Klamra Paycal for Aspaclaria

Maintenance review candidate: automatic WooCommerce payment completion is blocked in this version because the existing PayCal v1 response does not establish verified provider payment. Hosted checkout and Demo requests remain available, but must not be used as evidence that an order was paid. Do not install on a live store before separate approval and provider integration testing.

PayCal is a branded checkout and payment-management platform for WooCommerce stores built for creative businesses.

The plugin connects a merchant’s WooCommerce store to PayCal Platform, where WooCommerce checkout, hosted checkout sessions, merchant settings, License Token validation and approved payment-provider connections are managed.

Features

• Connect WooCommerce checkout to PayCal
• Prepare Apple Pay and hosted checkout experiences
• Use PayCal branded hosted checkout
• Manage merchant connection and License Token validation
• Connect to approved payment-provider configurations
• Support payment-management workflows for creative businesses

PayCal helps merchants manage checkout and payment context. It does not replace the merchant’s payment provider, does not act as a bank or seller of record, and does not store card details.

External service disclosure: this plugin connects the merchant’s WooCommerce store to PayCal Platform, an external PayCal service required for hosted checkout, payment verification, connector synchronization, optional license validation, connector event diagnostics and the read-only merchant payments dashboard. The plugin sends order/payment context needed to create or verify PayCal checkout sessions, merchant connector identifiers, public key/access token authentication headers, plugin/site metadata for connector health, optional license token data, and read-only dashboard requests for the authenticated merchant. It connects to the PayCal Platform URL configured in the plugin settings and to PayCal hosted checkout domains such as https://paycal.online and merchant-specific PayCal checkout domains configured by the store. PayCal service details are available in the PayCal Privacy Policy and Regulations / Terms:

• Privacy Policy: https://paycal.online/privacy-policy/
• Regulations / Terms: https://paycal.online/regulations/

PayCal Connector

This version is the customer-side connector. Merchant and terminal administration is handled in the PayCal platform.

Hosted Checkout Gateway

Version 1.3.2 includes the customer-side hosted WooCommerce gateway. Apple Pay provisioning remains in PayCal Platform and is synced by Merchant ID, Terminal ID, Public Key and Token.

1.4.4 Review changes

• Added display-only payment provider catalogue to dashboard (Stripe, Bit, Isracard, MAX, CAL, Tranzila, PayPlus).
• Provider statuses default to not configured; Bit is marked paused. Verified state may be supplied by trusted PHP integrations via paycal_provider_verified_states filter.
• Preserved INVOICES, license, system dashboard cards and all legacy invoice sources.
• No provider gateway or automatic order completion was enabled.

1. Upload the plugin files to /wp-content/plugins/klamra-paycal-for-aspaclaria
2. Activate the plugin through the Plugins menu in WordPress
3. Go to WooCommerce → Payments
4. Enable PayCal
5. Configure your PayCal settings

1. 

   Klamra PayCal dashboard and module navigation in a staging installation.

2. 

   PayCal Hosted Checkout gateway settings in WooCommerce, before activation.

3. 

   PayCal connector configuration in Sandbox, with credential fields empty.

4. 

   Invoice layout settings with demonstration business details in a staging installation.

5. 

   PayCal Payments dashboard displaying merchant payment history, ledger entries, settlement summaries, reconciliation status, and recent transactions in a read-only interface. Historical figures are not verified Live payment revenue.

1.4.3

• Fail closed on automatic payment completion, including legacy checkout fallback; positive Platform flags cannot substitute for verified provider integration.
• Merge the read-only payments dashboard, refresh cache and form improvements from 1.4.2 onto the security-maintained 1.3.2 baseline.
• Preserve strict payment parsing, WooCommerce CRUD session metadata and removal of the active Bit integration.
• Restrict dashboard access, require safe HTTPS transport, bind cache to merchant/environment and omit untrusted invoice links.
• Label all Platform ledger history as unverified; verified Live revenue and settlement totals are unavailable under the existing API.
• Gate diagnostic logging behind WP_DEBUG and omit dynamic sensitive details.
• Staging review candidate. No PayCal Suite, external checkout or Stripe integration changes.

1.4.2

• WordPress.org compliance release candidate: tightened escaping, request sanitization, debug logging and external-service disclosure.
• Displays PayCal Payments dashboard timestamps in the WordPress site timezone.
• Keeps hosted checkout, payment verification, order status handling, connector credentials and merchant dashboard API behavior unchanged.

