B2Brouter for WooCommerce

Өзгөртүүлөр

1.0.5

Changed:

• B2Brouter PHP SDK upgraded from 1.2 to 1.3. Default API version is now 2026-04-20. The plugin’s refund / credit-note payload migrates from the flat top-level amend fields to the new structured invoice_references[] array. Resolves a long-standing latent bug along the way: the refund reason was being emitted as amended_reason (extra d), which no API version has ever accepted — Rails strong-params had been silently dropping it on every release. The new payload places the reason inside the reference object, so the refund reason now actually reaches the backend.
• Outbound API requests now identify the plugin in their User-Agent header via the SDK’s app_info option, making plugin-originated calls distinguishable from raw SDK calls in B2Brouter’s server logs.
• Tested against WordPress 7.0 “Armstrong” with WooCommerce 10.7.

1.0.4

Security:

• Hardened invoice PDF cache path validation so privileged users can no longer coax the plugin into reading, deleting, or email-attaching files outside the configured PDF storage directory. The WooCommerce REST API can no longer write keys in the _b2brouter_* namespace on orders or refunds. Reported privately and coordinated with Really Simple Plugins; huge thanks to their team.

1.0.3

Fixed:

• Release ZIP no longer ships development-only files from the bundled B2Brouter PHP SDK (.env.example, the package’s own tests/, docs/, examples/, .github/, phpunit.xml.dist, CHANGELOG.md, README.md). Surfaced by the WordPress.org Plugin Review Team.

1.0.2

Added:

• Declare WooCommerce as a plugin dependency via the Requires Plugins: woocommerce header (WordPress 6.5+). Older WordPress versions ignore the header and fall back to the existing PHP-side dependency check.

1.0.1

Fixed:

• Plugin header Plugin URI and Author URI were both set to the same value; Plugin URI now points at the WooCommerce integration documentation (https://www.b2brouter.net/docs/#/en/integration/woocommerce) so the two URIs are distinct, as required by the WordPress.org submission validator.

1.0.0

First stable release. Cleared for distribution via the WordPress.org plugin directory and the WooCommerce Marketplace. Plugin Check reports zero errors and zero warnings on the shipped ZIP, and HPOS compatibility was audited end to end (no direct wp_postmeta access remains).

Added:

• == External Services == disclosure section listing the B2Brouter API endpoint, data sent/received, transmission triggers, and links to Terms and Privacy Policy.
• Build-time validation in build-release.sh: the release ZIP is rejected if readme.txt, uninstall.php, or the bundled SDK is missing.

Changed:

• Plugin slug renamed from b2brouter-woocommerce to b2brouter-for-woocommerce for WordPress.org trademark compliance. The user-facing plugin name is unchanged; PHP constants, option keys, and extension hooks are preserved for compatibility.
• Bulk “Generate B2Brouter Invoices” now runs through Action Scheduler instead of a synchronous loop — no more 504 timeouts on large selections. Progress visible under WooCommerce → Status → Scheduled Actions.
• Staging/production environment selector removed from the settings page. The plugin defaults to production; staging can be reached via the B2BROUTER_API_BASE constant.
• B2Brouter PHP SDK upgraded to v1.2 (API version 2026-03-02). API-key validation now uses the SDK’s new AccountService.
• Uninstaller routes all filesystem operations through the WordPress WP_Filesystem API.
• Invoice due date now uses wp_date() for timezone-stable formatting.

Security:

• All flagged output paths now run through appropriate escape functions (esc_html__, esc_html, wp_kses_post, (int) casts).
• Exception messages are escaped at throw time so any consumer that echoes them remains safe.
• All superglobal reads ($_POST / $_GET / $_REQUEST) go through wp_unslash() before sanitization; nonce verification uses the canonical check_admin_referer() pattern.
• Settings API options declare sanitize_callback (strict whitelist for invoice mode).

Fixed:

• Orphan PDF metadata cleanup is now HPOS-aware. The previous implementation queried wp_postmeta directly and silently missed orders on HPOS-only stores.

0.9.4

Final pre-release before 1.0. Focused on stability, operational polish, and preparing the plugin for distribution via the WordPress.org plugin directory and the WooCommerce Marketplace.

Compliance scope:

• Documented explicit support for three national e-invoicing regimes: Spain Verifactu, France DGFiP (PPF / Chorus Pro) and Poland KSeF. General electronic invoicing (UBL / Facturae / Peppol) continues to work for the rest of the EU, the UK, and other countries supported by B2Brouter. Authority-specific credentials and identifiers are managed in the B2Brouter dashboard, not in the WordPress plugin UI.

Added:

• Initial translation files for Catalan, German, Spanish, French and English plus a .pot template.
• Bulk “Generate Invoice” action on the HPOS orders screen; non-completed orders are skipped with a scoped admin notice.
• Organizational unit selector when the connected B2Brouter account has multiple organizational units.
• uninstall.php cleans up b2brouter_* options, sync timestamps and cached PDFs when the plugin is deleted.

Changed:

• Invoice numbering: removed sequential and custom numbering modes. Remaining modes are WooCommerce order number and automatic B2Brouter numbering.
• Status sync: finalized invoices are no longer re-polled; stale non-final invoices use exponential backoff.
• Service loading: admin services instantiated only in admin context and customer services only on the frontend.
• Logging: replaced error_log() with wc_get_logger(). Plugin messages now appear under WooCommerce → Status → Logs (source b2brouter-for-woocommerce).
• Filesystem operations: PDF reads, writes, deletions and directory operations now use the WP Filesystem API.
• Welcome page redesigned; admin menu cleaned up (Welcome is the default landing page).

Fixed:

• Customer invoice download reliability from My Account → Orders.
• _b2brouter_invoice_date now parsed in the site timezone.
• Eliminated the duplicate save-success notice on the settings page.

0.9.3

• Real-time webhook integration (HMAC-SHA256 signed issued_invoice.state_change events; 5-minute timestamp window).
• Smart polling strategy with optional 6-hour fallback when webhooks are enabled.
• Admin menu renamed to “Invoices” with a new custom SVG icon.
• Fixed TIN field saving for HPOS-enabled stores (classic checkout and admin order editing).

0.9.2

• Upgraded to B2Brouter PHP SDK v1.0.0.
• Fixed credit note number collision for refunds.
• Fixed WordPress 6.7.0 translation loading timing.
• Fixed refund invoice generation under HPOS.
• Improved invoice status sync UX (real status on creation instead of generic “draft”).

0.9.1

• New “List of Invoices” admin page with pagination, sorting and bulk PDF download.
• Invoice status sync system with hourly cron and color-coded badges.
• Customer invoice generation from My Account in manual mode.
• Customer credit note downloads from My Account.
• Exponential backoff retry for PDF downloads.

0.9.0

• First public beta. Automatic / manual / bulk invoice generation, credit notes for refunds, PDF caching and email attachment, TIN/VAT collection, HPOS compatibility.

For the complete history, see CHANGELOG.md in the repository.