From 0793a1ee824121ffd149c20597fc014be2c9d05d Mon Sep 17 00:00:00 2001
From: kristianwind <kristianwind@gmail.com>
Date: Fri, 2 Oct 2026 12:28:45 +0200
Subject: [PATCH] 1.7.0: shipping rule "Only" reserves a method, "Show" no
 longer does

Since 1.6.0 "Show" both whitelisted a method for its group and hid it from
everybody else. A group shown ordinary methods next to a free one therefore
took the ordinary ones away from every stranger, who was left with only the
free method. "Only" now carries the reservation; "Show" is just the group's
whitelist. Existing show rules are converted to only once on update so the
checkout does not change until the shop chooses.

Co-Authored-By: Claude Code <noreply@anthropic.com>
---
 README.txt                             |  8 +++-
 docs/CONTRACT.md                       |  2 +-
 docs/README.md                         |  9 ++--
 docs/RELEASE.md                        |  4 +-
 docs/SETUP.md                          | 16 ++++----
 includes/class-admin-shipping.php      |  8 +++-
 includes/class-db.php                  | 44 ++++++++++++++++----
 includes/class-frontend.php            | 10 +++--
 includes/class-rest-api.php            |  4 +-
 tests/smoke.php                        | 57 +++++++++++++++++++++++---
 woocommerce-email-discount-manager.php |  4 +-
 11 files changed, 129 insertions(+), 37 deletions(-)

diff --git a/README.txt b/README.txt
index a09285f..19a0cf6 100644
--- a/README.txt
+++ b/README.txt
@@ -4,7 +4,7 @@ Tags: woocommerce, discount, email, shipping, coupon
 Requires at least: 5.8
 Tested up to: 7.1.2
 Requires PHP: 7.4
-Stable tag: 1.6.3
+Stable tag: 1.7.0
 WC requires at least: 6.0
 WC tested up to: 11.1.2
 License: GPLv2 or later
@@ -50,7 +50,8 @@ coupons in a dropdown.
 
 * Per discount group, choose which shipping methods are shown or hidden.
 * No rules for a group means all shipping methods behave normally.
-* If any method is set to "Show", only "Show" methods are offered (whitelist).
+* If any method is set to "Show" or "Only", only those methods are offered to the group (whitelist).
+* "Only" also hides the method from every customer outside the group; "Show" does not.
 * Drag & drop reordering controls the order methods appear in at checkout.
 
 = How discounts are applied =
@@ -96,6 +97,9 @@ The most specific match wins: exact email, then domain, then partial match.
 
 == Changelog ==
 
+= 1.7.0 =
+* Shipping rules have a new choice, "Only". "Only" shows a method to the group and hides it from everybody else, which is what free delivery for one company needs. "Show" goes back to meaning just that: the group is offered the method, and nobody else is affected. Since 1.6.0 "Show" did both, so a group that was shown ordinary methods next to a free one took the ordinary ones away from every other customer. Every "Show" rule saved before this update is changed to "Only" automatically, so the checkout looks the same after updating. To give a group its ordinary methods without reserving them, set those to "Show" and leave the free ones on "Only".
+
 = 1.6.3 =
 * The WooCommerce version this plugin declares as tested is now the same in both places it is written. The readme still said 11.1.0 while the plugin itself said 11.1.2.
 
diff --git a/docs/CONTRACT.md b/docs/CONTRACT.md
index 68b1df3..cabe15c 100644
--- a/docs/CONTRACT.md
+++ b/docs/CONTRACT.md
@@ -1,6 +1,6 @@
 # Contract
 
-Every hook this plugin offers, and every family hook it answers. Version 1.6.3.
+Every hook this plugin offers, and every family hook it answers. Version 1.7.0.
 
 A contract is a name somebody else has to know. Core hooks this plugin merely
 listens to — `init`, `admin_menu`, `wp_enqueue_scripts` — are not here;
diff --git a/docs/README.md b/docs/README.md
index 9f0b4f3..edd2142 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,6 +1,6 @@
 # Nolimit Discounts
 
-Version 1.6.3 · a WooCommerce plugin · slug `woocommerce-email-discount-manager`
+Version 1.7.0 · a WooCommerce plugin · slug `woocommerce-email-discount-manager`
 
 Gives a customer a discount, and decides which shipping methods they may
 choose, based on the email address they check out with.
@@ -29,11 +29,14 @@ address, then domain, then fragment.
 A discount group can be given shipping rules, which is the half worth reading
 twice because it decides what a stranger sees.
 
