Payment Phase R: PAYONE-Integration entflechten (R1–R7 + Review)

Strangler-Refactoring der PAYONE-Zahlungslogik in eine testbare
Service-Schicht, ohne Verhalten in Checkout/Cron/IPN zu ändern.

Neue Services (app/Services/Payment/Payone):
- PayonePaymentService (+ PayonePaymentResult-DTO) für CC-/SEPA-Check
  und Abo-Abbuchung
- PayoneRequestBuilder, PaymentMethodResolver, PayoneMethodConfig
- PayoneTransactionRecorder: zentrale PaymentTransaction-Erstellung
  (API-Response, Invoice, Webhook) inkl. PCI-Redaction (cardpan/cardcvc2)
- PayoneWebhookHandler (+ PayoneWebhookResult): IPN/TSOK-Logik aus
  Api\PayoneController; response('TSOK') statt echo/exit
- PayoneTransportException + Handler-Mapping (403) statt abort() im Service

Hotfixes (R1): var_dump/exit & bare exit() entfernt, Log-Redaction.

Security (R-Review):
- PAYONE_KEY_HASH (MD5-Hash, kein Klartext) mit Boot-Hard-Fail; schließt
  zugleich die ''-Webhook-Bypass-Lücke. Artisan-Command payone:hash-key
  (verdeckte Eingabe, optional --write) zur Hash-Erzeugung.
- Webhook: txaction Pflichtfeld, mode-Fallback auf payment->mode.

Pay\PayoneController ist @deprecated-Fassade (614 → 328 Zeilen),
delegiert an Services via Container-Singleton.

Migration: fehlende Spalte shopping_payments.carddata nachgezogen.

Tests: 47 grün (PayonePaymentService, Recorder, Webhook, Resolver,
TransportException, hash-key). End-to-End im Test-System verifiziert
(siehe dev/2026-06-09-payments).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Kevin 2026-06-10 13:42:45 +00:00
parent 1668e5a879
commit ccc6f85809
31 changed files with 3420 additions and 717 deletions

