Sendit.ma for WooCommerce

This plugin connects your WooCommerce store to your Sendit.ma account, a delivery service operating in Morocco. It removes double data entry: orders are sent to Sendit in one click (or automatically), shipping is priced from the customer's city, and delivery statuses flow back into WooCommerce. The plugin interface is in French, the working language of the merchants it serves. Main features

• Parcel creation — send an order to Sendit from the order screen, as a bulk action, or automatically when an order reaches a status you choose.
• Dynamic shipping rates — the rate comes from the Sendit district the customer selects at checkout. Enable it globally or product by product.
• City / district selector — replaces the "City" field with a searchable list of Sendit districts. Works with both the classic checkout and the block checkout (WooCommerce 8.9+).
• PDF labels — download the label for one order, or generate a combined PDF for a selection of orders.
• Automatic status tracking — the Sendit webhook adds a timestamped note at each step and moves the order to "Completed", "Cancelled", "Failed" or "On hold" depending on the delivery outcome.
• Parcel options — "allow try on" and "allow opening" can be set globally, per order, or in bulk, and are synced to Sendit.
• Cities and rates kept current — the list is fetched when you save your API keys and refreshed weekly, so Sendit rate changes reach your store without anyone remembering to press a button.
• HPOS compatible — works with WooCommerce High-Performance Order Storage.

External service required This plugin is a connector: it only works with a Sendit.ma account. Sendit.ma is a Moroccan delivery service operated by Sendit (ICE 002745443000051, 120 Bd de la Grande Ceinture, Casablanca, Morocco). The plugin performs no delivery function of its own — it sends your orders to the Sendit API and displays what comes back. What is sent, when, and where

• https://app.sendit.ma/api/v1/login — when you save the settings and when you test the connection: your API keys, in exchange for a session token.
• https://app.sendit.ma/api/v1/districts — when you save API keys, once a week, and whenever you force a sync: no customer data, only a request for the list of cities and rates.
• https://app.sendit.ma/api/v1/deliveries — when a parcel is created, triggered by you or by the order status you configured: the customer's name, phone number and address, the order reference, the items and quantities, the amount to collect, and the parcel options.
• https://app.sendit.ma/api/v1/deliveries/getlabels — when you download a label: the code of the parcel concerned.

Nothing is transmitted until you enter your API keys. The plugin sends data to no other recipient, loads no external resources, and collects no usage statistics. In the other direction: Sendit calls your store's webhook URL to report delivery progress. That URL carries a token, and requests without a valid token are rejected. By using this plugin you accept the terms of the Sendit service:

• Terms of use: https://plugins.sendit.ma/terms
• Privacy policy: https://plugins.sendit.ma/privacy

The plugin is free and no feature is restricted. Physical deliveries carried out by Sendit.ma are billed separately, at Sendit.ma's published rates.

2.2.5

• WooCommerce is now declared as a required plugin. The plugin header carries Requires Plugins: woocommerce, so WordPress 6.5 and later will not let the plugin be activated before WooCommerce is installed and active, and offers to install it from the activation screen. Previously the activation succeeded and the store owner only discovered the dependency from an admin notice afterwards. Older WordPress versions ignore the header and keep the existing notice, so nothing changes for them.

2.2.4

• Settings sanitisation hardened against non-scalar input. Every register_setting() callback now rejects arrays and objects before passing anything to a string function. This matters on WordPress 5.8 and 5.9, which the plugin supports: sanitize_key() only gained its own is_scalar() guard in WordPress 6.0, so on those versions a crafted nested array in the auto-send status field reached strtolower() and caused a fatal error when saving the settings. The pickup-district option no longer uses intval() directly, which silently turned an array into district 1.

2.2.3 Addresses the points raised in the WordPress.org plugin review.

• Select2 updated from 4.0.13 (2020) to 4.1.0. The bundled copy was five years old. The library version is now a constant used for cache-busting, so an upgraded store actually receives the new file instead of serving the old one from browser cache. Verified on the block checkout: the city list, its search, selection and the resulting rate all behave as before.
• Permission check added to bulk label printing. WordPress validates the bulk-action nonce, but not authorisation. The other two bulk actions already checked edit_shop_orders; printing labels did not, so a user without rights over orders could have triggered label generation and obtained the parcel PDF address.
• The city-sync notice is now confined to the Sendit settings page. It could previously appear on any admin screen.

