=== CatCode Card Payments with PayTR for WooCommerce ===
Contributors: catcodestudio
Tags: paytr, payment gateway, turkey, taksit, woocommerce
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept cards in Turkey with the PayTR iFrame API: hash-checked notifications, status check, block checkout and HPOS.

== Description ==

A WooCommerce payment gateway for **PayTR** (PayTR Ödeme ve Elektronik Para Kuruluşu) built around one rule: an order is marked paid only by PayTR itself — never by what the browser says.

* **PayTR iFrame API** — the buyer pays in the PayTR form shown inside your own order page (3D Secure, installments, the cards PayTR accepts).
* **Hash-checked notifications** — the notification PayTR posts to your Notification URL is verified with HMAC-SHA256 over merchant_oid, status and total_amount before anything happens. Repeated notifications are answered "OK" and change nothing, exactly as the PayTR documentation asks.
* **Amount and currency checked** — the paid amount must match what was sent for that payment attempt and the order total; anything else puts the order on hold with a note instead of shipping it.
* **Status Inquiry safety net** — when the buyer reaches the thank-you page before the notification, the plugin asks PayTR for the result itself, so a paid order is not left pending.
* **No double payment** — the notification and the buyer's return can arrive in the same second; a database lock and a fresh read of the order make sure the payment is applied once.
* Each payment attempt has its own merchant_oid; a late notification of an older attempt is still matched to its order and checked against its own amount.
* Installments: every option PayTR allows, a maximum (2–12) or single payment only.
* Classic and block checkout, HPOS compatible, test mode, one-click key check, payment form in Turkish or English.
* TRY, EUR, USD, GBP and RUB — the method hides itself for other currencies.
* The merchant key and salt are stored encrypted.


PayTR is a third-party service and a trademark of its owner; this is an independent integration made by CatCode, not the official PayTR module, and is not affiliated with or endorsed by PayTR.

== Installation ==

1. Upload the plugin and activate it.
2. WooCommerce → Settings → Payments → **PayTR (CatCode)**.
3. Paste the Merchant ID (Mağaza No), Merchant key (Mağaza Parola) and Merchant salt (Mağaza Gizli Anahtar) from PayTR Merchant Panel → Support & Setup → Integration Information.
4. Press "Check keys".
5. Copy the Notification URL shown on the settings screen into PayTR Merchant Panel → Settings → Notification URL.
6. Make a test payment (test mode is on by default; the test card is pre-filled on the PayTR form), then request live mode in the PayTR panel and turn test mode off.

== Frequently Asked Questions ==

= Do I need a PayTR merchant account? =
Yes. PayTR gives the merchant ID, key and salt after the application; until the store is switched to live mode, every payment is a test payment.

= The payment shows "In progress" (Devam Ediyor) in the PayTR panel. =
PayTR has not received "OK" from the Notification URL. Check that the URL from the settings screen is saved in the PayTR panel exactly, and that no security plugin or firewall blocks POST requests to it.

= I used the official PayTR plugin before. =
PayTR sends notifications to one Notification URL per store. Switch it to the URL of this plugin, and keep the old plugin active only until its pending orders are settled.

= Why does the buyer see the thank-you page while the order is still pending? =
PayTR may send the buyer back before its notification arrives. The plugin then asks PayTR for the status itself; if PayTR has not finished either, the order updates by itself when the notification comes.

== External services ==

This plugin connects to PayTR (www.paytr.com), the payment service the shop owner signs up with. Nothing is sent until the merchant ID, key and salt are saved in the gateway settings.

* **iFrame API, get-token** (`POST https://www.paytr.com/odeme/api/get-token`) — when the buyer opens the order payment page. Sent: merchant ID, order payment reference (merchant_oid), buyer IP address, e-mail, name, billing address and phone, order amount and currency, the basket (product names, prices, quantities, shipping), installment settings, test mode flag, form language, return URLs and a signature made with the merchant key and salt.
* **Payment form** (`https://www.paytr.com/odeme/guvenli/<token>` in an iframe, and PayTR's `https://www.paytr.com/js/iframeResizer.min.js` script) — loaded in the buyer's browser on the order payment page; the card details are entered there and go to PayTR directly, never through your site.
* **Notifications** — PayTR posts the payment result to your site's Notification URL; the plugin only answers "OK".
* **Status Inquiry** (`POST https://www.paytr.com/odeme/durum-sorgu`) — when the buyer reaches the thank-you page before the notification, and when the shop owner presses "Check keys". Sent: merchant ID, merchant_oid and a signature.

PayTR terms of service: https://www.paytr.com/hizmet-kosullari — privacy policy: https://www.paytr.com/gizlilik-politikasi (English: https://www.paytr.com/en/privacy). API documentation: https://dev.paytr.com/en

== Changelog ==

= 1.0.0 =
* First release: PayTR iFrame API with hash-checked notifications, amount and currency checks, Status Inquiry safety net, payment lock, installment limit, block checkout, HPOS, test mode.