View file

@ -1,36 +1,31 @@
<?php
/*
* clearingtype
elv Debit payment
cc Credit card
rec Invoice
cod Cash on delivery
vor Prepayment
sb Online Bank Transfer
wlt e-wallet
fnc Financing
*/
/*private $payment_methods= [
'wlt#PPE' => 'PayPal',
'cc' => 'CreditCard',
'sb#GPY' => 'giropay',
'sb#PNT' => 'Sofort',
'wlt#PDT' => 'paydirekt',
'fnc' => 'Rechnungskauf',
'pref' => 'Vorauskasse',
];*/
namespace App\Http\Controllers\Pay;
use App\Http\Controllers\Controller;
use App\Models\PaymentTransaction;
use App\Models\ShoppingPayment;
use App\Services\CheckoutFunnelTracker;
use App\Services\MyLog;
use App\Services\Payment\Payone\DTOs\PayonePaymentResult;
use App\Services\Payment\Payone\PaymentMethodResolver;
use App\Services\Payment\Payone\PayonePaymentService;
use App\Services\Payment\Payone\PayoneRequestBuilder;
use App\Services\Payment\Payone\PayoneTransactionRecorder;
use App\Services\Payone;
use Util;
/**
* @deprecated Legacy stateful PAYONE payment facade. New code should depend on
* {@see PayonePaymentService} (Checkout-/Abo-/CC-Check) plus the extracted helpers
* {@see PayoneRequestBuilder}, {@see PaymentMethodResolver} and
* {@see PayoneTransactionRecorder} directly. This controller stays only as a thin
* facade for existing callers (CheckoutController, UserMakeOrder, PaymentHelper)
* and is migrated away in Phase 1.
*
* clearingtype reference (resolved in {@see PaymentMethodResolver}):
* cc = credit card, elv = SEPA debit, vor = prepayment, rec = invoice,
* sb = online bank transfer, wlt = e-wallet, fnc = financing.
*/
class PayoneController extends Controller
{
const PREAUTHORIZATION = 'preauthorization';
@ -53,11 +48,8 @@ class PayoneController extends Controller
private $prepayment = [];
/* private $onlineTransfer = [];
private $creditCard = []; */
private $deliveryData = [];
// private $payment_method;
private $urls = [];
private $shopping_user;
@ -68,10 +60,14 @@ class PayoneController extends Controller
private $reference;
private PayonePaymentService $paymentService;
private ?PayonePaymentResult $lastPaymentResult = null;
public function __construct()
{
$this->default = \Config::get('payone.defaults');
$this->paymentService = app(PayonePaymentService::class);
}
public function init($shopping_user, $shopping_order)
@ -86,47 +82,16 @@ class PayoneController extends Controller
return $this->shopping_payment;
}
public function setAboPayment($user_abo, $amount, $currency)
public function setAboPayment($user_abo, $amount, $currency): void
{
$this->reference = substr(uniqid('m', false), 0, 16);
$amount = intval($amount);
$this->method = [
'clearingtype' => $user_abo->clearingtype,
'wallettype' => $user_abo->wallettype,
'pseudocardpan' => isset($user_abo->carddata['pseudocardpan']) ? $user_abo->carddata['pseudocardpan'] : '',
'cardexpiredate' => isset($user_abo->carddata['cardexpiredate']) ? $user_abo->carddata['cardexpiredate'] : '',
'userid' => $user_abo->payone_userid,
'onlinebanktransfertype' => '',
'request' => 'authorization',
];
$this->aboInitPayment = [
'recurrence' => 'recurring',
'customer_is_present' => 'no',
'request' => 'authorization',
'amount' => $amount,
];
$this->prepayment = [
'reference' => $this->reference, // a unique reference, e.g. order number
'amount' => $amount, // amount in smallest currency unit, i.e. cents
'currency' => $currency,
'param' => $this->shopping_order->id,
];
$this->shopping_payment = ShoppingPayment::create([
'shopping_order_id' => $this->shopping_order->id,
'clearingtype' => $this->method['clearingtype'],
'wallettype' => $this->method['wallettype'],
'onlinebanktransfertype' => $this->method['onlinebanktransfertype'],
'carddata' => $user_abo->carddata,
'reference' => $this->reference,
'amount' => $amount,
'currency' => $currency,
'is_abo' => $this->shopping_order->is_abo,
'abo_interval' => 0,
'mode' => $this->shopping_order->mode,
]);
$this->lastPaymentResult = $this->paymentService->chargeAbo(
$user_abo,
$this->shopping_order,
$this->shopping_user,
intval($amount),
$currency,
);
$this->shopping_payment = $this->lastPaymentResult->shoppingPayment;
}
// make Payone payment
@ -206,150 +171,48 @@ class PayoneController extends Controller
public function setPersonalData()
{
$this->personalData = [
'firstname' => $this->shopping_user->billing_firstname,
'lastname' => $this->shopping_user->billing_lastname, // mandatory
'street' => $this->shopping_user->billing_address,
