HDWebmobile Loyalty Points & Store Credit

HDWebmobile Loyalty Points & Store Credit rewards customers with points for every completed order, which they can redeem for a discount on a future purchase. Customers see their balance and full history on a new "Loyalty Points" tab in their account. Security by design Store credit and coupon tools hold real monetary value, so broken access control in them (CWE-284) can let attackers generate high-value credit through insufficient authorization checks -- forging value that was never actually earned. A points balance is exactly the same kind of value, and needs the same discipline. This plugin closes that vulnerability class by construction:

• There is no "balance" field anywhere that gets directly written. Every award, redemption, and admin adjustment is a signed row in an append-only ledger table, and a customer's balance is always the live sum of their own rows -- never a cached number that could drift or be overwritten by a bad request.
• Every redemption re-checks the customer's current live balance at the exact moment of redemption, both when the discount is shown in the cart and again when the order is actually created -- never a points figure the checkout form sent back to the server.
• Every earn and redemption is tied to a specific order and only ever happens once for that order, so a page refresh, retried request, or duplicate status-change event can never double-award or double-redeem.
• If an order is later cancelled, refunded, or fails, any points it awarded or redeemed are automatically reversed -- so a cancelled order can never leave a customer with free points, or a lost balance, on the books.
• Manual adjustments (for customer service) always record which admin made the change.

Key Features

• Configurable points-earning rate (points per currency unit spent) and the order status that triggers earning
• Configurable redemption rate (points required per currency unit of discount), a minimum-points-to-redeem threshold, and a maximum percentage of any single order that can be paid with points
• A simple redemption box on the cart page showing the customer's live balance, with an amount they can apply as a discount
• "Loyalty Points" tab in My Account showing current balance and full transaction history
• Automatic point reversal on cancelled, refunded, or failed orders
• Admin manual adjustment tool (grant or deduct points for a specific customer by email) plus a recent-activity ledger view, both under WooCommerce > HDWebmobile

Limitations (please read before installing)

• Points can only be earned by logged-in customers with an account -- guest checkouts don't accrue points, since there's no account to credit them to
• No expiry date on points in this version
• The cart redemption box uses a plain form submission (not AJAX) -- applying or removing a redemption reloads the cart page

1.0.0

• Initial release: append-only points ledger, automatic earning on order completion, cart-page redemption with live balance re-verification, automatic reversal on cancelled/refunded/failed orders, My Account balance and history, admin manual adjustment and ledger view.