=== Stokzone for WooCommerce ===
Contributors: stokzone
Tags: woocommerce, shipment tracking, marketplace, inventory, orders
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.1.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect your WooCommerce store to Stokzone. Adds carrier, tracking number and tracking link fields to WooCommerce orders.

== Description ==

Stokzone for WooCommerce connects your WooCommerce store to **Stokzone** and adds
the shipment tracking fields that WooCommerce core does not provide.

= What it does =

* **One-click connection.** The plugin creates the WooCommerce REST API key for
  you; you never have to copy `ck_` / `cs_` values by hand.
* **Carrier, tracking number and tracking link fields.** WooCommerce core has no
  such fields. The plugin adds them to the order edit screen, to order emails and
  to the customer's "My account > Orders" page.
* **Tracking link generation.** Builds a tracking link from the tracking number
  for Yurtiçi, Aras, Sürat, PTT, MNG, UPS, FedEx and DHL.
* **WooCommerce REST support.** Tracking data is returned in the order REST
  response as a `stokzone_kargo` field.
* **District field for Turkey.** WooCommerce ships the 81 provinces but has no
  district level. This adds it, off by default.

= Compatibility =

* Compatible with WooCommerce **HPOS** (High-Performance Order Storage).
* Compatible with the WooCommerce **Cart & Checkout blocks**.
* Older WooCommerce versions are supported: the plugin detects **capabilities**,
  not versions, and falls back to the classic approach when newer APIs are absent.

= Requirements =

Your store must be served over **HTTPS**. WooCommerce refuses API key
authentication over plain HTTP connections, so a store without an SSL
certificate cannot be connected. The plugin tells you this up front instead of
failing later with a misleading error.

= Third-party service =

This plugin connects to an external service called **Stokzone**. Stokzone is a
**paid subscription service** that manages marketplace, shipping, accounting and
fulfilment integrations from a single panel. A Stokzone account is required to
use the connection features of this plugin.

* Service: https://stokzone.com
* Terms of Use: https://stokzone.com/kullanim-kosullari
* Privacy Policy: https://stokzone.com/gizlilik

**What data is sent, and where?**

The plugin makes **no external requests at all** until you press "Connect to
Stokzone" and approve the request in your Stokzone account. After you connect,
the following is transmitted:

* Your site address and your WordPress / WooCommerce / PHP versions (for
  compatibility purposes),
* The WooCommerce REST API key created by the plugin (so that Stokzone can access
  your store data),
* A randomly generated signing key, unique to this installation (so that requests
  coming from Stokzone can be verified).

Order, product and stock data is read by Stokzone through **WooCommerce's own
REST API**.

You can end the connection at any time using "Disconnect". Doing so deletes the
API key that was created and clears the locally stored secrets.

= Carrier tracking links =

To turn a tracking number into a clickable "Track shipment" link, the plugin
builds a URL that points to the relevant carrier's own public tracking page. The
plugin itself does **not** send any request to these carriers or share any data
with them: it only assembles the link on your own site. It is you or your
customer who chooses to click it, and only then does the carrier's website open
in the browser, with the tracking number carried as a URL parameter.

Tracking links can be generated for these carriers, each an independent company
with its own terms of service and privacy policy available on its site:

* Yurtiçi Kargo — https://www.yurticikargo.com
* Aras Kargo — https://www.araskargo.com.tr
* Sürat Kargo — https://www.suratkargo.com.tr
* PTT Kargo — https://www.ptt.gov.tr
* MNG Kargo — https://www.mngkargo.com.tr
* UPS — https://www.ups.com
* FedEx — https://www.fedex.com
* DHL — https://www.dhl.com

No link is built (and no carrier URL is used) unless an order has both a tracking
number and a recognised carrier.

== Installation ==

1. Install and activate the plugin.
2. Open **WooCommerce > Stokzone**.
3. Press **Connect to Stokzone** and approve the request in your account.

A Stokzone account is not required for the shipment tracking fields; you can fill
them in manually from the order screen without connecting.

== Frequently Asked Questions ==

= Is a Stokzone account required? =

Yes, for the connection features. The carrier / tracking number / tracking link
fields work without an account.

= Does it work with older WooCommerce versions? =

Yes. The minimum is WooCommerce 8.2. Adding fields to the block-based checkout is
enabled on WooCommerce 8.9 and above; on older versions the classic checkout path
is used instead.

= Will updating the plugin break my existing data? =

No. The plugin schema only grows: existing settings and order fields are never
deleted and their meaning never changes.

= Do you access order data with raw SQL? =

No. All order access goes through the WooCommerce CRUD layer (`WC_Order`), so it
also works correctly when HPOS is enabled.

= Why does the plugin require HTTPS? =

WooCommerce only accepts consumer key / secret authentication over HTTPS; over
plain HTTP it requires OAuth 1.0a signed requests instead. Without an SSL
certificate the connection cannot be established.

== Screenshots ==

1. The WooCommerce > Stokzone connection screen with the environment table.
2. The "Shipment Information" box on the order edit screen.
3. The tracking line shown on the customer's "My account" order page.
4. Dependent district selection on the classic checkout (Turkey > Istanbul > Kadikoy).

== Changelog ==

= 0.1.1 =
* Security: shipment-signature replay protection is now atomic. The nonce
  check-and-store used a separate read/check/write on an option, which under
  concurrency could let two requests with the same nonce both pass; it now uses
  a single atomic database insert.
* Security: the request signature now covers the HTTP method, route and nonce in
  addition to the timestamp and body. A captured request can no longer be
  replayed with a different nonce or retargeted to another order. Uses signature
  scheme version 2.
* Removed the bundled compiled translation files; translations are now handled
  through translate.wordpress.org.
* Documented, in the readme, the carrier tracking-link URLs the plugin builds.
* No changes to stored data or settings; existing installs are unaffected.

= 0.1.0 =
* Initial release.
* One-click Stokzone pairing (the WooCommerce REST key is created automatically).
* Carrier, tracking number and tracking link fields: order screen, order emails,
  "My account" and the WooCommerce REST response.
* Optional district (ilce) field for Turkish addresses, with a dependent
  province/district list on the classic checkout.
* Settings screen: turn customer-facing tracking on or off, and set a default
  carrier that pre-fills the order screen when the field is empty.
* HPOS and Cart/Checkout blocks compatibility declarations.

== Upgrade Notice ==

= 0.1.1 =
Hardens shipment-signature replay protection (atomic nonce handling). Safe,
data-preserving update.

= 0.1.0 =
Initial release.
