=== Integrate Saman Gateway for EDD ===
Contributors: mohammadr3z
Tags: easy digital downloads, edd, payment gateway, saman, sep
Requires at least: 5.5
Tested up to: 7.0
Requires PHP: 7.2
Requires Plugins: easy-digital-downloads
Stable tag: 1.2.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Saman Bank online payment gateway (SEP) integration for Easy Digital Downloads.

== Description ==

Saman Gateway (SEP) online payment gateway for Easy Digital Downloads.

Features include:

* Secure payment processing via Saman Payment (SEP)
* Automatic user redirection to bank gateway
* Transaction verification and amount validation
* Automatic transaction reversal on amount mismatch
* Protection against duplicate payments
* Support for both Iranian Rial and Toman

=== Security ===

The plugin includes several security measures to protect payment processing:

* Transaction amount validation during verification.
* Verification of the transaction reference number against the corresponding purchase.
* Protection against duplicate callback processing.
* Cryptographically secure transaction reference generation.
* Rate limiting on the payment callback endpoint.
* Validation of callback requests.
* Restricted logging of sensitive transaction data.
* Sensitive customer information is masked in logs.
* Automatic transaction reversal when verification detects an amount mismatch.

== Installation ==

1. Install the plugin from Plugins → Add New → Upload Plugin in your WordPress dashboard.
2. Go to Downloads → Settings → Payments → Saman (SEP) and enter your terminal number.
3. Enable the Saman (SEP) payment gateway under Payment Gateways.
4. Register your store server IP address with Saman Bank. This is required for token generation and transaction verification.

=== Configuration ===

After activating the plugin:

1. Open the Easy Digital Downloads payment settings.
2. Select the Saman (SEP) gateway.
3. Enter the terminal number provided by Saman Bank.
4. Enable the gateway.
5. Make sure the server IP address used by your WordPress installation is registered with Saman Bank.

=== External services ===

Saman Electronic Payment (SEP)
Integrates with Saman Electronic Payment (SEP) to process online payments.

Payment token, verification, and reversal requests are sent to:
https://sep.shaparak.ir/

The plugin transmits the merchant terminal ID, order amount, reference number (ResNum), and return URL to request payment tokens, verify completed transactions, and perform automatic reversals. Customers enter card details securely on the bank's hosted payment page.

* [Official Website](https://sep.ir/)
* [Terms of Service](https://sep.ir/%D9%82%D9%88%D8%A7%D9%86%DB%8C%D9%86-%D9%88-%D9%85%D9%82%D8%B1%D8%B1%D8%A7%D8%AA-%D9%BE%D8%B0%DB%8C%D8%B1%D9%86%D8%AF%DA%AF%D8%A7%D9%86)
* [Privacy Policy](https://sep.ir/%D8%AF%D8%B1%D8%A8%D8%A7%D8%B1%D9%87-%D8%B3%D9%BE)

== Frequently Asked Questions ==

= Does this plugin require a Saman SEP merchant account? =

Yes. You need an active Saman Bank terminal and must register your server IP address with the payment provider.

= Does the plugin support Toman? =

Yes. The plugin supports both Iranian Rial and Toman.

= Which versions of Easy Digital Downloads are supported? =

The plugin is designed to work with Easy Digital Downloads 2.x and 3.x.

= Does the plugin process payments through a third-party service? =

Yes. The plugin connects to the Saman Electronic Payment (SEP) gateway API to request payment tokens, redirect customers to the secure bank portal, verify transactions, and perform automatic reversals when necessary. Please see the "External services" section for full details on data transmissions, terms of service, and privacy policies.

== Changelog ==

= 1.2.1 =

* Improvement: Enhanced customer mobile number resolution with extensible filter hooks (`edd_saman_sep_phone_post_fields` and `edd_saman_sep_phone_order_meta_keys`).
* Compatibility: Added support for standard EDD checkout phone fields and Digits order metadata alongside JetOTP.

= 1.2.0 =

* Improvement: Replaced inline style and script tags in gateway redirection with standard WordPress enqueue and print functions.

= 1.1.6 =

* Simplified and condensed gateway settings descriptions for improved usability.

= 1.1.5 =

* Fixed a race condition in the reversal processing lock by replacing add_option() with a direct INSERT IGNORE query, following the locking pattern used by WP_Upgrader::create_lock().

= 1.1.4 =

* Removed unused code, including the SEND_TOKEN_URL constant, EDD_SAMAN_SEP_URL constant, translation file loading, transaction token metadata, and the edd_saman_sep_res_num filter.
* Fixed an inconsistent plugin version number in the plugin header.

= 1.1.3 =

* Removed the strict transaction ownership validation setting from the admin panel.
* Transaction ownership is now checked only when the bank returns the purchase reference number.
* Added the edd_saman_sep_strict_res_num filter to allow developers to disable this validation when necessary.

= 1.1.2 =

* Fixed a critical issue where a successful payment could be incorrectly marked as failed and reversed when the VerifyTransaction service did not return the purchase reference number.
* Added the edd_saman_sep_verify_res_num_keys filter and logging of TransactionDetail keys to assist with troubleshooting.

= 1.1.1 =

* Removed the "Allow GET callback" setting. Only POST callbacks are accepted by default.
* Added the edd_saman_sep_allow_get_callback filter for developers who need to enable GET callbacks.

= 1.1.0 =

* Security: Required the ResNum returned by VerifyTransaction to match the purchase reference associated with the order, preventing completion of an order using a digital receipt belonging to another order.
* Security: Replaced md5(purchase_key + time) with random_bytes() for generating ResNum values.
* Security: Replaced the get/set transient locking mechanism with an atomic processing lock to prevent race conditions.
* Security: Added IP-based rate limiting to the payment callback endpoint.
* Security: Rejected GET callback requests unless the GetMethod option is explicitly enabled.
* Security: Masked email addresses, customer names, card numbers, and restricted log fields to an allowlist.
* Improvement: Escaped the redirect URL output in the payment form and added gateway nonce validation.

= 1.0.0 =

* Initial release for Saman Bank payment gateway.
