=== Kafene ===
Contributors: kafene
Donate link: https://kafene.com/
Tags: payments, checkout, lease-to-own, woocommerce, ecommerce
Requires at least: 5.5
Tested up to: 7.0
Requires PHP: 8.2
Stable tag: 2.0.0
License: GPLv3 or later
License URI: https://www.gnu.org/licenses/gpl-3.0.html

Add Kafene lease-to-own checkout to WooCommerce with an embedded application, signing, and payment flow.

== Description ==

Kafene adds a lease-to-own payment method to WooCommerce checkout. When a shopper selects Kafene at checkout, they complete a full end-to-end application, lease signing, and payment flow inside the Kafene modal. The order is updated from the checkout SDK callbacks (no store webhook required).

Features:

* Adds Kafene as a WooCommerce payment gateway.
* Supports both the classic WooCommerce checkout and the WooCommerce Checkout block.
* Lets merchants mark individual products or bulk-edit catalog items as Kafene-leasable.
* Updates order status from the Kafene Checkout SDK (approved / completed) via secure AJAX callbacks.
* Sandbox and production environments are selectable from the gateway settings.

== External services ==

This plugin relies on services provided by Kafene to deliver the lease-to-own checkout experience. The plugin cannot function without them. By installing and using the plugin you, and the shoppers who choose Kafene at checkout, agree to Kafene's terms of service and privacy policy linked at the end of this section.

Which environment is contacted (production or sandbox) is determined by the Environment setting in WooCommerce -> Settings -> Payments -> Kafene.

= Kafene Partner API =

What it is: Kafene's partner API, used to authenticate your store, retrieve the merchant approval limit, and activate approved leases. It is contacted at https://partner-api.kafene.com (production) or https://staging-partner-api.kafene.com (sandbox), selected by the Environment setting.

What data is sent and when:

* When the gateway needs to authenticate with Kafene (admin lease activation), your store's Merchant ID and API key are sent to obtain a short-lived access token.
* When WooCommerce determines whether Kafene is available at checkout and the merchant approval limit is not cached, get_bearer_token() is called and sends your store's Merchant ID and API key before retrieving the merchant approval limit. This limit is cached for 12 hours.
* When an approved order is activated, the Kafene application/transaction ID and the order's delivery date are sent to activate the lease.

= Kafene Checkout SDK =

What it is: Kafene's hosted JavaScript checkout SDK, which renders and runs Kafene's full lease application, signing, and payment flow in a modal. The SDK JavaScript and CSS are always loaded from https://sdk.kafene.com. The Environment setting selects whether checkout runs against sandbox or production backends.

What data is sent and when: When a shopper selects Kafene and proceeds at checkout, the plugin passes the current order's details to the SDK, which transmits them to Kafene to start the lease application. This includes:

* The shopper's billing and shipping contact details: first and last name, email address, phone number, and full address (street, city, state, ZIP/postal code, and country).
* The order contents: each line item's product identifier, name, price, and quantity.
* Shipping cost and the WooCommerce order ID for reconciliation.

In addition, during Kafene's hosted approval and signing flow the shopper may provide further personal and financial information directly to Kafene (for example, details required to verify identity and underwrite the lease). That information is collected and processed by Kafene under its own terms and privacy policy.

= Service provider and legal =

All of the services above are provided by Kafene.

Kafene Terms of Service: https://www.kafene.com/legal/terms-conditions
Kafene Privacy Policy: https://www.kafene.com/legal/privacy-policy

== Installation ==

= From the WordPress.org plugin directory =

1. In your WordPress admin, go to Plugins -> Add New.
2. Search for "Kafene".
3. Click Install Now, then Activate.

= Manual upload =

1. Download the latest plugin zip from your Kafene integration team or the WordPress.org page.
2. In your WordPress admin, go to Plugins -> Add New -> Upload Plugin.
3. Choose the downloaded zip and click Install Now.
4. Activate the plugin on the Plugins screen.

= Configuration =

1. Sign in to the Kafene Merchant Portal, open the account menu, and select Integrations.
2. Select Add integration, choose WooCommerce, select your store, and continue to the credentials step.
3. Copy the Merchant ID, Store ID, and API Key shown in the Merchant Portal, then save the integration.
4. In WordPress, go to WooCommerce -> Settings -> Payments, find Kafene, and click Manage.
5. Enable Kafene Checkout and configure:
   * Environment: Sandbox (testing) or Production (live orders)
   * Merchant ID
   * Store ID
   * API Key
6. Save your changes, then mark the products customers can lease as Leasable with Kafene.

