=== CatCode Tpay Payments for WooCommerce ===
Contributors: catcodestudio
Tags: tpay, blik, przelewy, payment gateway, woocommerce
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Tpay payments for WooCommerce: bank transfers, BLIK, cards and more, orders confirmed by a signed notification plus a server check, block checkout.

== Description ==

A WooCommerce payment gateway for **Tpay** (Krajowy Integrator Płatności, Poland), built around one rule: an order is marked paid only when Tpay itself says so, never because a browser reached the thank-you page.

* **All the methods of your Tpay account** on the secure Tpay page: online bank transfers, BLIK, and the cards, Apple Pay, Google Pay and pay-later methods Tpay has switched on for you.
* **Notifications verified as Tpay requires** — the JWS signature against the Tpay certificate and its CA, then the md5sum with your security code. A sandbox notification cannot settle an order of a live shop: the two environments hang from different certificates.
* **Orders confirmed by Tpay, not by the browser** — after a notification the plugin reads the transaction back from the Tpay API with your own keys, and only a paid transaction for the right amount marks the order paid. Anything else puts it on hold with a note.
* **No order left "pending payment" after a successful payment** — the notification is handled on the spot (no background queue that waits for WP-Cron), and if it never arrives, the buyer's return and the thank-you page ask Tpay themselves. A thank-you page that is still waiting watches the status and updates by itself.
* **No double e-mails, no double stock reduction** — the notification and the buyer's return can arrive in the same second; a database lock and a fresh read of the order apply each payment exactly once (HPOS order cache included).
* **Failed payments the buyer can repeat** — a buyer who comes back from an unsuccessful payment lands on the payment form of the order, with a plain message and all the methods of the shop. When the order total changed, the old transaction is cancelled first, so it cannot be paid in another tab.
* **Late payments are not lost** — an order WooCommerce cancelled for being unpaid is marked paid again when Tpay confirms its payment afterwards, with a note to check the stock.
* **Full refunds made in the Merchant Panel** reach the order: Tpay reports them, and the order becomes "Refunded".
* **"Re-check the Tpay payment"** in the order actions — one click asks Tpay and settles the order.
* **"Check connection"** in the settings tests your keys (sandbox or live), lists the payment channels of your account and tests that your notification address answers.
* Classic and block checkout, HPOS compatible, the Tpay page in the language of the shop page, "Processing" or "Completed" after payment, debug log without secrets, keys stored encrypted.
* Transactions are in Polish zloty: the method hides itself for other currencies.
// @pro-begin
* Translation included: Polish.
// @pro-end

// @pro-begin
= Pro =

The Pro version is sold on [catcode.com.ua](https://catcode.com.ua/modules/catcode-tpay-payments-for-woocommerce/), with a 7-day trial that never starts by itself:

* **BLIK at checkout** — the buyer types the 6-digit code right in the shop (classic and block checkout), confirms the payment in the banking app and watches a waiting screen, without visiting the Tpay page. A rejected code, lack of funds or a timeout brings the buyer back with a plain reason.
* **Refunds from the order screen** — full or partial, through the Tpay API; partial refunds are counted, so Tpay is never asked for more than the payment still holds.
* **Payment watchdog** — every 15 minutes the plugin re-checks the unpaid Tpay orders of the last 48 hours, so a payment whose notification was blocked by a firewall or arrived during maintenance still settles its order without anyone pressing a button.
* **Payment journal** — every Tpay payment with its transaction, amount, refunds, sandbox or live, and a one-click re-check.
// @pro-end

Tpay is a trademark of its owner. This plugin is an independent integration made by CatCode; it is not the official Tpay plugin and is not affiliated with or endorsed by Tpay.

== Installation ==

1. Upload the plugin and activate it.
2. In the Tpay Merchant Panel open Integrations → API and add a new Open API key: you get a Client ID and a Secret. The security code is in Settings → Notifications → Security.
3. In the same Notifications tab keep "Allow overwriting the notification URL" switched on.
4. WooCommerce → Settings → Payments → **Tpay (CatCode)**: paste the three values, choose the environment and press "Check connection".
5. Enable the method and make a test payment.

== Frequently Asked Questions ==

= Do I need a Tpay account? =
Yes. For tests, Tpay has a free sandbox with its own account and keys: register.sandbox.tpay.com.

= How do I test? =
Choose "Sandbox" and paste the keys of the sandbox account. On the Tpay page, a BLIK code starting with 777 is accepted. Tpay lists its test cards and the amounts that trigger errors in its documentation: docs-api.tpay.com, "Available environments".

= I used the official Tpay plugin before. =
Deactivate it before enabling this one, so the checkout does not show Tpay twice. Each transaction carries its own notification address, so payments started with the old plugin keep reporting to the old plugin.

= An order stayed "Pending payment" although the buyer paid. =
Open the order and pick "Re-check the Tpay payment" in Order actions. If it happens again, press "Check connection" in the settings: it tells whether the site answers its own notification address. Security plugins and firewalls that block POST requests are the usual cause. Tpay also does not follow redirects, so the address must not redirect, for example from http to https.
// @pro-begin
The Pro watchdog re-checks such orders by itself.
// @pro-end

= An order note says the checksum does not fit. =
The security code in the plugin differs from the one in the Merchant Panel (Settings → Notifications → Security). Copy it again.

= Why is the method missing at checkout? =
The order currency is not PLN, or one of the three values in the settings is empty.

= Apple Pay and Google Pay? =
They appear on the Tpay page when Tpay enables them for your account. Ask Tpay support.

== External services ==

This plugin connects to Tpay, the payment service the shop owner chooses, run by Krajowy Integrator Płatności S.A.:

* Tpay API (api.tpay.com, or openapi.sandbox.tpay.com in the sandbox) — to get an access token with your keys; to create a transaction when a buyer pays (order total, a description with the order number and the shop name, an order reference, the buyer's name, e-mail, phone, billing address, IP address and browser, and the shop's return and notification addresses); to read the transaction after the payment; and, when you press "Check connection", to read the payment channels of your account.
* Tpay payment page (secure.tpay.com, or secure.sandbox.tpay.com) — the buyer is sent there to pay.
* Tpay certificates (secure.tpay.com/x509/, or secure.sandbox.tpay.com/x509/) — downloaded to verify the signature of notifications. Nothing is sent.
// @pro-begin
* CatCode licence server (catcode.com.ua) — only when the owner activates a key or starts the trial, and periodically while a key is stored: the key and the site address are sent (plus the e-mail typed for a trial). Updates are checked there with the same key. Privacy policy: https://catcode.com.ua/privacy/
// @pro-end

Tpay terms: https://tpay.com/user/assets/files_for_download/payment-terms-and-conditions.pdf — Tpay information clause (privacy): https://tpay.com/user/assets/files_for_download/information-clause-payer.pdf

== Changelog ==

= 1.0.0 =
* First release: payments on the Tpay page, notifications verified by JWS signature and md5sum, orders confirmed by reading the transaction from the Tpay API, amount checks, one transaction per attempt, payment lock, restored late payments, refunds from the Merchant Panel reaching the order, "Re-check the Tpay payment" order action, connection check, block checkout, HPOS.
// @pro-begin
* Pro: BLIK codes at checkout, refunds from the order screen, payment watchdog, payment journal, updates from catcode.com.ua.
// @pro-end