-A method a group is told to **show** is *reserved* for that group. Customers
+A method a group is set to **only** is *reserved* for that group. Customers
 who match no group do not see it. Before 1.6.0 a method set up for approved
 company addresses stayed on the checkout for everybody, so free delivery meant
 for one customer could be chosen by anyone who found it — the bug that release
-fixed.
+fixed. **Show** is the weaker rule and reserves nothing: it offers the method
+to the group and leaves everyone else alone. 1.6.0 made show do both, which
+took ordinary methods away from strangers whenever they were listed beside a
+free one; 1.7.0 split them and turned every old show rule into only.
 
 The plugin never leaves a customer with no shipping method at all. If applying
 the rules would empty the list, every method comes back.
diff --git a/docs/RELEASE.md b/docs/RELEASE.md
index b3bc740..6eef1d1 100644
--- a/docs/RELEASE.md
+++ b/docs/RELEASE.md
@@ -1,6 +1,6 @@
 # Releasing
 
-One release a day at most, cut by hand. Version 1.6.3 is current.
+One release a day at most, cut by hand. Version 1.7.0 is current.
 
 ## The sequence
 
@@ -233,7 +233,7 @@ derives everything from the header, so splitting them was a one-line change —
 and it means the source repository's visibility is a separate decision from the
 feed's.
 
-⚠️ The source repository is **still public** as of 1.6.3. Making it private is
+⚠️ The source repository is **still public** as of 1.7.0. Making it private is
 safe only once no installation is still pointing its `Update URI` at the old
 address; an install on a pre-1.5.0 build reads its feed from
 `kw/nolimit-discounts`, and making that private would silently stop its
diff --git a/docs/SETUP.md b/docs/SETUP.md
index eda02ff..328f02f 100644
--- a/docs/SETUP.md
+++ b/docs/SETUP.md
@@ -53,13 +53,15 @@ A fragment pattern (`john`) matches `john@anywhere.com` and also
 
 ### Shipping
 
-Per group, per shipping method, one of **show** or **hide**.
+Per group, per shipping method, one of **show**, **only** or **hide**.
 
-The consequence worth understanding before using this tab: a method any group
-is told to **show** becomes reserved. Customers who match no group stop seeing
-it everywhere on the shop, not only inside that group. That is the point — it
-is how "free delivery for approved addresses" stays unavailable to everybody
-else — but it means adding one show rule changes what strangers see.
+**Show** offers the method to the group (and, once any method is shown, the
+group is offered only the methods marked show or only). Nobody else is
+affected. **Only** does the same and also *reserves* the method: customers
+outside the group stop seeing it everywhere on the shop. That is how "free
+delivery for approved addresses" stays unavailable to everybody else — set the
+free methods to **only** and the ordinary ones (parcel shops, pickup) to
+**show**. Adding one only rule changes what strangers see.
 
 ## How to tell it is working
 
@@ -81,7 +83,7 @@ Not "no errors". A specific number on a specific screen:
 
 4. **Shipping, if you set any rules.** With rules in place, compare the
    checkout as a matching customer and in a private window as a stranger. The
-   reserved method must be absent for the stranger. Both should show at least
+   method marked only must be absent for the stranger. Both should show at least
    one method; if the stranger sees *everything*, the rules emptied the list
    and the never-leave-them-stranded fallback returned all of them.
 
diff --git a/includes/class-admin-shipping.php b/includes/class-admin-shipping.php
index ca1f586..33ba854 100644
--- a/includes/class-admin-shipping.php
+++ b/includes/class-admin-shipping.php
@@ -51,7 +51,7 @@ class WC_EDM_Admin_Shipping {
 
 			$action = isset( $raw_rules[ $method_id ] ) ? $raw_rules[ $method_id ] : '';
 