No webhook URL setup is required for plugin version 2.0.0 and later.

Kafene is available for order totals from $300 through the merchant approval limit. If no merchant limit is configured, the maximum defaults to $5,000.

= Minimum requirements =

* WordPress 5.5 or greater
* WooCommerce 8.0 or greater
* PHP 8.2 or greater
* MySQL 5.6 or greater

== Frequently Asked Questions ==

= Kafene is not showing up as a payment option at checkout =

Check that:

* The shopper has a valid US shipping address. Kafene is not available in NJ, MN, or WI.
* Every item in the cart is marked as Kafene-leasable. Kafene will not appear if the cart contains any non-leasable items. For variable products, variations inherit the parent setting unless a variation sets its own Leasable with Kafene checkbox. An unchecked variation is not leasable.
* Kafene is enabled under WooCommerce -> Settings -> Payments.
* The cart total meets the minimum order total ($300 by default).
* The cart total does not exceed the merchant approval limit ($5,000 by default when no merchant limit is configured).

= Where do I find my API key, merchant ID, and store ID? =

You can retrieve these credentials from the Kafene merchant portal, or by contacting your Kafene integration team.

= Do I need to configure a webhook? =

No. Starting with 2.0.0, order status updates come from the Kafene Checkout SDK callbacks while the shopper completes the modal flow.

== Screenshots ==

1. WooCommerce -> Settings -> Payments -> Manage to configure the Kafene gateway.
2. Enable Kafene Checkout, select the environment, and enter the Merchant ID, Store ID, and API key.
3. Bulk action to mark multiple products as leasable or non-leasable.
4. Mark a single product as leasable from the product edit screen.
5. Kafene order details showing the application reference and payment status.
6. Set a Kafene order to Completed when it is ready for funding.

== Changelog ==

= 2.0.0 =
* Breaking: replaces the legacy Codvo-hosted checkout SDK with the first-party Kafene Checkout SDK (loaded from sdk.kafene.com) using kafene.init / openCheckout and a full in-modal apply/sign/pay flow.
* Breaking: Environment is now a Sandbox / Production select (legacy Partner API URL values are migrated automatically).
* Breaking: store webhooks are no longer required; POST webhook processing is removed. Orders update from SDK callbacks via AJAX.
* Checkout cart payload aligned to the SDK camelCase shape; browser bearer-token injection removed.
* Checkout: Kafene is hidden when the cart total exceeds the merchant approval limit.
* Integration: merchant approval limits are retrieved from the Kafene Partner API and cached for 12 hours, with a $5,000 fallback.

= 1.0.5 =
* Quality: dropped redundant files

= 1.0.4 =
* Compatibility: bumped the "Tested up to" header to WordPress 7.0.
* Quality: added a languages folder with a kafene.pot translation template so the Domain Path header resolves to an existing folder.
* Quality: removed debug logging from production paths and guarded the remaining diagnostic logs behind WP_DEBUG.
* i18n: moved HTML out of translatable admin-notice strings so only the message text is translated.

= 1.0.3 =
* Security: Kafene bearer token is no longer exposed in the page-level frontend configuration. It is now minted on demand by a nonce-guarded AJAX endpoint (order ownership + order-key + Kafene payment-method gate) and injected into the SDK via kafene.overrideConfig() immediately before kafene.checkout.load(), keeping the credential off non-checkout views and out of view-source.
* Security: enforced timestamp validation on incoming webhooks with a 5-minute TTL to prevent replay attacks.
* Security: added order ownership and order-key validation across AJAX endpoints and the checkout bootstrap redirect.
* Compatibility: added support for the WooCommerce Checkout block alongside the classic checkout shortcode.
* Compatibility: added the Requires Plugins: woocommerce header (WordPress 6.5 and later) for a cleaner dependency message.
* Quality: enqueued scripts now use the plugin version constant for cache busting.
* Quality: switched the WooCommerce activation check to a multisite-safe pattern using is_plugin_active and is_plugin_active_for_network.

== Upgrade Notice ==

= 2.0.0 =
BREAKING CHANGE: Checkout now uses the Kafene modal SDK end-to-end. Re-save Payments -> Kafene settings (Environment is Sandbox or Production). Webhooks are no longer required. Merchants on 1.x should upgrade and retest the full apply/sign/pay flow before going live.

= 1.0.4 =
WordPress 7.0 compatibility and packaging fixes for WordPress.org submission. No merchant configuration changes required.

= 1.0.3 =
Security and compatibility release. WordPress.org submission readiness fixes; no merchant configuration changes required.
