[botinc-agent]

Problem

Android shoppers at dampfelix.ch cannot open the liveness camera inside the plugin's frame, and the plugin then blocks their recovery. Every retry created another Didit session (the duplicate-session warning) and spent the guest limit of 3 per hour, so a later attempt returned rate_limit (429). Opening the hosted page at the top level, Didit's documented escape for a blocked iframe camera, was not available: display modes were modal and embedded only.

The camera denial itself is not reproducible here: this repository has no hosted-flow code, and it needs the customer's Permissions-Policy header and a failed Android console log.

Solution

• A retry reopens the session this browser (or WooCommerce order) already has, before the rate limiter runs. Before reopening, the plugin asks Didit for the session's current status, because the stored status only changes when a webhook arrives (this shop's webhooks were failing). Abandoned, expired, approved and declined sessions, sessions whose status can't be confirmed, and guest sessions after the shopper logs in all start a new verification.
• New Redirect display mode in settings, [didit_verify mode="redirect"] and the checkout buttons. Each button follows the mode it was rendered with, so a shortcode's own mode still overrides the site setting.
• A redirected shopper returns to the page they started on (same-site addresses only). There the plugin confirms the result on the server and shows the same approved, declined, expired, in-review or error messages as the modal. Version 0.3.5.

Verification

• PHP 8.3, all six suites pass: retry 21/21, redirect 7/7, iframe 6, shortcode 15, authorization 34, webhook 53. On the previous revision, 9 of the new retry checks and 1 redirect check fail.
• php -l, node --check and git diff --check are clean.
• A throwaway jsdom harness (not committed) ran the real script with 15 checks: redirect navigation and return address, a modal shortcode under site-wide Redirect, and each return result. The previous revision fails 13 of them.
• Not verified: PHP 7.4 (left to CI), and the Android camera failure itself.

🤖 Generated with Claude Code

Visual proof

The Display Mode setting as a shop owner sees it, before and after this change. Sandbox has no WordPress install, so each image renders the plugin's own settings field inside a static copy of the admin card styling.

• 
• 

The redirect flow itself (leaving checkout for the hosted page, then confirming the result on return) needs a live Didit session and an Android device, so it is covered by the tests instead of a screenshot.