=== AcquirerOS Payment Gateway for WooCommerce ===
Contributors: gaydukevich1987
Tags: woocommerce, payment gateway, hosted checkout, credit card, payments
Requires at least: 6.5
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 2.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept card payments in WooCommerce with AcquirerOS Hosted Checkout or an advanced S2S / Direct API integration.

== Description ==

AcquirerOS Payment Gateway for WooCommerce adds an AcquirerOS-compatible payment method to classic WooCommerce checkout and the WooCommerce Checkout Block.

For new installations, Redirect / Hosted Checkout is the recommended and default mode. Customers enter card data on the hosted payment page rather than directly in WordPress. S2S / Direct API remains available as an advanced option for merchants that are specifically prepared to meet the applicable PCI DSS obligations.

= Payment modes =

* Redirect / Hosted Checkout (Recommended): WordPress sends order and customer information to the configured Hosted Checkout endpoint and redirects the customer to the returned payment URL. Card number, expiry date and CVV are not collected by this plugin in Redirect mode.
* S2S / Direct API (Advanced): Card number, expiry date and CVV are entered in WooCommerce and sent server-to-server to the configured payment endpoint for authorization. Merchants using this mode are responsible for confirming their PCI DSS scope and obligations with their payment provider and qualified compliance advisers.

= External service =

This plugin connects to the payment endpoint configured by the merchant in WooCommerce > Settings > Payments > AcquirerOS. The service is required to create and process payment transactions.

Depending on payment mode and transaction requirements, information sent to the configured endpoint can include order number, order amount, currency, product/order item information, billing and shipping details, customer name, email address, phone number, IP address, browser/user-agent information, callback URLs, and transaction identifiers. In S2S / Direct API mode only, card number, expiry date and CVV/CVC are also transmitted to the configured payment endpoint for payment processing.

AcquirerOS service: https://acquireros.com/

AcquirerOS Privacy Policy: https://acquireros.com/privacy/

AcquirerOS Terms of Service: https://acquireros.com/terms/

Merchants should publish appropriate privacy disclosures and ensure their use of the configured payment service complies with applicable laws, contractual requirements, and payment-card security requirements.

= Security notes =

* Hosted Checkout is the default mode for new installations.
* Card numbers and CVV/CVC are not stored in WordPress order metadata by this plugin.
* Diagnostic logs do not contain card numbers or CVV/CVC.
* Payment callbacks use per-order random callback tokens.
* Asynchronous notify callbacks require a valid gateway signature.
* Callback merchant, gateway, order number, amount and currency are checked before an order is updated.
* Notify callbacks accept POST requests only.
* Payment endpoints must use public HTTPS URLs.
* Duplicate successful callbacks are handled idempotently through WooCommerce payment status checks.

== Installation ==

1. Install and activate WooCommerce.
2. Install and activate AcquirerOS Payment Gateway for WooCommerce.
3. Go to WooCommerce > Settings > Payments > AcquirerOS.
4. Select Redirect / Hosted Checkout (Recommended) or S2S / Direct API (Advanced).
5. Enter Merchant Number, Gateway Number, Signature Key, and the applicable HTTPS payment endpoint.
6. Enable the payment method and save changes.
7. Test payment creation, Hosted Checkout or 3DS return, asynchronous notification, and WooCommerce order status updates before production use.

When upgrading from the legacy Doyza package, the plugin attempts to migrate existing `woocommerce_unify_app_b_settings` into the AcquirerOS settings on activation. Existing AcquirerOS installations keep their saved payment mode; Redirect becomes the default only for new installations.

== Frequently Asked Questions ==

= Which payment mode should I use? =

Redirect / Hosted Checkout is recommended for most merchants. S2S / Direct API should only be enabled when your organization and payment provider are prepared for the additional cardholder-data security requirements.

= Does the plugin store card numbers or CVV? =

No. The plugin does not save card numbers or CVV/CVC to WordPress order metadata. In Redirect mode it does not collect those values in WordPress. In S2S mode the values are used to create the payment request and are not written to the plugin diagnostic log.

= Does it support WooCommerce Checkout Block? =

Yes. Both Hosted Checkout and S2S modes support the WooCommerce Checkout Block as well as classic checkout.

= Is HPOS supported? =

Yes. The plugin uses WooCommerce order APIs and declares compatibility with High-Performance Order Storage.

= Where are diagnostic logs? =

When diagnostic logging is enabled, logs are available in WooCommerce > Status > Logs under the AcquirerOS gateway source. These logs are intended for troubleshooting and do not include card number or CVV/CVC.

== Changelog ==
= 2.2.0 Review Fix 3 =
* Moved checkout behavior to a properly enqueued static JavaScript file for WooCommerce AJAX compatibility.




= 2.2.0 =
* Made Redirect / Hosted Checkout the recommended default for new installations.
* Kept S2S / Direct API as an advanced optional mode.
* Added an administrator notice explaining Hosted Checkout versus S2S card-data scope.
* Removed bundled third-party card-brand artwork from the WordPress.org first release candidate.
* Added WordPress privacy-policy suggested text.
* Hardened callbacks by validating HTTP method, merchant number, gateway number, order number, amount and currency before updating orders.
* Required POST for asynchronous notify callbacks.
* Hardened configured payment endpoint validation and continued to use the WordPress safe HTTP API.
* Improved diagnostic HTTP status logging without logging PAN or CVV.
* Updated WordPress.org readme, security notes, installation instructions and external-service disclosure.

= 2.1.1 =
* Added production dual-mode checkout: S2S / Direct API and Redirect / Hosted Checkout.
* Aligned Hosted Checkout request/signature behavior with the existing Hosted Checkout integration.
* Added unique payment order numbers and goods numbers for retry safety.
* Added tokenized WooCommerce wc-api return/notify callbacks and callback signature verification.

= 2.1.0 =
* Added S2S / Direct API and Redirect / Hosted Checkout payment modes.

= 2.0.0 =
* Rebranded the plugin for AcquirerOS.
* Added Checkout Block and HPOS compatibility.
* Replaced direct cURL usage with the WordPress HTTP API.
* Replaced direct PHP callback execution with the WooCommerce API endpoint.
* Added per-order callback tokens, safer logging and legacy settings migration.

== Upgrade Notice ==

= 2.2.0 =
Hosted Checkout is now the default for new installations. Existing stores retain their saved payment mode. Test payment creation and callbacks in staging before production deployment.
