook URL** shown in the settings matches what you set in the
   Chargedeck dashboard, then use the dashboard's **Send test event** button to
   verify delivery.

== Configuration reference ==

* **API base URL** — Chargedeck host. Default `https://checkout.2.25.199.135.nip.io`.
* **API secret key** — `cdk_live_<hex>`. Used as the Bearer token for
  `POST /api/v1/checkouts`. Kept server-side; never exposed to the storefront.
* **Webhook signing secret** — `whsec_<hex>`. Used to verify inbound
  `order.paid` events. Must match the secret shown in your dashboard.
* **Webhook receiver URL** — `https://YOUR-SITE.com/wp-json/chargedeck/v1/webhook`.
  A compatibility endpoint is also available at
  `https://YOUR-SITE.com/?wc-api=chargedeck`.

== How the webhook is verified ==

The `Chargedeck-Signature` header has the form `t=<unix>,v1=<hmacHex>`.

* Requests with a timestamp more than 300 seconds from now are rejected (replay
  protection).
* The plugin recomputes `HMAC-SHA256("<t>.<rawBody>", webhook_secret)` and
  compares it to `v1` with a constant-time check. A mismatch returns HTTP 401.
* On a valid `order.paid` event, the order named by `reference` (the WooCommerce
  order id) is looked up. The event `amount` (minor units) and `currency` must
  match the order before it is completed. Completion is idempotent.

== Frequently Asked Questions ==

= Does Chargedeck hold my money? =
No. Chargedeck is non-custodial. Funds settle to your own connected processor.
Chargedeck only records the order and notifies your store.

= Why is my order still "pending" after the buyer paid? =
The order is completed by the webhook. Check that:
* Your **Webhook URL** in the Chargedeck dashboard points to this store.
* The **Webhook signing secret** in the plugin matches the dashboard secret.
* Your site is reachable over HTTPS from the internet.
Use the dashboard **Send test event** button to confirm delivery.

= What currencies are supported? =
GBP, USD, EUR, CAD, AUD.

== Changelog ==

= 1.0.0 =
* Initial release: redirect checkout gateway + signed `order.paid` webhook
  receiver with replay protection and amount/currency verification.
