=== RahaPay Payments for WooCommerce ===
Contributors: rahapay
Tags: payments, mpesa, airtel money, card, checkout
Requires at least: 6.4
Requires PHP: 7.4
Stable tag: 1.0.0
License: Proprietary

Accept RahaPay card, M-Pesa, Airtel Money and bank-transfer payments through a hosted checkout.

== Description ==

The plugin creates a Payment Intent on the merchant server, redirects the customer to a hosted RahaPay checkout page, and verifies the result from the server before completing the WooCommerce order.

Features:

* Classic and Checkout Block payment-method registration.
* RahaPay secret key remains on the WordPress server.
* Public key and one-transaction client secret are passed to the hosted checkout.
* Server-side verification before order completion.
* Signed webhook endpoint.
* High-Performance Order Storage compatibility declaration.
* Sandbox URLs for local RahaPay development.

== Installation ==

1. Upload the `rahapay-payments` folder to `/wp-content/plugins/`, or install the ZIP from Plugins > Add New > Upload Plugin.
2. Activate the plugin.
3. Open WooCommerce > Settings > Payments > RahaPay.
4. Enable sandbox mode and enter a matching `pk_test_...` / `sk_test_...` key pair.
5. For the local stack, use API base `http://localhost:8001` and checkout base `http://localhost:5173`.
6. Add the store origin in the RahaPay merchant dashboard. For a local store this may be `http://localhost:8080`.
7. Configure the webhook URL displayed in the gateway settings and paste the matching `whsec_...` secret.

== Checkout flow ==

1. WooCommerce calculates and signs the order total on the server.
2. The plugin creates `/v1/payment_intents` using the secret key and an idempotency key.
3. The customer is redirected to the plugin's hosted checkout page.
4. `rahapay.js` embeds the RahaPay checkout iframe with the public key and Payment Intent client secret.
5. The plugin retrieves the Payment Intent with the secret key and calls `payment_complete()` only after `status` is `succeeded`.

== Webhook ==

Endpoint:

`/wp-json/rahapay/v1/webhook`

Expected signature header:

`RahaPay-Signature: t=UNIX_TIMESTAMP,v1=HMAC_SHA256`

The signature payload is `timestamp + "." + raw_request_body`.

== Changelog ==

= 1.0.0 =
* Initial server-side Payment Intent integration.
* Added hosted checkout, status verification, webhook verification, Checkout Blocks and HPOS compatibility.