'zip' => $this->shopping_user->billing_zipcode,
'city' => $this->shopping_user->billing_city,
'country' => ($this->shopping_user->billing_country) ? $this->shopping_user->billing_country->code : 'DE', // mandatory
'email' => $this->shopping_user->billing_email,
// "language" => ($this->shopping_user->billing_country) ? strtoupper($this->shopping_user->billing_country->code) : "DE", // mandatory
'language' => 'DE',
];
/**
* Paydirekt requires both, personal data and shipping data
*/
/* $this->deliveryData = array(
"shipping_firstname" => "Paul",
"shipping_lastname" => "Neverpayer",
"shipping_street" => "Hamburger Allee 26-28",
"shipping_zip" => "60486",
"shipping_city" => "Frankfurt am Main",
"shipping_country" => "DE"
);*/
$this->personalData = PayoneRequestBuilder::buildPersonalData($this->shopping_user);
}
private function setMethod($payment_method, $ret = [])
{
if ($payment_method) {
if (strpos($payment_method, '#')) {
$payment_method = explode('#', $payment_method);
// wallet Paypal
if ($payment_method[0] === 'wlt') {
$this->method = [
'clearingtype' => 'wlt',
'wallettype' => $payment_method[1],
'onlinebanktransfertype' => '',
'request' => 'authorization',
];
}
// Online-Überweisung
if ($payment_method[0] === 'sb') {
$this->method = [
'clearingtype' => 'sb',
'wallettype' => '',
'onlinebanktransfertype' => $payment_method[1], // this is the type for Sofort.com
'bankcountry' => 'DE', // we need to know the country of the customer's bank, i.e. of the invoice address
'request' => 'authorization',
];
}
// Rechnungskauf
if ($payment_method[0] === 'fnc') {
// MIVITA
if (isset($payment_method[1]) && $payment_method[1] === 'MIV') {
$this->method = [
'clearingtype' => 'fnc',
'wallettype' => '',
'onlinebanktransfertype' => 'MIV',
'request' => 'authorization',
];
}
// PAYONE
/* $this->method = [
"clearingtype" => "fnc",
"wallettype" => "",
'onlinebanktransfertype' => "",
"financingtype" => "PYV",
"request" => "genericpayment",
"add_paydata[action]" => "pre_check",
"add_paydata[payment_type]" => "Payolution-Invoicing",
];*/
}
}
// vorkasse
if ($payment_method === 'elv') {
$this->method = [
'clearingtype' => 'elv',
'wallettype' => '',
'onlinebanktransfertype' => '',
'request' => 'authorization',
'mandate_identification' => $ret['elv']['mandate_identification'],
'iban' => $ret['elv']['iban'],
'bic' => $ret['elv']['bic'],
'bankaccountholder' => $ret['elv']['bankaccountholder'],
// "bankcountry" => "DE",
];
}
// vorkasse
if ($payment_method === 'vor') {
$this->method = [
'clearingtype' => 'vor',
'wallettype' => '',
'onlinebanktransfertype' => '',
'request' => 'authorization',
];
}
// CreditCard
if ($payment_method === 'cc') {
// need the $cc_ret
$this->method = [
'clearingtype' => 'cc',
'wallettype' => '',
'onlinebanktransfertype' => '',
'request' => 'authorization',
'pseudocardpan' => $ret['cc']['pseudocardpan'],
// "xid" => "3-D Secure transaction ID"
];
}
$this->method = PaymentMethodResolver::resolve($payment_method, $ret)->toArray();
}
}
public function onlyPaymentResponse()
public function onlyPaymentResponse(): array
{
$request = array_merge($this->default, $this->personalData, $this->deliveryData, $this->method, $this->prepayment, $this->aboInitPayment, $this->urls);
$response = Payone::sendRequest($request);
// Abo path: chargeAbo (called from setAboPayment) already fetched the response.
if ($this->lastPaymentResult !== null) {
return $this->lastPaymentResult->toArray();
}
return $response;
// Checkout path: state was set by setPrePayment + setPersonalData + setDeliverylData.
$request = PayoneRequestBuilder::buildRequest(
$this->default, $this->personalData, $this->deliveryData,
$this->method, $this->prepayment, $this->aboInitPayment, $this->urls,
);
return Payone::sendRequest($request);
}
public function ResponseData($is_abo = false)
{
$request = array_merge($this->default, $this->personalData, $this->deliveryData, $this->method, $this->prepayment, $this->aboInitPayment, $this->urls);
$request = PayoneRequestBuilder::buildRequest($this->default, $this->personalData, $this->deliveryData, $this->method, $this->prepayment, $this->aboInitPayment, $this->urls);
if ($this->shopping_payment->clearingtype === 'fnc' && $this->shopping_payment->onlinebanktransfertype === 'MIV') {
$payt = PaymentTransaction::create([
'shopping_payment_id' => $this->shopping_payment->id,
'request' => $this->method['request'],
'txid' => 0,
'userid' => 0,
'status' => 'FNCMIV',
