Payment Phase R: PAYONE-Integration entflechten (R1–R7 + Review)

Strangler-Refactoring der PAYONE-Zahlungslogik in eine testbare
Service-Schicht, ohne Verhalten in Checkout/Cron/IPN zu ändern.

Neue Services (app/Services/Payment/Payone):
- PayonePaymentService (+ PayonePaymentResult-DTO) für CC-/SEPA-Check
  und Abo-Abbuchung
- PayoneRequestBuilder, PaymentMethodResolver, PayoneMethodConfig
- PayoneTransactionRecorder: zentrale PaymentTransaction-Erstellung
  (API-Response, Invoice, Webhook) inkl. PCI-Redaction (cardpan/cardcvc2)
- PayoneWebhookHandler (+ PayoneWebhookResult): IPN/TSOK-Logik aus
  Api\PayoneController; response('TSOK') statt echo/exit
- PayoneTransportException + Handler-Mapping (403) statt abort() im Service

Hotfixes (R1): var_dump/exit & bare exit() entfernt, Log-Redaction.

Security (R-Review):
- PAYONE_KEY_HASH (MD5-Hash, kein Klartext) mit Boot-Hard-Fail; schließt
  zugleich die ''-Webhook-Bypass-Lücke. Artisan-Command payone:hash-key
  (verdeckte Eingabe, optional --write) zur Hash-Erzeugung.
- Webhook: txaction Pflichtfeld, mode-Fallback auf payment->mode.

Pay\PayoneController ist @deprecated-Fassade (614 → 328 Zeilen),
delegiert an Services via Container-Singleton.

Migration: fehlende Spalte shopping_payments.carddata nachgezogen.

Tests: 47 grün (PayonePaymentService, Recorder, Webhook, Resolver,
TransportException, hash-key). End-to-End im Test-System verifiziert
(siehe dev/2026-06-09-payments).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/Feature/PayoneHashKeyCommandTest.php

@@ -0,0 +1,19 @@
+<?php
+
+use Tests\TestCase;
+
+uses(TestCase::class);
+
+it('gibt den korrekten MD5-Hash für den PAYONE-Portal-Key aus', function (): void {
+    $this->artisan('payone:hash-key')
+        ->expectsQuestion('PAYONE-Portal-Key (Klartext, verdeckte Eingabe)', 'Zjop5cvP2UeB7Qhy')
+        ->expectsOutputToContain('698fb2555f8b2efc74f60b2121421f45')
+        ->assertExitCode(0);
+});
+
+it('hasht beliebige Eingaben deterministisch (md5)', function (): void {
+    $this->artisan('payone:hash-key')
+        ->expectsQuestion('PAYONE-Portal-Key (Klartext, verdeckte Eingabe)', 'hello')
+        ->expectsOutputToContain(hash('md5', 'hello'))
+        ->assertExitCode(0);
+});

