Fungies for WooCommerce

Isbeddellada

2.4.4

• Fix: Customer email was not pre-filled on the Fungies hosted checkout page when redirecting from WooCommerce. Root cause: Fungies_Checkout_URL_Builder::build() was sending fngs-user-email as the prefill query parameter, but per the official Fungies docs the prefill parameter is fngs-customer-email. fngs-user-email is the outbound system parameter Fungies appends to the post-purchase Instant Redirect URL — not the inbound prefill param. Mixing the two meant the WC billing email was passed but ignored by Fungies, so customers had to retype their email at checkout. The plugin now sends fngs-customer-email for prefill while still reading fngs-user-email from the return URL (where Fungies appends it) — both names are now used in their correct directions. No data migration needed; existing orders are unaffected.
• Docs: Corrected the URL examples in the readme to match.

2.4.3

• Lint: Replaced the three phpcs:ignore annotations added in 2.4.2 with proper phpcs:disable / phpcs:enable blocks. The slow-query sniff fires on the 'meta_key' / 'meta_value' / 'meta_query' array-key string tokens inside the wc_get_orders() / get_posts() literal, not on the outer call line, so the single-line ignore form never reached them. Affects Fungies_Order_Sync::find_order_by_meta(), Fungies_Return_Resolver::by_meta(), and Fungies_Product_Sync::push_to_fungies().
• No runtime behaviour changes.

2.4.2

• Security/correctness: Replaced two SQL queries in Fungies_Workspace_Meta::get_all_pushed_offer_ids() and Fungies_Product_Sync::cleanup_pushed_duplicates() that interpolated class constants directly into the SQL string with fully prepared statements using $wpdb->prepare() + $wpdb->esc_like(). Behaviour is unchanged — values were already trusted constants, but the new form is what WordPress.org Plugin Check requires and what static analyzers can verify.
• i18n: Added the missing /* translators: ... */ comments above every gettext call that uses placeholders so translators see what each %s / %d refers to. Reworked 'Connected to %s API! (%s)' into ordered placeholders 'Connected to %1$s API! (%2$s)' per WP i18n guidelines.
• Lint: Added narrow phpcs:ignore annotations with inline rationale on the handful of justified direct-DB / slow-query / nonce-check warnings (e.g. the wc-api=fungies_return redirect handler reads $_GET for read-only redirect logic and is paired with an HMAC-verified webhook; the direct postmeta lookups are single-row indexed reads). No new ignores were added blindly.
• No runtime behaviour changes.

2.4.1

• Compliance: Added the Requires Plugins: woocommerce header introduced in WordPress 6.5. WordPress now refuses to activate the plugin unless WooCommerce is installed and active, and the WooCommerce dependency is shown in the Plugins screen.
• i18n: Renamed the plugin text domain from fungies-wp to fungies-for-woocommerce (matching the plugin slug) across all 97 gettext calls and the plugin header. Required for the WordPress.org translation platform to pick up strings for community translation. Any custom .po / .mo files keyed off the old fungies-wp domain must be re-generated.
• No runtime behaviour changes.

2.4.0

• Security: Hardened the Fungies Store URL setting — the field is now an <input type="url"> and saves through esc_url_raw, plus the runtime read site re-validates with esc_url_raw + wp_http_validate_url and rejects anything other than http/https schemes before building a customer redirect.
• Security: Added an HTTPS host allowlist (fungies.io, fungies.net) before sideloading product images via media_sideload_image, mitigating SSRF risk from third-party image URLs. Extensible via the fungies_image_host_allowlist filter.
• Privacy: Verbose API request/response logging is now opt-in via a new WooCommerce → Settings → Fungies → Debug Logging checkbox. Errors and warnings are still logged unconditionally so genuine failures remain diagnosable; verbose dumps are off by default to keep log files small and avoid storing third-party API payloads unless troubleshooting.
• i18n: Wrapped two previously-untranslated admin AJAX error strings in __() with translator comments and numbered placeholders.
• Cleanup: Removed console.log / console.error calls from the front-end Blocks checkout JS so the customer’s browser console stays clean.
• Docs: Inline rationale comment added above the webhook REST route’s permission_callback => '__return_true' explaining the HMAC-SHA256 signature verification, timing-safe comparison, and idempotency replay protection that act as the real auth.
• Docs: Older changelog entries (2.1.x, 2.0.x, 1.x) moved to changelog.txt per WP.org guidelines, keeping the readme focused on the current and previous major.
• Build: .gitattributes now export-ignores README.md, build.ps1, and fungies-*.zip so the shipped plugin zip contains only runtime files.
• Readme: Removed obsolete Donate link and the Screenshots section (no screenshot assets shipped).

