=== HandyPay Payments ===
Contributors: kylekonstnar
Tags: payments, stripe, checkout, payment links, ecommerce
Requires at least: 6.2
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept payments anywhere on your WordPress site with HandyPay. Drop a button, share a payment link, manage everything from one dashboard.

== Description ==

**HandyPay** lets you accept card payments on your WordPress site without WooCommerce or a complicated checkout setup. Create a payment button, then drop it on a page, share it as a URL, or paste it in an email.

= Why HandyPay? =

* **One button, three ways to use it** — embed on a page, share a URL, paste raw HTML on any site.
* **Unlimited buttons** — one for every service, product, or tier. Manage them all from one screen.
* **Sharable payment links** — `/handypay/pay/your-slug` URLs you can drop in DMs, emails, social bios.
* **Reusable or one-time** — pay-me-anytime tip jar, or single-use ticket link that expires after one purchase.
* **Custom design** — colors, padding, corner radius, font (built-in Matter, Google Fonts, or upload your own).
* **Live preview** — see the button update as you configure it.
* **Built-in dashboard** — revenue stats, recent payments, status breakdown, sparkline chart.
* **Powered by HandyPay** — a complete merchant platform, including a mobile app, payouts, and dispute management.

= HandyPay Pro =

HandyPay Pro is an optional paid upgrade ($29/month):

* **Reduced transaction fees** on every payment.
* **Custom payment-page branding** — your logo, colors, and a footer message — added by the separate HandyPay Pro add-on, installed from [handypay.me](https://handypay.me).

The "Secure checkout powered by HandyPay" credit on the payment page is off by default and only appears if you turn it on under HandyPay → Settings.

= What you need =

1. A HandyPay merchant account — sign up at [merchant.handypay.me](https://merchant.handypay.me/onboarding) (free).
2. One click to connect — HandyPay creates your API key and registers the webhook for you.
3. Two minutes for setup.

= Features =

* Drop-in `[handypay_pay]` shortcode with attributes for amount, currency, description, button text, colors, font, padding, and size.
* Payment Buttons admin: create unlimited buttons, each with its own price and styling.
* Sharable payment links at clean URLs.
* Webhook reconciliation with HMAC-SHA256 signature verification.
* Built-in dashboard mirroring the HandyPay merchant portal.
* Custom font uploads (.woff2, .woff, .ttf, .otf).
* Curated Google Fonts: Inter, Roboto, Poppins, Manrope, DM Sans, Plus Jakarta, Work Sans, Space Grotesk.
* Onboarding wizard for first-time merchants.
* Test mode toggle.

== Installation ==

1. Install **HandyPay Payments** from **Plugins → Add New** (search "HandyPay"), or upload the `handypay-payments` folder to `/wp-content/plugins/`. Click **Activate**.
2. Go to **HandyPay** and click **Connect HandyPay**. Sign in at handypay.me and your store is linked in one click — we create the API key and register the webhook for you automatically. No keys to copy, no webhook to set up by hand.
3. Go to **HandyPay → Payment Buttons** and create your first button, then drop it on any page with the block, shortcode, or your page builder.

Prefer to enter credentials manually? You still can under **HandyPay → Settings**.

== External services ==

This plugin connects to the **HandyPay payments API** (`https://api.handypay.me`) to create payment sessions, render signed buttons, and reconcile payments through HandyPay's payment processor (**Stripe**). This connection is required for the plugin to accept payments.

* **When:** when a button or payment link is rendered, when a customer starts a payment, when HandyPay sends a webhook to your site, and when the store owner views the dashboard or manages payments.
* **Data sent:** payment amount and currency, button/link descriptions, the customer's email (if provided at checkout), and your HandyPay API key for authentication. Raw card details are collected by HandyPay/Stripe directly and are never sent to or stored on your site.
* **HandyPay:** Terms — https://handypay.me/terms · Privacy — https://handypay.me/privacy
* **Stripe (payment processor):** Terms — https://stripe.com/legal · Privacy — https://stripe.com/privacy

== Frequently Asked Questions ==

= Do I need WooCommerce? =

No. HandyPay is standalone and works on any WordPress site, including page-builder themes like Elementor, Divi, Bricks, Beaver Builder, and the default block editor.

= Where does the payment actually happen? =

On a HandyPay-hosted Stripe Checkout page. Customers leave your site, complete payment, and return to your configured success page. PCI compliance is handled by HandyPay + Stripe — your WordPress site never touches card data.

= Can prices be tampered with? =

No. Amounts are signed server-side when the button renders, and re-verified on the way to checkout. Customers can't modify prices via DevTools.

= Which currency does the plugin use? =

New payment buttons and shortcode payments default to the site's primary HandyPay payment currency. You can select another supported charge currency when creating a button. Dashboards and charts never add unlike currencies together; detailed reports remain grouped by ISO currency code.

= How are webhooks verified? =

HandyPay signs every webhook with HMAC-SHA256. The plugin verifies in constant time using PHP's `hash_equals` before processing.

= Can I use my own fonts? =

Yes. Upload `.woff2`, `.woff`, `.ttf`, or `.otf` files via **HandyPay → Fonts**, then pick them in Settings → Appearance → Font. Each button can also override the font via the `font="..."` shortcode attribute.