1.4.1

• Hardened PayCal Payments refresh so manual Refresh always performs a fresh Platform fetch and replaces the previous dashboard cache.
• Added no-cache request headers and a refresh cache-buster for the read-only merchant dashboard fetch.
• Keeps Platform-unavailable fallback limited to the last successful fetch and leaves checkout/payment flow unchanged.

1.4.0

• Added WooCommerce PayCal Payments read-only merchant dashboard.
• Pulls Ledger, Settlement and Reconciliation data from PayCal Platform through the authenticated merchant dashboard API.
• Adds short-lived dashboard caching and last-good fallback when PayCal Platform is temporarily unavailable.
• Does not create local Ledger or Settlement tables and does not change checkout, payment verification, refunds or money movement.

1.3.2

• Update screenshot captions for planned staging captures. Replacement screenshots must be captured and reviewed before directory publication.
• Harden payment verification types, amount validation and payment-method isolation.
• Preserve new checkout session IDs using the WooCommerce order metadata API.
• Require HTTPS and validated destinations for API requests; do not follow credential-bearing redirects.
• Stop recording order-key URLs in new return diagnostics.
• Restrict invoice administration and merchant dashboard access.
• Remove the Bit gateway, settings, payment instructions and marketing UI. Preserve historical order status registration and all existing order data.
• Reject malformed or explicitly unsuccessful sync responses.
• Correct unverified security-status claims in the connector screen.
• Retain existing environment selection and credentials; no Sandbox/Production routing changes.
• Use a neutral PayCal label for new gateway configurations and payment notes.
• Escape invoice and admin output at the rendering boundary.
• Local regression tests: WordPress 7.1.3, WooCommerce 11.2.1, HPOS and classic order storage. Provider responses were mocked; live wallets and provider webhooks require separate staging validation.
• Maintenance candidate: see the separate validation report before production installation. Historical testing claims below are inherited, not re-certified.

1.3.1

• Tested with WordPress 7.1.
• Reviewed admin UI, JavaScript, media picker and editor compatibility with WordPress 7.1.
• Verified existing PayCal connections, License Token data and connector settings remain unchanged during update.
• Verified WooCommerce hosted checkout, payment verification and HPOS admin-link compatibility.
• No changes to existing merchant credentials, terminal IDs, tokens, API endpoints or payment protocol.

1.3.0

• Security hardening release: strengthened hosted checkout sessions, server-side verification, merchant isolation, webhook idempotency, sanitized logs, and safer customer-facing errors.
• Improved WooCommerce order completion by passing the verified PayCal payment ID as the WooCommerce transaction ID after successful hosted checkout verification.
• Added cleaner private order notes for successful verification, failed verification, and expired sessions.

1.2.9

• Improved WooCommerce order completion by passing the verified PayCal payment ID as the WooCommerce transaction ID after successful hosted checkout verification.
• Hardened hosted checkout return handling so the success confirmation is shown only after server-to-server verification confirms the order is paid.
• Sanitizes hosted return request values and keeps failed verification details in private order notes or logs only.
• No UI/admin design, merchant connection, license behavior, checkout.paycal.online session flow, WooCommerce email logic, or payment status rules changed.

1.2.8

• Fixed old hosted checkout customer return after successful Apple Pay payment.
• wc-api=paycal_hosted_return now serves a no-cache HTML transition page after successful verification.
• Prevents legacy template_redirect handler from interfering with the dedicated wc-api return handler.
• Removes pending Location headers and returns HTTP 200 before outputting the transition page.
• Adds response mode diagnostics for hosted return: html_transition.
• No payment verification, payment_complete, order status, checkout.paycal.online, capture logic, or forced completed status changed.

1.2.7

• Improved successful old hosted checkout return experience.
• After successful verification, wc-api=paycal_hosted_return serves a no-cache confirmation transition page from the store domain.
• The transition page redirects customers to the WooCommerce order-received URL using window.location.replace(), with meta refresh and fallback link.
• Preserves existing merchant connection and license data across plugin updates/replacements.
• uninstall.php now preserves PayCal connection/license/invoice data by default.
• Data is removed only when paycal_remove_data_on_uninstall is explicitly set to yes.
• Adds connection persistence diagnostics for settings, license data, merchant ID, terminal ID, public key, sync state, and plugin basename changes.
• Avoids marking license invalid on temporary API/HTTP/malformed-response failures.
• No payment verification, checkout.paycal.online session flow, capture logic, or forced completed status changed.