tests/Feature/PayonePaymentServiceTest.php

@@ -0,0 +1,225 @@
+<?php
+
+use App\Models\ShoppingOrder;
+use App\Models\ShoppingPayment;
+use App\Models\ShoppingUser;
+use App\Models\UserAbo;
+use App\Services\Payment\Payone\DTOs\PayonePaymentResult;
+use App\Services\Payment\Payone\PayonePaymentService;
+use GuzzleHttp\Client;
+use GuzzleHttp\Handler\MockHandler;
+use GuzzleHttp\HandlerStack;
+use GuzzleHttp\Psr7\Response;
+use Tests\TestCase;
+
+uses(TestCase::class, Illuminate\Foundation\Testing\RefreshDatabase::class);
+
+// --- Helpers ---
+
+function makePayoneClient(string $status, array $extra = []): Client
+{
+    $pairs = array_merge(['status' => $status], $extra);
+    $body = implode("\n", array_map(fn ($v, $k) => "$k=$v", $pairs, array_keys($pairs)));
+    $mock = new MockHandler([new Response(200, ['Content-Type' => 'text/plain;charset=UTF-8'], $body)]);
+
+    return new Client(['handler' => HandlerStack::create($mock)]);
+}
+
+function makeService(Client $client): PayonePaymentService
+{
+    return new PayonePaymentService(
+        defaults: ['mid' => '1', 'aid' => '1', 'portalid' => '1', 'key' => 'abc', 'api_version' => '3.11'],
+        client: $client,
+    );
+}
+
+// --- PayonePaymentResult DTO ---
+
+it('fromResponse baut ein vollständiges Ergebnis-DTO', function (): void {
+    $raw = [
+        'status' => 'APPROVED',
+        'txid' => '12345',
+        'userid' => '67890',
+        'redirecturl' => null,
+        'errormessage' => null,
+        'customermessage' => null,
+        'errorcode' => null,
+    ];
+
+    $result = PayonePaymentResult::fromResponse($raw);
+
+    expect($result->status)->toBe('APPROVED')
+        ->and($result->txid)->toBe('12345')
+        ->and($result->userid)->toEqual(67890)
+        ->and($result->isApproved())->toBeTrue()
+        ->and($result->isError())->toBeFalse()
+        ->and($result->isRedirect())->toBeFalse()
+        ->and($result->toArray())->toBe($raw);
+});
+
+it('fromResponse setzt UNKNOWN bei fehlendem Status', function (): void {
+    $result = PayonePaymentResult::fromResponse([]);
+
+    expect($result->status)->toBe('UNKNOWN')
+        ->and($result->txid)->toBe('')
+        ->and($result->userid)->toEqual(0);
+});
+
+it('isValid erkennt VALID-Status (creditcardcheck)', function (): void {
+    $result = PayonePaymentResult::fromResponse(['status' => 'VALID', 'pseudocardpan' => 'PSEUDO1']);
+
+    expect($result->isValid())->toBeTrue()
+        ->and($result->isApproved())->toBeFalse();
+});
+
+// --- checkCreditCard ---
+
+it('checkCreditCard gibt PayonePaymentResult mit VALID zurück', function (): void {
+    $client = makePayoneClient('VALID', ['pseudocardpan' => 'PSEUDO999']);
+    $service = makeService($client);
+
+    $result = $service->checkCreditCard([
+        'cc_cardholder_first' => 'Max',
+        'cc_cardholder_last' => 'Mustermann',
+        'cc_cardpan' => '4111111111111111',
+        'cc_cardexpireyear' => '2026',
+        'cc_cardexpiremonth' => '12',
+        'cc_cardtype' => 'V',
+        'cc_cardcvc2' => '123',
+    ], 'test');
+
+    expect($result)->toBeInstanceOf(PayonePaymentResult::class)
+        ->and($result->status)->toBe('VALID')
+        ->and($result->isValid())->toBeTrue()
+        ->and($result->rawResponse['pseudocardpan'])->toBe('PSEUDO999');
+});
+
+it('checkCreditCard gibt ERROR-Ergebnis bei abgelehnter Karte zurück', function (): void {
+    $client = makePayoneClient('ERROR', ['errorcode' => '863', 'errormessage' => 'Card declined']);
+    $service = makeService($client);
+
+    $result = $service->checkCreditCard([
+        'cc_cardholder_first' => 'Max',
+        'cc_cardholder_last' => 'Mustermann',
+        'cc_cardpan' => '4111111111111111',
+        'cc_cardexpireyear' => '2025',
+        'cc_cardexpiremonth' => '01',
+        'cc_cardtype' => 'V',
+        'cc_cardcvc2' => '000',
+    ], 'test');
+
+    expect($result->isError())->toBeTrue()
+        ->and($result->errorCode)->toBe('863')
+        ->and($result->errorMessage)->toBe('Card declined');