= Does it work on multisite? =

Yes. Activate per-site; each site has its own API key and settings.

= What countries are supported? =

Wherever HandyPay supports onboarding merchants. See [handypay.me](https://handypay.me) for the current list.

== Screenshots ==

1. The dashboard — KPI cards (today / 7 / 30 days / all-time), revenue chart, recent payments.
2. Payment Buttons list — every button you've created, with status, usage, and copy URL/shortcode actions.
3. Create button form — amount, description, reusable toggle, expiration, appearance.
4. The public payment landing page — clean Stripe-style checkout with your branding.
5. Settings → Appearance — live preview with color/font/size/padding controls.
6. Plan & Branding — upgrade to Pro for reduced fees + custom branding.

== Changelog ==

= 1.2.0 =
* Subscription lifecycle webhooks: the plugin now subscribes to customer.subscription.created/updated/deleted, invoice.paid, and invoice.payment_failed, so HandyPay for WooCommerce sees renewals, failed renewals, and cancellations. Existing sites re-register their endpoint on the next admin visit.
* Fixed: a customer's subscription event could be mistaken for this site's own HandyPay Pro billing and change the plan status. Plan updates now come only from pro-subscription events and the plan refresh button.
* API client: fetch, list, cancel, resume, and open the customer manage page for subscriptions; subscription checkouts accept trial days, a saved customer, and one-time sign-up items.
* Add-ons hub recognises HandyPay for WooCommerce by its real plugin folder and links to it for subscriptions.

= 1.1.0 =
* Added recurring checkout API support for HandyPay for WooCommerce subscriptions.
* Test mode is real: separate Live and Test API key slots (both encrypted), a working mode switch, and per-mode webhook secrets. Keys pasted into the wrong slot are sorted automatically by their prefix, and installs holding a test key in the single slot migrate on update.
* Merchants who have not finished HandyPay onboarding default into test mode (a mode you choose by hand always wins), with an orange notice on HandyPay screens naming the 4242 4242 4242 4242 test card.
* Test payments are tagged TEST in the Payments list and excluded from every KPI, report, chart, and CSV, so test money never mixes into real totals. Test webhook events can never change live payments.
* Payments can be dismissed and restored, with a dismissed view - handy for decluttering after testing.
* Refund honesty: the Payments screen now respects the API's refund status instead of recording success blindly; failed refunds change nothing and say so.
* New dashboard service hub: live system status, the latest HandyPay product updates, help and support entry points, and your payout bank account at a glance with a direct link to add or manage it.

= 1.0.1 =
* Added country-aware currency symbols and all currently enabled HandyPay merchant currencies to payment controls.
* Payment buttons now default to the site's primary payment currency.
* Dashboard and report charts isolate currencies instead of combining unlike amounts.
* Fixed webhook subscriptions: the plugin now registers the event names the HandyPay API actually sends, so payments, bookings, and orders confirm automatically again. Existing sites re-register themselves on the next admin visit — no action needed.
* Payment statuses now sync for expired checkouts and delayed (asynchronous) payment methods, and a checkout is only marked paid once the money has actually moved.
* New: a floating Feedback button on every HandyPay screen — report an issue or idea straight to the HandyPay team and get a case reference back.
* Plan & Billing: refresh your plan status after subscribing on the HandyPay dashboard, plus clearer past-due billing warnings.
* Security hardening from a full audit: stricter refund amount validation with duplicate-submit protection, rate limiting on public checkout endpoints, webhook amount/site verification, an HTTPS allowlist for the API base URL, safer CSV exports, and multisite-aware uninstall.
* Refreshed the HandyPay logo across the plugin to match the current brand icon.

= 1.0.0 =
* First stable release.
* Refund management from the Payments screen.
* Dispute management with evidence submission.
* Redesigned create-button form and admin tables (shadcn-style), toast and confirm dialogs, and a full-screen admin app shell.
* External-services disclosure added (HandyPay API + Stripe).

= 0.4.0 =
* Custom font uploads (.woff2/.woff/.ttf/.otf) + curated Google Fonts.
* Payment Buttons (renamed from Payment Links) with per-row Copy URL and Copy Shortcode.
* Plan & Branding admin: free vs Pro, upgrade flow, branded payment page (logo, colors, footer text, hide HP branding).
* Subscription webhook handlers update the cached plan automatically.
* Dashboard nudge for free merchants to upgrade.

= 0.3.0 =
* Payment Links (now "Payment Buttons"): create reusable / one-time / capped / expiring buttons with their own URLs.
* Public landing page at `/handypay/pay/<slug>`.
* `[handypay_pay link="slug"]` shortcode mode.
* Webhooks increment use count for one-time and capped links.

= 0.2.0 =
* Live preview on the settings page.
* Button color, hover color, padding, font size, font weight, corner radius controls.
* Size presets (Small / Medium / Large).
* Matter typeface (same as the HandyPay merchant portal).
* Built-in dashboard mirroring the HandyPay merchant portal.

= 0.1.0 =
* Initial release.

== Upgrade Notice ==

= 1.0.0 =
First stable release with refunds, disputes, and a redesigned admin. Re-activate once to apply database upgrades.

= 0.4.0 =
Adds custom font uploads, the Plan & Branding screen, and renames Payment Links to Payment Buttons. Re-activate the plugin once to flush rewrite rules and create the new options.
