Pay4All Age Verification – For WooCommerce & Pay4All Shop

Changelog

1.5.0

• i18n refactor – source strings converted to English. All user-facing strings in the plugin code are now in English, matching the WordPress i18n convention (msgid = English source, msgstr = translation). Full translation packs are bundled and validated for French (fr_FR), German (de_DE) and Italian (it_IT) under /languages/.
• Config.php cleanup. The historic per-locale TEXT_DEFAULTS / ADMIN_STRINGS inline catalogs (~600 lines of hardcoded fr/de/it/en strings) are replaced by a single English source array feeding through gettext. The merchant per-language text override (Pay4All AGE > Settings > Texts) still wins over the shipped translation, so custom copy is preserved on upgrade.
• No behaviour change, no configuration change, no manual action required.

1.4.2

• Readme rewrite: Description, WooCommerce support and How it works sections rewritten in clearer English to better reflect the current feature set (video selfie, QR-code capture, choice between ID document and/or video selfie). No behaviour change.

1.4.1

• Anti-fraude étendu aux photos : le code défi 4 chiffres est désormais aussi incrusté sur les photos de pièce d’identité (recto + verso), pas seulement sur la vidéo. Composé côté client via un canvas dans le coin haut-droit avant l’upload. Le code n’est jamais affiché au client (ni pendant la vidéo, ni avant la photo) – il apparaît uniquement dans les fichiers finaux, et l’admin le voit dans la lightbox au-dessus de chaque item pour cross-check visuel.
• UX desktop : sur les écrans ≥ 901 px, les boutons « Prendre la photo » / capture vidéo directe sont masqués – le client est forcé à scanner le QR code pour capturer depuis son smartphone. Garantit que chaque fichier passe bien par la caméra du téléphone (où le code défi est burned par le canvas). Mobile / tablette portrait garde les boutons.

1.4.0

• New liveness selfie video replaces the two static selfie photos. When the merchant asks for a selfie, the mobile capture page now records a single 5 s clip via MediaRecorder, with a random 4-digit challenge code (minted by the server) burned into the top-right of the recorded pixels as a real-time proof. The head-motion prompt (« Tournez lentement la tête ») shows as an HTML overlay to guide the customer but doesn’t pollute the recorded file. Video is compressed client-side (VP8 or H.264, ~500 kbps, ~325 KB for 5 s), encrypted AES-256-GCM before storage, and played back inline in the admin lightbox with the same shield button. Legacy orders that stored the two-photo variant remain readable and decryptable – no data migration needed.
• No third-party service : the challenge code is minted by the plugin, the recording, overlay compositing and compression all run in the customer’s browser, and the encrypted bytes never leave the merchant’s server. Matches the plugin’s « 100 % local » promise as before.
• UX customer : « Vous aurez 5 secondes pour tourner lentement la tête » notice shown before the recording starts ; the customer then previews the recorded clip and clicks « Valider et envoyer » (or « Refaire la vidéo ») BEFORE the upload begins. « Recommencer la vidéo » button only surfaces after a successful upload.
• UX admin : the lightbox displays the « Code attendu dans la vidéo : #XXXX » banner above the video player so the merchant can visually cross-check the digits burned into the video pixels against the reference code – proof the clip is a real-time recording, not a stale replay. The code is persisted on the order as post_meta at upload time (checkout + resend flows). The video autoplays and loops muted for at-a-glance review.
• UX admin resend : a single « Demander au client de renvoyer les photos et la vidéo » button now resends the whole KYC bundle at once ; no more per-photo checkboxes. The default OR-choice option at checkout now follows the merchant’s drag-drop order (was always « pièce d’identité » before, even when moved to 2nd position).
• Réglages admin : new « Vidéo » text-override section under Pay4All AGE > Paramètres > Textes exposing every customer-facing string of the video capture flow (pre-recording notice, single head-motion prompt, statuses, Démarrer / Valider / Refaire / Recommencer buttons, camera-denied / unsupported-browser errors), overridable per language. Default text is now shown as an input placeholder (empty field = « use built-in translation »).
• Cleanup : dropped the now-obsolete admin fields « Libellé – Selfie 1 / 2 (historique) » and « Bouton – Prendre le selfie ». Renamed the drag-drop step « Selfies » to « Vidéo selfie » (FR / EN / IT) / « Selfie-Video » (DE) and the metabox hint on the order screen to mention the video alongside the photos.
• Plugin Check : sanitisation of $_POST['slots'] via array_map('sanitize_key', wp_unslash(...)) in the admin resend handler ; mt_rand() replaced by wp_rand() in the challenge-code fallback.