+});
+
+// --- chargeAbo ---
+
+it('chargeAbo erstellt ShoppingPayment und gibt APPROVED zurück', function (): void {
+    $client = makePayoneClient('APPROVED', ['txid' => '77777', 'userid' => '12345']);
+    $service = makeService($client);
+
+    $shoppingUser = ShoppingUser::create([
+        'auth_user_id' => 1,
+        'billing_firstname' => 'Max',
+        'billing_lastname' => 'Mustermann',
+        'billing_address' => 'Musterstraße 1',
+        'billing_zipcode' => '12345',
+        'billing_city' => 'Musterstadt',
+        'billing_country_id' => 1,
+        'shipping_country_id' => 1,
+        'billing_email' => 'max@example.com',
+        'same_as_billing' => true,
+        'mode' => 'test',
+        'wp_order_number' => 0,
+    ]);
+
+    $shoppingOrder = ShoppingOrder::create([
+        'shopping_user_id' => $shoppingUser->id,
+        'auth_user_id' => 1,
+        'country_id' => 1,
+        'user_shop_id' => 1,
+        'mode' => 'test',
+        'is_abo' => 1,
+        'abo_interval' => 1,
+        'total_shipping' => '99.00',
+    ]);
+
+    $userAbo = UserAbo::create([
+        'user_id' => 1,
+        'shopping_user_id' => $shoppingUser->id,
+        'clearingtype' => 'cc',
+        'wallettype' => '',
+        'payone_userid' => 99,
+        'carddata' => ['pseudocardpan' => 'PSEUDO123', 'cardexpiredate' => '2612'],
+        'abo_interval' => 1,
+        'status' => 1,
+    ]);
+
+    $result = $service->chargeAbo($userAbo, $shoppingOrder, $shoppingUser, 9900, 'EUR');
+
+    expect($result)->toBeInstanceOf(PayonePaymentResult::class)
+        ->and($result->isApproved())->toBeTrue()
+        ->and($result->txid)->toBe('77777')
+        ->and($result->userid)->toEqual(12345)
+        ->and($result->shoppingPayment)->toBeInstanceOf(ShoppingPayment::class)
+        ->and($result->shoppingPayment->clearingtype)->toBe('cc')
+        ->and($result->shoppingPayment->amount)->toEqual(9900)
+        ->and($result->shoppingPayment->currency)->toBe('EUR')
+        ->and($result->shoppingPayment->is_abo)->toBeTruthy()
+        ->and($result->shoppingPayment->mode)->toBe('test');
+
+    expect(ShoppingPayment::count())->toEqual(1);
+});
+
+it('chargeAbo gibt ERROR-Ergebnis zurück bei abgelehnter Abbuchung', function (): void {
+    $client = makePayoneClient('ERROR', ['errorcode' => '307', 'errormessage' => 'Transaction declined']);
+    $service = makeService($client);
+
+    $shoppingUser = ShoppingUser::create([
+        'auth_user_id' => 1,
+        'billing_firstname' => 'Anna',
+        'billing_lastname' => 'Test',
+        'billing_address' => 'Testweg 5',
+        'billing_zipcode' => '54321',
+        'billing_city' => 'Testort',
+        'billing_country_id' => 1,
+        'shipping_country_id' => 1,
+        'billing_email' => 'anna@test.com',
+        'same_as_billing' => true,
+        'mode' => 'test',
+        'wp_order_number' => 0,
+    ]);
+
+    $shoppingOrder = ShoppingOrder::create([
+        'shopping_user_id' => $shoppingUser->id,
+        'auth_user_id' => 1,
+        'country_id' => 1,
+        'user_shop_id' => 1,
+        'mode' => 'live',
+        'is_abo' => 1,
+        'abo_interval' => 1,
+        'total_shipping' => '49.50',
+    ]);
+
+    $userAbo = UserAbo::create([
+        'user_id' => 1,
+        'shopping_user_id' => $shoppingUser->id,
+        'clearingtype' => 'cc',
+        'wallettype' => '',
+        'payone_userid' => 42,
+        'carddata' => ['pseudocardpan' => 'PSEUDO456'],
+        'abo_interval' => 1,
+        'status' => 1,
+    ]);
+
+    $result = $service->chargeAbo($userAbo, $shoppingOrder, $shoppingUser, 4950, 'EUR');
+
+    expect($result->isError())->toBeTrue()
+        ->and($result->errorCode)->toBe('307')
+        ->and($result->shoppingPayment)->toBeInstanceOf(ShoppingPayment::class)
+        ->and($result->shoppingPayment->mode)->toBe('live');
+
+    // ShoppingPayment wird auch bei ERROR erstellt (für Protokollierung)
+    expect(ShoppingPayment::count())->toEqual(1);
+});

