=== CatCode Mail OAuth & Email Log for WooCommerce ===
Contributors: catcodestudio
Tags: microsoft 365, oauth, smtp, email log, woocommerce
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Send store email through Microsoft 365 / Outlook.com or Gmail with OAuth 2.0, log every email and see on each order which emails reached the customer.

== Description ==

Microsoft is switching off password (Basic) authentication for SMTP AUTH in Exchange Online; OAuth 2.0 is the supported way. A shop that sends order emails from a Microsoft 365 mailbox with a user name and password stops sending — and nobody notices until a customer asks where the confirmation is.

This plugin sends every WordPress and WooCommerce email through your own mailbox with OAuth 2.0 — no password is stored — or through any SMTP server, keeps a log of every email, and shows on each WooCommerce order which emails were delivered and which were not.

= Sending =

* **Microsoft 365 / Outlook.com** with OAuth 2.0: through the Microsoft Graph API (HTTPS — works when the host blocks SMTP ports) or SMTP AUTH with XOAUTH2. Business mailboxes and personal Outlook.com accounts, shared mailboxes in SMTP mode.
* **Google Workspace / Gmail** with OAuth 2.0 through the Gmail API, with the narrowest Gmail permission ("send email on your behalf").
* **Any SMTP server**: your hosting mailbox, Brevo, Mailgun, Amazon SES, Postmark and others.
* You register the app in your own Microsoft Entra / Google Cloud account and sign in once. Tokens go straight from Microsoft or Google to your site; client secrets and tokens are stored encrypted.
* Bcc copies are kept on every connection (Microsoft Graph gets them as real Bcc recipients).
* The From address is aligned with the signed-in mailbox, so Microsoft does not refuse the email and Gmail does not rewrite it. Optional fixed From address and name.
* Send a test email through the saved connection and see the exact error when it fails.

= The connection keeps working =

* Tokens are refreshed once a day even when no email goes out — Microsoft refresh tokens lapse after 90 days without use, Google's after six months.
* Enter the expiry date of the Microsoft client secret and get a warning 14 days before it runs out.
* When a Google connection dies about a week after the sign-in, the plugin tells you why: the Google Cloud app is still in "Testing", where Google ends the sign-in after 7 days.
* Admin notice and a Site Health test when a connection lost its sign-in.

= Email log =

* Every email: date, from, to, Cc, Bcc, subject, which plugin or WooCommerce email sent it, the order, the connection, the result and the exact error, every attempt.
* View the email as it was sent (HTML in a sandboxed frame, or plain text).
* Filters (problems, sent, failed, not sent), search by recipient, subject or order number.
* Retention in days, optional "do not keep the content", a size indicator, "delete the whole log".
* Personal data: Tools → Export Personal Data and Erase Personal Data include a person's emails in the log (addressed to them or about their orders), and the privacy policy guide gets a suggested text.
* Shop managers see the emails of orders; account emails (password resets, new accounts) and other site emails are visible to administrators only.

= WooCommerce =

* An **Emails** box on every order (HPOS and the classic order screen): which emails of this order went to the customer and to the shop, when, through which connection, delivered or not, with the error.
* Emails WooCommerce did not send are listed too — "this email type is switched off" or "no recipient address" — so "why didn't the customer get it?" has an answer on the order page.
* Works with WooCommerce's own "Deferred emails" feature (sending through Action Scheduler) and with the block email editor.


Microsoft, Microsoft 365, Outlook, Microsoft Graph and Microsoft Entra are trademarks of the Microsoft group of companies. Google, Gmail and Google Workspace are trademarks of Google LLC. WooCommerce is a trademark of Automattic Inc. This plugin is an independent integration and is not affiliated with or endorsed by them.

== Installation ==

1. Install and activate the plugin.
2. Open WooCommerce → Mail & Email Log → Connection (Settings → Mail & Email Log on a site without WooCommerce).
3. Choose Microsoft 365 / Outlook.com, Google Workspace / Gmail or SMTP. For Microsoft and Google, follow the short guide on the screen to register the app, paste the client ID and secret, then click "Save and sign in".
4. Send a test email.

== Frequently Asked Questions ==

= Do I need a Microsoft 365 or Google Workspace admin? =

Not always. Any user can register an app in their own Microsoft Entra tenant unless the organisation forbids it, and a personal Gmail account can create a Google Cloud project. Some organisations require an administrator to grant consent to the app.

= Graph or SMTP for Microsoft 365? =

Graph is recommended: it uses HTTPS (port 443), needs no "Authenticated SMTP" switch in Exchange and keeps Bcc copies. Use SMTP AUTH (XOAUTH2) when your organisation does not allow the Mail.Send permission, or to send as a shared mailbox.

= Microsoft refuses the email with "SendAsDenied" =

The From address differs from the signed-in mailbox and the account has no "Send As" right for it. Keep "Keep From addresses that differ from the signed-in mailbox" off, or grant the right in Exchange.

= Google stops sending after a week =

Your Google Cloud app is in "Testing". Google ends sign-ins of such apps after 7 days. Publish the app ("In production") and sign in again.

= Is the content of my emails stored? =

Only in your own WordPress database, in the log table, for the number of days you choose — and you can switch keeping the content off. Nothing is sent anywhere except to the mail service you connected. A customer's copies are included in Tools → Export Personal Data and removed by Tools → Erase Personal Data.

= Does it work with other SMTP plugins? =

Two mail plugins cannot both deliver WordPress email. The settings screen names any other active mail plugin; keep one of them.

== External services ==

This plugin connects to the services below, and only to the ones you set up.

= Microsoft identity platform (login.microsoftonline.com) =

Used to sign in to Microsoft 365 / Outlook.com and to refresh access tokens: when you click "Save and sign in with Microsoft", when an email is sent with an expired access token, and once a day to keep the sign-in alive. Sent: the application (client) ID and secret you entered, the authorization code, the refresh token and the requested permissions. Terms: https://www.microsoft.com/en-us/servicesagreement/ — Privacy: https://privacy.microsoft.com/en-us/privacystatement

= Microsoft Graph (graph.microsoft.com) and Microsoft 365 SMTP (smtp.office365.com, smtp-mail.outlook.com) =

Every email is sent through Microsoft when a Microsoft connection is selected: recipients, subject, body, attachments and headers of the email. Same terms and privacy statement as above.

= Google OAuth 2.0 (accounts.google.com, oauth2.googleapis.com) =

Used to sign in to Google and to refresh access tokens (sign-in, an expired access token, once a day), and to revoke the token when you sign out. Sent: the client ID and secret you entered, the authorization code, the refresh token and the requested permissions. Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy

= Gmail API (gmail.googleapis.com) =

Every email is sent through the Gmail API when a Google connection is selected: the complete message (recipients, subject, body, attachments, headers). Terms: https://developers.google.com/terms — Privacy: https://policies.google.com/privacy

= Your SMTP server =

With an SMTP connection every email goes to the SMTP server you entered, with the user name and password you entered. Its terms are those of your mail provider.


== Screenshots ==

1. Email log with filters and search.
2. One email: details, attempts and the content as it was sent.
3. The Emails box on a WooCommerce order.
4. Microsoft 365 connection with the setup guide.

== Changelog ==

= 1.0.0 =
* First release: Microsoft 365 / Outlook.com (Graph or SMTP XOAUTH2) and Google (Gmail API) with OAuth 2.0, SMTP, email log, order email box, daily token keep-alive, client secret expiry warning, Site Health test.
