=== QRPayBD Payments ===
Contributors: bitquintet
Tags: payments, woocommerce, elementor, bangladesh, qr code
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept Bangladeshi wallet and Bangla QR payments confirmed from your own phone's payment SMS. WooCommerce gateway and Elementor Pay Button.

== Description ==

QRPayBD confirms Bangladeshi mobile wallet and Bangla QR payments by reading the "payment received" SMS on an Android phone that you own. This plugin connects your WordPress site to **your own QRPayBD server**:

1. Your site creates an order at QRPayBD and sends the customer to the QRPayBD-hosted payment page.
2. The customer scans your shop's QR in their wallet or banking app, pays the exact amount and enters the TrxID from their payment SMS.
3. QRPayBD checks the TrxID and amount against the SMS on your phone and marks the order paid.
4. QRPayBD sends your site a signed webhook and your order is completed. QRPayBD never holds your money.

**Not affiliated.** bKash, Nagad, Upay and Rocket are trademarks of their respective owners. This plugin is not affiliated with, endorsed by or sponsored by any of them; they are named only to describe payment services your customers may already use.

**WooCommerce (optional)**

* Classic payment gateway that also works in the Cart and Checkout **Blocks** and with the classic checkout shortcode.
* Compatible with High-Performance Order Storage (custom order tables).
* BDT only. The method is hidden at checkout for any other currency.
* The order is placed **on hold** and completed automatically. An amount mismatch is never auto-completed: the order stays on hold with a clear order note.
* Order screen box with status, reference, TrxID, match method, payment link and a **Re-check now** button.
* Cancelling the WooCommerce order cancels the pending payment at QRPayBD (best effort).

**Elementor (optional, the free version is enough)**

* Widget **QRPayBD Pay Button** in its own "QRPayBD" category. It works **without WooCommerce**: fixed amount, item text, optional return URL and full style controls.
* The amount is read from the saved page **on the server**. The browser only sends the page id and widget id, so the price cannot be tampered with.
* Each click creates a private record under **QRPayBD Payments** (amount, status, reference, TrxID, times).
* The action `qrpaybd_payment_completed` lets you run your own automation when a payment completes.

**Reliability**

* Webhooks are verified with HMAC-SHA256 over the raw request body (constant-time comparison).
* QRPayBD has no webhook retry queue, so the plugin also checks unpaid orders every five minutes (Action Scheduler when available, otherwise WP-Cron) for up to 48 hours, and once when the customer returns to your site.

**No tracking.** The plugin has no analytics, telemetry, update checks or advertising, and it never contacts any server other than the QRPayBD address you configure.

= External services =

This plugin connects to exactly one external service: **the QRPayBD server whose base URL you enter in Settings > QRPayBD** (for example `https://pay.example.com`). QRPayBD is the payment-confirmation service described above. Whoever operates that server (you, or the provider you use) is the service provider, and its terms and privacy policy apply.

What is sent, and when:

* **Creating a payment** (a customer chooses the QRPayBD payment method at checkout, or a visitor clicks a QRPayBD Pay Button): the order total in taka, a store order id (`wc-<site hash>-<order number>` or `el-<page id>-<widget id>-<random>`), and a return URL (the WooCommerce order-received page, or the page holding the button). Your store API key is sent in the `Authorization` header. The plugin sends no customer name, email address, phone number or address. The customer's browser is then redirected to the QRPayBD-hosted payment page, where the customer enters the TrxID from their payment SMS; that page is operated by the QRPayBD server.
* **Checking a payment**: the QRPayBD order id and your API key, every five minutes for unpaid orders younger than 48 hours, once when the customer returns to the order-received page, and when an administrator presses "Re-check now".
* **Cancelling a payment**: the QRPayBD order id and your API key, when a WooCommerce order is cancelled while its payment is unpaid.
* **Test connection** (administrators only, on request): a request to `/health` with no data, and one lookup of a dummy order id with your API key.

Data received: QRPayBD sends signed webhooks to `/wp-json/qrpaybd/v1/webhook` on your site containing the order ids, amounts, TrxID, match method and payment time. These are stored as order meta (WooCommerce) or in the private "QRPayBD Payments" records (Elementor).

