SecurePay WHMCS Payment Gateway
================================

Version: 2.0.0
Compatible with: WHMCS 7.x, 8.x, 9.x (PHP 7.2+)
License: GPLv2 or later

Accept bKash, Nagad, Rocket, Upay and every BD gateway in WHMCS through the
premium branded SecurePay checkout. Payments are always verified
server-to-server against the SecurePay API before the invoice is marked paid.

---------------------------------------------------------------------------
Installation
---------------------------------------------------------------------------

1. Download this folder.

2. Upload  securepay.php  to your WHMCS directory:

        WHMCS/modules/gateways/securepay.php

3. Upload the callback file:

        WHMCS/modules/gateways/callback/securepay.php

   (Make sure the file is inside the "callback" folder, not in the gateways
   root.)

4. In the WHMCS admin area go to:

        Setup -> Payments -> Payment Gateways

5. Open the "SecurePay" gateway and enter:

   - API Key
        Paste the API key from your SecurePay dashboard
        (My Websites -> copy the API key of this website).

   - Payment Site URL
        Leave the default: https://payment.farhadyt.shop/

   - BDT Conversion Rate (optional)
        Leave 0 when your WHMCS currency is BDT (recommended), or when you use
        the Currency Converter addon so SecurePay converts automatically.
        If your currency is NOT BDT and you have no addon, enter the rate so
        invoice amounts are converted to BDT before being sent.

6. Click "Save Changes". The gateway is now active. When a customer pays an
   invoice they will see the SecurePay Pay Now button and be redirected to the
   branded checkout. Verified payments mark the invoice paid automatically.

---------------------------------------------------------------------------
How it works
---------------------------------------------------------------------------

1. Customer clicks "Pay Now" on the invoice page.
2. A payment link is created on the SecurePay gateway (one link per click).
3. The customer pays through the branded checkout (bKash / Nagad / Rocket /
   Upay / bank, etc).
4. SecurePay posts a webhook to callback/securepay.php.
5. The callback verifies the transaction with the SecurePay verify API, finds
   the correct invoice (the invoice id is embedded in the payment metadata)
   and applies the payment with addInvoicePayment(). Duplicate transactions
   are ignored via checkCbTransID(). The customer is then returned to their
   invoice page.

Security features
-----------------

- The API key is read from the gateway configuration server-side; it is never
  sent in callback URLs or webhook query strings.
- Every callback is re-verified against the SecurePay API before any invoice
  is touched, so a forged or stale webhook can never mark an invoice paid.
- The final invoice amount is taken from the verified API response instead of
  trusting URL parameters.
- cURL runs with SSL verification enabled and a request timeout.

Troubleshooting
---------------

- Enable "Debug Logging" in the gateway settings, then check
  Utilities -> Logs -> Activity Log / Module Log for securepay entries.
- Ensure the API key belongs to the same SecurePay website that owns this
  WHMCS installation.
- Your WHMCS SystemURL must be a public, DNS-resolvable domain
  (localhost / .test will be rejected by the payment server for safety).

Changelog
---------

2.0.0  - Complete rebuild: verify-before-pay, invoice resolution via payment
         metadata, server-side API key, SSL-verified cURL, debug logging,
         currency conversion options, modern Pay Now UI.