'transmitted_data' => $request,
'txaction' => 'invoice_open',
'mode' => $this->shopping_payment->mode,
]);
$payt = PayoneTransactionRecorder::recordInvoicePayment(
$this->shopping_payment,
$this->method['request'],
$request,
);
Util::setUserHistoryValue(['status' => 5]);
if ($is_abo) {
return $this->reference;
}
return redirect(route('checkout.transaction_approved', [$payt->id, $this->reference]));
exit;
}
$response = Payone::sendRequest($request);
/*
@ -362,16 +225,11 @@ class PayoneController extends Controller
'PayPal Preauthorization Fehler: '.$response['errormessage'],
$response
);
PaymentTransaction::create([
'shopping_payment_id' => $this->shopping_payment->id,
'request' => $this->method['request'],
'errorcode' => $response['errorcode'],
'errormessage' => $response['errormessage'],
'customermessage' => $response['customermessage'],
'transmitted_data' => $request,
'status' => $response['status'],
'mode' => $this->shopping_payment->mode,
]);
PayoneTransactionRecorder::recordFromResponse(
$this->shopping_payment,
$this->method['request'],
$response,
);
Util::setUserHistoryValue(['status' => 3]);
if ($is_abo) {
return $response;
@ -383,36 +241,25 @@ class PayoneController extends Controller
}
if ($response['status'] === 'REDIRECT') {
PaymentTransaction::create([
'shopping_payment_id' => $this->shopping_payment->id,
'request' => $this->method['request'],
'txid' => $response['txid'],
'userid' => $response['userid'],
'status' => $response['status'],
'mode' => $this->shopping_payment->mode,
]);
PayoneTransactionRecorder::recordFromResponse(
$this->shopping_payment,
$this->method['request'],
$response,
);
Util::setUserHistoryValue(['status' => 4]);
if ($is_abo) {
return $response;
}
return redirect()->away($response['redirecturl']);
exit;
}
if ($response['status'] === 'APPROVED') {
// header("Location: " . $response["redirecturl"]); // or other redirect method
$payt = PaymentTransaction::create([
'shopping_payment_id' => $this->shopping_payment->id,
'request' => $this->method['request'],
'txid' => $response['txid'],
'userid' => $response['userid'],
'status' => $response['status'],
'transmitted_data' => $response,
'mode' => $this->shopping_payment->mode,
]);
$payt = PayoneTransactionRecorder::recordFromResponse(
$this->shopping_payment,
$this->method['request'],
$response,
);
Util::setUserHistoryValue(['status' => 5]);
if ($is_abo) {
return $response;
@ -421,27 +268,25 @@ class PayoneController extends Controller
if ($payt->shopping_payment->clearingtype === 'vor') {
// vorkasse
return redirect(route('checkout.transaction_approved', [$payt->id, $this->reference]));
exit;
}
if ($payt->shopping_payment->clearingtype === 'cc') {
// creditcard
return redirect(route('checkout.transaction_approved', [$payt->id, $this->reference]));
exit;
}
if ($payt->shopping_payment->clearingtype === 'elv') {
// sepa
return redirect(route('checkout.transaction_approved', [$payt->id, $this->reference]));
exit;
}
var_dump($response);
exit();
// txid
// Payment process ID (PAYONE)
// userid
// Debtor ID (PAYONE)
MyLog::writeLog(
'payone',
'error',
'Error:1002 Unbekannter clearingtype bei APPROVED-Status. App\Http\Controllers\Pay\PayoneController::ResponseData',
['clearingtype' => $payt->shopping_payment->clearingtype ?? null, 'txid' => $response['txid'] ?? null]
);
abort(403, 'Zahlung konnte nicht abgeschlossen werden. Unbekannte Zahlungsart. Fehlercode: 1002');
}
if ($response['status'] === 'PENDING') {
@ -451,11 +296,7 @@ class PayoneController extends Controller
'Error:1000 Status PENDING App\Http\Controllers\Pay\PayoneController::ResponseData response status PENDING',
$response
);
exit();
// txid
// Payment process ID (PAYONE)
// userid
// Debtor ID (PAYONE)
abort(503, 'Ihre Zahlung wird noch verarbeitet. Bitte haben Sie einen Moment Geduld. Fehlercode: 1000');
}
MyLog::writeLog(
'payone',
@ -466,148 +307,22 @@ class PayoneController extends Controller
abort(403, 'Der Zahlungsanbieter ist nicht erreichbar, die Zahlung konnte nicht durchgeführt werden. Bitte versuchen Sie es später erneut. Fehlercode: 1001');
}
public function checkCreditCard($data)
public function checkCreditCard($data): array
{
$this->prepayment = [
'request' => 'creditcardcheck', // create account receivable and instantly book the amount
'cardholder' => $data['cc_cardholder_first'].' '.$data['cc_cardholder_last'],
'cardpan' => $data['cc_cardpan'],
