=== Blazo Checkout ===
Contributors: blazocheckout
Tags: woocommerce, checkout, hosted checkout, payments, delivery
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 8.0
Stable tag: 1.1.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Redirects WooCommerce checkout to the Blazo hosted checkout platform and writes completed orders back into WooCommerce.

== Description ==

Blazo Checkout connects your WooCommerce store to the **Blazo** hosted checkout platform. When a shopper proceeds to checkout, they are redirected to your Blazo checkout page to complete the order (address, delivery/courier selection, and payment). Once the order is confirmed, Blazo sends it back to your store and a matching WooCommerce order is created with the customer, address, shipping, and fee details.

**Blazo** is a product brand owned by Fantasy Software Ltd. Blazo Checkout is one product in the Blazo line; this plugin is the official WooCommerce connector for it.

**Features**

* Redirects the native WooCommerce checkout to your Blazo hosted checkout page.
* Securely transmits cart and customer details (AES-256-GCM encrypted, HMAC-signed).
* Creates WooCommerce orders from the Blazo confirmation callback (HMAC-verified, with replay protection and idempotent de-duplication).
* Verifies the order total against the amount the shopper confirmed, to detect price tampering.
* Surfaces Blazo fulfilment context (courier, pickup office, B2B company/EIK) in the WooCommerce order screen.
* Syncs your Blazo custom order statuses into WooCommerce.
* High-Performance Order Storage (HPOS) compatible.
* Zero-touch connection: connect with a one-time onboarding token instead of copying IDs and secrets by hand.

A Blazo account is required to use this plugin.

== External services ==

This plugin relies on the **Blazo Checkout** third-party service to function. It is not usable without a Blazo account, and by installing it you direct your store's checkout traffic to Blazo.

**What is sent, and when**

1. **At checkout (browser redirect).** When a shopper clicks "Proceed to checkout", the plugin builds an order payload and redirects the shopper's browser to your configured Blazo checkout URL. The payload is AES-256-GCM encrypted and HMAC-signed and contains: store ID, currency, return/callback URLs, cart line items (product name, SKU, price, quantity, image URL, variation data), order totals, and the customer's email, first name and last name (where available).

2. **On connection (server to server).** When the merchant connects the store, the plugin sends a one-time onboarding token and the site URL to the Blazo API (`/plugin/bootstrap`) to retrieve the store configuration.

3. **Order confirmation (server to server).** Blazo calls back to this site to create the order. No store-initiated PII is sent in this step; the plugin receives and verifies the confirmed order data.

4. **Status sync (server to server).** The plugin periodically requests your custom order-status definitions from the Blazo API.

**Service endpoints**

* Checkout URL — configured by the merchant (e.g. `https://checkout.blazo.bg`)
* API base URL — configured by the merchant (e.g. `https://api.blazo.bg`)

**Service provider, terms and privacy**

* Service provided by Blazo (a product of Fantasy Software Ltd) — https://blazo.bg
* Terms of Service — https://blazo.bg/terms
* Privacy Policy — https://blazo.bg/privacy

Merchants are responsible for disclosing this data flow to their own customers as required by applicable privacy law.

== Installation ==

1. Install and activate WooCommerce (7.0 or newer).
2. Upload the `blazo-checkout` folder to `/wp-content/plugins/`, or install the plugin through the WordPress **Plugins > Add New** screen.
3. Activate the plugin through the **Plugins** screen in WordPress.
4. Go to **Blazo Checkout** in the admin menu.
5. Connect using the one-time token from your Blazo onboarding, or enter the Checkout URL, API URL, App Secret, and Store ID manually.

== Frequently Asked Questions ==

= Do I need a Blazo account? =

Yes. This plugin is a connector for the Blazo hosted checkout platform and cannot process checkouts on its own.

= Does it work with High-Performance Order Storage (HPOS)? =

Yes. The plugin only touches orders through WooCommerce CRUD APIs and declares HPOS compatibility.

= Is customer data sent securely? =

Yes. The checkout payload is AES-256-GCM encrypted and HMAC-signed, and the confirmation callback is verified with an HMAC signature, a timestamp window, and idempotent de-duplication.

== Changelog ==

= 1.1.2 =
* Bug fixes and stability improvements.

= 1.1.1 =
* Settings screen refinements and checkout on/off status sync.

= 1.1.0 =
* Zero-touch onboarding (one-time token connection).
* Store ⇄ Blazo connectivity pre-flight checks.
* Custom order status sync from Blazo.
* High-Performance Order Storage (HPOS) compatibility.

= 1.0.0 =
* Initial release.
