| @@ -1,8 +1,321 @@ | ||
| 1 | 1 | # Changelog |
| 2 | 2 | |
| 3 | 3 | <details> |
| 4 | 4 | |
| 5 | +<summary>1.10.25 - 2026-09-30</summary> | |
| 6 | + | |
| 7 | +### Changed / Improved | |
| 8 | +- Revoke the stored Basalam vendor authorization on upgrade so every store reconnects and grants the currently required scopes | |
| 9 | + | |
| 10 | +### Note | |
| 11 | +- Existing connections must reauthenticate after updating to this version | |
| 12 | + | |
| 13 | +</details> | |
| 14 | + | |
| 15 | +<details> | |
| 16 | + | |
| 17 | +<summary>1.10.24 - 2026-09-30</summary> | |
| 18 | + | |
| 19 | +### Added | |
| 20 | +- Request the `vendor.product.read` scope when connecting to Basalam | |
| 21 | + | |
| 22 | +### Note | |
| 23 | +- Existing connections must reauthenticate to grant the new product read scope | |
| 24 | + | |
| 25 | +</details> | |
| 26 | + | |
| 27 | +<details> | |
| 28 | + | |
| 29 | +<summary>1.10.23 - 2026-09-28</summary> | |
| 30 | + | |
| 31 | +### Added | |
| 32 | +- Request the `vendor.financial.read` and `vendor.financial.write` scopes when connecting to Basalam | |
| 33 | + | |
| 34 | +### Changed / Improved | |
| 35 | +- Blur and lock the financial management page when a financial API request returns HTTP 403, with a direct button to reconnect to Basalam | |
| 36 | + | |
| 37 | +### Note | |
| 38 | +- Existing connections must reauthenticate to grant the new financial scopes | |
| 39 | + | |
| 40 | +</details> | |
| 41 | + | |
| 42 | +<details> | |
| 43 | + | |
| 44 | +<summary>1.10.22 - 2026-09-27</summary> | |
| 45 | + | |
| 46 | +### Added | |
| 47 | +- Added an optional recurring full product update every 24 or 48 hours, configured beside the product sync control; new and existing stores default to 48 hours and can turn the schedule off | |
| 48 | + | |
| 49 | +### Changed / Improved | |
| 50 | +- Automatic product connection now searches for safe title matches among Basalam products after scanning the vendor catalog | |
| 51 | +- Aligned the dashboard controls and advanced settings on narrow screens, and centered the add and update product dialogs at matching mobile sizes | |
| 52 | + | |
| 53 | +### Fixed | |
| 54 | +- The product update dialog now reads live queue status when opened and while visible, clearing completed-job messages without a page reload | |
| 55 | +- Empty-queue probes no longer hold the async dispatch lease, so newly created jobs can start promptly while shutdown dispatch continues to repair the database connection | |
| 56 | + | |
| 57 | +</details> | |
| 58 | + | |
| 59 | +<details> | |
| 60 | + | |
| 61 | +<summary>1.10.21 - 2026-09-17</summary> | |
| 62 | + | |
| 63 | +### Fixed | |
| 64 | +- "All fields" and "price & stock" update modes always send one complete product request with the variants array (without Basalam variation ids), matching earlier major versions; the dedicated variation endpoint is only used in "custom" mode with the variation price/stock fields enabled | |
| 65 | +- Product updates now recover automatically when WooCommerce contains stale Basalam variation IDs, rebuilding and saving the current variation mapping instead of repeatedly failing with HTTP 404 | |
| 66 | +- Commission lookup now uses Basalam's product-specific commission API for products already connected to Basalam; new or unconnected products continue to use category-based commission lookup, with product commission responses cached during the sync request | |
| 67 | + | |
| 68 | +</details> | |
| 69 | + | |
| 70 | +<details> | |
| 71 | + | |
| 72 | +<summary>1.10.20 - 2026-09-17</summary> | |
| 73 | + | |
| 74 | +### Fixed | |
| 75 | +- Basalam authorization callbacks no longer fail when Redis or Memcached drops the temporary OAuth marker; the single-use authorization proof is now carried in a signed, time-limited HttpOnly cookie | |
| 76 | + | |
| 77 | +</details> | |
| 78 | + | |
| 79 | +<details> | |
| 80 | + | |
