Gramota — EU Digital Identity for WooCommerce

WordPress plugin that adds an EU Digital Identity Wallet verification step to WooCommerce checkout.

For end-user installation instructions, settings reference, and FAQ, see readme.txt — that's the file the WordPress.org plugin directory parses.

What this is

A merchant installs the plugin, drops in their gk_live_* key from gramota.eu, and picks a verification preset (age-18, age-21, or kyc-basic). On every checkout page a "Verify your identity" panel appears above the payment block. The customer scans the QR with their EU Digital Identity Wallet; on success the panel turns green and the order can be placed. On failure (or no attempt) the server blocks submission with a checkout error.

Architecture

                  ┌──────────────────────────────────────────────┐
                  │  Customer's browser (checkout page)          │
                  │                                              │
                  │  ┌────────────────────────────────────────┐  │
                  │  │  Gramota widget (loaded from CDN)      │  │
                  │  │  - renders QR + polls Gramota API      │  │
                  │  └────────────────────────────────────────┘  │
                  │           ▲                          │       │
                  │  assets/checkout.js                  │       │
                  │  - calls REST bridge for session     │       │
                  │  - mounts widget                     │       │
                  │  - mirrors result into hidden inputs │       │
                  └───────────┼──────────────────────────┼───────┘
                              │                          │
       POST /wp-json/         │                          │  GET /v1/verifications/:id
       gramota/v1/            │                          │  (uses short-lived clientToken)
       start-verification     │                          ▼
                              │                  ┌──────────────────┐
                              ▼                  │  api.gramota.eu  │
                  ┌─────────────────────────┐    └──────────────────┘
                  │  WordPress (this plugin)│              ▲
                  │  REST bridge            │              │
                  │  - verifies nonce       │              │  POST /v1/verifications
                  │  - calls Gramota API    │──────────────┘  Authorization: Bearer gk_live_*
                  │    with gk_live_* key   │
                  │  Settings tab           │
                  │  Checkout hooks         │
                  └─────────────────────────┘

The gk_live_* secret never leaves the WordPress server: the browser asks the plugin's REST endpoint to start a session, and the plugin forwards that to Gramota with the secret attached. The browser only ever holds the short-lived clientToken.

File layout

gramota-wp/
├── gramota-wp.php          Main plugin file. WP plugin header. Bootstrap.
├── readme.txt              WordPress.org plugin directory readme (rigid format).
├── README.md               This file.
├── uninstall.php           Cleans up wp_options on plugin delete.
├── .gitignore
├── includes/
│   ├── class-gramota-plugin.php       Singleton bootstrap.
│   ├── class-gramota-settings.php     WooCommerce → Settings → Gramota tab.
│   ├── class-gramota-api-client.php   wp_remote_post wrapper for POST /v1/verifications.
│   ├── class-gramota-checkout.php     Renders panel + validates on submit.
│   └── class-gramota-rest-bridge.php  /wp-json/gramota/v1/start-verification endpoint.
├── assets/
│   ├── checkout.js         Vanilla JS — wires the widget to WC's form.
│   └── checkout.css        Panel chrome (the widget brings its own CSS).
└── languages/
    └── gramota-wp.pot      Empty translation template.

Development

Run the syntax linter against every PHP file before committing:

find . -name '*.php' -print0 | xargs -0 -n1 php -l

The widget repo lives next door: ../gramota-widget. During dev, point the "Widget URL (advanced)" setting at a local build (e.g. http://localhost:5173/gramota-widget.js) so you can iterate without redeploying.

License

GPL-2.0-or-later. See readme.txt for the full notice.