=== CatCode Card Payments with SumUp for WooCommerce ===
Contributors: catcodestudio
Tags: sumup, payment gateway, credit card, apple pay, google pay
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

SumUp online payments for WooCommerce: the SumUp payment form on your order page, orders confirmed by webhook plus a server check, block checkout.

== Description ==

A WooCommerce payment gateway for **SumUp** online payments, built around one rule: an order is marked paid only when SumUp itself says so — never because a browser reached the thank-you page.

* **SumUp Payment Widget on your own order page** — cards (Visa, Mastercard, Maestro, American Express and the other schemes SumUp accepts), with 3D Secure, plus Apple Pay, Google Pay and the local methods SumUp enables for your account (PayPal, iDEAL, Bancontact, BLIK, Przelewy24, EPS…). Card details go straight from the form to SumUp; they never touch your server.
* **Orders confirmed by SumUp, not by the browser** — after every payment the plugin reads the checkout back from the SumUp API with your own key: on the buyer's return, on the webhook SumUp posts, and on the thank-you page. Only a PAID checkout for the right amount and currency marks the order paid; anything else puts it on hold with a note.
* **No order left "pending payment" after a successful payment** — the webhook is handled on the spot (no background queue that waits for WP-Cron), and if it never arrives the buyer's return and the thank-you page ask SumUp themselves. A thank-you page that is still waiting watches the status and updates by itself.
* **No double e-mails, no double stock reduction** — the webhook and the buyer's return can arrive in the same second; a database lock and a fresh read of the order apply each payment exactly once (HPOS order cache included).
* **Retries that just work** — every payment attempt is its own SumUp checkout with a unique reference, so a second try never hits "duplicated checkout". Reloading the payment page reuses the open checkout; when the order total changed, the old checkout is closed first so it cannot be paid in another tab.
* **Late payments are not lost** — an order WooCommerce cancelled for being unpaid is marked paid again when SumUp confirms its payment afterwards, with a note to check the stock.
* **"Re-check the SumUp payment"** in the order actions — one click asks SumUp and settles the order.
* **A secret API key instead of an account-connect redirect** — paste a key from the SumUp Dashboard; "Check connection" reads your merchant account (name, country, currency, sandbox or live, available payment methods), fills in the merchant code, warns about a currency mismatch and tests that your webhook address answers.
* Nothing to configure in SumUp: the webhook address is sent with every payment.
* Classic and block checkout, HPOS compatible, payment form in the language of the page (35 SumUp locales), optional Google Pay merchant ID, "Processing" or "Completed" after payment, debug log without secrets.
* Currencies SumUp checkouts accept: EUR, GBP, CHF, PLN, CZK, DKK, SEK, NOK, HUF, RON, USD, BRL, CLP, COP. The method hides itself for other currencies and for orders in a currency other than your SumUp account's.
* The API key is stored encrypted.


SumUp is a trademark of its owner. This plugin is an independent integration made by CatCode; it is not the official SumUp plugin and is not affiliated with or endorsed by SumUp.

== Installation ==

1. Upload the plugin and activate it.
2. In the SumUp Dashboard open Settings → For developers → Toolkit → API keys and create a secret key (it starts with sup_sk_). For tests, create it while your sandbox merchant account is selected.
3. WooCommerce → Settings → Payments → **SumUp (CatCode)**: paste the key and press "Check connection" — the merchant code is filled in when the key belongs to one merchant account.
4. Enable the method and make a test payment.

== Frequently Asked Questions ==

= Do I need a SumUp account? =
Yes — a SumUp merchant account that is allowed to take online payments. For tests, SumUp gives every account a sandbox merchant account (Developer settings → Sandboxes) that moves no real money.

= How do I test? =
Create the API key in your sandbox merchant account and pay with SumUp's test cards (developer.sumup.com → Testing). A checkout of 11.00 in any currency always fails, which tests the failed-payment path.

= I used the official SumUp plugin before. =
Deactivate it before enabling this one, so the checkout does not show SumUp twice. Each SumUp checkout carries its own webhook address, so payments started with the old plugin keep reporting to the old plugin.

= An order stayed "Pending payment" although the buyer paid. =
Open the order and pick "Re-check the SumUp payment" in Order actions. If it happens again, press "Check connection" in the settings: it tells whether the site answers its own webhook address — security plugins and firewalls that block POST requests are the usual cause.

= The payment form does not appear. =
The form is SumUp's script from gateway.sumup.com. If your site sends a strict Content-Security-Policy, allow https://*.sumup.com for scripts, frames and connections and https://static.sumup.com for images, as SumUp's documentation describes. Content blockers in the buyer's browser can also hide it.

= Why is the method missing at checkout? =
The order currency is one SumUp checkouts do not accept, or it differs from the currency of your SumUp account (shown by "Check connection").

= Apple Pay and Google Pay? =
They appear in the form when SumUp enables them for your account; availability depends on the country your business is registered in. For Google Pay, SumUp's widget documentation asks for your Google Pay merchant ID — enter it in the settings.

== External services ==

This plugin connects to SumUp, the payment service the shop owner chooses:

* SumUp API (api.sumup.com) — to create a checkout when a buyer pays (order total, currency, your merchant code, an order reference made of the order number and a random part, a short description with the order number and the shop name, and the shop's webhook and return addresses), to read it back after the payment and on SumUp's webhook, and, when you press "Check connection", to read your merchant account and its available payment methods. Every request carries your secret API key.
* SumUp Payment Widget (gateway.sumup.com/gateway/ecom/card/v2/sdk.js) — loaded on the order payment page; the buyer types the card or wallet details into it and they go straight to SumUp. The buyer's billing e-mail is passed to the form.
* Google Pay — only when you enter a Google Pay merchant ID; Google Pay transactions in the SumUp form are subject to the Google Pay terms: https://payments.developers.google.com/terms/sellertos

SumUp terms: https://www.sumup.com/en-gb/terms/ — SumUp privacy policy: https://www.sumup.com/en-gb/privacy/ — SumUp API terms: https://www.sumup.com/en-gb/terms/api/

== Changelog ==

= 1.0.0 =
* First release: SumUp Payment Widget on the order page, orders confirmed by reading the checkout back from the SumUp API (webhook, the buyer's return, the thank-you page), amount and currency checks, a checkout per attempt, payment lock, restored late payments, "Re-check the SumUp payment" order action, connection check with merchant code detection, block checkout, HPOS.