tests/Feature/PayoneTransactionRecorderTest.php

@@ -0,0 +1,134 @@
+<?php
+
+use App\Models\PaymentTransaction;
+use App\Models\ShoppingPayment;
+use App\Services\Payment\Payone\PayoneTransactionRecorder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+beforeEach(function (): void {
+    // SQLite in-memory: FK constraints not enforced, so shopping_order_id = 0 is fine here.
+    $this->payment = ShoppingPayment::create([
+        'shopping_order_id' => 0,
+        'reference' => 'test-'.uniqid(),
+        'amount' => 9900,
+        'currency' => 'EUR',
+        'clearingtype' => 'cc',
+        'mode' => 'test',
+    ]);
+});
+
+it('records an APPROVED response with txid and userid', function (): void {
+    $response = [
+        'status' => 'APPROVED',
+        'txid' => '12345',
+        'userid' => '67890',
+    ];
+
+    $transaction = PayoneTransactionRecorder::recordFromResponse($this->payment, 'authorization', $response);
+
+    expect($transaction)->toBeInstanceOf(PaymentTransaction::class)
+        ->and($transaction->shopping_payment_id)->toBe($this->payment->id)
+        ->and($transaction->request)->toBe('authorization')
+        ->and($transaction->status)->toBe('APPROVED')
+        ->and($transaction->txid)->toBe('12345')
+        ->and($transaction->userid)->toBe('67890')
+        ->and($transaction->mode)->toBe('test')
+        ->and($transaction->errorcode)->toBeNull()
+        ->and($transaction->transmitted_data)->toMatchArray($response);
+});
+
+it('records an ERROR response with error fields and no txid', function (): void {
+    $response = [
+        'status' => 'ERROR',
+        'errorcode' => '909',
+        'errormessage' => 'Card declined',
+        'customermessage' => 'Ihre Karte wurde abgelehnt.',
+    ];
+
+    $transaction = PayoneTransactionRecorder::recordFromResponse($this->payment, 'authorization', $response);
+
+    expect($transaction->status)->toBe('ERROR')
+        ->and($transaction->txid)->toEqual(0)
+        ->and($transaction->userid)->toEqual(0)
+        ->and($transaction->errorcode)->toBe('909')
+        ->and($transaction->errormessage)->toBe('Card declined')
+        ->and($transaction->customermessage)->toBe('Ihre Karte wurde abgelehnt.')
+        ->and($transaction->transmitted_data)->toMatchArray($response);
+});
+
+it('records a REDIRECT response', function (): void {
+    $response = [
+        'status' => 'REDIRECT',
+        'txid' => '99999',
+        'userid' => '11111',
+        'redirecturl' => 'https://paypal.com/redirect',
+    ];
+
+    $transaction = PayoneTransactionRecorder::recordFromResponse($this->payment, 'authorization', $response);
+
+    expect($transaction->status)->toBe('REDIRECT')
+        ->and($transaction->txid)->toBe('99999')
+        ->and($transaction->userid)->toBe('11111');
+});
+
+it('falls back to useridFallback when response has no userid', function (): void {
+    $response = ['status' => 'APPROVED', 'txid' => '555'];
+
+    $transaction = PayoneTransactionRecorder::recordFromResponse($this->payment, 'authorization', $response, 42);
+
+    expect($transaction->userid)->toEqual(42);
+});
+
+it('records an invoice payment with synthetic FNCMIV status', function (): void {
+    $requestPayload = ['clearingtype' => 'fnc', 'onlinebanktransfertype' => 'MIV', 'amount' => 9900];
+
+    $transaction = PayoneTransactionRecorder::recordInvoicePayment($this->payment, 'authorization', $requestPayload);
+
+    expect($transaction)->toBeInstanceOf(PaymentTransaction::class)
+        ->and($transaction->status)->toBe('FNCMIV')
+        ->and($transaction->txaction)->toBe('invoice_open')
+        ->and($transaction->txid)->toEqual(0)
+        ->and($transaction->userid)->toEqual(0)
+        ->and($transaction->mode)->toBe('test')
+        ->and($transaction->transmitted_data)->toMatchArray($requestPayload);
+});
+
+it('records a webhook callback with PAYONE status and stored fields', function (): void {
+    $data = [
+        'key' => 'somekey',
+        'txid' => '321623031',
+        'userid' => '158723953',
+        'txaction' => 'paid',
+        'price' => '89.00',
+        'errorcode' => '0',
+    ];
+
+    $transaction = PayoneTransactionRecorder::recordWebhookCallback($this->payment, $data);
+
+    expect($transaction)->toBeInstanceOf(PaymentTransaction::class)
+        ->and($transaction->request)->toBe('transaction')
+        ->and($transaction->status)->toBe('PAYONE')
+        ->and($transaction->txid)->toBe('321623031')
+        ->and($transaction->userid)->toBe('158723953')
+        ->and($transaction->txaction)->toBe('paid')
+        ->and($transaction->mode)->toBe('test') // falls back to payment->mode when data has none
+        ->and($transaction->transmitted_data)->toMatchArray(['txaction' => 'paid', 'price' => '89.00']);
+});
+
+it('strips cardpan and cardcvc2 from stored transmitted_data', function (): void {
+    $payload = [
+        'clearingtype' => 'cc',
+        'cardpan' => '4111111111111111',
+        'cardcvc2' => '123',
+        'amount' => 9900,
+    ];
+
+    $transaction = PayoneTransactionRecorder::recordInvoicePayment($this->payment, 'authorization', $payload);
+
+    expect($transaction->transmitted_data)->not->toHaveKey('cardpan')
+        ->and($transaction->transmitted_data)->not->toHaveKey('cardcvc2')
+        ->and($transaction->transmitted_data)->toMatchArray(['clearingtype' => 'cc', 'amount' => 9900]);
+});