| 81 | +<summary>1.10.19 - 2026-09-17</summary> | |
| 82 | + | |
| 83 | +### Changed / Improved | |
| 84 | +- Single-product update jobs now run before bulk and full-update coordinator jobs | |
| 85 | + | |
| 86 | +</details> | |
| 87 | + | |
| 88 | +<details> | |
| 89 | + | |
| 90 | +<summary>1.10.18 - 2026-09-12</summary> | |
| 91 | + | |
| 92 | +### Fixed | |
| 93 | +- Public plugin metadata, help, terms, and privacy links now use the live canonical Hamsalam and Basalam URLs instead of the retired `wp.hamsalam.ir` host | |
| 94 | +- Product create and update requests now retry once without product or variation SKUs when Basalam rejects a duplicate SKU | |
| 95 | + | |
| 96 | +</details> | |
| 97 | + | |
| 98 | +<details> | |
| 99 | + | |
| 100 | +<summary>1.10.17 - 2026-09-09</summary> | |
| 101 | + | |
| 102 | +### Fixed | |
| 103 | +- Async job dispatch runs during shutdown again, keeping queue probes and loopback requests out of the storefront response path | |
| 104 | +- The dispatch lease is reserved before checking the queue, preventing concurrent requests from launching duplicate async runners | |
| 105 | + | |
| 106 | +</details> | |
| 107 | + | |
| 108 | +<details> | |
| 109 | + | |
| 110 | +<summary>1.10.16 - 2026-09-08</summary> | |
| 111 | + | |
| 112 | +### Fixed | |
| 113 | +- Installing a newer plugin package now clears the previous version's force-update gate, allowing migrations, hooks, and the background jobs runner to start normally | |
| 114 | +- Hotfix builds newer than the latest published package are no longer disabled when the version API has not registered them yet | |
| 115 | + | |
| 116 | +</details> | |
| 117 | + | |
| 118 | +<details> | |
| 119 | + | |
| 120 | +<summary>1.10.15 - 2026-09-08</summary> | |
| 121 | + | |
| 122 | +### Fixed | |
| 123 | +- Large product queues no longer spawn overlapping AJAX runners from normal site traffic; one runner now owns the entire processing batch and duplicate workers exit immediately | |
| 124 | +- Async runner dispatches are leased for 25 seconds instead of one second, preventing PHP worker exhaustion and storefront 503/504 errors during full or quick product updates | |
| 125 | +- Installing a newer plugin package now clears the previous version's force-update gate, allowing migrations, hooks, and the background jobs runner to start normally | |
| 126 | +- Hotfix builds newer than the latest published package are no longer disabled when the version API has not registered them yet | |
| 127 | + | |
| 128 | +</details> | |
| 129 | + | |
| 130 | +<details> | |
| 131 | + | |
| 132 | +<summary>1.10.14 - 2026-09-08</summary> | |
| 133 | + | |
| 134 | +### Added | |
| 135 | +- Product SKUs are now sent to Basalam when creating or updating products, and variation SKUs are sent with variant payloads and per-variation updates; a new "کد محصول (SKU)" option controls the field in custom update mode (enabled by default) | |
| 136 | + | |
| 137 | +### Fixed | |
| 138 | +- The async job runner now dispatches from init instead of shutdown, avoiding database "commands out of sync" errors caused by unread result sets left by other shutdown callbacks | |
| 139 | + | |
| 140 | +</details> | |
| 141 | + | |
| 142 | +<details> | |
| 143 | + | |
| 144 | +<summary>1.10.13 - 2026-09-01</summary> | |
| 145 | + | |
| 146 | +### Added | |
| 147 | +- Added a manual vendor-status recheck button to inactive-vendor notices so store owners can immediately restore synchronization after reactivating their Basalam booth | |
| 148 | + | |
| 149 | +### Changed / Improved | |
| 150 | +- Local environments now bypass vendor-status checks and inactive-vendor restrictions; the daily vendor-status cron is also unscheduled locally | |
| 151 | +- The category detection endpoint now uses API v2.0 while preserving the existing response consumer contract | |
| 152 | + | |
| 153 | +</details> | |
| 154 | + | |
| 155 | +<details> | |
