=== Open Border Payments for WooCommerce ===
Contributors: openborderpayments
Tags: payments, woocommerce, payment gateway, 3d secure, hpos
Requires at least: 6.9
Tested up to: 7.1
Requires PHP: 8.3
Requires Plugins: woocommerce
Stable tag: 0.2.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept entity-routed card payments in WooCommerce Blocks and classic checkout, with 3DS, tax
quotes, exact totals, and HPOS support.

== Description ==

Open Border Payments connects WooCommerce to the hosted Open Border payment and tax service. The
same server-side payment service powers Cart and Checkout Blocks and classic checkout. It supports
automatic capture, provider-hosted secure card fields, 3DS continuation, exact integer totals, HS-coded tax
quotes, HPOS, idempotent callbacks, and scheduled repair.

The plugin supports USD, GBP, EUR, CAD, and AUD. The charge currency selects the Open Border
entity, while the store base country and shipping destination form the tax and duty trade lane.
Guest and signed-in checkout use the same payment lifecycle.

The public beta does not include WooCommerce refunds, saved cards, subscriptions, express wallets,
manual capture or cancellation, split shipments, or WooCommerce's beta block product editor. Keep
the classic product editor enabled so every product and variation can store the required HS code.
The gateway fails closed when required classifications, credentials, HTTPS, or exact totals are
missing.

This plugin is an API client for a separately hosted commercial service. An Open Border merchant
account and sandbox or live credentials are required. See the External services section for the
data sent to Open Border and Stripe.

Full setup, lifecycle, privacy, troubleshooting, upgrade, rollback, and uninstall guidance is in
README.md inside the plugin package and at https://developers.openborderpayments.com/guides/woocommerce.

== Installation ==

1. Install and activate WooCommerce.
2. Install and activate Open Border Payments for WooCommerce.
3. Open WooCommerce > Settings > Payments > Open Border.
4. Leave Sandbox mode enabled and enter a sandbox `sk_test_OB_...` API key and the matching
   `whsec_...` callback secret. API origins are pinned by the plugin.
5. Register the exact sandbox callback URL shown in the settings screen in the Open Border
   dashboard. Subscribe to the payment-intent and refund status events listed in README.md.
6. Set WooCommerce > Settings > General > Store Address > Country / State. The country is required
   as the ship-from side of every tax and duty quote.
7. Keep the classic product editor enabled and add a valid Open Border HS code to every product and
   variation.
8. Enable the gateway and complete a sandbox checkout before live use. The gateway always obtains
   a server-issued quote; the retired zero-tax policy is not available.

Checkout requires HTTPS. Sandbox-only HTTP can be enabled solely for a loopback integration-test
site by defining `OPENBORDER_WC_ALLOW_INSECURE_LOOPBACK` as `true`; live mode always fails closed.
Never put a production API key in a demo or staging store.

== External services ==

= Open Border =

The plugin sends the order reference, customer email and name, billing and shipping addresses,
line descriptions, immutable SKU and HS-code snapshots, shipping, currency, and amounts to Open
Border when it requests browser-safe entity configuration, tax quotes, payment creation or replay,
payment status, and callback reconciliation. These requests are necessary to provide the payment
gateway. Open Border receives the data when checkout is loaded or submitted and while unresolved
payments are reconciled.

Open Border terms: https://www.openborder.com/terms-conditions
Open Border privacy notice: https://www.openborder.com/privacy

= Stripe =

The plugin loads Stripe.js directly from Stripe to display Stripe-hosted card fields and complete
3DS. Stripe receives card data plus browser and device information under its own policies. PAN and
CVC do not traverse WordPress or Open Border; WordPress receives only the resulting payment-method
token.

Stripe privacy policy: https://stripe.com/privacy
Stripe services agreement: https://stripe.com/legal/ssa

Store owners must disclose these processors in their privacy notice and are responsible for their
lawful basis, consent configuration, PCI assessment, WordPress security, HTTPS, backups, retention,
and product classifications.

== Frequently Asked Questions ==

= Does the plugin store card data? =

No. PAN and CVC are entered into Stripe-hosted fields and sent directly to Stripe. WordPress and
Open Border do not receive them. The plugin also excludes payment tokens, client secrets, keys,
customer data, and raw provider responses from diagnostics.

