APG Withdrawal for WooCommerce

Changelog

0.5.0

• Compliance with Directive (EU) 2023/2673 (amends Directive 2011/83/EU on consumer rights). The plugin now covers the additional obligations introduced by the new Article 11a (online withdrawal function) plus the related pre-contractual and burden-of-proof requirements.
• Category-level Withdrawal type term meta on product_cat, with automatic inheritance for products that keep the “Withdrawal allowed (default)” value. When a product belongs to several categories with conflicting types, the most restrictive type wins (priority order: excluded > personalized > digital > manual > allowed).
• New [apg_withdrawal_notice] shortcode, matching apg-withdrawal/notice Gutenberg block and woocommerce_single_product_summary injection (priority 20, between the price and the Add to Cart button) that automatically displays the exclusion notice on the product page when the effective withdrawal type is not allowed.
• New plugin settings section “Exclusion notice texts” with one editable textarea per non-default type (excluded, digital, personalized, manual) and a translated default text per type. Optional per-product override field on the Withdrawal product data tab to customise the notice for a single product.
• “Digital content waiver” settings section simplified to a single excluding selector with three modes — Never (disabled), On products classified as digital content, On every order — driven exclusively by the per-product / per-category withdrawal type. Legacy installations with mode virtual are migrated to digital; mode specific is migrated to digital and the previously selected categories / products are automatically marked with _apg_withdrawal_type = digital to preserve their behaviour. The legacy digital_waiver_categories / digital_waiver_products settings stop being honoured at the UI level (a one-time silent migration runs on init, flagged by the apg_withdrawal_migrated_to_0_5 option).
• New printable Annex I.B model withdrawal form served at ?apg_withdrawal_model_form=1 with @media print styling, pre-populated with the store name, address, email (from WooCommerce settings) and an optional merchant phone (new Merchant phone (optional) plugin setting). The public withdrawal request form links to it as “Download the official model withdrawal form (Annex I.B)”.
• New [apg_withdrawal_link] shortcode and apg-withdrawal/link Gutenberg block to render a link to the public withdrawal form with optional label, class and target attributes. The default label uses the literal wording suggested by Article 11a(1) (“Withdraw from the contract here”). The My Account per-order action label has been updated to the same default for new installs.
• Customer acknowledgement email now includes a verifiable SHA-256 hash of the receipt content (computed over name + email + order + scope + products + details + UTC timestamp) and the UTC timestamp used for verification. Hash and timestamp are also persisted in post meta (_apg_withdrawal_receipt_hash, _apg_withdrawal_receipt_hash_timestamp) and exposed in the CSV export.
• Digital-content waiver consent at checkout is now persisted as a structured log (_apg_withdrawal_digital_waiver_log order meta) that includes the exact label shown to the customer, UTC timestamp, IP, user agent and checkout type (classic or block). The legacy _apg_withdrawal_digital_waiver boolean meta is also written for backwards compatibility.
• Email delivery indicator: every status-change email and the initial customer acknowledgement now record whether wp_mail() was invoked, whether it returned success (= “accepted by the mailer”, not actual recipient delivery), the UTC timestamp and any error captured through wp_mail_failed. The information is surfaced in the request detail screen and exported as two additional CSV columns.
• GDPR integration: the plugin now registers a personal-data exporter and a personal-data eraser with the native WordPress privacy tools. The eraser anonymises withdrawal requests (replaces name, email, phone, IP, user agent and customer-supplied free text with [redacted]) and keeps the record itself plus the _apg_withdrawal_wc_order_id reference for legal evidence, in line with the burden of proof in Article 16 bis(8). The same anonymisation is also triggered automatically when a WordPress user is deleted (via Users → Delete, a customer-facing “Delete my account” button shipped by third-party plugins such as apg-gdpr-texts-for-forms, or any other path), so the withdrawal records never outlive the user account with personal data attached.
• CSV export now defends against spreadsheet formula injection: every cell whose first character is =, +, -, @, tab or carriage return is prefixed with an apostrophe before being written via fputcsv.
• New FAQ entries documenting where the withdrawal link should be placed by the merchant or the web designer and recommending a minimum 5-year retention period for withdrawal request records.

0.4.0

• New setting “Custom checkbox text” in the Digital content waiver section: lets the merchant override the default acknowledgement label rendered at checkout with a custom plain-text string. Leaving the field empty keeps the default translatable text.
• The default page auto-created by the plugin now uses the title “Exercise the right of withdrawal” (translated to “Ejercer derecho de desistimiento” in Spanish) and lets WordPress derive its slug from the title. Existing pages are not modified — only new installations get the new title and slug.
• Internal: corrected the allowed-modes whitelist in the settings sanitiser (disabled, virtual, all, specific) so the values now match the actual mode selector.

0.3.0

• New: digital-content withdrawal waiver checkbox at checkout. Customers buying digital content or virtual services see an optional acknowledgement that requesting the immediate supply waives their right of withdrawal (EU consumer protection requirement). The checkbox is informational; ticking it is not mandatory and does not block order placement.
• The checkbox is injected in both checkouts: classic shortcode (via woocommerce_checkout_before_terms_and_conditions with priority 999) and block-based (via JavaScript that reinserts itself with a MutationObserver to remain right before the native terms checkbox, after any other custom one).
• In the block checkout, a generic cleanup pass removes content injected next to our wrapper by third-party plugins whose selectors over-match (e.g. plugins using .wp-block-woocommerce-checkout-terms-block .wc-block-components-checkbox plus jQuery .after()), avoiding duplicated privacy or marketing notices.
• The customer’s choice is persisted to order meta _apg_withdrawal_digital_waiver ('1' or '0') on both checkouts: the classic checkout reads the POST value on woocommerce_checkout_create_order, the block checkout injects the value into the StoreAPI request body under extensions['apg-withdrawal']['digital_waiver'] and the server hook woocommerce_store_api_checkout_update_order_from_request writes the same meta.
• The block-checkout script reacts to cart changes mid-checkout: it watches StoreAPI cart mutations and, via a nonced AJAX endpoint (apg_withdrawal_check_cart_waiver), re-checks server-side whether the current cart still qualifies, inserting or removing the checkbox without a full page reload.
• New settings section “Digital content waiver” with a single SelectWoo selector for when to show the checkbox: never (default), only on virtual products, on every order, or on products in selected categories or selected products (these two can be combined). Category and product selectors load only when relevant. The “Only on virtual products” mode also matches products with the per-product _apg_withdrawal_type = digital setting, so virtual flag and explicit digital classification are treated as equivalent triggers.

0.2.0

• The frontend form now inherits the native WooCommerce stylesheet (notices, fields, buttons) without requiring custom CSS overrides.
• Notices rendered with wc_print_notice() so they pick up the correct WooCommerce template for both block themes (block-notices/*.php) and classic themes (notices/*.php).
• Dynamic notices (order-not-found feedback and product warning) are pre-rendered server-side via wc_print_notice() and toggled by JavaScript, instead of being built by hand with legacy markup that breaks on block themes.
• Order-not-found feedback follows the native WooCommerce pattern: notice at the top of the form plus woocommerce-invalid class on the email field.
• Buttons use wc_wp_theme_get_element_class_name( 'button' ) for theme and block-theme compatibility.
• Removed inline CSS injected from JavaScript in favour of native WooCommerce notice classes.
• Spanish translation updated to informal “tú” treatment as recommended by the WooCommerce style guide.

0.1.0

• Initial release.