tests/Feature/PayoneTransportExceptionHandlingTest.php

@@ -0,0 +1,23 @@
+<?php
+
+use App\Exceptions\Handler;
+use App\Services\Payment\Payone\Exceptions\PayoneTransportException;
+use Illuminate\Http\Request;
+use Tests\TestCase;
+
+uses(TestCase::class);
+
+it('renders an uncaught PayoneTransportException as a 403 response', function (): void {
+    $handler = app(Handler::class);
+    $request = Request::create('/checkout', 'POST');
+
+    $response = $handler->render($request, new PayoneTransportException('Fehlercode: 1002'));
+
+    expect($response->getStatusCode())->toBe(403);
+});
+
+it('does not report PayoneTransportException (no duplicate exception mail)', function (): void {
+    $handler = app(Handler::class);
+
+    expect($handler->shouldReport(new PayoneTransportException('x')))->toBeFalse();
+});

tests/Feature/PayoneWebhookHandlerTest.php

@@ -0,0 +1,257 @@
+<?php
+
+use App\Models\PaymentTransaction;
+use App\Models\ShippingCountry;
+use App\Models\ShoppingOrder;
+use App\Models\ShoppingPayment;
+use App\Models\ShoppingUser;
+use App\Models\UserShop;
+use App\Services\Payment\Payone\DTOs\PayoneWebhookResult;
+use App\Services\Payment\Payone\PayoneWebhookHandler;
+use App\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Mail;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+beforeEach(function (): void {
+    Mail::fake();
+});
+
+/**
+ * Creates a matching order + payment for an 89.00 EUR transaction.
+ *
+ * @return array{0: ShoppingOrder, 1: ShoppingPayment}
+ */
+function webhookBootstrap(array $orderOverrides = [], array $paymentOverrides = []): array
+{
+    $country = ShippingCountry::first() ?? ShippingCountry::create(['shipping_id' => 1, 'country_id' => 1]);
+
+    $shopOwner = User::forceCreate([
+        'email' => 'wh-owner-'.uniqid('', true).'@example.com',
+        'password' => bcrypt('secret'),
+        'lang' => 'de',
+    ]);
+
+    $userShop = UserShop::first() ?? UserShop::create([
+        'user_id' => $shopOwner->id,
+        'name' => 'WH Shop',
+        'slug' => 'wh-shop-'.uniqid(),
+        'domain' => 'wh-test.local',
+    ]);
+
+    $shoppingUser = ShoppingUser::create([
+        'auth_user_id' => $shopOwner->id,
+        'billing_firstname' => 'Web',
+        'billing_lastname' => 'Hook',
+        'billing_email' => 'webhook-'.uniqid().'@example.com',
+        'billing_country_id' => $country->id,
+        'shipping_country_id' => $country->id,
+    ]);
+
+    $order = ShoppingOrder::create(array_merge([
+        'shopping_user_id' => $shoppingUser->id,
+        'auth_user_id' => $shopOwner->id,
+        'country_id' => $country->id,
+        'user_shop_id' => $userShop->id,
+        'total' => 89.00,
+        'paid' => false,
+        'txaction' => null,
+        'mode' => 'test',
+    ], $orderOverrides));
+
+    // txaction is not fillable on ShoppingPayment; apply it explicitly after create.
+    $paymentTxaction = $paymentOverrides['txaction'] ?? null;
+    unset($paymentOverrides['txaction']);
+
+    $payment = ShoppingPayment::create(array_merge([
+        'shopping_order_id' => $order->id,
+        'reference' => 'wh-ref-'.uniqid(),
+        'amount' => 8900,
+        'clearingtype' => 'cc',
+        'currency' => 'EUR',
+        'mode' => 'test',
+    ], $paymentOverrides));
+
+    if ($paymentTxaction !== null) {
+        $payment->txaction = $paymentTxaction;
+        $payment->save();
+    }
+
+    return [$order, $payment];
+}
+
+function validCallback(ShoppingOrder $order, ShoppingPayment $payment, string $txaction): array
+{
+    return [
+        'key' => config('payone.defaults.key'),
+        'txaction' => $txaction,
+        'clearingtype' => 'cc',
+        'userid' => '158723953',
+        'txid' => '321623031',
+        'price' => '89.00',
+        'param' => $order->id,
+        'reference' => $payment->reference,
+        'mode' => 'test',
+    ];
+}
+
+// --- Validation / rejection paths ---
+
+it('rejects an incomplete callback with code 2001', function (): void {
+    $result = (new PayoneWebhookHandler)->handle(['txaction' => 'paid']);
+
+    expect($result)->toBeInstanceOf(PayoneWebhookResult::class)
+        ->and($result->response)->toBe('TSOK')
+        ->and($result->processed)->toBeFalse()
+        ->and($result->rejectionCode)->toBe('2001');
+});
+
+it('rejects a callback missing txaction with code 2001', function (): void {
+    [$order, $payment] = webhookBootstrap();
+    $data = validCallback($order, $payment, 'paid');
+    unset($data['txaction']);
+
+    $result = (new PayoneWebhookHandler)->handle($data);
+
+    expect($result->processed)->toBeFalse()
+        ->and($result->rejectionCode)->toBe('2001');
+});
+
+it('rejects a callback with a wrong key (2002)', function (): void {
+    [$order, $payment] = webhookBootstrap();
+    $data = validCallback($order, $payment, 'paid');