-			if ( ! in_array( $action, array( 'show', 'hide' ), true ) ) {
+			if ( ! in_array( $action, array( 'show', 'hide', 'only' ), true ) ) {
 				continue;
 			}
 
@@ -84,7 +84,7 @@ class WC_EDM_Admin_Shipping {
 		?>
 		<h2><?php esc_html_e( 'Shipping Rules', 'wc-email-discount' ); ?></h2>
 		<p class="description">
-			<?php esc_html_e( 'Choose which shipping methods are shown or hidden for customers in a discount group. If a group has no rules, all shipping methods behave normally. If any method is set to "Show", only "Show" methods are offered.', 'wc-email-discount' ); ?>
+			<?php esc_html_e( 'Choose which shipping methods are shown or hidden for customers in a discount group. If a group has no rules, all shipping methods behave normally. If any method is set to "Show" or "Only", only those methods are offered to the group. "Only" also hides the method from every customer outside the group, which is what free delivery for one company needs; "Show" leaves it available to everybody.', 'wc-email-discount' ); ?>
 		</p>
 
 		<?php if ( empty( $groups ) ) : ?>
@@ -175,6 +175,10 @@ class WC_EDM_Admin_Shipping {
 								<input type="radio" name="rule[<?php echo esc_attr( $method_id ); ?>]" value="show" <?php checked( $action, 'show' ); ?>>
 								<?php esc_html_e( 'Show', 'wc-email-discount' ); ?>
 							</label>
+							<label title="<?php esc_attr_e( 'Shown to this group, and hidden from everybody else', 'wc-email-discount' ); ?>">
+								<input type="radio" name="rule[<?php echo esc_attr( $method_id ); ?>]" value="only" <?php checked( $action, 'only' ); ?>>
+								<?php esc_html_e( 'Only', 'wc-email-discount' ); ?>
+							</label>
 							<label>
 								<input type="radio" name="rule[<?php echo esc_attr( $method_id ); ?>]" value="hide" <?php checked( $action, 'hide' ); ?>>
 								<?php esc_html_e( 'Hide', 'wc-email-discount' ); ?>
diff --git a/includes/class-db.php b/includes/class-db.php
index 050f8e5..a869155 100644
--- a/includes/class-db.php
+++ b/includes/class-db.php
@@ -77,7 +77,7 @@ class WC_EDM_DB {
 			id bigint(20) unsigned NOT NULL AUTO_INCREMENT,
 			group_id bigint(20) unsigned NOT NULL,
 			shipping_method_id varchar(191) NOT NULL,
-			action enum('show','hide') NOT NULL DEFAULT 'show',
+			action enum('show','hide','only') NOT NULL DEFAULT 'show',
 			sort_order int(11) NOT NULL DEFAULT 0,
 			PRIMARY KEY  (id),
 			KEY group_id (group_id)
@@ -102,10 +102,37 @@ class WC_EDM_DB {
 		dbDelta( $sql );
 
 		self::add_foreign_keys();
+		self::migrate_show_to_only();
 