Terms of Service: https://qrpaybd.com/terms/

Privacy Policy: https://qrpaybd.com/privacy/

== Installation ==

1. Upload the `qrpaybd-payments` folder to `/wp-content/plugins/`, or install the zip through Plugins > Add New > Upload Plugin, then activate it.
2. Go to **Settings > QRPayBD** (or WooCommerce > Settings > Payments > QRPayBD) and enter:
   * **QRPayBD base URL**: must start with `https://`. Plain `http://` is only accepted for `localhost` or `127.0.0.1`.
   * **Store API key**: create it in your QRPayBD dashboard (Store setup).
   * **Webhook secret**: shown in the QRPayBD dashboard next to the webhook URL.
3. Copy the **Webhook URL** shown on the settings page (`https://your-site/wp-json/qrpaybd/v1/webhook`) into the webhook setting of your QRPayBD dashboard. In production QRPayBD requires a public https address.
4. Press **Test connection**. It checks that the server answers and that the key is accepted. The key is never displayed.
5. WooCommerce: enable the QRPayBD method under WooCommerce > Settings > Payments and set the store currency to BDT.
6. Elementor: drag **QRPayBD Pay Button** (QRPayBD category) into a page, set the amount and update the page.

Both WooCommerce and Elementor are optional. Each part loads only when its plugin is active. With neither active the plugin loads harmlessly and shows a dismissible notice explaining what each part needs.

== Frequently Asked Questions ==

= Is this an official wallet or bank API? =

No. QRPayBD reads the payment SMS on your own Android phone with a collector app and matches the customer's TrxID and the exact amount. It is not an official wallet or bank API, the SMS wording of a wallet can change, and a forged SMS combined with a matching TrxID is a residual risk. Review unusual orders and use the optional balance check offered by QRPayBD.

= Which phones and currencies work? =

The collector app is Android-only. Only Bangladeshi Taka (BDT) is supported.

= Can I refund from WooCommerce? =

No. QRPayBD does not hold or move money, so the gateway supports products only and no refunds. Refund the customer from your own wallet and then update the order.

= What happens if the customer pays a different amount? =

The order is **not** completed. It stays on hold with a note "PAID AMOUNT DIFFERS" showing the order total, the QRPayBD amount, the amount received and the TrxID. You decide whether to complete or cancel it.

= What if the webhook never arrives? =

The plugin checks on-hold orders every five minutes and when the customer returns to the order-received page. You can also press **Re-check now** on the order.

= Does the five-minute check need a real cron job? =

WP-Cron and Action Scheduler only run when the site receives visits. On a quiet store add a system cron that requests `wp-cron.php` every few minutes.

= Why must my webhook URL be https and public in production? =

The QRPayBD server refuses webhook URLs that are not https or that point at a private or loopback address when it runs in production mode.

= Is the Elementor Pro Checkout widget supported? =

Elementor Pro widgets render the standard WooCommerce checkout, which this gateway supports. The plugin was tested on a page built with free Elementor and the `[woocommerce_checkout]` shortcode. Elementor Pro itself could not be tested, so the Pro widgets are untested.

= Where is the Bangla translation? =

A `bn_BD` translation ships with the plugin. It has not been reviewed by a native speaker; corrections are welcome.

= Does the plugin work without WooCommerce or without Elementor? =

Yes. Each integration loads only when its host plugin is active. The Pay Button needs Elementor but not WooCommerce; the gateway needs WooCommerce but not Elementor.

== Screenshots ==

1. Settings > QRPayBD with the Test connection result.
2. WooCommerce gateway settings (shared connection fields, no-refunds note).
3. Classic checkout with the three-step "how you will pay" text.
4. Checkout Block with the QRPayBD method.
5. Order screen box with status, TrxID and Re-check now.
6. "Paid amount differs" order note keeping the order on hold.
7. QRPayBD Pay Button in the Elementor editor.
8. QRPayBD Payments list.

== Changelog ==

= 0.1.0 =
* First release: WooCommerce gateway (classic and Blocks checkout, HPOS), signed webhook receiver, five-minute reconciliation, order box and cancel hook, Elementor Pay Button with server-side amount and payment records, Bangla translation.

== Upgrade Notice ==

= 0.1.0 =
First release.