+    $data['key'] = 'totally-wrong-key';
+
+    $result = (new PayoneWebhookHandler)->handle($data);
+
+    expect($result->processed)->toBeFalse()
+        ->and($result->rejectionCode)->toBe('2002');
+});
+
+it('rejects when the shopping order is not found (2003)', function (): void {
+    [$order, $payment] = webhookBootstrap();
+    $data = validCallback($order, $payment, 'paid');
+    $data['param'] = 999999;
+
+    $result = (new PayoneWebhookHandler)->handle($data);
+
+    expect($result->rejectionCode)->toBe('2003');
+});
+
+it('rejects when the shopping payment is not found (2004)', function (): void {
+    [$order, $payment] = webhookBootstrap();
+    $data = validCallback($order, $payment, 'paid');
+    $data['reference'] = 'does-not-exist';
+
+    $result = (new PayoneWebhookHandler)->handle($data);
+
+    expect($result->rejectionCode)->toBe('2004');
+});
+
+it('rejects when payment does not belong to the order (2005)', function (): void {
+    [$order, $payment] = webhookBootstrap();
+    [$otherOrder] = webhookBootstrap();
+    $data = validCallback($order, $payment, 'paid');
+    // Point param at a different existing order than the payment's order.
+    $data['param'] = $otherOrder->id;
+
+    $result = (new PayoneWebhookHandler)->handle($data);
+
+    expect($result->rejectionCode)->toBe('2005');
+});
+
+it('rejects on a price mismatch (2006)', function (): void {
+    [$order, $payment] = webhookBootstrap(paymentOverrides: ['amount' => 5000]);
+    $data = validCallback($order, $payment, 'paid'); // price 89.00 -> 8900 != 5000
+
+    $result = (new PayoneWebhookHandler)->handle($data);
+
+    expect($result->rejectionCode)->toBe('2006');
+});
+
+// --- Duplicate handling ---
+
+it('ignores a duplicate paid callback when already paid', function (): void {
+    [$order, $payment] = webhookBootstrap(
+        orderOverrides: ['txaction' => 'paid', 'paid' => true],
+        paymentOverrides: ['txaction' => 'paid'],
+    );
+    $data = validCallback($order, $payment, 'paid');
+
+    $result = (new PayoneWebhookHandler)->handle($data);
+
+    expect($result->processed)->toBeFalse()
+        ->and($result->duplicate)->toBeTrue()
+        ->and($result->txaction)->toBe('paid');
+
+    // No new transaction recorded for the ignored duplicate.
+    expect(PaymentTransaction::count())->toBe(0);
+});
+
+it('ignores a duplicate appointed callback with same txaction', function (): void {
+    [$order, $payment] = webhookBootstrap(
+        orderOverrides: ['txaction' => 'appointed'],
+        paymentOverrides: ['txaction' => 'appointed'],
+    );
+    $data = validCallback($order, $payment, 'appointed');
+
+    $result = (new PayoneWebhookHandler)->handle($data);
+
+    expect($result->duplicate)->toBeTrue()
+        ->and($result->txaction)->toBe('appointed');
+    expect(PaymentTransaction::count())->toBe(0);
+});
+
+// --- Processing paths ---
+
+it('processes an appointed callback: records transaction and updates txaction', function (): void {
+    [$order, $payment] = webhookBootstrap();
+    $data = validCallback($order, $payment, 'appointed');
+
+    $result = (new PayoneWebhookHandler)->handle($data);
+
+    expect($result->processed)->toBeTrue()
+        ->and($result->txaction)->toBe('appointed')
+        ->and($result->paid)->toBeFalse();
+
+    $order->refresh();
+    $payment->refresh();
+    expect($order->txaction)->toBe('appointed')
+        ->and($payment->txaction)->toBe('appointed')
+        ->and(PaymentTransaction::count())->toBe(1);
+});
+
+it('does not downgrade txaction when a lower-priority callback arrives', function (): void {
+    // Order already 'paid' (priority 10), incoming 'appointed' (priority 1) must not override.
+    [$order, $payment] = webhookBootstrap(
+        orderOverrides: ['txaction' => 'paid', 'paid' => true],
+        paymentOverrides: ['txaction' => 'pending'],
+    );
+    $data = validCallback($order, $payment, 'appointed');
+
+    $result = (new PayoneWebhookHandler)->handle($data);
+
+    expect($result->processed)->toBeTrue();
+    $order->refresh();
+    expect($order->txaction)->toBe('paid'); // unchanged
+    // Transaction still recorded even though txaction was not updated.
+    expect(PaymentTransaction::count())->toBe(1);
+});
+
+it('processes a paid callback: marks order paid and records transaction', function (): void {
+    [$order, $payment] = webhookBootstrap();
+    $data = validCallback($order, $payment, 'paid');
+
+    $result = (new PayoneWebhookHandler)->handle($data);
+
+    expect($result->processed)->toBeTrue()
+        ->and($result->paid)->toBeTrue()
+        ->and($result->mailSent)->toBeTrue();
+
+    $order->refresh();
+    expect((bool) $order->paid)->toBeTrue()
+        ->and($order->txaction)->toBe('paid')
+        ->and(PaymentTransaction::count())->toBe(1);
+});