1.3.1

• Fix : the resend « Documents received » screen didn’t paint on the desktop copy of the mobile page after the customer uploaded from their phone. Root cause : the resend token was cleared the instant the last photo landed, so the desktop poll got 410 and never observed the « satisfied » state. The token now stays alive for a 15-minute grace window after completion and the admin notification is idempotent (no double e-mail on re-uploads).
• Fix : admin resend e-mail on Pay4All Shop orders was missing the order link because get_edit_post_link() returns an empty string when called from the customer’s public REST upload (no edit_post cap). URL is now built manually.
• Fix : « Ask to resend » checkboxes now appear on WooCommerce orders even when the photos live in the customer’s account bucket rather than the order bucket.
• UX : the resend mobile page now shows both a QR code AND the clickable URL below it so a customer who opened the e-mail on their desktop can either scan or copy-paste to their phone. Polls the status endpoint every 4 s so the desktop copy flips to « Documents received » once the phone finishes.

1.3.0

• New « Ask the customer to resend the photos » admin action. On any order screen (Pay4All Shop AND WooCommerce – via Pay4All Pro), the age-verification lightbox now shows a checkbox next to each photo. The admin ticks the ones to retake and clicks the new button – the customer receives an e-mail with a secure 30-day link that opens the same mobile capture page, this time restricted to the requested photos. New photos overwrite the old encrypted files (same order id, so admin decryption keeps working).
• Once every requested photo has been re-uploaded, the admin gets a single « new photos received » notification e-mail – never one per photo.
• Customer + admin e-mails have their own subject + body per locale in Pay4All AGE > Paramètres > Textes > Renvoi, with placeholders {customer_firstname}, {customer_lastname}, {order_number}, {slots_list}, {link}, {admin_order_url}, {site_name}, {shop_name}. Sensible FR / DE / IT / EN defaults ship out of the box.

1.2.0

• New drag-and-drop reorder of the ID card and selfies steps from Pay4All AGE > Paramètres > Documents à demander > Ordre d'affichage. The chosen order applies to both Pay4All Shop and WooCommerce checkouts (single source of truth). Keyboard fallback (up/down arrows) included for accessibility.
• Plugin renamed to « Pay4All Age Verification for WooCommerce & Pay4All Shop » to reflect the dual-storefront support already provided when paired with Pay4All Pro.
• Full FR / DE / IT / EN translations for the new « Ordre d’affichage » UI strings.

1.1.2

• Fix : the KYC text-override form is now correctly styled when embedded inside Pay4All Shop’s « Réglages › Vérification d’âge » tab. The settings-page CSS was only enqueued on the plugin’s own page, so labels overlapped with inputs and the language accordions rendered as bare <details> markup.

1.1.1

• Renamed the settings page title from « Pay4All — Age verification » to « Pay4All Age verification » in the four bundled languages.
• Added FR/EN/DE/IT translations for the « Important reminder » box on the settings page (previously French-only).

1.1.0

• Fix bug security.

1.0.0

• Initial release.
• Product-level Requires age verification checkbox (Pay4All Shop).
• Cross-device QR flow (desktop QR -> mobile capture page).
• AES-256-GCM encryption at rest, per-order and per-user derived subkeys.
• Metabox on the Pay4All Shop order edit screen with nonce-protected decrypted-photo streaming and a lightbox to view every document side-by-side.
• Shield column on the WordPress users list — one click opens the customer’s verified documents.
• Settings page with OR / AND mode, purge delay, per-locale text overrides.
• FR / DE / IT / EN built-in translations, with 4-language text override per string from the settings page.
• WPML / Polylang aware : translated products inherit the Requires age verification flag from their source.