=== CHIP for WooCommerce ===
Contributors: chipasia, wanzulnet, awisqirani, amirulazreen
Tags: chip
Requires at least: 6.3
Tested up to: 7.0
Stable tag: 2.1.0
Requires PHP: 7.4
License: GPLv3
License URI: http://www.gnu.org/licenses/gpl-3.0.html

CHIP - Digital Finance Platform. Securely accept one-time and subscription payments with CHIP for WooCommerce.

== Description ==

**CHIP for WooCommerce** is the official payment gateway plugin that connects your WooCommerce store to CHIP's powerful Digital Finance Platform. Accept payments seamlessly with Malaysia's leading payment methods.

= Why Choose CHIP for WooCommerce? =

* **WooCommerce Blocks Support** - Fully compatible with the new WooCommerce Blocks checkout experience
* **Multiple Payment Methods** - Accept FPX, Credit/Debit Cards, DuitNow QR, E-Wallets, and more
* **Subscription Payments** - Native support for WooCommerce Subscriptions
* **Tokenization** - Allow customers to save cards for faster checkout
* **Direct Post Integration** - Secure card payments without redirecting customers
* **Pre-Orders Support** - Works seamlessly with WooCommerce Pre-Orders
* **Authorize & Capture** - Delay capture for card payments until order fulfillment

= Supported Payment Methods =

* **FPX** - Malaysia's #1 online banking payment
* **FPX B2B1** - Corporate online banking
* **Credit/Debit Cards** - Visa, Mastercard, Maestro
* **DuitNow QR** - Malaysia's national QR payment
* **E-Wallets** - GrabPay, Touch 'n Go, Boost, and more via Razer

= About CHIP =

CHIP is a comprehensive Digital Finance Platform specifically designed to support and empower Micro, Small and Medium Enterprises (MSMEs). We provide a suite of solutions encompassing payment collection, expense management, risk mitigation, and treasury management.

Our aim is to help businesses streamline their financial processes, reduce operational complexity, and drive growth. With CHIP, you gain a financial partner committed to simplifying, digitizing, and enhancing your financial operations for ultimate success.

= Documentation =

Integrate your WooCommerce site with CHIP as documented in our [API Documentation](https://docs.chip-in.asia).

== Screenshots ==

1. Gateway configuration - Enter your Brand ID and Secret Key to connect with CHIP.
2. Payment gateways overview - All CHIP payment gateways available in WooCommerce Payments settings.
3. Payment method settings - Configure accepted payment methods and card options.
4. Card payment form (Legacy) - Secure card input with Visa/Mastercard brand detection.
5. FPX bank selection - Choose from available Malaysian banks with status indicators.
6. WooCommerce Blocks checkout - Modern checkout experience with card payment support.
7. Saved cards selection - Returning customers can pay with saved cards.
8. CHIP payment page - Secure hosted checkout for completing payment.
9. Order confirmation - Customer receives order confirmation after successful payment.
10. Order admin panel - View payment details including card brand and Purchase ID.
11. Capture payment - Capture pre-authorized payments when ready to fulfill.
12. Refund order - Process full or partial refunds directly from WooCommerce.
13. Site Health integration - Verify CHIP API connection status in WordPress Site Health.

