CartMan Connect for WooCommerce

1.6.5

• Fixed support form critical errors: auto-create ticket tables on init if missing after plugin upgrade
• Support form errors now redirect back to the page with a message instead of wp_die white screen
• Back-compat for old [easywpshop_support_form] shortcode and easywpshop_submit_support form action
• Safer support ticket database queries and email notification handling

1.6.4

• WordPress.org review: load wp-admin includes only when required and call their functions immediately
• Base64 product uploads use image.php helpers only; URL sideloads use media.php via media_sideload_image()

1.6.3

• Proper WooCommerce refunds from the app via wc_create_refund (line items, restock, totals)
• PATCH status=refunded now creates a real refund record instead of only changing status
• POST /orders/{id}/refund endpoint for explicit refunds from CartMan

1.6.2

• Block refund status changes from the app (refunds must be processed in WooCommerce admin)
• Harden order list/detail API against plugin conflicts and malformed order data
• Declare WooCommerce HPOS (custom order tables) compatibility
• Add admin URL on order detail responses for mobile deep links

1.6.1

• Internal identifiers migrated to cartman prefix (API, options, shortcodes)
• OAuth client ID and redirect schemes updated for the CartMan app

1.6.0

• Rebranded to CartMan Connect for WooCommerce (slug: cartman-connect) for WordPress.org compliance
• Distinctive plugin name; third-party disclaimer; scoped admin notices
• Plugin URI and Author URI are separate

1.5.6

1.5.4

• Custom fields: only schema-defined and explicitly allowlisted meta keys are exposed (no more plugin junk like PEWC_, EKIT_, WCBOOST_)
• Empty non-schema meta values are hidden from the mobile app

1.5.3

• Fixed auth lockout blocking valid OAuth/application password logins after failed attempts
• Successful login now clears IP lockout automatically

1.5.2

• Fixed OAuth “Invalid OAuth request” for Expo Go and development redirect URIs (exp://)
• Improved OAuth redirect URI validation and clearer error messages
• Discover endpoint now validates redirect_uri before login

1.5.1

• Fixed OAuth / application password authentication for REST API requests
• Extended connection test with store software health and admin shortcut URLs

1.5.0

• Added product custom fields / meta support for the mobile app (read, write, schema endpoint)
• Expose all product attributes including descriptive (non-variation) attributes
• Admin settings for extra meta keys and mobile custom field schema

1.4.0

• Extended product API: categories, tags, shipping dimensions, tax, inventory, sale dates, and variable products with variations
• Added GET /products/tags endpoint for mobile product editor

1.3.0

• Added store OAuth login for the mobile app (authorization code + PKCE)
• Mobile users can log in on their WordPress site instead of pasting keys manually

1.2.0

• Added optional connection key expiry (never expire by default, or expire after N days)
• Added security hardening: hashed keys, HTTPS enforcement, rate limiting, auth lockout, audit log, IP allowlist
• Added support tickets and customer support shortcode
• Added order status updates via REST API
• Added sales reports and transaction endpoints

1.1.0

• Added support system and improved mobile API responses

1.0.0

• Initial release