WebBlocks Memberships

Memberships 0.2.0 provides site visitor accounts, free/manual membership packages, paid subscriptions and automatic renewal in one plugin. It requires WebBlocks CMS 1.100.0 or later in the 1.x series. Paid billing uses optional Commerce 0.16.0 payment providers; free/manual memberships continue without Commerce.

The documented release is Memberships 0.2.0. It requires PHP 8.4 or later and WebBlocks CMS ^1.100.0. Paid plans additionally use Commerce ^0.16.

Download the compatible ZIP from the Memberships catalog page. Install it under System → Plugins, enable it, and check that plugin database setup completed successfully. Configure the site's canonical domain and CMS outbound mail before inviting visitors. Open Memberships and select the site whose accounts and packages you want to manage.

Use the native Account block or the site route /plugins/webblocks-memberships/account for registration, login, password reset and viewing memberships. Email verification is required for package enrollment and member-only content. The site needs a canonical domain and configured CMS outbound mail. Verification links expire after 24 hours and reset links after one hour. GET displays a confirmation form; only a CSRF-protected POST consumes a link. Password reset and account deactivation invalidate existing member sessions.

The site-scoped Memberships panel manages packages and membership grants. Packages can allow free self-enrollment or require an operator grant. Operators set UTC or explicit-offset start and end times, extend a grant, revoke it or deactivate an account. Visitor accounts are separate from CMS administrators.

The panel can make a page public, accessible to verified members or accessible to holders of a chosen package. Protected pages stay closed if Memberships is unavailable and do not appear in public search, sitemap or automatic page lists and navigation. Restoring a content revision does not remove current protection. Copies retain it. A CMS downgrade below 1.99.0 cannot enforce these new rules; unpublish protected pages before such a downgrade. Exported protected pages are drafts; imported package rights require explicit reassignment to a local package before members gain access.

Page access controls the rendered page, not an already public file URL. Confidential media needs a private non-public filesystem disk. Private media used by a published block on a protected page can be served through /plugins/webblocks-memberships/downloads/{page}/{media} with the same access check.

Appointments uses Memberships optionally. Login can prefill customer details and associate a booking with the verified member. A service can require a verified member or an active package. Without Memberships, ordinary guest booking works; restricted services remain unavailable. Past customer snapshots are preserved.

The Internal Content API exposes /webadmin/api/plugins/webblocks-memberships?site_id=... with memberships.read. POST operations require memberships.write and an explicit authorized site_id: package, package/{id}, grant, revoke/{id}, member/{id} and access. Personal API tokens must also satisfy their current delegated site scope.

The earlier 0.1.0 release supports free/manual memberships without paid billing. English UI source copy and Turkish translations are available through locale catalogues; the remaining catalogues currently use English fallback copy.

Registration collects name and email first. The verification POST sets the account password and invalidates earlier sessions, so a third party cannot retain a password chosen before mailbox ownership was proved. Password-reset requests for pending accounts issue a verification link instead.

This phase remains inside Memberships. It requires the CMS 1.100.0 payment contract and Commerce 0.16.0 provider implementation. Appointments 0.16.1 accepts both Memberships 0.1 and 0.2 through the existing member directory.

Configure payment credentials in Commerce once. Memberships does not duplicate them. Create a monthly/yearly paid plan with integer minor-unit prices, currency and provider selection in the Memberships panel. EUR 1000 means EUR 10.00. Monthly interval counts are 1–12; yearly is 1. Existing subscription prices remain fixed. A new plan does not silently change an existing authorization.

A verified member explicitly authorizes renewal. PayPal uses its native subscription approval and billing flow. SumUp obtains consent and a saved-card token through its payment widget; the temporary 1-unit setup payment is reimbursed and does not buy membership. Access begins after the server verifies a subscription payment, and existing manual grants remain independent. Paid package access also works for restricted Appointments services without copying payment logic into Appointments.

Run the host's Laravel scheduler every minute. Memberships registers five-minute reconciliation and authorized SumUp renewal processing. Native PayPal renewals are handled by PayPal and reconciled locally. A decline or expired paid period does not grant access. Unknown requests are checked against the same provider reference instead of blindly charged again. A fully missed SumUp period needs fresh enrollment. Cancellation stops future renewal requests; already-requested debits may complete. Cancellation remains pending until an external agreement is confirmed cancelled. Settled access lasts until its period ends, except refunded/reversed periods.

Add subscription/sale topics to the existing Commerce PayPal webhook. SumUp checkouts use the canonical site's Memberships callback. Before enabling live plans, verify merchant permissions, saved-card/SCA behavior and callback delivery with that merchant's sandbox. Cancel external agreements before permanently removing billing plugins or their provider configuration.

The existing API site scope and memberships.read/memberships.write capabilities cover plans, subscriptions and payment history. POST /plugins/webblocks-memberships/plan creates a plan; /stop-plan/{id} closes it and requests renewal cancellation. POST /plugins/webblocks-memberships/billing/{subscription-uuid}/refresh or /cancel reconciles/cancels an owned site subscription. Amounts, member ownership and package scope are checked on the server; card tokens and approval/request secrets are excluded from API output.

Provider contracts: PayPal subscriptions, PayPal billing frequencies, SumUp tokenization, SumUp checkout and transaction evidence.

If account mail does not arrive, check CMS outbound mail and the site's canonical domain before requesting another verification message. If a member cannot open a restricted page, check email verification, account activity, the required package and the grant's start/end times. Paid access additionally needs verified provider payment evidence; enabling a plan alone does not grant access.

Return to the plugin overview, configure payment providers with the Commerce guide, or review the optional Appointments integration.