=== Experia360 UPI Collections for WooCommerce ===
Contributors: experia360
Tags: upi, qr code, payments, woocommerce, india
Requires at least: 6.4
Tested up to: 6.8
Requires PHP: 7.4
Stable tag: 1.1.0
License: GPLv2 or later

Bank-verified UPI collections with dynamic QR checkout, signed callbacks and automatic WooCommerce order confirmation.

== Description ==

Experia360 UPI Collections connects WooCommerce orders to the Experia360 hosted checkout.
Customers confirm their name, mobile number and email, then receive an amount-bound dynamic UPI
QR code with a timer. A signed callback from Experia360 confirms the WooCommerce order only after
the connected partner bank has confirmed the collection.

The plugin does not collect a UPI PIN, OTP or card data.

== Installation ==

1. Upload the plugin ZIP in WordPress under Plugins > Add New > Upload Plugin.
2. Activate WooCommerce and this plugin.
3. In Experia360, create an API client with collections:write and collections:read scopes.
4. Open WooCommerce > Settings > Payments > Experia360 UPI Collections.
5. Enter the client ID, API secret and a random callback signing secret of at least 32 characters.
6. Enable the gateway and save.
7. Confirm that https://your-store.example/wp-json/experia360/v1/callback is publicly reachable.

For stronger secret management, add these constants to wp-config.php above the stop-editing line:

define('EXPERIA360_CLIENT_ID', 'exc_your_client_id');
define('EXPERIA360_API_SECRET', 'exs_your_api_secret');
define('EXPERIA360_WEBHOOK_SECRET', 'a-random-secret-of-at-least-32-characters');

When constants are used, secrets do not need to be stored in WordPress options.

== Security ==

* API calls are server-to-server over verified HTTPS.
* Saved secrets are encrypted with AES-256-GCM using WordPress authentication salt material.
* Callback signatures are verified over the timestamp and exact raw request body.
* Callbacks older than five minutes are rejected.
* Event IDs are replay protected.
* Order reference, INR amount and bank transaction reference are checked before payment completion.
* Browser return parameters never mark a WooCommerce order paid.
* Supports both classic checkout and WooCommerce Checkout Blocks.

== Payment flow ==

1. WooCommerce creates an Experia360 payment order using server-side API credentials and an idempotency key.
2. The customer is redirected to the merchant-branded Experia360 checkout.
3. The customer confirms name, mobile and email before the amount-bound QR timer begins.
4. Experia360 receives the signed collection result from the configured partner bank.
5. Experia360 sends a signed payment callback to WordPress.
6. The plugin validates the signature, event age, order reference, amount, currency and bank reference.
7. WooCommerce marks the order paid and records the bank transaction reference.

If callback delivery is temporarily interrupted, a bounded background reconciliation job checks
the authenticated Experia360 order-status API until the payment is confirmed or the retry window ends.

== Changelog ==

= 1.1.0 =
* Updated production branding and documentation links for experia360.com.
* Added a direct WooCommerce settings link on the WordPress Plugins screen.
* Packaged as part of the versioned Experia360 merchant API kit.

= 1.0.1 =
* Removed PHP 8-only syntax for shared-hosting compatibility.
* Deferred all WooCommerce-dependent files until WooCommerce is loaded.
* Added safer gateway availability checks.

= 1.0.0 =
* Initial Experia360 dynamic UPI QR and bank-callback WooCommerce gateway.
