=== Zibal Advanced Connection Checker ===
Contributors: zibal
Tags: zibal, payment gateway, diagnostics, connection test, merchant
Requires at least: 5.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.1
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Run admin-only diagnostics for Zibal gateway connectivity, outbound server IP status, and merchant code responses.

== Description ==

Zibal Advanced Connection Checker helps site administrators diagnose whether their WordPress site can communicate with Zibal payment gateway services.

The plugin provides:

* Connection checks for the Iran gateway endpoint.
* Connection checks for the outside gateway endpoint.
* Outbound server IP detection.
* Gateway reachability checks using WordPress HTTP APIs.
* Merchant code validation through the Zibal request API.
* Separate AJAX tests and a full diagnostic action from the WordPress admin.

Only administrators with the `manage_options` capability can access the diagnostic page or run tests. The plugin does not run diagnostic requests from the public-facing frontend.

No plugin settings are stored by this plugin.

== External services ==

This plugin connects to Zibal services to run payment gateway diagnostics, server connectivity checks, merchant validation checks, and service availability tests from the WordPress admin dashboard.

The plugin only sends these requests when a site administrator opens the admin page and clicks an individual diagnostic button, or submits the full diagnostic form in the WordPress admin area. It does not track visitors and does not send diagnostic requests from the public-facing frontend.

The plugin may connect to the following Zibal endpoints:

* `https://gateway.zibal.ir/v1/request`
* `https://gateway.zibal.ir/api/healthy-check`
* `https://gateway.zibal.io/api/healthy-check`
* `https://gateway.zibal.ir/`
* `https://help.zibal.ir/ip.php`

When an administrator runs a connection diagnostic, the plugin sends a GET request to the selected Zibal gateway health endpoint to check whether the website server can reach that Zibal service. These requests include normal HTTP request metadata such as the website server IP address, user agent, request time, and server connection status.

When an administrator runs the IP diagnostic, the plugin sends a GET request to `https://help.zibal.ir/ip.php` so Zibal can return the website server public IP address. The plugin then sends a HEAD request to `https://gateway.zibal.ir/` to check gateway reachability from that server.

When an administrator enters a valid merchant code and runs the merchant diagnostic, the plugin sends the configured merchant code, a randomly generated test amount, and a callback URL on the current WordPress site to `https://gateway.zibal.ir/v1/request`. The callback URL is used only to validate gateway connectivity for the diagnostic request.

These requests are required for the plugin's core functionality because the plugin is designed to help administrators check whether their WordPress website can connect to Zibal payment gateway services and whether the configured merchant connection is working correctly.

This service is provided by Zibal.

Zibal homepage: https://zibal.ir/
Terms of Service: https://zibal.ir/privacy-policy
Privacy Policy: https://zibal.ir/privacy-policy

== Installation ==

1. Upload the plugin files to the `/wp-content/plugins/zibal-advanced-connection-checker/` directory, or install the plugin through the WordPress Plugins screen.
2. Activate the plugin through the Plugins screen in WordPress.
3. Go to the "Zibal Check" menu in the WordPress admin.
4. Run individual diagnostics or enter a merchant code and run the full diagnostic.

== Frequently Asked Questions ==

= Who can run diagnostics? =

Only users who can manage site options can access the admin page and run diagnostic requests.

= Does this plugin store merchant codes? =

No. Merchant codes are used only for the diagnostic request and are not saved by the plugin.

= Does this plugin make external requests? =

Yes. Diagnostic requests are sent to Zibal endpoints when an administrator starts a test.

= Why does the plugin throttle repeated tests? =

Short-lived transients prevent repeated diagnostic requests from being sent too quickly.

== Changelog ==

= 1.1 =
* Added WordPress.org submission metadata and documentation.
* Hardened input handling, nonce verification, output escaping, and AJAX responses.
* Replaced raw socket checks with WordPress HTTP API checks.
* Added debug-only logging and PHPUnit test scaffolding.