== Changelog ==

= 2.1.0 =
* Added - Unified payment method dropdown. The classic and Blocks checkout now renders a single dropdown listing all eligible payment methods (FPX banks, Razer e-wallets, DuitNow QR, Card) instead of three separate POST fields. The selected value is submitted as a tag-encoded `chip_payment_method` field (e.g. `fpx:MB2U0227`, `fpx_b2b1:PBB0234`, `razer:GrabPay`, `dnqr`, `card`).
* Added - Card group. The Card entry in the `payment_method_whitelist` multiselect now expands at runtime to the full `{visa, mastercard, maestro}` group, matching the existing DuitNow QR group pattern. Saved values containing the legacy `visa`/`mastercard`/`maestro` multiselect keys are auto-migrated in memory to the new `card` key on the next load.
* Added - REST endpoint type `unified`. `GET /chip/v1/banks/unified/<gateway>` returns the merchant's eligible payment methods as a flat `{ tag: label }` object, used by the unified dropdown for lazy loading.
* Added - Blocks support class `unified` mode. Mixed whitelists (Card plus one or more dropdown methods, or two or more dropdown methods) now render the unified dropdown alongside the card form in Blocks checkout. Saved cards coexist with the dropdown.
* Added - Shared `UnifiedPaymentMethodList` React component used by all five clone gateway bundles, exposed via `wp.element.createElement` and registered as a webpack `dependencies` injection so the shared bundle loads before each clone bundle in the browser.
* Changed - `bypass_chip()` rewritten as a tag parser that handles `fpx:CODE`, `fpx_b2b1:CODE`, `razer:WALLET`, `dnqr`, `card`, plus the legacy single-method values.
* Changed - Card option label clarified to "Card (Visa, Mastercard, Maestro)" in the unified dropdown for explicit disclosure of the accepted card networks.
* Changed - Replaced the placeholder `assets/duitnow_qr.png` with a proper 50x50 DuitNow logo rendered from the existing `duitnow_only.svg`, matching the visual style of the other dropdown option icons.
* Fixed - `is_card_only_whitelist()` and `process_payment_with_context()` correctly handle the constructor-expanded `['card']` whitelist so the card-only merchant flow (delayed capture, Blocks checkout direct POST) works after the Card group refactor.
* Fixed - Blocks support class `js_display` decision now uses the in-memory expanded whitelist so saved `['card']` and `['fpx', 'card']` merchants correctly render `js_display='unified'` instead of an empty value.
* Fixed - Shared `unified-payment-method-list` bundle is now enqueued via a webpack `SharedBundleDependencyPlugin` that injects the dependency into each clone's `.asset.php`, so the component renders at runtime instead of returning `null`.
* Changed - Blocks checkout renders the unified dropdown as a native `<select>` element (no logo) for a lighter, more accessible experience.
* Added - Offline FPX banks are now displayed but disabled (not selectable) in both classic and Blocks checkout, instead of being silently removed.
* Added - Crypto Coin and Atome e-wallet logos in the unified dropdown.
* Changed - Card option logo now uses the Visa/Mastercard-only asset (no CHIP badge).
* Fixed - Cross-contamination between gateway clones on the order-pay page: each gateway's dropdown now submits a scoped field name (`chip_payment_method_<id>`) so a DuitNow QR-only clone can no longer clobber another gateway's FPX selection.
* Fixed - Global JS collision where only the last gateway clone received the dropdown enhancement (selectWoo, logo, hidden mirror); all scoped selects are now enhanced in one pass.
* Fixed - Card option on the order-pay "try again" page now redirects to the CHIP payment page (`?preferred=card`) so the customer fills card details at CHIP.
* Fixed - Offline bank list race condition: the unavailable-bank lists are now computed lazily so they are correct regardless of when the gateway is queried.
* Fixed - Removed a per-page-load curl to the CHIP health-check API (`api.chip-in.asia/health_check`) that ran on every request via `register_script()`; the bank data is now only fetched on the checkout page.
* Fixed - Saved-card subscription payments failed with "Expected a list of items but got type dict". `array_intersect()` preserved the keys of the group-expanded whitelist, so `json_encode()` serialized the recurring whitelist as a JSON object instead of a list. The recurring whitelist is now re-indexed with `array_values()`.
* Fixed - Card data is now posted to CHIP via jQuery `.val()` setters instead of string concatenation, removing a DOM-based XSS vector in the direct-post flow.
* Fixed - Bank codes and `?preferred=` values are now `rawurlencode()`d before being appended to the redirect URL, preventing parameter injection.
* Added - A "CHIP Saved Card" metabox on the subscription admin page lets a store owner switch the subscription's saved card without the customer logging in. Only existing saved tokens are offered (never a raw card number), and switching records a consent note on the subscription for audit.
* Fixed - The `/chip/v1/banks` REST endpoint now requires a valid `wp_rest` nonce (sent as `X-WP-Nonce` by the Blocks checkout), so unauthenticated callers can no longer trigger the outbound health-check request at will.
* Fixed - Cardholder name and masked PAN are now redacted from debug logs, so enabling debug mode does not write customer PII to the log file.
* Changed - Payment-methods API cache TTL raised to 1 hour (from 3 minutes / 30 minutes) to reduce outbound API latency on checkout.
* Fixed - Renewal and pre-order charges now fail fast with a clear note when no saved card matches the gateway, instead of charging with an empty token and surfacing a confusing "Invalid or inactive recurring token" error.

[See changelog for all versions](https://raw.githubusercontent.com/CHIPAsia/chip-for-woocommerce/main/changelog.txt).

== Installation ==

= Demo =

[Test with WordPress](https://tastewp.com/new/?pre-installed-plugin-slug=chip-for-woocommerce&pre-installed-plugin-slug=woocommerce&redirect=admin.php%3Fpage%3Dwc-settings%26tab%3Dcheckout%26section%3Dchip&ni=true)

= Minimum Requirements =

* PHP 7.4 or greater is required (PHP 8.0 or greater is recommended)
* MySQL 5.6 or greater, OR MariaDB version 10.1 or greater, is required

= Automatic installation =

Automatic installation is the easiest option -- WordPress will handle the file transfer, and you won't need to leave your web browser. To do an automatic install of CHIP for WooCommerce, log in to your WordPress dashboard, navigate to the Plugins menu, and click "Add New."