'cardexpiredate' => substr($data['cc_cardexpireyear'], -2).$data['cc_cardexpiremonth'],
'cardtype' => $data['cc_cardtype'],
'cardcvc2' => $data['cc_cardcvc2'],
'storecarddata' => 'yes',
'language' => 'de',
];
$request = array_merge($this->default, $this->prepayment);
return Payone::sendRequest($request);
return $this->paymentService
->checkCreditCard($data, $this->default['mode'] ?? 'test')
->toArray();
}
public function checkBankAccount($data, $amount, $currency, $shopping_user)
public function checkBankAccount($data, $amount, $currency, $shopping_user): array
{
$this->shopping_user = $shopping_user;
$this->setPersonalData();
$this->prepayment = [
'clearingtype' => 'elv',
'amount' => $amount, // amount in smallest currency unit, i.e. cents
'currency' => $currency,
'request' => 'managemandate', // create account receivable and instantly book the amount
'bankaccountholder' => $data['elv_bankaccountholder'],
'iban' => $data['elv_iban'],
'bic' => $data['elv_bic'],
// "language" => 'de',
];
$request = array_merge($this->default, $this->personalData, $this->deliveryData, $this->method, $this->prepayment, $this->urls);
return Payone::sendRequest($request);
return $this->paymentService
->checkBankAccount($data, (int) $amount, $currency, $shopping_user, $this->default['mode'] ?? 'test')
->toArray();
}
public function setDeliverylData($shopping_user)
{
if ($shopping_user->same_as_billing == true) {
$this->deliveryData = [
'shipping_firstname' => $shopping_user->billing_firstname,
'shipping_lastname' => $shopping_user->billing_lastname,
'shipping_zip' => $shopping_user->billing_zipcode,
'shipping_city' => $shopping_user->billing_city,
'shipping_country' => $shopping_user->billing_country->code,
'shipping_street' => $shopping_user->billing_address,
];
} else {
$this->deliveryData = [
'shipping_firstname' => $shopping_user->shipping_firstname,
'shipping_lastname' => $shopping_user->shipping_lastname,
'shipping_zip' => $shopping_user->shipping_zipcode,
'shipping_city' => $shopping_user->shipping_city,
'shipping_country' => $shopping_user->shipping_country->code,
'shipping_street' => $shopping_user->shipping_address,
];
}
$this->deliveryData = PayoneRequestBuilder::buildDeliveryData($shopping_user);
}
/* public function getPDFFile($mandateId)
{
$params['file_reference'] = $mandateId;//"XX-T0000000";
$params['file_type'] = 'SEPA_MANDATE';
$params['file_format'] = 'PDF';
$request = array_merge($this->default, $params);
return Payone::sendRequest($request);
}
*/
/* public function checkStatus(){
// again, the default values will be needed
$capture = array(
"request" => "capture",
"txid" => "your_txid",
"sequencenumber" => "previous_sequencenumber_plus_one", // get this from the last received transactionsstatus
"amount" => "your_amount", // you can either capture the full amount of the tx, or less
"currency" => "EUR"
);
$request = array_merge($this->default, $capture);
$response = Payone::sendRequest($request);
} */
// set for clearingtype
// debit payment
/*
*
*
* $params['bankaccountholder'] = $paymentData['mopt_payone__debit_bankaccountholder'];
$params['iban'] = $this->removeWhitespaces($paymentData['mopt_payone__debit_iban']);
$params['bic'] = $this->removeWhitespaces($paymentData['mopt_payone__debit_bic']);
* $params['bankcountry'] = $paymentData['mopt_payone__debit_bankcountry'];
$params['bankaccount'] = $this->removeWhitespaces($paymentData['mopt_payone__debit_bankaccount']);
$params['bankcode'] = $this->removeWhitespaces($paymentData['mopt_payone__debit_bankcode']);
if (Shopware()->Session()->moptMandateData) {
$params['mandate_identification'] = Shopware()->Session()->moptMandateData['mopt_payone__mandateIdentification'];
}
*
* ["clearing_bankaccount"]=> string(10) "2599100003"
["clearing_bankcode"]=> string(8) "12345678"
["clearing_bankcountry"]=> string(2) "DE"
["clearing_bankname"]=> string(8) "Testbank"
["clearing_bankaccountholder"]=> string(11) "Test Nutzer"
["clearing_bankcity"]=> string(4) "Kiel"
["clearing_bankiban"]=> string(22) "DE00123456782599100003"
["clearing_bankbic"]=> string(8) "TESTTEST" }
*/
/*
* PNT Sofortbanking (DE, AT, CH, NL)
GPY giropay (DE)
EPS eps – online transfer (AT)
PFF PostFinance E-Finance (CH)
PFC PostFinance Card (CH)
IDL iDEAL (NL)
P24 Przelewy24 (PL)
BCT Bancontact*/
/*
* iban
* bic
* bankcountry*/
/* * Card type
V Visa
M MasterCard
A American Express
D Diners / Discover
J JCB
O Maestro International
*/
}