Per-account live/sandbox environment — manage the same PayPal merchant independently in live and sandbox; routing only applies an account whose mode matches the site’s current GiveWP mode.
Import GiveWP’s already-connected PayPal account in one click (reuses stored credentials, no second OAuth).
Re-sync an imported account’s credentials from GiveWP (same-merchant, same-mode guarded).
Re-activate a deactivated account directly from the Accounts list.
Delete a PayPal account from the Accounts list (confirmation required; deregisters the account’s PayPal webhook first).
GiveWP version compatibility guard — refuses below GiveWP 3.0 and warns on untested GiveWP majors (ador_block_on_untested_givewp filter to fail closed).
Changed
Accounts list gains a Mode column (live/sandbox badge).
The Import button is always shown on the Accounts list for discoverability — disabled with an inline reason when there is nothing to import (GiveWP not connected, or the account is already imported).
Flat, minimal admin restyle built on the WordPress core colour palette — status/mode badges, buttons, modals, notices, and the receipt templates. Primary calls to action now use WordPress’s native primary-button style.
Schema 1.1.0: adds the mode column and a composite UNIQUE(merchant_id, mode) constraint.
Schema now migrates on plugin update, not only on activation.
Fixed
List-table bulk actions now reach their handlers. The bulk Apply collided with WP_List_Table‘s own action field and dispatched to no handler, dying with an empty error page; the routing field is now printed after the table so it wins.
Refunds to routed accounts no longer fail silently — the PayPal access token is re-minted at refund time instead of reusing the stale connect-time token, and a refund whose account mode does not match the site mode is blocked with an actionable admin error.
Inbound webhooks for a genuinely unknown account return 404, while a real processing error now logs and returns 500 instead of being masked as not-found.
Cached PayPal access tokens are encrypted at rest and re-minted on decrypt failure.
Credential routing no longer fatals against GiveWP’s PayPal Commerce contract (overrider parameter-type compatibility).
Per-account credentials no longer leak to wp_options when GiveWP refreshes an access token.
Inbound PayPal webhooks read the WP-canonicalised transmission headers, fixing signature verification and dropped events.
Removed
The unused ador_paypal_mode option.
1.0.0 – 2026-05-07
Added
Multi-account admin panel (Donation Forms → PayPal Accounts) with Accounts, Country Routing, and Settings tabs.
Account add/edit form with AES-256-GCM encrypted credential storage.
Country routing rules with add/edit/bulk-deactivate actions.
Custom database tables {prefix}ador_accounts and {prefix}ador_country_routing with schema versioning.
PayPal_Credential_Router intercepting GiveWP’s IoC container before every PayPal AJAX payment request to substitute per-account credentials.
IoC container rebinding for both MerchantDetail::class and MerchantDetails::class covering all GiveWP PayPal credential resolution paths.
Refund routing with inactive-account guard.
Per-account REST webhook endpoint POST /wp-json/ador/v1/webhook/{account_id} with HMAC-SHA256 signature verification and idempotency checking.
Country selector popup shortcode [ador_country_selector] with sessionStorage persistence.
Geolocation hint (non-binding IP-based country pre-selection).
Seven GiveWP email template tags for per-entity receipt details.
Per-entity sequential receipt numbers allocated atomically via FOR UPDATE lock.
Default tax-deductibility statement templates for US and Canada.
PDF receipt generation via dompdf behind ador_pdf_receipts_enabled option flag.
Action hooks ador_credentials_routed and ador_webhook_processed.
PHPStan level 8, WPCS 3.x, PHPUnit 9.6 with BrainMonkey test suite.
Security
AES-256-GCM encryption for all stored PayPal credentials with HKDF-SHA256 key derivation.
PayPal HMAC-SHA256 webhook signature verification on all inbound webhook events.
WordPress nonce protection on all admin form submissions and AJAX endpoints.
current_user_can( ‘manage_give_settings’ ) capability checks on all admin-only actions.
$wpdb->prepare() for all parameterised database queries.
