Didit Verify

Changelog

0.3.1

• Page builders that render shortcode content outside the post content (for example Oxygen) no longer show an unstyled verification button or embedded container. The plugin stylesheet and the button appearance CSS are now always queued in the header, while the SDK script is still enqueued when the shortcode itself renders.
• Webhook receiver now verifies X-Signature-V2 first, falls back to the legacy X-Signature, and finally to X-Signature-Simple. A delivery is accepted as soon as one variant verifies, so a reverse proxy, CDN rule or security plugin that strips a single X-* header no longer causes a 401 “Missing or stale webhook signature”.
• Middleware that re-encodes the request body (Unicode escaping, slash escaping, key reordering) no longer breaks verification: X-Signature-V2 is computed over the canonical JSON form rather than the raw bytes.
• Freshness is now checked against the signed timestamp inside the payload, which also rejects a replayed delivery re-sent with a refreshed X-Timestamp header.
• When only X-Signature-Simple verifies, the payload is authenticated for session_id, status and webhook_type only, so the user is resolved from the session mapping this site stored itself instead of the unsigned metadata.wp_user_id / vendor_data fields.
• Enabling Debug Logging now records which signature headers arrived when a webhook is rejected.

0.3.0

• Customizable WooCommerce copy: new settings for the verification section title, checkout message, and post-purchase message (GitHub issue #2).
• Translation support: load the plugin text domain from languages/, POT file included, and German translations (de_DE informal, de_DE_formal formal) for all customer-facing text (GitHub issue #2).
• Frontend JavaScript strings (“Creating session…”, “Verification In Review”, error messages) are now translatable.
• Product scope for WooCommerce verification: require verification for all products, only selected products, or all products except selected (GitHub issue #3).
• New “Didit verification” checkbox on the product edit page (Product data → Advanced) to select products for the include/exclude scope.
• Product scope is enforced in classic checkout, block checkout, and after-purchase mode (confirmation box, emails, reminders, order hold).
• Button text and success text settings now fall back to translatable defaults when left empty.

0.2.0

• New WooCommerce verification mode: “After purchase” — keep checkout low-barrier and ask for verification on the order confirmation page, My Account order view, and order emails (GitHub issue #1).
• Guest customers can now verify after purchase: the order key authenticates the session and result endpoints, no login required.
• Webhook receiver (didit/v1/webhook) with HMAC-SHA256 signature and timestamp validation — verification results update orders even if the customer closes the browser.
• Optional “Hold orders” setting: orders stay On hold until the Didit webhook confirms approval, then move to Processing automatically.
• Optional reminder emails (configurable interval and cap) for customers who have not completed verification, scheduled via Action Scheduler.
• After-purchase sessions are created server-side from order billing data and reused across clicks/reloads to avoid duplicates.
• Verification status is now shown next to the session id in the admin order screen.
• Update Didit Web SDK to version 0.2.1.

0.1.4

• Match verification status handling like in woocommerce: only grant access for Approved status.
• Differentiate Approved, Declined, and In Review states in button, content gate, status shortcode, and admin users list.
• Use Didit design system colors for status indicators.

0.1.3

• Update Didit Web SDK to version 0.1.8.
• Improved support for Woocommerce block based checkout on new versions.

0.1.2

• Update Didit Web SDK to version 0.1.6.
• Document bundled SDK source code repository, license, and build instructions in readme.
• Move admin inline scripts to enqueued JavaScript file.
• Fix contributors username.

0.1.1

• Bundle SDK JavaScript locally instead of loading from CDN.
• Add third-party service disclosure (Didit Terms of Use and Privacy Policy).
• Add all 49 supported languages to the language selector.
• Fix Plugin Check (PCP) errors: output escaping, translators comment, variable prefixes.
• Wrap debug logging behind WP_DEBUG flag.

0.1.0

• Initial release.
• UniLink and API Session modes.
• Modal and embedded display modes.
• Configurable button appearance with live admin preview (colors, radius, padding, font size).
• Content gating with [didit_gate] shortcode.
• Verification status shortcode [didit_status].
• Verification status saved to WordPress user meta.
• Verification column in admin Users list.
• WooCommerce checkout integration with 4 position options and billing data forwarding.
• Dynamic vendor data (User ID, email, custom prefix, or none).
• PHP action hooks and didit_sdk_url filter for developer extensibility.
• 6-layer security model for API session creation.
• 49 language options for the verification UI.