wt_commerce 1.4.1

# WT Commerce 1.4.1 — release notes

Covers all three modules. Drupal 11, PHP 8.1+. **Run `drush cr` after updating** (see Upgrade notes). There are no database updates.

## Security

**The Viva webhook token is no longer written to logs.** Viva sends the token in the webhook URL, and Drupal logs the URL of each request, so entries logged during a webhook call contained your `webhook_token`. The token is now removed before anything is logged, and it is compared in constant time.

**What you should do if you use Viva Wallet.** Older log entries and your web server's access logs may still contain the token:

1. **Rotate the token, after updating to this release** (otherwise the new token gets logged too). Set a new `webhook_token` in `settings.php` and update the webhook URL in your Viva dashboard (`https://yourdomain.com/wtpay/webhook?token=…`). Do both within a few minutes: Viva's calls fail while the two differ.
2. **Clear the old log entries.** `drush watchdog:delete all` removes the **entire site log**, not just these entries, and cannot be undone. To remove only the entries with the token:

```bash
drush sql:query "DELETE FROM watchdog WHERE location LIKE '%/wtpay/webhook?token=%'"
```

3. **Check your web server's access logs** and those of your hosting panel. The token stays in the URL, so your server can still record it. This release cannot change that, and rotating it protects you from the old entries.

## Bug fixes

- **A missing Stripe library no longer breaks checkout.** Paying with Stripe could end in a fatal error (`Class "Stripe\StripeClient" not found`), leaving an unpaid order behind. Without the library, Stripe is now hidden at checkout, unless it is your only payment method. In that case the buyer gets a clear message and no order is created. The status report warns you on Drupal 11.2 and later.
- **Composer now installs the dependencies.** Earlier releases did not pull in `stripe/stripe-php` or `drupal/paragraphs`, so both had to be installed by hand.
- **A missing Stripe secret key leaves no unpaid order.** Checkout now refuses Stripe before the order is created.
- **Stripe orders are completed only when paid.** A Stripe session that is not paid no longer completes an order. Stripe payments are card payments: other methods enabled in your Stripe Dashboard, such as bank debits, are not offered.
- **Views integration moved out of the `*.views.inc` files** (Drupal 12 readiness), because Drupal 12 no longer loads hooks from them. The hooks are now in each module's `.module` file, as plain functions rather than `#[Hook]` classes. These modules support all of Drupal 11, and Drupal 11.0 does not discover `#[Hook]` classes, so views would otherwise lose the add-to-cart and booking fields and the order date filter there. Nothing changes in your views.

## Features

No new features in this release.

## Upgrade notes

1. Back up the database and update the code (`composer update drupal/wt_commerce`).
2. Run `drush cr`. This is required: checkout needs a new service, and the Views data must be rebuilt. Until caches are rebuilt, checkout fails.
3. If you added `stripe/stripe-php` or `drupal/paragraphs` to your own `composer.json`, you can keep them. Versions 16 to 21 of the Stripe library are supported.
4. If you use Viva Wallet, follow the steps under **Security**.
5. On multilingual sites, translate the new message "Card payment is temporarily unavailable. Please choose another payment method or contact us." For Greek, import `wt_simple_pay/translations/el.po` at *Configuration → Regional and language → User interface translation → Import*.

## Tested on

- Composer: on a fresh `drupal/recommended-project` (Drupal 11.4), a dry run of `composer require drupal/wt_commerce:1.4.1-rc1` installs Paragraphs 1.23.0 and `stripe/stripe-php` v21.3.3. `composer show drupal/wt_commerce 1.4.1-rc1 --all` lists both under `requires`.
- Drupal 11.4 (PHP 8.4, MySQL 8.0), manual tests: a Stripe sandbox card payment with the webhook, from checkout to a completed order. With the Stripe library hidden: Stripe gone from the cart, the status report warning, and a stale checkout refused with no order created. A Viva webhook call with a wrong token, logged without the token.
- Automated Unit and Kernel tests (134 tests, 4 new test classes) on SQLite and MySQL with Drupal 11.4, and on Drupal 11.1 (the status report test is skipped there, because that hook needs 11.2). Each new fix was switched off once to confirm that a test fails without it.
- A second site: 1.4.1-rc1 installed with Composer and a Stripe sandbox session created. Its webhook was not connected, so that order stayed pending.
- Drupal 11.0.13: the Views data test only.
- drupal.org CI: pipeline 1024406 (tag `1.4.1-rc1`) passed.
- Not tested on a real payment or live Viva call: the correct-token path of the Viva webhook and the missing Stripe secret are covered by automated tests only.