== Changelog ==

Full release history for eew Subscriptions Lite. The most recent entries also
appear in readme.txt; everything from 1.3.7 back lives here, to keep readme.txt
under the size WordPress.org recommends.

= 1.3.8 =
* New: the Subscription Form block and `[eew_sub_lite_subscription_form]` shortcode gained a "Hide plans the visitor already subscribes to" option. Any plan a logged-in visitor already has an active subscription to is left out of the plan list, and when that leaves nothing to offer the form disappears entirely - or shows a short message of your choosing instead.
* New: "Create Webhook Automatically" buttons on the Stripe and PayPal settings sections. These register the webhook URL with the gateway and store the signing secret / webhook ID for you, instead of requiring you to copy the URL into the vendor dashboard, tick individual event checkboxes, and paste a secret back by hand. If a webhook for the same URL already exists, Stripe's is replaced with a fresh one and PayPal's is reused as-is - the buttons now say which on screen.
* Fix: PayPal API errors now include the specific reason PayPal gives (e.g. "Not a valid webhook URL") rather than only its generic top-level message.
* Performance/hardening: product names and descriptions shown on the subscription form are now cached for 12 hours instead of being fetched live from Stripe on every page view, and the endpoint that serves them is rate limited in line with the plugin's other public endpoints. Previously a busy (or hostile) page could drive one Stripe API call per configured product per visit. Note a product renamed in the Stripe dashboard can now take up to 12 hours to appear on the form.
* Security: the two PayPal subscription endpoints now require a valid WordPress request nonce, so they can only be reached from a page on your site rather than called directly - matching the protection the Stripe endpoints have had since 1.2.4/1.2.9. One of the two creates a WordPress account for a first-time PayPal payer, so this closes an anonymous account-creation path. No action needed on your part, and no change to how the payment form behaves.
* Security: the PayPal subscription endpoint now accepts only plan IDs that are actually configured under Products in the plugin settings, instead of any plan that happens to exist in your PayPal account.
* Bugfix: uninstalling Lite on a site that also has the full edition installed no longer deletes the Stripe customer ID stored against each user. That meta key is deliberately shared between the two editions - it is what keeps your subscribers linked to their Stripe customer through a Lite to full upgrade - so deleting it silently unlinked every subscriber on the other edition. The shared database tables were already protected this way; the user meta now matches.
* Docs: "Tested up to" updated to 7.1 - this release has been tested against WordPress 7.1 with no issues found.

= 1.3.7 =
* Bugfix: a cached Stripe customer ID left over from before a Stripe key/mode change (or after a customer was deleted directly in the Stripe dashboard) could crash the customer lookup and setup-intent endpoints with a server error instead of failing gracefully. The plugin now verifies a cached customer ID against Stripe before using it and transparently re-creates it if it's no longer valid.
* Docs: readme Tags updated to include PayPal, live demo link added near the top of the plugin description, Installation's webhook step now links directly to the Stripe and PayPal sections of the setup guide, and "Tested up to" updated to 7.0.2.

= 1.3.6 =
* Bugfix: the Stripe secret key, Stripe webhook secret, and PayPal client secret/webhook ID settings fields could be silently wiped if a browser or password manager cleared the pre-filled password field and the settings page was then saved for any reason - saving now treats a blank submission the same as "unchanged" rather than overwriting a working secret with nothing. Recommended if you've experienced webhook signature failures ("Invalid signature") after a routine settings save.

= 1.3.5 =
* Docs: the Products settings section's description and Product ID field help text still referred to Stripe specifically after 1.3.4 made the section title vendor-neutral - now consistent for PayPal-only sites too.
* Docs: the "What webhook events should I listen for?" FAQ now covers PayPal's required webhook events (previously only mentioned in the 1.3.1 changelog entry), and the External Services section now names PayPal's sandbox API host alongside its live one.
* Internal: removed an accidental duplicate function definition in the manage-subscriptions dashboard script (no behaviour change).

= 1.3.4 =
* Internal: the Products settings section and the "no products configured" notice no longer refer to Stripe specifically, now that PayPal is also supported as a payment vendor - wording only, no functional change.

= 1.3.3 =
* Security: the subscription form now shows each billing option's actual live price and billing frequency, resolved directly from Stripe and/or PayPal, alongside its label - protects customers from a billing option whose label doesn't match what they would actually be charged.
* New: the Settings page's Stripe and PayPal key fields are now labelled with their vendor for clarity, and the API/webhook key fields and Stripe Price ID / PayPal Plan ID fields each link to the relevant section of the setup guide.

= 1.3.2 =
* New: the WP Dashboard widget now shows PayPal alongside Stripe - a Setup & Health row per configured vendor, correct per-vendor mode badges, and a dashboard link for each configured vendor instead of a Stripe-only shortcut.
* Bugfix: after a successful subscription redirect, the page didn't scroll to the confirmation message - on a long page this could leave a customer looking at an unrelated part of the page with no visible sign anything had happened.

= 1.3.1 =
* Bugfix: recurring PayPal subscription payments (renewals after the first billing cycle) were not sending admin/customer notification emails - PayPal delivers these as a separate `PAYMENT.SALE.COMPLETED` event distinct from the subscription-lifecycle events already handled, which was previously unhandled. Note: sites using PayPal subscriptions also need to add "Payment sale completed" (and optionally "Payment sale denied") to their PayPal webhook's subscribed event types for this to take effect.