1.2.6

• Added explicit order save after successful PayCal hosted checkout verification and payment_complete().
• Confirmed hosted return redirects to the WooCommerce order-received URL after verification.
• Keeps WooCommerce email hooks intact and does not suppress order emails.
• No checkout.paycal.online session flow, capture logic, or forced completed status changed.

1.2.5

• Added explicit order save after successful PayCal hosted checkout verification and payment_complete().
• Confirmed hosted return redirects to the WooCommerce order-received URL after verification.
• Keeps WooCommerce email hooks intact and does not suppress order emails.
• No checkout.paycal.online session flow, capture logic, or forced completed status changed.

1.2.4

• Fixed old pay.aspaclaria.co.il hosted checkout return bridge.
• Added dedicated WooCommerce API return endpoint for PayCal hosted checkout returns.
• Old hosted checkout now returns through wc-api=paycal_hosted_return so server-to-server verification runs reliably.
• Redirects customers to the clean WooCommerce order-received URL after successful verification.
• Preserves backward compatibility with existing template_redirect return handling.
• No new checkout.paycal.online session flow, capture logic, or forced completed status changed.

1.2.3

• Added return verification support for generic PayCal checkout sessions.
• Connector now sends the latest pcs_ checkout session ID to server-to-server verification.
• Avoids duplicate failed verification notes on repeated return handling.
• No old hosted checkout behavior, capture logic, or forced completed status changed.

1.2.2

• Improved PayCal Apple Pay private WooCommerce approval notes using existing verification values.
• Added cleaner payment evidence summary for approved PayCal orders.
• Avoids duplicate approval notes for the same PayCal payment ID.
• No checkout flow, capture logic, or order status logic changed.

1.2.1

• Added planned PayCal Order Evidence Log roadmap UI to the Marketplace/Bundles admin page.
• Reframed shipping evidence as a synchronized order evidence layer between merchant, customer, and PayCal.
• Added planned timeline/status copy for order handling, customer updates, delivery proof, and digital/service fulfillment.
• Improved Hebrew PayCal connector wording using ל־PayCal / ו־PayCal / ב־PayCal.
• No payment flow, checkout logic, capture logic, provider sync, persistence, uploads, or order status logic changed.

1.2.0

• Demo-ready merchant wording.
• Generic merchant positioning.
• License Token wording consistency.
• Test connection / sync wording.
• Connector event reporting for merchant onboarding.
• Safe provider wording.
• No payment flow changes.

1.1.9

• Added an opt-in checkout.paycal.online session redirect with safe fallback to the existing hosted checkout flow.
• Clarified demo-ready admin wording for PayCal checkout, payment-management and approved provider connections.
• Existing Apple Pay, payment processing, return handling, verification, and WooCommerce order status behavior remain unchanged.

1.1.8

• UI polish release.
• Refined PayCal dashboard hero, cards, badges, stats, and quick actions.
• Improved Dragon Shield artwork placement.
• Polished Marketplace / Bundles page layout.
• Improved ornate golden lock artwork placement.
• Preserved checkout, payment processing, Apple Pay, licensing, sync, connector behavior, and WooCommerce order status logic.

1.1.7

• Design fixes release.
• Added PayCal dashboard hero artwork with an updated transparent Dragon Shield brand image.
• Added Marketplace / Bundles hero artwork with an updated transparent ornate golden lock illustration.
• Refined dashboard and bundles page visuals for a cleaner premium branded experience.
• Switched dashboard artwork to cache-busting clean asset filenames.

1.1.6

• Added License Token validation against the configured PayCal Platform endpoint.

1.1.5

• Security: Restricted invoice downloads to the owning customer or authorized shop managers. Added nonce validation, invoice post type validation, linked order validation, and capability checks for the PayCal invoice download endpoint.

1.1.4

• WordPress 7 safety hardening release: guarded loading, safer API failure handling, admin visibility, sanitized logging, and tested with PHP 8.3.31 / hardened for PHP 8.3.31 without payment-flow changes.

1.1.2

• Production release based on the live WordPress.com plugin export.
• Version bump for WordPress.org update distribution.

1.0.6

• Hardening release: safe loading for missing files and fallback permissions module.

1.0.4

• Added a permissions management screen for PayCal administrators
• Kept plugin structure aligned with version 1.0.3 for WordPress.org consistency
• Enforced saved permissions across Dashboard, Bit, Invoices, License and Setup screens
• Improved README version consistency
• Locked the permissions screen to a single owner admin with an extra access code

1.0.3

• Tested with WordPress 6.9.4
• Improvements and small fixes

1.0.2

• Initial improvements