| 156 | + | |
| 157 | +<summary>1.10.12 - 2026-08-29</summary> | |
| 158 | + | |
| 159 | +### Fixed | |
| 160 | +- Restored the AJAX click handlers for product update, archive, restore, and disconnect actions on the WooCommerce product editor | |
| 161 | + | |
| 162 | +### Changed / Improved | |
| 163 | +- The authenticated Woosalam chat widget now loads on every WordPress admin screen while other Woosalam assets remain scoped to their relevant pages | |
| 164 | + | |
| 165 | +</details> | |
| 166 | + | |
| 167 | +<details> | |
| 168 | + | |
| 169 | +<summary>1.10.11 - 2026-08-26</summary> | |
| 170 | + | |
| 171 | +### Fixed | |
| 172 | +- Product media MIME types are now detected from the actual file contents before checking the filename extension | |
| 173 | +- Non-standard image MIME aliases such as `image/jpg`, `image/pjpeg`, and vendor-specific PNG/BMP values are normalized to the canonical values accepted by Basalam Uploadio | |
| 174 | +- The media upload request and multipart file transfer now use the same canonical MIME type, preventing valid JPEG images from failing with a `422` unsupported-MIME response | |
| 175 | + | |
| 176 | +</details> | |
| 177 | + | |
| 178 | +<details> | |
| 179 | + | |
| 180 | +<summary>1.10.10 - 2026-08-25</summary> | |
| 181 | + | |
| 182 | +### Added | |
| 183 | +- Added a daily vendor-status check with persistent inactive-duration tracking and automatic recovery when the vendor becomes active again | |
| 184 | +- Added state-specific admin notices, dashboard badges, disabled controls, and explanatory UI for limited and suspended synchronization modes | |
| 185 | + | |
| 186 | +### Changed / Improved | |
| 187 | +- Vendors inactive for less than 21 days can no longer create products; manual, bulk, queued, and automatic updates are restricted to price and stock | |
| 188 | +- Vendors inactive for 21 days or longer can no longer create, update, archive, restore, or discount products until the vendor becomes active again | |
| 189 | +- Product jobs revalidate the vendor policy at execution time so queued work cannot bypass a later status change | |
| 190 | +- Improved background job dispatch and limited admin assets and notices to relevant Woosalam, product, and order screens | |
| 191 | +- Aligned the connection-status header, card, and inner synchronization panel across active and inactive states | |
| 192 | + | |
| 193 | +</details> | |
| 194 | + | |
| 195 | +<details> | |
| 196 | + | |
| 197 | +<summary>1.10.9 - 2026-08-16</summary> | |
| 198 | + | |
| 199 | +### Fixed | |
| 200 | +- The ticket reply access form is now shown only after site access is rejected; it stays hidden while access is pending, after approval, and when the status is missing or unknown | |
| 201 | + | |
| 202 | +</details> | |
| 203 | + | |
| 204 | +<details> | |
| 205 | + | |
| 206 | +<summary>1.10.8 - 2026-08-15</summary> | |
| 207 | + | |
| 208 | +### Added | |
| 209 | +- Added independent settings for updating variation prices and variation stock | |
| 210 | + | |
| 211 | +### Changed / Improved | |
| 212 | +- Connected variations are now updated individually through Core v4 | |
| 213 | +- Price-only variation updates send only `primary_price`, while stock-only updates send only `stock` | |
| 214 | +- Variation price updates work independently from the product price setting | |
| 215 | +- Custom update mode now requires at least one selected field and shows the plugin error toast without refreshing the page when none is selected | |
| 216 | +- Full, quick, selected, and automatic updates no longer create jobs or API requests when the custom field selection is empty | |
| 217 | +- Product admin JavaScript now uses a file-aware cache version so the latest validation behavior is loaded immediately after deployment | |
| 218 | + | |
| 219 | +</details> | |
| 220 | + | |
| 221 | +<details> | |
| 222 | + | |
