wt_commerce 1.4.1-rc1

# WT Commerce 1.4.1 — release notes

Covers all three modules. Drupal 11, PHP 8.1+. **Run `drush cr` after updating** (see Upgrade notes). There are no database updates.

## Security

**The Viva webhook token is no longer written to logs.** Viva sends the token in the webhook URL, and Drupal logs the URL of each request, so entries logged during a webhook call contained your `webhook_token`. The token is now removed before anything is logged, and it is compared in constant time.

**What you should do if you use Viva Wallet.** Older log entries and your web server's access logs may still contain the token:

1. **Rotate the token.** Set a new `webhook_token` in `settings.php` and update the webhook URL in your Viva dashboard (`https://yourdomain.com/wtpay/webhook?token=…`).
2. **Clear the old log entries.** `drush watchdog:delete all` removes the **entire site log**, not just these entries, and cannot be undone. To remove only the entries with the token:

```bash
drush sql:query "DELETE FROM watchdog WHERE location LIKE '%/wtpay/webhook?token=%'"
```

3. **Check your web server's access logs** and those of your hosting panel. The token stays in the URL, so your server can still record it. This release cannot change that, and rotating it protects you from the old entries.

## Bug fixes

- **A missing Stripe library no longer breaks checkout.** Paying with Stripe could end in a fatal error (`Class "Stripe\StripeClient" not found`), leaving an unpaid order behind. Without the library, Stripe is now hidden at checkout, unless it is your only payment method. In that case the buyer gets a clear message and no order is created. The status report warns you on Drupal 11.2 and later.
- **Composer now installs the dependencies.** Earlier releases did not pull in `stripe/stripe-php` or `drupal/paragraphs`, so both had to be installed by hand.
- **A missing Stripe secret key leaves no unpaid order.** Checkout now refuses Stripe before the order is created.
- **Stripe orders are completed only when paid.** A Stripe session that is not paid no longer completes an order. Stripe payments are card payments: other methods enabled in your Stripe Dashboard, such as bank debits, are not offered.
- **Views integration moved out of the `*.views.inc` files** (Drupal 12 readiness), because Drupal 12 no longer loads hooks from them. The hooks are now in each module's `.module` file, as plain functions rather than `#[Hook]` classes. These modules support all of Drupal 11, and Drupal 11.0 does not discover `#[Hook]` classes, so views would otherwise lose the add-to-cart and booking fields and the order date filter there. Nothing changes in your views.

## Features

No new features in this release.

## Upgrade notes

1. Back up the database and update the code (`composer update drupal/wt_commerce`).
2. Run `drush cr`. This is required: checkout needs a new service, and the Views data must be rebuilt. Until caches are rebuilt, checkout fails.
3. If you added `stripe/stripe-php` or `drupal/paragraphs` to your own `composer.json`, you can keep them. Versions 16 to 21 of the Stripe library are supported.
4. If you use Viva Wallet, follow the steps under **Security**.
5. On multilingual sites, translate the new message "Card payment is temporarily unavailable. Please choose another payment method or contact us."

## Tested on

To be filled in at the release check, including the CI pipeline and `composer show drupal/wt_commerce 1.4.1 --all`, which must confirm that Composer installs the dependencies.