 		update_option( 'wc_edm_db_version', WC_EDM_VERSION );
 	}
 
+	/**
+	 * Once, when "only" was introduced: every existing "show" rule was reserved
+	 * for its group, so it becomes "only" and the shop's checkout looks exactly
+	 * as it did. Without this the update would silently put reserved free
+	 * delivery back in front of every stranger.
+	 */
+	private static function migrate_show_to_only() {
+		global $wpdb;
+
+		if ( get_option( 'wc_edm_show_to_only_done' ) ) {
+			return;
+		}
+
+		$table  = self::table( 'shipping_rules' );
+		$column = $wpdb->get_row( "SHOW COLUMNS FROM {$table} LIKE 'action'" ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+
+		// dbDelta did not widen the enum: converting now would store '' rather
+		// than 'only'. Leave the flag unset so the next load tries again.
+		if ( ! $column || false === strpos( (string) $column->Type, "'only'" ) ) {
+			return;
+		}
+
+		$wpdb->query( "UPDATE {$table} SET action = 'only' WHERE action = 'show'" ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+		update_option( 'wc_edm_show_to_only_done', 1 );
+	}
+
 	/**
 	 * Run create_tables() again when the plugin was updated without
 	 * re-activation (dbDelta adds any missing columns).
@@ -510,10 +537,13 @@ class WC_EDM_DB {
 	/**
 	 * Every shipping method any group reserves for itself.
 	 *
-	 * A "show" rule means the group sees that method. It also has to mean
-	 * nobody else does — otherwise reserving a free-delivery method for an
-	 * approved group leaves it on the checkout for every other customer, which
-	 * is what a shop notices as lost shipping revenue rather than as a bug.
+	 * An "only" rule means the group sees that method AND nobody else does —
+	 * otherwise reserving a free-delivery method for an approved group leaves
+	 * it on the checkout for every other customer, which is what a shop
+	 * notices as lost shipping revenue rather than as a bug. A plain "show"
+	 * rule is a whitelist for its own group and reserves nothing: 1.6.0 made
+	 * "show" do both, and a group that needed to show ordinary methods next to
+	 * a reserved one took those ordinary methods away from everybody else.
 	 *
 	 * @return string[] Rate ids, e.g. "free_shipping:15".
 	 */
@@ -521,7 +551,7 @@ class WC_EDM_DB {
 		global $wpdb;
 		$table = self::table( 'shipping_rules' );
 
-		$ids = $wpdb->get_col( "SELECT DISTINCT shipping_method_id FROM {$table} WHERE action = 'show'" ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+		$ids = $wpdb->get_col( "SELECT DISTINCT shipping_method_id FROM {$table} WHERE action = 'only'" ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
 
 		return is_array( $ids ) ? $ids : array();
 	}
@@ -538,7 +568,7 @@ class WC_EDM_DB {
 		$wpdb->delete( self::table( 'shipping_rules' ), array( 'group_id' => $group_id ), array( '%d' ) );
 
 		foreach ( $rules as $rule ) {
-			if ( empty( $rule['shipping_method_id'] ) || ! in_array( $rule['action'], array( 'show', 'hide' ), true ) ) {
+			if ( empty( $rule['shipping_method_id'] ) || ! in_array( $rule['action'], array( 'show', 'hide', 'only' ), true ) ) {
 				continue;
 			}
 			$wpdb->insert(
diff --git a/includes/class-frontend.php b/includes/class-frontend.php
index 0a39461..732a773 100644
--- a/includes/class-frontend.php
+++ b/includes/class-frontend.php
@@ -340,7 +340,7 @@ class WC_EDM_Frontend {
 			//
 			// This used to return $rates untouched, and a test asserted that
 			// as intended: "an unmatched customer sees every method". It made
-			// a "show" rule a whitelist FOR THE GROUP and nothing more, so
+			// a "show" rule (now "only") a whitelist FOR THE GROUP and nothing more, so
 			// reserving free delivery for approved addresses left it on the
 			// checkout for every other customer. Reported from a live shop,
 			// where a gmail address could pick a free-delivery method meant
@@ -389,7 +389,9 @@ class WC_EDM_Frontend {
 	 * Apply a group's show/hide shipping rules.
 	 *
 	 * If the group has no rules, all rates pass through untouched.
-	 * "show" rules act as a whitelist; "hide" rules remove rates.
+	 * "show" and "only" rules act as a whitelist; "hide" rules remove rates.
+	 * "only" additionally reserves the method for the group (see
+	 * WC_EDM_DB::restricted_shipping_methods()).
 	 * Rates are reordered to follow the rules' sort order.
 	 *
 	 * @param array $rates    Available shipping rates (rate_id => WC_Shipping_Rate).
@@ -413,7 +415,7 @@ class WC_EDM_Frontend {
 		$hide = array();
 
 		foreach ( $rules as $rule ) {
-			if ( 'show' === $rule->action ) {
+			if ( 'show' === $rule->action || 'only' === $rule->action ) {
 				$show[] = $rule->shipping_method_id;
 			} else {
 				$hide[] = $rule->shipping_method_id;
@@ -422,7 +424,7 @@ class WC_EDM_Frontend {
 
 		$filtered = array();
 