| 223 | +<summary>1.10.7 - 2026-08-11</summary> | |
| 224 | + | |
| 225 | +### Fixed | |
| 226 | +- Ticket validation and API failures are now shown as admin toasts instead of WordPress `admin-post.php` error pages | |
| 227 | +- New-ticket submissions now use AJAX, preserving entered text, credentials, and uploaded-image previews when a request fails; if the ticket was created before access storage failed, retrying updates only the access data and does not create a duplicate ticket | |
| 228 | +- Ticket JavaScript now uses a file-aware cache version so updated validation and submission behavior is loaded immediately after deployment | |
| 229 | + | |
| 230 | +</details> | |
| 231 | + | |
| 232 | +<details> | |
| 233 | + | |
| 234 | +<summary>1.10.6 - 2026-08-11</summary> | |
| 235 | + | |
| 236 | +### Fixed | |
| 237 | +- Product images in AVIF or another image format unsupported by Basalam are now converted to JPEG before the upload request, preventing the `422` unsupported-MIME error | |
| 238 | +- Temporary downloaded and converted product-image files are removed after both successful and failed uploads; when the server cannot decode the source format, the plugin now returns an actionable error instead of sending an invalid MIME type to Basalam | |
| 239 | +- A copied product no longer inherits *any* Woosalam data from the product it was copied from — not the Basalam connection, and not the per-product settings (video, custom price change, gold/mobile fields, product type and value, wholesale, discount flag). Every `sync_basalam_*` / `_sync_basalam_*` meta on the duplicate and its variations is stripped before WooCommerce saves the duplicate (`woocommerce_duplicate_product_exclude_meta`), cleaned again after duplication, and also cleaned for copies made by third-party duplicate plugins (`dp_duplicate_post`, `dp_duplicate_page`, `duplicate_post_post_copy`). Individual keys can be kept via the `sync_basalam_duplicate_purge_meta_keys` filter | |
| 240 | +- Disconnecting a product now removes the connection meta of every vendor id (previously only the currently configured vendor's keys were removed, so a stale, hard to find key could stay in the database) and clears `sync_basalam_variation_id` from all variations, not only from products currently typed as variable | |
| 241 | +- No product data, status change, or discount is sent to Basalam while two or more WooCommerce products share one Basalam product id. The operation is stopped with a clear message instead of overwriting the wrong Basalam product (this is what made old prices and old stock reappear on Basalam) | |
| 242 | +- Products with an empty Basalam product id no longer produce a malformed update request | |
| 243 | + | |
| 244 | +### Added | |
| 245 | +- A one-time repair on update that finds WooCommerce products sharing a Basalam product id, keeps the connection on the oldest (original) product, disconnects the copies, and reports the result in an admin notice and the plugin log | |
| 246 | + | |
| 247 | +</details> | |
| 248 | + | |
| 249 | +<details> | |
| 250 | + | |
| 251 | +<summary>1.10.5 - 2026-08-05</summary> | |
| 252 | + | |
| 253 | +### Changed / Improved | |
| 254 | +- Limited bulk product update API requests to a maximum of five per minute without reducing the execution rate of other background jobs | |
| 255 | + | |
| 256 | +</details> | |
| 257 | + | |
| 258 | +<details> | |
| 259 | + | |
| 260 | +<summary>1.10.4 - 2026-08-04</summary> | |
| 261 | + | |
| 262 | +### Fixed | |
| 263 | +- Preserved complete URLs in new ticket messages, ticket replies, and optional access-information fields, including percent-encoded URL segments that WordPress text sanitization previously removed | |
| 264 | +- Updated ticket media uploads to send `type=ticket_item` and `collection=IMAGE` as multipart form fields to the `/media` endpoint, and fixed the upload service to return the API response | |
| 265 | + | |
