=== Navidium Shipping Protection ===
Contributors: devsnestnavidium
Tags: woocommerce, shipping protection, shipping insurance, package protection, checkout
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 2.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Add an optional shipping protection fee to your WooCommerce cart and checkout, managed from your Navidium account.

== Description ==

Navidium Shipping Protection lets shoppers add protection against lost, damaged or
stolen deliveries, as a toggle on your cart and checkout. The protection fee is
collected by your own store as part of the order.

The widget text, pricing rules and claim handling are configured in your Navidium
account and delivered to this plugin, so you can change them without editing anything
in WordPress.

= Features =

* Optional protection toggle on the cart and the checkout
* Works with classic cart and checkout, the WooCommerce cart and checkout blocks, and CheckoutWC
* Charge the fee either as an order fee or as a hidden protection product
* Percentage or flat pricing, with a configurable minimum
* Choose where the widget appears on the cart and the checkout
* Optionally exclude wholesale customer roles
* Multi-currency aware

= A Navidium account is required =

This plugin is a client for the Navidium shipping protection service. It does nothing
on its own: until you connect it to a Navidium account, it adds nothing to the cart,
changes no prices, and makes no external requests.

Navidium is a paid subscription service, billed separately from WordPress. See
https://navidiumapp.com for plans and details. The protection fee your shoppers
pay is collected by your store and is yours; Navidium charges you a monthly
subscription for the service.

== Installation ==

1. Install and activate the plugin. WooCommerce must be installed and active.
2. Go to **WooCommerce > Shipping Protection** in your WordPress admin.
3. Click **Start free trial**. You are taken to navidiumapp.com to choose a plan; your store
   address is filled in from this site, so the connection cannot be pointed at the wrong store.
4. After checkout you are returned to this screen and the store is connected automatically.
5. Choose where the widget should appear. Pricing, widget text and claim handling are
   configured in your Navidium account.

Already have a Navidium account? The same screen accepts a plugin token from
**Settings > Store connection** in your dashboard.

Until you connect the plugin, it stays inactive: nothing is added to the cart and no
external request is made until you choose to start.

== Frequently Asked Questions ==

= Do I need a paid account to use this plugin? =

Yes. The plugin is a client for the Navidium service, which is a paid subscription.
Without a connected account, the plugin does nothing.

= What happens if I do not connect it? =

Nothing at all. The widget is not shown, no fee is added, no cart is modified, and no
external requests are made. The plugin only registers its admin screen.

= What happens if Navidium is unreachable? =

Your store keeps working. Settings are read from a static feed and cached in WordPress
for 60 seconds. If both the feed and the API fail, the plugin serves the last settings
it successfully read and backs off for two minutes rather than retrying on every page
load. A brief outage never interrupts your checkout.

If settings cannot be refreshed for more than seven days, the widget stops rendering and
an admin notice explains why. The plugin will not price protection from settings it can
no longer confirm.

= What happens if my subscription lapses? =

If a renewal payment fails, nothing changes while your card is retried, so shoppers who
are mid-checkout are unaffected. If the subscription is cancelled outright, the service
stops enabling the widget: it no longer appears and no protection fee is added to any
order. Your existing orders, settings and claim history are untouched, and everything
resumes automatically once billing is up to date.

= Does this work with block checkout? =

Yes. Classic cart and checkout, the WooCommerce cart and checkout blocks, and
CheckoutWC are all supported. CheckoutWC is detected automatically.

= What data does this plugin send? =

Your store domain, your site URL when connecting, and (in product billing mode) the
WordPress product ID and SKU of the protection product. No customer or order data is
sent by this plugin. See "External services" below.

= What does uninstalling remove? =

The plugin's own options and cached settings. Order data is left untouched, because it
is part of your financial records. The hidden protection product is only removed if you
explicitly opt in, since it is referenced by existing orders.

= Can I change the widget text? =

Yes, in your Navidium dashboard. Changes appear on your store within about a minute
without needing a plugin update.

== External services ==

This plugin connects to services operated by Navidium (https://navidiumapp.com).
It makes **no external requests at all** until you connect it with a plugin token.