-		// Reserved by some group, but not by THIS one.
+		// Reserved ("only") by some group, but not shown to THIS one.
 		$others = array_diff( WC_EDM_DB::restricted_shipping_methods(), $show );
 
 		foreach ( $rates as $rate_id => $rate ) {
diff --git a/includes/class-rest-api.php b/includes/class-rest-api.php
index a45dbc7..00d14b8 100644
--- a/includes/class-rest-api.php
+++ b/includes/class-rest-api.php
@@ -709,10 +709,10 @@ class WC_EDM_REST_API {
 			$method_id = isset( $rule['shipping_method_id'] ) ? sanitize_text_field( (string) $rule['shipping_method_id'] ) : '';
 			$action    = isset( $rule['action'] ) ? sanitize_key( (string) $rule['action'] ) : '';
 
-			if ( '' === $method_id || ! in_array( $action, array( 'show', 'hide' ), true ) ) {
+			if ( '' === $method_id || ! in_array( $action, array( 'show', 'hide', 'only' ), true ) ) {
 				return new WP_Error(
 					'wc_edm_invalid',
-					__( 'Each rule needs a shipping_method_id and an action of "show" or "hide".', 'wc-email-discount' ),
+					__( 'Each rule needs a shipping_method_id and an action of "show", "hide" or "only".', 'wc-email-discount' ),
 					array( 'status' => 400 )
 				);
 			}
diff --git a/tests/smoke.php b/tests/smoke.php
index 4862f2d..2959abe 100644
--- a/tests/smoke.php
+++ b/tests/smoke.php
@@ -184,7 +184,7 @@ WC_EDM_DB::replace_shipping_rules(
 	// shape. A rule holding a bare method id silently matches nothing, and the
 	// "never leave the customer without shipping" fallback then hands back
 	// every rate, so the misconfiguration looks exactly like no rule at all.
-	array( array( 'shipping_method_id' => 'flat_rate:1', 'action' => 'show', 'sort_order' => 0 ) )
+	array( array( 'shipping_method_id' => 'flat_rate:1', 'action' => 'only', 'sort_order' => 0 ) )
 );
 
 $rates = array(
@@ -194,7 +194,7 @@ $rates = array(
 
 WC()->customer->set_billing_email( 'someone@company.com' );
 $filtered = wc_edm()->frontend->filter_shipping_rates( $rates, array() );
-wc_edm_is( 'a "show" rule hides every method it does not name', array( 'flat_rate:1' ), array_keys( $filtered ) );
+wc_edm_is( 'an "only" rule hides every method it does not name', array( 'flat_rate:1' ), array_keys( $filtered ) );
 
 // 🔴 This used to assert "an unmatched customer sees every method", which is
 // what made a reserved free-delivery method visible to everybody on a live
@@ -212,8 +212,8 @@ wc_edm_is(
 WC_EDM_DB::replace_shipping_rules(
 	(int) $fixtures['group_id'],
 	array(
-		array( 'shipping_method_id' => 'flat_rate:1', 'action' => 'show', 'sort_order' => 0 ),
-		array( 'shipping_method_id' => 'local_pickup:2', 'action' => 'show', 'sort_order' => 1 ),
+		array( 'shipping_method_id' => 'flat_rate:1', 'action' => 'only', 'sort_order' => 0 ),
+		array( 'shipping_method_id' => 'local_pickup:2', 'action' => 'only', 'sort_order' => 1 ),
 	)
 );
 $filtered = wc_edm()->frontend->filter_shipping_rates( $rates, array() );
@@ -221,7 +221,7 @@ wc_edm_is( 'but is never left with no shipping at all', 2, count( $filtered ) );
 
 WC_EDM_DB::replace_shipping_rules(
 	(int) $fixtures['group_id'],
-	array( array( 'shipping_method_id' => 'flat_rate:1', 'action' => 'show', 'sort_order' => 0 ) )
+	array( array( 'shipping_method_id' => 'flat_rate:1', 'action' => 'only', 'sort_order' => 0 ) )
 );
 
 // A SECOND group, with no rules of its own. Its members must not see what the
@@ -267,6 +267,53 @@ wc_edm_ok(
 	'saw: ' . implode( ', ', array_keys( $filtered ) )
 );
 