2.2.2

• Plugin URI and Author URI now point to different pages, as the directory requires: the plugin page at plugins.sendit.ma/woocommerce, and the company site at www.sendit.ma.

2.2.1 Release preparation for the WordPress.org directory, plus automatic city syncing.

• Cities now sync on their own. Saving valid API keys fetches the city and rate list immediately — the separate "sync" step is no longer something to remember. A sync only re-runs when the keys change or the list is empty, so saving the page repeatedly costs nothing. If it fails, the page says why, and the next save retries.
• Weekly refresh now reaches existing stores. The weekly city refresh was only scheduled when the plugin was activated, so stores that updated in place never got it and could keep charging outdated rates. It is now scheduled on load as well.
• The manual button remains as "Force a city sync", for an immediate refresh.
• Plugin renamed to "Sendit.ma for WooCommerce" to follow the WooCommerce trademark naming rules.
• Readme rewritten in English, as the directory requires, and the external service Sendit.ma now fully documented.
• API keys and the shipping strategy option now go through explicit sanitisation callbacks.
• Label download now verifies that the PDF address returned by the API belongs to Sendit before redirecting to it.
• Translation identifier aligned with the plugin folder (sendit-ma-integration), which WordPress.org requires before it will distribute translations.
• Added the translation template languages/sendit-ma-integration.pot (146 strings), previously missing: no translation could have been produced without it.

2.2.0 Version validated on a real store (WordPress 7.1, WooCommerce 11.1), on both the classic and block checkouts, with and without High-Performance Order Storage. Important fixes:

• City search restored on the block checkout. The field listed 500+ cities as a raw list with no search: the library it needs was being removed from the page by WooCommerce right after it loaded. It is now bundled with the plugin. The field also keeps working after each address recalculation, which was not the case before.
• Phone number now required at checkout. Sendit rejects any parcel without a phone number (HTTP 422). The block checkout left the field optional, so an order could be saved without a number and then fail to send indefinitely. This can be turned off.
• No more accidental free shipping. A district missing from the rate list (removed at Sendit, stale customer address, unsynced list) offered "Shipping: 0 MAD". No rate is offered in that case now.
• Consistent default parcel options. The settings showed "try on: No" while "Yes" was being sent to Sendit on a fresh install.
• Native city, postcode and state fields hidden on the block checkout. The state field stayed visible next to the Sendit field, inviting customers to fill in the wrong one.
• No resources loaded from an external CDN: the search library ships with the plugin.

Performance:

• The city and rate lists (~22 KB) are no longer loaded on every page view of the site, only where they are used.
• Checkout styles and scripts are now real files, cached by the browser, instead of being re-injected into the HTML on every load (~320 lines).

Other:

• Automatic weekly refresh of cities and rates.
• Deactivating the plugin no longer deletes the city list; deleting the plugin does erase all data, API keys included.
• The API test endpoint now checks user capabilities.
• Fixed an untranslatable label and translations inserted into JavaScript (a single apostrophe was enough to break the checkout script).
• Compatibility headers updated (WordPress 7.1, WooCommerce 11.1).

2.1.1

• HPOS and block checkout compatibility declarations: WooCommerce no longer shows the plugin as incompatible.
• Fixed: the confirmation message for a manual send was displayed in red, like an error.
• Fixed: bulk label printing returned no message when none of the selected orders had a Sendit code.
• Fixed: possible PHP notice when saving an order whose city field was absent from the checkout.
• Added the required version headers (WordPress, PHP, WooCommerce) and the plugin documentation.

2.1

• Compatibility with the WooCommerce block checkout (8.9+), with a searchable district selector.
• Automatic sending to Sendit when the order status changes.
• "Send to Sendit" bulk action and a direct send button on the order screen.
• Parcel options (try on / opening) configurable by default, per order, and in bulk.
• Webhook secured by token, with timestamped order notes at each delivery step.
• Product and variant details forwarded to Sendit.