2.3.1

• Feature: Coupons are now pushed to Fungies the moment they are saved in WooCommerce, mirroring how products already work. Hook save_post_shop_coupon runs Fungies_Coupon_Sync::on_coupon_saved, which creates or updates the corresponding Fungies discount immediately — no need to wait for the hourly cron or click “Sync Now”. Skipped silently for autosaves and revisions, debounced via a 5-second transient lock per coupon.
• Feature: Deleting a coupon (before_delete_post) now clears its workspace-scoped _fungies_pushed_discount_id__<hash> post meta, so re-creating a coupon with the same code creates a fresh Fungies discount instead of trying to update a stale ID.

2.3.0

• Feature: WooCommerce coupon codes applied at checkout are now forwarded to the Fungies hosted checkout via the fngs-discount-code query parameter, so the Fungies-side total automatically matches the WooCommerce-side total after discount. The first coupon code on the order is forwarded as-is — it is expected to match a Fungies discount code already synced via “Sync Now”. No action needed on the Fungies dashboard side as long as the coupon was synced.

2.2.3

• Fix: PATCH /v0/discounts/:id/update rejected every coupon update with id: Required because the Fungies update schema demands id in the request body in addition to the URL path. The API client now injects the discount UUID into the body automatically.
• Fix: Coupon diff now correctly normalizes server-side amount storage. Fungies stores fixed-amount discounts in currency minor units (e.g. 1 USD becomes "100" in responses), so the previous diff always reported “different” and triggered an update on every sync. The mapper now multiplies fixed amounts by wc_get_price_decimals() before comparing, and converts validUntil from milliseconds to seconds before comparing.

2.2.2

• Fix: Coupon sync no longer aborts when the Fungies GET /v0/discounts/list endpoint returns 500 because of pre-existing rows with negative validFrom Dates (a known server-side timezone bug). The plugin now falls back to a row-by-row walk that skips broken pages, and primarily relies on the local _fungies_pushed_discount_id post meta to decide between create and update.
• Fix: If an UPDATE call returns “not found” (e.g., the Fungies discount was archived/deleted manually), the plugin now clears the stale local mapping and creates a fresh discount instead of erroring.
• Note for existing installs: any duplicate percent10 / fixed1 rows already in your Fungies workspace from a v2.2.0 install must be archived manually in the Fungies dashboard — the plugin can no longer see them through the broken LIST page.

2.2.1

• Fix: Fungies API rejects validFrom: 0 with “Number must be greater than or equal to 0” even though the spec lists 0 as valid. The coupon now sends the WooCommerce coupon’s actual date_created timestamp (or current time as fallback) for validFrom, which is also more semantically correct.
• Fix: purchaseLimit was always sent — its create-schema enum forbids null, so coupons without a usage limit failed validation. The field is now only included when the WooCommerce coupon has a usage limit set.
• Fix: When GET /v0/discounts/list fails on the first page, the coupon sync now returns the API error instead of silently treating the remote index as empty (which could create duplicates on a transient outage).

2.2.0

• Feature: WooCommerce coupons are now synced to Fungies on every “Sync Now” run. Each coupon (percent, fixed_cart, fixed_product) is created or updated as a Fungies discount with the same code, amount, amount type, expiration date, and usage limit. The Sync panel reports a third “Coupons → Fungies” line with created / updated / error counts. Mapping is workspace-scoped (sandbox vs production) so toggling Sandbox Mode does not orphan the link, and re-running Sync skips coupons that are already in sync.

For changelog entries from earlier releases (2.1.x, 2.0.x, 1.x), see changelog.txt in the plugin root.