BNPLX Payment Gateway for WooCommerce

1.0.0

• 2025.03.20
• New – initial release.

1.0.1

• 2025.03.21
• New – script to create automatically a new version
• Tweak – add more details to the readme.txt

1.0.7

• 2025.10.19
  New and Improved – Frontend Refactor
• Refactored payment form using native HTML and elements.
• Standardized all form fields to use 14px font size, 40px height, and consistent borders.
• Added user-friendly placeholder options: “Select gender”, “Day / Month / Year”, “Select country”.
• Improved accessibility with native keyboard navigation and screen reader compatibility.
• Fixed duplicate key warning for USA/Canada phone country codes.
• Maintained emoji flag display with fallback handling.

Refactoring and Optimization
– Migrated all WordPress UI components to native HTML for improved performance.
– Added accessible loading spinner using CSS modules.
– Optimized decodeEntities logic for batching and error handling.
– Consolidated hard-coded values into formConstants.js.
– Cleaned up CSS modules and removed unused CustomDropdown component.
– Fixed DEFAULT_PAD reference error.

Fixes – Payment Flow and Backend
– Added bnplx_phone_country_code hidden input to resolve backend validation errors.
– Removed redundant tax and amount calculations from build_payment_payload.
– Improved payload creation logic for order processing.
– Corrected tax calculation using WooCommerce getter methods.
– Fixed per-unit tax_amount calculation for order details.
– Removed unused methods from Order_Details_Builder.

Internationalization
– Completed full German translation of all admin and frontend strings (105 total).
– Regenerated POT, PO, MO, and JSON translation files.
– Fixed translation inconsistencies and ensured complete i18n support.

1.0.8

• 2025.10.20
  Improvements
• Regenerated POT/PO/MO/JSON; improved i18n script flow.
• JS Runtime: migrated http client to Axios with interceptors + timeout; lazy client init to avoid load-order issues.
• Woo Blocks: defined $user_id in payment method data; ensured script translations load via wp_set_script_translations.
• Correct construction of range/length messages (no mixed regex replacements).
• Improved order details handling

1.0.9

• 2025.10.27
• Use mathematical approach for precise tax calculations
• Add support for fees, gift cards, and multiple shipping methods
• Support currencies with no decimals (JPY, ISK)
• Remove rounding discrepancy fixes for consistent calculations

1.0.10

• 2025.10.29
  Refactor payment intent update flow and improve security
• Harmonize create/update payment intent methods structure
• Fix calculate_payment_amounts return value usage (order_tax_amount)
• Remove redundant checkoutEvents.js, merge duplicate handlers
• Simplify update API response (return only payment_id)
• Add session-based payment ID validation for security
• Support both jQuery (classic) and native events (Blocks checkout)

1.1.0

• 2025.11.20
  Refactor payment intent update flow and improve security
• Harmonize create/update payment intent methods structure
• Fix calculate_payment_amounts return value usage (order_tax_amount)
• Remove redundant checkoutEvents.js, merge duplicate handlers
• Simplify update API response (return only payment_id)
• Add session-based payment ID validation for security
• Support both jQuery (classic) and native events (Blocks checkout)

2.0.0

• 2026.04.19

Major: Hosted Payment Page (HPP) Integration

Replaced the embedded inline checkout with a redirect-based hosted payment page flow.
Customers are now redirected to the BNPLX SDK to complete payment, then returned to
WooCommerce where the order status is verified server-side. This significantly reduces
plugin complexity and maintenance burden.

New – Hosted Payment Page Flow
– Customer clicks “Place Order” → payment intent created server-side → redirect to BNPLX SDK
– After payment, customer returns to WooCommerce via wc-api callback
– Payment status verified server-side via BNPLX API (never trusted from URL params)
– Supports success, failure, cancellation, and requires_capture statuses
– Cart preserved until payment is confirmed — retry on failure without re-adding items
– Cancel detection via SDK /cancelled URL path for requires_payment_method status

New – Admin Settings
– “Merchant ID” — merchant identifier registered on the BNPLX gateway
– “Checkout URL” — BNPLX hosted payment page URL (e.g. https://gateway.bnplx.io/sdk)
– “Checkout description” — configurable text shown at checkout (defaults to dynamic redirect message with payment method name)
– “Place Order” button overridden to “Continue to payment” when BNPLX is selected