= 1.3.0 =
* New: PayPal is now supported as an optional second payment vendor alongside Stripe for subscriptions. Pair a PayPal Plan ID with (or instead of) a Stripe Price ID on each billing option in settings; customers see a simple Card / PayPal choice when both are configured for the same plan, and no extra step at all on a site using only one vendor.
* New: the manage subscriptions dashboard and cancel action now correctly recognise whichever vendor a given subscription actually used, rather than assuming Stripe.
* New: the "Enabled Payment Vendors" setting is now a genuine kill switch - disabling a vendor there immediately stops new checkouts through it and stops loading its script for visitors, rather than just hiding it from the checkout form while still quietly accepting requests.
* New: a clear message is now shown to visitors if every configured payment vendor is currently disabled, instead of a blank form.
* Requires a PayPal REST app (Client ID, Secret, and Webhook ID) if you choose to enable it - entirely optional, Stripe-only sites are unaffected.

= 1.2.9 =
* Added a stable Stripe idempotency key to SetupIntent subscription creation so concurrent or retried status requests cannot create duplicate subscriptions.
* Removed unused one-off payment storage code and stopped Lite from creating the full version's payments table.
* Removed stray Composer and PHPUnit artifacts and strengthened distribution exclusions to keep them out of future archives.

= 1.2.8 =
* Admin notification settings now accept multiple comma-separated recipient addresses (up to 25).
* Hardened SetupIntent status checks by requiring and validating the Stripe client secret before subscription state can be created or returned.
* Updated the bundled Stripe PHP SDK to 20.3.1 and removed upstream development folders from the distribution archive.
* Revised full-version references to describe only features supplied by the separately distributed plugin.

= 1.2.7 =
* Bugfix: subscription names were missing from the manage subscriptions dashboard due to an incorrect items array accessor.

= 1.2.6 =
* New: after a guest completes a subscription, the success screen now reminds them to check their email to set a password and log in to manage their subscription. Logged-in customers are unaffected.

= 1.2.5 =
* Unlimited subscription products - the settings page now has a products repeater and the subscription form offers plans from every configured product.
* Removed automatic login after guest checkout - new customers receive a password-set email and log in through the standard WordPress flow.
* Guest checkout hardening: a fresh Stripe customer is always created for guest purchases, and emails matching an existing account are asked to log in instead.
* Updated the bundled Stripe PHP SDK to the latest stable release.
* Rename plugin slug, text domain, main PHP file and .pot file
* Update cross-plugin detection paths in both uninstall.php files
* Security audit fixes: nonce guards, key encryption, filtered Stripe responses, generic error messages, auto-login restriction for existing accounts

= 1.2.4 =
* Fix of pre submit security and issues audit results plus various other fixes and improvments to get things in line for WP plugin repo submit
* Bugfix: re-saving the settings page could overwrite the stored Stripe secret key or webhook secret with its own masking placeholder, resulting in "Invalid API Key" errors. Masked key fields are now preserved correctly on save.
* Error hardening: a misconfigured or invalid Stripe API key now shows a clear message instead of returning a server error.

= 1.2.3 =
* Dashboard setup & health widget - Stripe/webhook status, last-webhook tracker and quick shortcuts.
* General bugfixes.

= 1.2.0 – 1.2.2 =
* Pro edition releases (content restriction and media gating) - no changes to Lite.

= 1.1.7 =
* Security hardening pass - tightened access control on REST routes, extra verification on public endpoints, additional rate limiting and quieter error logging.

= 1.1.6 =
* Fixed the keys-status colour in the dashboard health widget and a mixed-up CSS selector.

= 1.1.5 =
* Hygiene bump.

= 1.1.0 – 1.1.4 =
* Pro edition releases (admin overview dashboard and auto-updater fixes) - no changes to Lite.

= 1.0.8 =
* Webhook event filtering - events for Stripe products other than the configured product are now ignored (plays nicely with shared Stripe accounts).

= 1.0.7 =
* Tested with WordPress 7.0, plus small style updates.

= 1.0.6 =
* Manage Subscriptions block added.
* Assorted notification styling changes.

= 1.0.5 =
* Plan tier options now use the configured button colour selections.

= 1.0.4 =
* More style attributes connected up to the blocks.

= 1.0.3 =
* Text justification fixes for blocks.

= 1.0.2 =
* Primary/secondary text colouring added to blocks.

= 1.0.1 =
* Blocks can now use Gutenberg-native styling properties and panels.

= 1.0.0 =
* Initial release.


== Older Upgrade Notices ==

= 1.3.3 =
Customers now see each billing option's real Stripe/PayPal price and frequency alongside its label, so a mislabelled plan can no longer mislead them at checkout. Update recommended.

= 1.2.9 =
Prevents duplicate subscription creation during checkout retries and removes unused one-off payment and development artifacts from Lite.

= 1.2.8 =
Adds multiple admin notification recipients, strengthens SetupIntent authorization, updates Stripe PHP to 20.3.1, and cleans the production archive.

= 1.2.7 =
Fixes missing subscription names on the manage subscriptions dashboard.

= 1.2.6 =
Guests are now reminded to set their password and log in from the subscription success screen.

= 1.2.5 =
Rename plugin slug, text domain, main PHP file and .pot file
Update cross-plugin detection paths in both uninstall.php files
Security audit fixes: nonce guards, key encryption, filtered Stripe responses, generic error messages, auto-login restriction for existing accounts

= 1.2.4 =
First public release on WordPress.org.