| 266 | +</details> | |
| 267 | + | |
| 268 | +<details> | |
| 269 | + | |
| 270 | +<summary>1.10.3 - 2026-07-22</summary> | |
| 271 | + | |
| 272 | +### Changed / Improved | |
| 273 | +- "Price increase" became "price change" everywhere (code, markup, CSS classes): negative values are supported, so e.g. `-10` lowers the final Basalam price by 10% (percentages are capped at 35% increase and 35% decrease; values outside the -100..100 range are fixed Toman amounts) | |
| 274 | +- The global setting key was renamed from `increase_price_value` to `price_change_value`, and the per-product meta from `_sync_basalam_increase_price_value` to `_sync_basalam_price_change_value`. Old values are not migrated — re-enter the price change in the settings | |
| 275 | +- The category-commission mode is now stored as `commission` instead of `-1`, so it no longer collides with a real negative percentage | |
| 276 | + | |
| 277 | +### Added | |
| 278 | +- A "custom price change" field in the Basalam product settings tab and in the products list bulk edit, so a single product or a selection of products can override the global value (or switch to category commission) | |
| 279 | + | |
| 280 | +</details> | |
| 281 | + | |
| 282 | +<details> | |
| 283 | + | |
| 284 | +<summary>1.10.2 - 2026-07-19</summary> | |
| 285 | + | |
| 286 | +### Changed / Improved | |
| 287 | +- Migrated product photo and video uploads from the legacy direct upload endpoint to Uploadio's presigned media flow | |
| 288 | +- Added SHA-256 metadata, direct staging upload, completion handling, and status polling so product payloads receive the final Basalam media ID and URL | |
| 289 | +- Ensured temporary remote media files are removed after both successful and failed uploads | |
| 290 | +- Streamed remote media downloads and multipart uploads with size-aware limits and timeouts to support large product videos without buffering the entire file in PHP memory | |
| 291 | + | |
| 292 | +</details> | |
| 293 | + | |
| 294 | +<details> | |
| 295 | + | |
| 296 | +<summary>1.10.1 - 2026-07-13</summary> | |
| 297 | + | |
| 298 | +### Fixed | |
| 299 | +- When Basalam rejects a product create/update with `422` because the description contains forbidden content (social-network names, page/channel mentions, etc.), the plugin now extracts the flagged phrases — highlighted inside `<em>...</em>` in the response `snippet` — strips them from the description, and automatically retries (up to 3 times). Previously the sanitizer looked for a non-existent `value` field, so nothing was removed and the retry never helped | |
| 300 | + | |
| 301 | +</details> | |
| 302 | + | |
| 303 | +<details> | |
| 304 | + | |
| 305 | +<summary>1.10.0 - 2026-07-11</summary> | |
| 306 | + | |
| 307 | +### Added | |
| 308 | +- Merged the "Woosalam Plus" add-on into the core plugin as a built-in "Financial Management" section: view store balance, active settlement requests, settlement history, and submit settlement requests to wallet or bank account | |
| 309 | +- Added the `customer.identity.read` scope to the Basalam OAuth connection request (required to fetch the user's bank account list in the settlement flow) | |
| 310 | + | |
| 311 | +### Note | |
| 312 | +- Users who connected to Basalam before this release must reconnect ("Connect to Basalam") once so the new scope is granted before the bank-account settlement feature works | |
| 313 | + | |
| 314 | +</details> | |
| 315 | + | |
| 316 | +<details> | |
| 317 | + | |
| 5 | 318 | <summary>1.9.2 - 2026-07-08</summary> |
| 6 | 319 | |
| 7 | 320 | ### Security |
| 8 | 321 | - Fixed a CSRF vulnerability in the Basalam OAuth callback (`basalam-save-token`) that could let a forged request overwrite the stored connection credentials; the callback now requires a single-use, time-limited authorization that the admin actively started, and the "connect to Basalam" links go through a nonce-protected request |