+
+// 🔴 "show" is a whitelist for the group and reserves NOTHING. 1.6.0 made it
+// do both, so a shop that listed ordinary methods next to a free-delivery one
+// took the ordinary ones away from every stranger and left them only the
+// free one (reported live: strangers saw nothing but "Fri levering").
+WC_EDM_DB::replace_shipping_rules(
+	(int) $fixtures['group_id'],
+	array(
+		array( 'shipping_method_id' => 'flat_rate:1', 'action' => 'show', 'sort_order' => 0 ),
+		array( 'shipping_method_id' => 'local_pickup:2', 'action' => 'only', 'sort_order' => 1 ),
+	)
+);
+WC()->customer->set_billing_email( 'nobody@nowhere.test' );
+$filtered = wc_edm()->frontend->filter_shipping_rates( $wc_edm_rates3, array() );
+wc_edm_is(
+	'a stranger keeps a "show" method and loses the "only" one',
+	array( 'flat_rate:1', 'flat_rate:9' ),
+	array_keys( $filtered )
+);
+WC()->customer->set_billing_email( 'someone@company.com' );
+$filtered = wc_edm()->frontend->filter_shipping_rates( $wc_edm_rates3, array() );
+wc_edm_is(
+	'a group member sees both its "show" and its "only" method, in rule order',
+	array( 'flat_rate:1', 'local_pickup:2' ),
+	array_keys( $filtered )
+);
+
+// The update from 1.6.x: rows written as "show" were reserved, and must stay so.
+global $wpdb;
+$wc_edm_table = WC_EDM_DB::table( 'shipping_rules' );
+WC_EDM_DB::replace_shipping_rules( (int) $fixtures['group_id'], array() );
+$wpdb->insert( $wc_edm_table, array( 'group_id' => (int) $fixtures['group_id'], 'shipping_method_id' => 'local_pickup:2', 'action' => 'show', 'sort_order' => 0 ) );
+delete_option( 'wc_edm_show_to_only_done' );
+WC_EDM_DB::create_tables();
+wc_edm_is(
+	'an update turns every old "show" rule into "only"',
+	array( 'only' ),
+	$wpdb->get_col( $wpdb->prepare( "SELECT action FROM {$wc_edm_table} WHERE group_id = %d", (int) $fixtures['group_id'] ) ) // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+);
+$wpdb->update( $wc_edm_table, array( 'action' => 'show' ), array( 'shipping_method_id' => 'local_pickup:2' ) );
+WC_EDM_DB::create_tables();
+wc_edm_is(
+	'and does it once only: a later "show" stays "show"',
+	array( 'show' ),
+	$wpdb->get_col( $wpdb->prepare( "SELECT action FROM {$wc_edm_table} WHERE group_id = %d", (int) $fixtures['group_id'] ) ) // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+);
+
 WC()->customer->set_billing_email( 'someone@company.com' );
 
 WC_EDM_DB::replace_shipping_rules( (int) $fixtures['group_id'], array() );
diff --git a/woocommerce-email-discount-manager.php b/woocommerce-email-discount-manager.php
index a532c6a..d8398e7 100644
--- a/woocommerce-email-discount-manager.php
+++ b/woocommerce-email-discount-manager.php
@@ -4,7 +4,7 @@
  * Plugin URI:  https://gitea.nolimit.dk/kw/woo-discount-manager
  * Update URI:  https://gitea.nolimit.dk/kw/nolimit-discounts-dist
  * Description: Apply discounts and show/hide shipping methods based on the customer's email address (full address, domain or partial match).
- * Version:     1.6.3
+ * Version:     1.7.0
  * Author:      Kristian Wind
  * Author URI:  https://gitea.nolimit.dk/kw
  * License:     GPL-2.0-or-later
@@ -28,7 +28,7 @@ if ( ! defined( 'ABSPATH' ) ) {
 	exit;
 }
 
-define( 'WC_EDM_VERSION', '1.6.3' );
+define( 'WC_EDM_VERSION', '1.7.0' );
 define( 'WC_EDM_PLUGIN_FILE', __FILE__ );
 define( 'WC_EDM_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 define( 'WC_EDM_PLUGIN_URL', plugin_dir_url( __FILE__ ) );