New – Block & Legacy Checkout Support
– Both WooCommerce Blocks checkout and legacy [woocommerce_checkout] shortcode supported
– Minimal 25-line blocks.js using plain JS (no React, no JSX, no build step)
– Consistent display: bold centered description, custom button label

Removed – Embedded Frontend
– Removed all React components (PaymentFormContent, PaymentMethodSelector, PhoneNumberField, DateOfBirthField, GenderField, SSNField, HintAndPrivacyAgreement, LoadingSpinner)
– Removed all CSS modules and frontend services (httpClient.js, utils.js)
– Removed all AJAX endpoints (create/update payment intent, get payment methods)
– Removed frontend form validation (server-side validation no longer needed — SDK handles it)

Removed – PHP Services
– WC_BNPLX_Payment_Service (AJAX payment intent creation)
– WC_BNPLX_Validation_Service (inline form validation)
– WC_BNPLX_Payment_Method_Service (AJAX payment method fetcher)
– WC_BNPLX_Customer_Service (customer data extraction for inline form)
– WC_BNPLX_Old_Checkout (legacy checkout renderer)
– WC_BNPLX_Settings_Sanitizer (validated removed payment methods order setting)

Removed – Build Toolchain
– No more webpack, babel, node_modules, package.json, or npm install
– Zero JavaScript build dependencies — blocks.js committed directly as plain JS

Removed – Admin Settings
– “Show gender dropdown”, “Show date of birth dropdown”, “Show SSN field” (SDK handles form fields)
– “Order of payment methods” (SDK handles method selection)
– “Retry Action” (hardcoded to manual_retry)

Improved – Code Quality
– Removed ~4,000 lines of dead code
– Removed browser fingerprinting (SDK collects it on the hosted page)
– Billing/shipping phone sent as string instead of nested object (gateway schema compatibility)
– Consistent use of BNPLX_Keys constants and WC_BNPLX_Settings accessors throughout
– Redundant $order->save() calls removed (WooCommerce update_status already saves)
– Consolidated error redirect pattern into reusable redirect_to_checkout() helper
– Regenerated translation files — removed stale JS references, added new German translations

Unchanged
– Capture, refund, and cancel admin actions remain fully functional in WooCommerce
– Manual capture via order actions
– HPOS (High Performance Order Storage) compatibility
– Subscription support

2.0.1

• 2026.04.22
• Packaging and release fixes for the WordPress.org listing.

2.0.2

• 2026.06.05
• Remove phone from the API payload — the hosted payment page collects it.
• Fix health check calling the HTTP client with an outdated signature.
• Default API URL switched to the sandbox environment.

2.1.0

• 2026.06.10

New – Payment Webhooks
– HMAC-SHA512-verified webhook endpoint (/?wc-api=wc_bnplx_webhook): orders are
confirmed even when the customer never returns from the hosted payment page.
– Signature verified in constant time against the Payment response hash key;
paid orders are never downgraded by stale events.

Fixed – Reliability
– API client returns proper errors after exhausted retries (no more fatals on
gateway downtime in admin screens).
– API errors can no longer mark unpaid orders as processing.
– Failed captures mark the order failed instead of on-hold.
– Order cancellation only contacts BNPLX for BNPLX-paid orders and no longer
breaks the status change when the API is unreachable.
– Refunds and captures honor zero-decimal currencies (JPY, ISK).
– Customer reference IDs use the publishable key again (regression fix).
– Addresses are sent unencoded — names like O’Brien arrive intact.
– Product variations resolve to the variation, not the parent product.
– Health check cached for 60 seconds with a 3 second timeout — checkout no
longer blocks on a slow gateway.

Changed
– supports list reduced to products + refunds (no tokenization exists, so
subscription renewals could never be charged).
– Order meta migrated to prefixed bnplx* keys (legacy keys still readable).
– Payment success uses payment_complete() (paid date, stock, standard hooks).
– Place-order button text is configurable; obsolete DEV mode and Merchant ID
settings removed; order timestamps sent in UTC.
– Added uninstall.php (removes settings, keeps order history).

2.1.1

• 2026.06.11
• Packaging fix: exclude infrastructure tooling (Terraform templates, sops
  config) that was unintentionally included in the 2.1.0 distribution.
  No functional changes; no credentials were ever included.