=== Revelbit eUPN for WooCommerce ===
Contributors: revelbit
Tags: woocommerce, upn, qr, bank transfer, payment slip
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 8.1
Requires Plugins: woocommerce
Stable tag: 0.1.0
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

UPN QR payment slips for existing WooCommerce direct bank transfer orders.

== Description ==

Adds an on-demand QR code and payment PDF to direct bank transfer (BACS)
orders that are on hold and denominated in EUR. It uses the existing payment
method and never changes the order's payment state. Other currencies are
left to WooCommerce's normal bank transfer instructions.

The customer on-hold email includes an embedded QR image and PDF attachment.
Plain-text email includes the PDF and payment details. Administrators can
regenerate/download a PDF or resend the on-hold email from an order.
These are payment documents, not invoices or e-invoice delivery.

= External service and privacy =

This plugin requires a Revelbit eUPN account and API key. Service allowances
and charges are set by the merchant's selected plan; installing this plugin
does not buy a plan or submit a payment.

When enabled by the merchant, https://api.revelbit.com/v1/upn/qr and
https://api.revelbit.com/v1/upn/slip receive the payer's billing name, street,
postcode and city, recipient configuration, amount, reference, payment
purpose and due date to render the UPN document. No payer email, phone,
order items, account identifiers or order key are sent. The service does
not persist the payment payload; its aggregate usage reporting is described
in its service terms and DPA. The merchant must disclose this processing.

Service: https://eupn.revelbit.com/
Terms: https://eupn.revelbit.com/terms
Privacy: https://eupn.revelbit.com/privacy
DPA: https://eupn.revelbit.com/dpa

The plugin stores only its merchant settings, including recipient name,
address and IBAN, plus an optionally encrypted API key. Existing WooCommerce
orders remain the source of payer data. It adds generic failure notes with
no API response text, key or payment fields. It creates no new payment
payload records, document files, transients, background jobs or logs.

PDF and PNG exist in request memory. Attachments are passed directly to
WordPress's PHPMailer in memory. Normal email delivery necessarily sends
the attachment to the merchant's mail service and customer; email plugins
and mail servers may retain messages. Asynchronous mail plugins that defer
WordPress's PHPMailer initialization are not supported in this release.

== Installation ==

1. Install and activate WooCommerce, and configure Direct bank transfer.
2. Upload revelbit-eupn-0.1.0.zip in Plugins > Add New > Upload Plugin.
3. Activate Revelbit eUPN for WooCommerce.
4. Open WooCommerce > Revelbit eUPN and configure the same recipient bank
   account as WooCommerce BACS, recipient name/address, reference model,
   payment due days, purpose code and API key. Enable the integration.
5. Start with a test key (rb_test_...). PDFs are marked VZOREC by the API.
6. Place a synthetic EUR bank transfer order and inspect its confirmation,
   the on-hold email and the administrator's PDF download before live use.

Prefer defining REVELBIT_UPN_API_KEY in protected wp-config.php or your
server's secret configuration. Otherwise the setting encrypts the key with
PHP sodium and WordPress authentication salts. Rotating salts requires
entering the key again. No key is printed back into the settings form.

The reference uses the canonical WooCommerce order ID (normally also the
order number). Formatted display numbers remain in the payment purpose.
This prevents invalid SI references and collisions from stripping custom
order-number prefixes. RF check digits follow ISO 11649. Payment text that
exceeds UPN's field limits is shortened by the API's explicit truncate mode.

== Frequently Asked Questions ==

= What happens if the API is unavailable or my allowance is exhausted? =

The order and normal BACS instructions continue. Email is sent without a
UPN document. A private generic order note identifies the failure category.
Each HTTP request has a ten-second timeout and no redirects. There are no
automatic retries or background jobs. Retry from the order or PDF form.

= Are repeated downloads charged twice? =

The plugin submits identical payment fields for QR and PDF. The API counts
the same normalized payload once per calendar month. Changed payment data
or generation in a later month may count again. The plugin sends no extra
usage event and does not report the order as paid.

= Who can download a payment PDF? =

An administrator allowed to edit that order, its logged-in owner, or the
guest already authorized by WooCommerce's native secret order key. The
download uses a short-lived signed POST form with a WordPress nonce.
Guest forms are bound to a random host-only HttpOnly SameSite=Lax browser
cookie that expires in thirty minutes and contains no payment data.
No key, payer data or API credential is placed in a download URL.
Guest documents for registered-customer orders require login.

= Does it support HPOS and block checkout? =

It uses WooCommerce order CRUD and existing BACS hooks. Classic confirmation
and the Order Confirmation Additional Information block invoke the same
hook. Keep that block in a customized block confirmation template. See
the repository integration guide for tested versions and exact evidence;
the declared minimum versions are requirements, not a claim that every
combination of WordPress, WooCommerce, theme and email extension is tested.

== Changelog ==

= 0.1.0 =
* Initial installable integration for UPN payment documents.