= Can I use the plugin without an Open Border account? =

No. The GPL license covers the plugin source, but the hosted Open Border payment and tax service is
separate and requires a merchant account plus sandbox or live credentials.

= Does it support refunds or manual capture? =

Not in this public beta. The gateway uses automatic capture and does not advertise WooCommerce
refund support or expose capture and cancellation controls.

= Why is the payment method unavailable? =

Confirm PHP 8.3+, WordPress 6.9+, WooCommerce 10.8+, HTTPS, a supported currency, two-decimal prices,
matching mode-specific credentials, the classic product editor, and valid HS codes. The plugin
fails closed when those requirements are not satisfied.

= What should I do when a payment outcome is unknown? =

Do not submit a different card or replace the API key. Preserve the order and allow callback or
scheduled reconciliation to resolve the same idempotent attempt. Share only the plugin version,
order number, attempt number, timestamp, rail, and redacted error code with support.

== Screenshots ==

1. Configure checkout labels, Sandbox mode, redacted credentials, callback, and diagnostics in WooCommerce payment settings. All values shown are synthetic or redacted.
2. Open Border appears as a focused payment choice in Cart and Checkout Blocks without exposing card or customer data in the listing image.
3. The same payment lifecycle is available in classic checkout for stores that have not moved to Checkout Blocks.
4. A synthetic sandbox order shows the projected WooCommerce status after an automatically captured payment.

== Changelog ==

= 0.2.3 =
* Send state/province and postal code with tax quotes when available, and reject a US/CA checkout
  before API work when both are missing.

= 0.2.2 =
* Use the official `api-sandbox.openborderpayments.com` origin for Sandbox requests. The immutable
  0.2.1 package used the retired demo origin and is not reused for this corrected candidate.
* Keep the Live rail pinned to `api.openborderpayments.com`; settings and plugin tables are unchanged.
* Authenticate browser configuration for guest and signed-in Blocks and classic checkout.
= 0.2.1 =
* Preserve an unpaid on-hold order when an automatic charge is still processing, then converge it
  through callback or scheduled reconciliation without asking the shopper to pay again.
* Always obtain a tax quote before charging and send the store base country as the required
  ship-from side of the trade lane.
* Stop checkout with an actionable configuration error, before any request, when the store base
  country is missing or is not a two-letter country code.

= 0.2.0 =
* First GPLv2-or-later WordPress.org public beta candidate.
* Added public installation, external-service, privacy, support, and upgrade documentation.
* Added version-consistency, package-size, secret-pattern, and listing-asset checks.
* Added safe checkout recovery after an abandoned 3DS challenge by canceling the unconfirmed Open
  Border intent before allocating a new attempt.
* Preserved the 0.1.0 table schema, automatic-capture scope, and deterministic package format.

= 0.1.0 =
* Initial pilot with Blocks and classic checkout, automatic capture, 3DS, HPOS, exact totals, tax
  quotes, single-flight attempts, verified callbacks, reconciliation, and redacted diagnostics.

== Upgrade Notice ==

= 0.2.3 =
US and CA checkout now requires a state/province or postal code before Open Border is called.

= 0.2.2 =
Sandbox now uses the official `api-sandbox.openborderpayments.com` origin, and signed-in checkout
can prepare card fields. Verify guest/account checkout and the callback after upgrading.

= 0.2.1 =
Configure the WooCommerce store base country before upgrading. 0.2.1 always quotes with that
required ship-from country, retires the old zero policy, and preserves processing charges on one
unpaid order for callback or scheduled reconciliation.

= 0.2.0 =
Back up the database, verify mode-specific credentials and callbacks, then run a sandbox checkout.
The table schema is unchanged. After abandoned 3DS, a new submission cancels the unconfirmed Open
Border intent before allocating another attempt.

== Support ==

Setup and troubleshooting: https://developers.openborderpayments.com/guides/woocommerce

For plugin and Open Border service support, email support@openborderpayments.com. Report security
issues privately to security@openborderpayments.com; do not disclose keys, tokens, callback bodies,
client secrets, customer data, or unredacted logs in the public WordPress.org support forum.
