wt_commerce 1.4.0

# WT Commerce 1.4.0 — release notes

Covers `wt_simple_pay`. Drupal 11, PHP 8.1+. **Run `drush updb -y` after updating** (see Upgrade notes).

## Security

No security fixes in this release. The new CSV export is built to be safe by default:
- it needs its own permission, *Export WT Commerce orders* (marked *restrict access*, never granted automatically), and is off on updated sites until you turn it on;
- the file is never cached by the browser or a proxy (`Cache-Control: no-store`);
- cells that a spreadsheet would run as a formula are neutralised (CSV injection).

## Bug fixes

- **The revenue total ignored the list it was shown with.** It summed every completed order on the site, including unpublished ones, whatever the dashboard showed, and would have counted a translated order once per language. It now counts exactly the orders the dashboard lists, each once.
- **Shipped dashboard views.** The Orders, Reservations and Appointments views installed on new sites carried settings that the configuration schema does not define (one of them unknown to Drupal 11.1), so strict schema checks failed. New installs only; nothing to do on existing sites.

## Features

- **Orders dashboard filters.** *Orders* (`/admin/wt-commerce/orders`) can be filtered by:
- **Search**: order number (`WT-123`), first or last name, or email.
- **Date**: today, last 7 days, this month, last month, last 3 months, this quarter, last quarter, this year, last year, or a custom range. Periods are calendar days in the site time zone, and both days of a custom range are included.
- **Status**, **Payment method** and **Delivery method**.
- The list now has 50 orders per page and a *Reset* button.

New installs get this dashboard. Existing sites add it with one button (see *Existing sites* below).

- **Order count and revenue at the top.** Above the table: the number of orders in the filtered list, how many are completed, and the revenue of the completed ones. It covers the whole filtered list, not only the page you see, and replaces the total that used to appear below the table.

- **CSV export of the filtered list.** Two buttons in the summary download exactly the list you filtered, every page of it, in the dashboard's order:
- **Export CSV for Excel (;)**: separator `;` and decimal comma, for Excel in Greek and most European languages.
- **Standard CSV (,)**: separator `,` and decimal point, for import tools.

Both are UTF-8, so Greek text opens correctly. Amounts are real numbers, and dates are written as `2026-10-29 14:30:00` in the site time zone. Columns: order, date, status, payment method, delivery method, buyer name, email, phone, address, amount, currency, transaction ID, items and notes. Large lists are streamed, so they neither time out nor run out of memory.
- New permission **Export WT Commerce orders** (not granted to anyone automatically). The file contains buyers' personal data.
- A cell that starts with `=`, `+`, `-` or `@` gets a leading apostrophe, so a spreadsheet never runs it as a formula. Phone numbers such as `+30 697…` therefore show an apostrophe in Excel.
- The export can be turned off under *Documentation & Help → Order Management Dashboard*.

- **Payment and delivery method on orders.** Every new order records how it was paid and delivered (new fields *Payment method* and *Delivery method*, shown on the order page, not editable). Orders that needed no delivery (bookings, digital products) show *No delivery*. For older orders the update fills in the payment method where it can be known for sure, from the order status or the shape of the transaction ID (Stripe, Viva Wallet, PayPal). The others, and the delivery method of every older order, stay empty.

## Existing sites

Your Orders dashboard is a view you may have changed, so updating **does not touch it**. What changes on its own:

- The order total moves **above** the table and shows the number of orders. Without filters it shows the same revenue as before, except that unpublished orders are no longer counted, so it now matches the list it sits on.
- Order pages show the two new fields.

To get the filters and the export, open *Configuration → Web services → WT Commerce: Payment & Cart Setup → Documentation & Help → Order Management Dashboard* and click **Add filters and export to my Orders dashboard**. It lists what it will add, adds only what is missing, keeps your own columns, filters and settings, and turns the export on. If one of your own filters already uses the same URL key (for example `status`), that filter of ours is left out and the page says so. Then:
- give **Export WT Commerce orders** to the roles that need it (e.g. your accountant);
- if you manage configuration in code, export it (`drush cex`), or the next configuration import undoes the change.

## Upgrade notes

1. Put the site in maintenance mode (`drush state:set system.maintenance_mode 1`), back up the database, update the code (`composer update drupal/wt_commerce`).
2. Run `drush updb -y`. New updates:
- `wt_simple_pay_update_8110`: adds the *Payment method* and *Delivery method* fields to orders, hidden on the order form and shown on the order page. It only adds; running it again changes nothing.
- `wt_simple_pay_update_8111`: adds the CSV export setting, **off** on existing sites. The dashboard button turns it on; so does the checkbox under *Documentation & Help → Order Management Dashboard*.
- `wt_simple_pay_post_update_order_payment_method`: fills in the payment method of older orders where it is certain, in batches of 50. It never overwrites a value, creates no revision, and does not change the orders' "last updated" date, their bookings or their stock.
3. `drush cr`, then end maintenance mode (`drush state:set system.maintenance_mode 0`). If you manage configuration in code, export it (`drush cex`): the new fields and the setting belong to your site's configuration.
4. Optional: add the dashboard filters and the export (see *Existing sites*), and grant the export permission.

## Tested on

- Drupal 11.4 (PHP 8.4, MySQL 8.0): manual tests on a site with 169 real orders: the opt-in button, every filter alone and combined (including the browser's own form submission), the summary against direct database counts, and both CSV formats.
- CSV files: tested in Google Sheets. The default format (semicolon, decimal comma, UTF-8 BOM) is designed for Excel with Greek regional settings; please report any Excel issues.
- Upgrade from 1.3.0: a copy of the same site's 1.3.0 database. Before `drush updb`, with the new code: shop pages, cart, the Orders dashboard (count and revenue), the settings page and the stock/shipping/notes regression checks (checkout with Stripe sandbox, bank transfer and pay later, cancel/reactivate, refunds, cron) all work, and the export is refused. Then all three updates in one `drush updb`, the backfill, the opt-in button, the filters, a CSV download, and the same regression checks again.
- Automated Unit and Kernel tests (119 tests, 7 new test classes for the summary, periods with quarter and year boundaries, daylight saving time and time zones, filters, CSV content and encoding, access, the update hooks, the backfill and the dashboard upgrade): all passing on Drupal 11.4 with SQLite and MySQL 8.0, and on Drupal 11.1.10 with SQLite. drupal.org CI (pipeline 1023119): all 119 tests pass on Drupal 11.4.9, PHP 8.3, MySQL 8.0.