Payment Phase R: PAYONE-Integration entflechten (R1–R7 + Review)

Strangler-Refactoring der PAYONE-Zahlungslogik in eine testbare
Service-Schicht, ohne Verhalten in Checkout/Cron/IPN zu ändern.

Neue Services (app/Services/Payment/Payone):
- PayonePaymentService (+ PayonePaymentResult-DTO) für CC-/SEPA-Check
  und Abo-Abbuchung
- PayoneRequestBuilder, PaymentMethodResolver, PayoneMethodConfig
- PayoneTransactionRecorder: zentrale PaymentTransaction-Erstellung
  (API-Response, Invoice, Webhook) inkl. PCI-Redaction (cardpan/cardcvc2)
- PayoneWebhookHandler (+ PayoneWebhookResult): IPN/TSOK-Logik aus
  Api\PayoneController; response('TSOK') statt echo/exit
- PayoneTransportException + Handler-Mapping (403) statt abort() im Service

Hotfixes (R1): var_dump/exit & bare exit() entfernt, Log-Redaction.

Security (R-Review):
- PAYONE_KEY_HASH (MD5-Hash, kein Klartext) mit Boot-Hard-Fail; schließt
  zugleich die ''-Webhook-Bypass-Lücke. Artisan-Command payone:hash-key
  (verdeckte Eingabe, optional --write) zur Hash-Erzeugung.
- Webhook: txaction Pflichtfeld, mode-Fallback auf payment->mode.

Pay\PayoneController ist @deprecated-Fassade (614 → 328 Zeilen),
delegiert an Services via Container-Singleton.

Migration: fehlende Spalte shopping_payments.carddata nachgezogen.

Tests: 47 grün (PayonePaymentService, Recorder, Webhook, Resolver,
TransportException, hash-key). End-to-End im Test-System verifiziert
(siehe dev/2026-06-09-payments).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/Exceptions/Handler.php

@@ -2,12 +2,14 @@
 
 namespace App\Exceptions;
 
-use Throwable;
+use App\Services\Payment\Payone\Exceptions\PayoneTransportException;
+use Illuminate\Foundation\Exceptions\Handler as ExceptionHandler;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Mail;
-use Symfony\Component\ErrorHandler\Exception\FlattenException;
-use Illuminate\Foundation\Exceptions\Handler as ExceptionHandler;
 use Symfony\Component\ErrorHandler\ErrorRenderer\HtmlErrorRenderer;
+use Symfony\Component\ErrorHandler\Exception\FlattenException;
+use Symfony\Component\HttpKernel\Exception\HttpException;
+use Throwable;
 
 class Handler extends ExceptionHandler
 {
@@ -17,7 +19,9 @@ class Handler extends ExceptionHandler
      * @var array
      */
     protected $dontReport = [
-        //
+        // PAYONE-Transportfehler werden bereits via MyLog protokolliert (inkl. Mail);
+        // kein zusätzlicher Exception-Report nötig (entspricht dem alten abort(403)-Verhalten).
+        PayoneTransportException::class,
     ];
 
     /**
@@ -33,7 +37,6 @@ class Handler extends ExceptionHandler
     /**
      * Report or log an exception.
      *
-     * @param  \Throwable  $exception
      * @return void
      *
      * @throws \Exception
@@ -51,13 +54,18 @@ class Handler extends ExceptionHandler
      * Render an exception into an HTTP response.
      *
      * @param  \Illuminate\Http\Request  $request
-     * @param  \Throwable  $exception
      * @return \Symfony\Component\HttpFoundation\Response
      *
      * @throws \Throwable
      */
     public function render($request, Throwable $exception)
     {
+        // Fallback für nicht im Checkout abgefangene PAYONE-Transportfehler:
+        // identisch zum früheren abort(403, $message) in Payone::sendRequest.
+        if ($exception instanceof PayoneTransportException) {
+            $exception = new HttpException(403, $exception->getMessage(), $exception);
+        }
+
         return parent::render($request, $exception);
     }
 
@@ -65,7 +73,6 @@ class Handler extends ExceptionHandler
      * Convert an authentication exception into a response.
      *
      * @param  \Illuminate\Http\Request  $request
-     * @param  \Illuminate\Auth\AuthenticationException  $exception
      * @return \Symfony\Component\HttpFoundation\Response
      */
     protected function unauthenticated($request, \Illuminate\Auth\AuthenticationException $exception)
@@ -83,12 +90,12 @@ class Handler extends ExceptionHandler
             //     'crm' => 'login', // CRM hat eine eigene login route
             //     default => 'login'
             // };
-            
+
             // Temporär: Verwende Standard-Login-Route
             return redirect()->guest(route('login'));
         } catch (\Exception $e) {
             // Fallback: Weiterleitung zur Hauptdomain
-            return redirect()->guest('https://' . config('app.domain') . config('app.tld_care') . '/login');
+            return redirect()->guest('https://'.config('app.domain').config('app.tld_care').'/login');
         }
     }
 
@@ -99,24 +106,23 @@ class Handler extends ExceptionHandler
             $handler = new HtmlErrorRenderer(true); // boolean, true raises debug flag...
             $css = $handler->getStylesheet();
             $content = $handler->getBody($e);
-            //Mail::to(config('app.exception_mail'))->send(new MailContact($contact));
+            // Mail::to(config('app.exception_mail'))->send(new MailContact($contact));
             // Verwende normale Mail-Klasse statt Facade, um Probleme bei der Initialisierung zu vermeiden
             $to = config('app.exception_mail');
-            $subject = 'mivita Exception: ' . \Request::fullUrl();
+            $subject = 'mivita Exception: '.\Request::fullUrl();
 
             if ($to) {
                 \Mail::send('emails.exception', compact('css', 'content'), function ($message) use ($to, $subject) {
                     $message
                         ->to($to)
-                        ->subject($subject)
-                    ;
+                        ->subject($subject);
                 });
             }
         } catch (Throwable $ex) {
             // Einfache Fehlerprotokollierung ohne Facade
             file_put_contents(
-                storage_path('logs/laravel-' . date('Y-m-d') . '.log'),
-                '[' . date('Y-m-d H:i:s') . '] exception-handler-error: ' . $ex->getMessage() . "\n",
+                storage_path('logs/laravel-'.date('Y-m-d').'.log'),
+                '['.date('Y-m-d H:i:s').'] exception-handler-error: '.$ex->getMessage()."\n",
                 FILE_APPEND
             );
         }