=== HULO Payments ===
Contributors: huloglobal
Tags: payments, stripe, payment form, pay links, donations
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 0.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Take card payments on any WordPress site with Stripe: payment forms, pay links, a hosted payment page, refunds and a ledger. Works with WooCommerce.

== Description ==

HULO Payments takes payments through your own Stripe account on any WordPress site. Works on any WordPress site; with WooCommerce it is also a checkout gateway, and every payment lands in the same payments list and ledger.

* **Payment forms**: the "HULO payment form" block or the `[hulo_payment_form amount="12.50" currency="GBP" description="Workshop ticket"]` shortcode. Fixed or customer-chosen amount (`allow_custom_amount="1"`). The visitor enters their name and e-mail and pays on the hosted payment page. Works without JavaScript.
* **Pay links**: create a payment for any amount under HULO → Payments → Pay links and send the link. Pay links stay open for 30 days.
* **Hosted payment page** with the Stripe Payment Element: cards, Apple Pay, Google Pay, Link, Klarna and whatever you enable in Stripe; 3-D Secure handled by Stripe. Content-Security-Policy with a per-request nonce, no framing.
* **Server-side verification**: the browser never decides a payment is paid. The plugin re-reads the PaymentIntent from Stripe and checks the payment, amount and currency.
* **Signed, idempotent webhooks**: Stripe signatures are checked on the raw body with a 5-minute tolerance; each event is applied once; a failure is released so Stripe retries. "Register webhook" sets it up and saves the secret.
* **Refunds**, full or partial, from the payment screen (or WooCommerce's refund button). Refunds made in the Stripe dashboard are recorded once.
* **Authorise only**: reserve the money and capture or release it later from the payment screen.
* **Disputes** land in the ledger and are e-mailed to your ops address.
* **Rules**: offer a method only for an amount band, currencies, countries, user roles or signed-in users.
* **Payments list, ledger and dashboard**: takings, refunds, disputes and success rate for 7 and 30 days, a transaction list and a webhook log.
* **Developer API** for other plugins: create, find, capture, release and refund payments; card risk checks; a filter before every charge and actions on every status change (see README.md).

**With WooCommerce** it is also a payment gateway for the classic checkout, the Checkout block and the pay-for-order page (HPOS compatible), adds **pay later by invoice** for orders, applies the rules to every WooCommerce gateway, and keeps each order in step with its payment (status, notes, refunds, capture and release from the order actions).

= Pro =

HULO Payments Pro is a separate add-on from huloglobal.com. It adds Adyen, PayPal, Mollie, Square, Braintree, GoCardless, Checkout.com and Coinbase Commerce (for forms, pay links and WooCommerce), provider-hosted payment links for any unpaid payment, fallback to another method after a decline, payment surcharges, a weekly report and, with WooCommerce, saved cards. Try Pro free for 14 days, no card: https://huloglobal.com/wordpress-plugins/payments/

== Installation ==

1. Install and activate the plugin.
2. Open HULO → Payments → Payment methods → Stripe → Set up. Paste your publishable and secret keys (test keys first: pk_test_ / sk_test_), tick Enable and save.
3. Click "Test keys", then "Register webhook".
4. Add the "HULO payment form" block to a page, or create a pay link, and pay with Stripe's test card 4242 4242 4242 4242.

== Frequently Asked Questions ==

= Do I need WooCommerce? =

No. Payment forms, pay links, the hosted payment page, refunds, webhooks and the ledger all work on a plain WordPress site. With WooCommerce the same payments also run your checkout.

= Do card details touch my server? =

No. The Stripe Payment Element runs in Stripe's own frames on the hosted payment page; your server only sees the PaymentIntent id.

= Which currency does a payment form use? =

The one in the shortcode or block, otherwise the default under Settings (WooCommerce's store currency when WooCommerce is active).

= What happens if a webhook arrives twice? =

The event id is claimed in the webhook log before anything is applied, so the second delivery is acknowledged and skipped.

= What does "Delete data on uninstall" remove? =

Payments, the ledger, the webhook log, hosted payment sessions and the plugin's settings. WooCommerce orders, their transaction ids and refunds are never removed.

== Screenshots ==

1. The hosted payment page with the Stripe Payment Element.
2. A payment form made with the block.
3. Payments, with capture, release and refund.
4. Payment methods: every method on every surface.

== External services ==

This plugin connects to **Stripe** (Stripe, Inc. / Stripe Payments Europe, Ltd.) to take card payments. Nothing is sent until you enter Stripe API keys and enable Stripe.

* When someone pays, the plugin calls the Stripe API (api.stripe.com) from your server to create and read a PaymentIntent: the amount, currency, the payment's id and reference or order number, the payer's e-mail address (for the receipt) and the site's host name. Refunds, captures and releases send the PaymentIntent id and amount. "Test keys" reads your Stripe account name; "Register webhook" lists and creates webhook endpoints for this site's webhook URL.
* The hosted payment page loads Stripe.js from js.stripe.com in the payer's browser, which collects the card or wallet details directly for Stripe.
* Stripe sends signed webhook events (payments, refunds, disputes) to this site's /wp-json/hulo-payments/v1/webhook/stripe endpoint.

Stripe terms: https://stripe.com/legal/ssa — Stripe privacy policy: https://stripe.com/privacy

Payment forms, pay later and the rules use no external service. The plugin makes no other external requests: no tracking, no licence checks, no remote updates.

== Changelog ==

= 0.1.0 =
* First release: payment forms (block and shortcode), pay links and a hosted payment page; Stripe with wallets, 3-D Secure, automatic or manual capture, refunds, disputes and signed idempotent webhooks; payments list, ledger and dashboard; rules; standalone payments API for other plugins. With WooCommerce: checkout gateway (classic, block, pay-for-order), pay later by invoice, order sync and the WooCommerce integration API.