tests/Unit/Services/Payment/PaymentMethodResolverTest.php

@@ -0,0 +1,115 @@
+<?php
+
+use App\Services\Payment\Payone\PaymentMethodResolver;
+use Tests\TestCase;
+
+uses(TestCase::class);
+
+// --- Simple methods ---
+
+it('resolves cc with pseudocardpan from context', function (): void {
+    $config = PaymentMethodResolver::resolve('cc', ['cc' => ['pseudocardpan' => 'PSEUDO123']]);
+
+    expect($config->toArray())->toMatchArray([
+        'clearingtype' => 'cc',
+        'wallettype' => '',
+        'onlinebanktransfertype' => '',
+        'request' => 'authorization',
+        'pseudocardpan' => 'PSEUDO123',
+    ]);
+});
+
+it('resolves vor with no context needed', function (): void {
+    $config = PaymentMethodResolver::resolve('vor');
+
+    expect($config->toArray())->toMatchArray([
+        'clearingtype' => 'vor',
+        'wallettype' => '',
+        'onlinebanktransfertype' => '',
+        'request' => 'authorization',
+    ]);
+});
+
+it('resolves elv with bank data from context', function (): void {
+    $ctx = [
+        'elv' => [
+            'mandate_identification' => 'MAND001',
+            'iban' => 'DE89370400440532013000',
+            'bic' => 'COBADEFFXXX',
+            'bankaccountholder' => 'Max Mustermann',
+        ],
+    ];
+
+    $config = PaymentMethodResolver::resolve('elv', $ctx);
+
+    expect($config->toArray())->toMatchArray([
+        'clearingtype' => 'elv',
+        'request' => 'authorization',
+        'iban' => 'DE89370400440532013000',
+        'bic' => 'COBADEFFXXX',
+        'mandate_identification' => 'MAND001',
+        'bankaccountholder' => 'Max Mustermann',
+    ]);
+});
+
+// --- Compound methods ---
+
+it('resolves wlt#PPE for PayPal via PAYONE', function (): void {
+    $config = PaymentMethodResolver::resolve('wlt#PPE');
+
+    expect($config->toArray())->toMatchArray([
+        'clearingtype' => 'wlt',
+        'wallettype' => 'PPE',
+        'onlinebanktransfertype' => '',
+        'request' => 'authorization',
+    ]);
+});
+
+it('resolves wlt#PDT for paydirekt', function (): void {
+    $config = PaymentMethodResolver::resolve('wlt#PDT');
+
+    expect($config->toArray()['wallettype'])->toBe('PDT');
+});
+
+it('resolves sb#PNT for Sofort', function (): void {
+    $config = PaymentMethodResolver::resolve('sb#PNT');
+
+    expect($config->toArray())->toMatchArray([
+        'clearingtype' => 'sb',
+        'wallettype' => '',
+        'onlinebanktransfertype' => 'PNT',
+        'bankcountry' => 'DE',
+        'request' => 'authorization',
+    ]);
+});
+
+it('resolves sb#GPY for giropay', function (): void {
+    $config = PaymentMethodResolver::resolve('sb#GPY');
+
+    expect($config->toArray()['onlinebanktransfertype'])->toBe('GPY');
+});
+
+it('resolves fnc#MIV for MIVITA invoice', function (): void {
+    $config = PaymentMethodResolver::resolve('fnc#MIV');
+
+    expect($config->toArray())->toMatchArray([
+        'clearingtype' => 'fnc',
+        'wallettype' => '',
+        'onlinebanktransfertype' => 'MIV',
+        'request' => 'authorization',
+    ]);
+});
+
+// --- Error cases ---
+
+it('throws for unknown simple payment method', function (): void {
+    PaymentMethodResolver::resolve('unknown');
+})->throws(InvalidArgumentException::class, 'Unknown payment method: unknown');
+
+it('throws for unknown compound type', function (): void {
+    PaymentMethodResolver::resolve('xyz#FOO');
+})->throws(InvalidArgumentException::class, 'Unknown compound payment method type: xyz');
+
+it('throws for unknown fnc subtype', function (): void {
+    PaymentMethodResolver::resolve('fnc#PYV');
+})->throws(InvalidArgumentException::class, 'Unknown fnc subtype: PYV');

