ProducerKit 2.1.0

Recommended for anyone on 2.0.0. That release shipped a commission workflow that could not complete, and a checkout that could charge less than the listed price.

Commissions now work

In 2.0.0 a maker could send a quote and no customer could ever accept it. The accept/decline endpoint only answers POST — deliberately, so that a mail client prefetching a link cannot accept a quote on someone's behalf — but the email could only send a clickable link, and a click is a GET. Every customer who tried got a 404.

Quote links now open a confirmation page showing the price, the estimated date and what was asked for, with Accept and No thank you buttons. The page is noindex and sends no-referrer, so a quote link cannot travel further than the person it was sent to.

Quotes can also now be revised or reissued after the 30-day expiry. Previously the customer was told to ask for a new link and the maker had no way to send one.

Money

• Pre-orders could be undercharged. The checkout read prices with a heuristic built for search-engine markup, which takes the first run of digits it finds: 2 for $5 was charged as $2.00, and $1,200.00 as $1.00. Any price that is not one unambiguous amount now stops the checkout and names the product so it can be fixed.
• An accepted commission never produced a payment link — the code that raises the order had no caller at all.
• Paying an order could settle nothing. The link between order and request was not checked before a payment URL was handed out, so the customer could pay and the request stay open.
• Settlement ran twice per payment, overwriting the payment time with the fulfilment time.
• Retrying a failed checkout created a duplicate hidden product each time.

Privacy

• The hidden product raised for a commission was publicly readable. It was saved with WordPress's default published status, so the customer's name and their verbatim request were served to anyone who guessed its URL. It is now private, and no longer carries the customer's words at all.
• The public commission endpoint returned database columns added by the WooCommerce module.
• Reading customer records and issuing binding quotes required only the Contributor role. It now requires Editor, adjustable with the pkit_commission_manage_cap filter.
• Rate limiting hashed visitor IP addresses without a salt.

Also fixed

One click on the commissions screen could put a request into a state it could not be recovered from. A commission's type and material displayed as raw slugs. Settlement columns could never be added on a site that enabled the commissions module second, and a failed table creation was never retried. Around twenty database queries were run to draw the commissions filter row, and four on every order status change store-wide.

Upgrading

Safe from 2.0.0 — no data changes. If you are on 1.x, read the 2.0.0 notes first: there is no upgrade path from 1.x and content saved by it is not read.

Requirements

WordPress 6.9+ · PHP 8.1+ · WooCommerce optional

24 unit and 197 integration tests, PHPCS clean, Plugin Check clean, PHPUnit passing on PHP 8.1.