In the search field type "CHIP for WooCommerce," then click "Search Plugins." Once you've found us, you can view details about it such as the point release, rating, and description. Most importantly of course, you can install it! Click "Install Now," and WordPress will take it from there.

= Manual installation =

Manual installation method requires downloading the CHIP for WooCommerce plugin and uploading it to your web server via your favorite FTP application. The WordPress codex contains [instructions on how to do this here](https://wordpress.org/support/article/managing-plugins/#manual-plugin-installation).

= Updating =

Automatic updates should work smoothly, but we still recommend you back up your site.

== Frequently Asked Questions ==

= Where is the Brand ID and Secret Key located? =

Brand ID and Secret Key are available through our [merchant dashboard](https://gate.chip-in.asia). Navigate to Developer > Credentials after logging in.

= What currencies are supported? =

CHIP for WooCommerce supports MYR (Malaysian Ringgit) as the primary currency. Contact CHIP support for multi-currency options.

= Is this plugin compatible with WooCommerce Blocks? =

Yes! CHIP for WooCommerce fully supports the new WooCommerce Blocks checkout experience, including card payments, saved cards, and all payment methods.

= Can customers save their cards for future purchases? =

Yes. Enable "Allow Customers to Save Cards" in the gateway settings. Customers can then save their Visa, Mastercard, or Maestro cards for faster checkout.

= Why is my order showing "On Hold" status? =

Orders with "On Hold" status have pre-authorized payments awaiting capture. Go to the order page and click "Capture Payment" when ready to charge the customer.

= How do I capture a pre-authorized payment? =

Navigate to WooCommerce > Orders, open the order, and click the "Capture Payment" button in the order actions section. You can also enable auto-capture when order status changes to Processing or Completed.

= Does this work with WooCommerce Subscriptions? =

Yes! CHIP for WooCommerce supports WooCommerce Subscriptions with automatic recurring payments using saved cards.

= Does this work with WooCommerce Pre-Orders? =

Yes. Pre-Orders are supported with card tokenization. The saved card will be charged when the pre-order is released.

= Payment failed but money was deducted from my account? =

This is usually a temporary hold by your bank. If payment failed on CHIP's end, the hold will be released automatically within 1-7 business days depending on your bank.

= Why can't I see the CHIP payment option at checkout? =

Check the following:

1. Plugin is activated and gateway is enabled
2. Brand ID and Secret Key are correctly configured
3. Your store currency is supported (MYR)
4. Check Site Health (Tools > Site Health) for API connection status

= Is card data stored on my server? =

No. Card data is processed directly by CHIP's secure servers. Your WooCommerce store never handles or stores sensitive card information, ensuring PCI compliance.

= Are there any transaction fees? =

Transaction fees are determined by your CHIP merchant agreement. Contact CHIP sales for pricing details.

= Where can I find documentation? =

Visit our [API documentation](https://docs.chip-in.asia/) for technical reference.

= What CHIP API services are used in this plugin? =

**CHIP API** – `CHIP_ROOT_URL` (https://gate.chip-in.asia)

*Payment Operations:*

- `/purchases/` – Create payment
- `/purchases/{id}/` – Get payment status
- `/purchases/{id}/refund/` – Refund payment
- `/purchases/{id}/capture/` – Capture pre-authorized payment
- `/purchases/{id}/release/` – Release pre-authorized payment

*Card Token Operations:*

- `/purchases/{id}/charge/` – Charge saved card
- `/purchases/{id}/delete_recurring_token/` – Delete saved card

*Other:*

- `/payment_methods/` – Get available payment methods
- `/clients/` – Create clients

**FPX Health Check API** – `CHIP_FPX_ROOT_URL` (https://api.chip-in.asia/health_check)

- `/fpx_b2c` – FPX B2C bank status
- `/fpx_b2b1` – FPX B2B1 bank status

= How to clone CHIP for WooCommerce? =

Create a new class that extends **Chip_Woocommerce_Gateway** with your own customizations.

Then, hook it with filter **woocommerce_payment_gateways** and pass your class name to it.

Refer to **includes/class-chip-woocommerce-gateway-2.php** for an example.

= How to remove additional payment methods? =

Add this constant to your wp-config.php file:

`define( 'CHIP_WOOCOMMERCE_DISABLE_GATEWAY_CLONES', true );`

== Links ==

[CHIP Website](https://www.chip-in.asia)

[Terms of Service](https://www.chip-in.asia/terms-of-service)

[Privacy Policy](https://www.chip-in.asia/privacy-policy)

[API Documentation](https://docs.chip-in.asia/)

[CHIP Merchants & DEV Community](https://www.facebook.com/groups/3210496372558088)