tests/Unit/Services/PayoneTest.php

@@ -1,5 +1,6 @@
 <?php
 
+use App\Services\Payment\Payone\Exceptions\PayoneTransportException;
 use App\Services\Payone;
 use GuzzleHttp\Client;
 use GuzzleHttp\Exception\ConnectException;
@@ -8,7 +9,6 @@ use GuzzleHttp\HandlerStack;
 use GuzzleHttp\Psr7\Request;
 use GuzzleHttp\Psr7\Response;
 use Illuminate\Support\Facades\Mail;
-use Symfony\Component\HttpKernel\Exception\HttpException;
 use Tests\TestCase;
 
 uses(TestCase::class);
@@ -47,7 +47,7 @@ it('sendRequest liefert das geparste Array bei text/plain;charset=UTF-8', functi
         ->and($result['txid'])->toBe('999');
 });
 
-it('sendRequest wandelt Netzwerkfehler ohne HTTP-Antwort in Fehler 1002 um', function () {
+it('sendRequest wandelt Netzwerkfehler ohne HTTP-Antwort in PayoneTransportException (1002) um', function () {
     Mail::fake();
 
     $mockRequest = new Request('POST', Payone::PAYONE_SERVER_API_URL);
@@ -59,15 +59,33 @@ it('sendRequest wandelt Netzwerkfehler ohne HTTP-Antwort in Fehler 1002 um', fun
     $thrown = null;
     try {
         Payone::sendRequest(['request' => 'authorization'], '', $client);
-    } catch (HttpException $e) {
+    } catch (PayoneTransportException $e) {
         $thrown = $e;
     }
 
-    expect($thrown)->toBeInstanceOf(HttpException::class)
-        ->and($thrown->getStatusCode())->toBe(403)
+    expect($thrown)->toBeInstanceOf(PayoneTransportException::class)
         ->and($thrown->getMessage())->toContain('Fehlercode: 1002');
 });
 
+it('sendRequest wirft PayoneTransportException (1004) wenn die Antwort keinen Status enthält', function () {
+    Mail::fake();
+
+    $mock = new MockHandler([
+        new Response(200, ['Content-Type' => 'text/plain;charset=UTF-8'], "foo=bar\nbaz=qux\n"),
+    ]);
+    $client = new Client(['handler' => HandlerStack::create($mock)]);
+
+    $thrown = null;
+    try {
+        Payone::sendRequest(['request' => 'authorization'], '', $client);
+    } catch (PayoneTransportException $e) {
+        $thrown = $e;
+    }
+
+    expect($thrown)->toBeInstanceOf(PayoneTransportException::class)
+        ->and($thrown->getMessage())->toContain('Fehlercode: 1004');
+});
+
 it('exponiert die erwartete Post-Gateway-URL', function () {
     expect(Payone::PAYONE_SERVER_API_URL)->toBe('https://api.pay1.de/post-gateway/');
 });