**1. Navidium API — https://woocommerce.navidiumapp.com**

Used for four things:

* **Connecting your store.** When you submit your plugin token on the
  WooCommerce > Shipping Protection screen, the plugin makes one request to
  `https://woocommerce.navidiumapp.com/api/v1/plugin/connect`, sending your plugin token
  and your site URL (from `home_url()`). Navidium replies with your account's shop
  name, store domain, and settings feed URLs. This happens only when you click
  Connect or Test connection.
* **Reading your protection settings**, as a fallback when the settings feed below is
  unreachable: `GET https://woocommerce.navidiumapp.com/api/v1/plugin/settings?domain=YOUR-STORE-DOMAIN`.
  This sends only your store domain.
* **Completing a connection.** When you return from checkout, the plugin makes one request to
  `https://woocommerce.navidiumapp.com/api/v1/plugin/claim`, sending the one-time code from the
  return link and this site's URL, and receives the credential this site uses from then on.
* **Registering the protection product**, once, and only when "product" billing mode is
  enabled: `POST https://woocommerce.navidiumapp.com/api/v1/plugin/protection-product`,
  sending your store domain, the WooCommerce product ID and the product SKU,
  authenticated with your plugin token.

**2. Navidium settings feed — https://cdnv2.navidiumapp.com**

Your protection settings (widget text, icon, pricing rules) are published by Navidium
as a static JSON file at
https://cdnv2.navidiumapp.com/nsp-wp-settings/YOUR-STORE-DOMAIN.json , served from
Amazon S3 and CloudFront. The plugin only ever contacts the CDN hostname above; if it
cannot be reached, the plugin falls back to the Navidium API host already listed.

* WordPress reads this file on the server, cached for 60 seconds in a transient.
* The cart and checkout script also reads it in the shopper's browser, so widget
  changes appear without clearing a page cache. That copy is stored in the shopper's
  browser under `localStorage` key `navidium_live_settings_payload`.

These requests send only the URL. No customer data, order data, or personal data is
included, and no credential is present in the response.

**3. Widget icon**

The default widget icon ships with the plugin and is served from your own site. If you
upload a custom icon in your Navidium dashboard, that image is loaded from wherever you
host it.

**4. Order data**

This plugin does not send order or customer data to Navidium. If you use Navidium for
claims handling, order data is sent by a WooCommerce webhook that you configure
separately in your Navidium dashboard. That is a different integration and is not
performed by this plugin.

Service provider: Navidium — https://navidiumapp.com
Terms and conditions: https://navidiumapp.com/terms-conditions
Privacy policy: https://navidiumapp.com/privacy-policy

== Screenshots ==

1. The shipping protection widget on the cart page.
2. The widget on the checkout page.
3. Connecting the plugin to a Navidium account.
4. Choosing where the widget appears.

== Changelog ==

= 2.0.1 =
* Fix: the settings feed URL in the External services section was missing its
  store-domain placeholder on the plugin page, reading ".../nsp-wp-settings/.json".
* Fix: the API section said it was used for three things and then listed four.
* Removed a paragraph in the description that only pointed at the section below it.

= 2.0.0 =
* New: connect your store from WordPress by pasting a plugin token, instead of
  downloading a pre-configured build. The plugin is now a single standard release.
* New: CheckoutWC support is built in and detected automatically. The separate
  CheckoutWC build is no longer needed.
* New: the plugin is completely inactive until connected. It previously fell back to
  built-in defaults and could add a fee before it had been configured.
* New: uninstall now removes the plugin's options and cached settings.
* Fix: security. Removed an unauthenticated AJAX action that allowed a third-party page
  to change a shopper's protection choice and modify their cart.
* Fix: escape all widget output, and remove inline event handlers that broke
  Content-Security-Policy.
* Fix: the widget icon is now bundled with the plugin instead of being loaded from a
  remote server on every cart and checkout view.
* Fix: the plugin no longer causes a fatal error when WooCommerce is deactivated.
* Fix: admin styles and scripts are now loaded only on the order editor, instead of on
  every screen in wp-admin.
* Fix: shop managers can now save the widget placement settings.
* Fix: the protection product is no longer created from a storefront page view.
* Fix: corrected an unbalanced tag in the widget markup that could break theme layout.
* Fix: the cart toggle switch is now styled, and works without JavaScript.
* Improved: declared compatibility with WooCommerce High-Performance Order Storage.
* Improved: the plugin is now fully translatable.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 2.0.0 =
Important: this release replaces the per-store download. After updating, go to
WooCommerce > Shipping Protection and connect your store with the plugin token from
your Navidium dashboard. Includes a security fix for an unauthenticated action that
could change a shopper's protection choice.
