Payment Phase R: PAYONE-Integration entflechten (R1–R7 + Review)

Strangler-Refactoring der PAYONE-Zahlungslogik in eine testbare
Service-Schicht, ohne Verhalten in Checkout/Cron/IPN zu ändern.

Neue Services (app/Services/Payment/Payone):
- PayonePaymentService (+ PayonePaymentResult-DTO) für CC-/SEPA-Check
  und Abo-Abbuchung
- PayoneRequestBuilder, PaymentMethodResolver, PayoneMethodConfig
- PayoneTransactionRecorder: zentrale PaymentTransaction-Erstellung
  (API-Response, Invoice, Webhook) inkl. PCI-Redaction (cardpan/cardcvc2)
- PayoneWebhookHandler (+ PayoneWebhookResult): IPN/TSOK-Logik aus
  Api\PayoneController; response('TSOK') statt echo/exit
- PayoneTransportException + Handler-Mapping (403) statt abort() im Service

Hotfixes (R1): var_dump/exit & bare exit() entfernt, Log-Redaction.

Security (R-Review):
- PAYONE_KEY_HASH (MD5-Hash, kein Klartext) mit Boot-Hard-Fail; schließt
  zugleich die ''-Webhook-Bypass-Lücke. Artisan-Command payone:hash-key
  (verdeckte Eingabe, optional --write) zur Hash-Erzeugung.
- Webhook: txaction Pflichtfeld, mode-Fallback auf payment->mode.

Pay\PayoneController ist @deprecated-Fassade (614 → 328 Zeilen),
delegiert an Services via Container-Singleton.

Migration: fehlende Spalte shopping_payments.carddata nachgezogen.

Tests: 47 grün (PayonePaymentService, Recorder, Webhook, Resolver,
TransportException, hash-key). End-to-End im Test-System verifiziert
(siehe dev/2026-06-09-payments).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/Unit/Services/Payment/PaymentMethodResolverTest.php

@@ -0,0 +1,115 @@
+<?php
+
+use App\Services\Payment\Payone\PaymentMethodResolver;
+use Tests\TestCase;
+
+uses(TestCase::class);
+
+// --- Simple methods ---
+
+it('resolves cc with pseudocardpan from context', function (): void {
+    $config = PaymentMethodResolver::resolve('cc', ['cc' => ['pseudocardpan' => 'PSEUDO123']]);
+
+    expect($config->toArray())->toMatchArray([
+        'clearingtype' => 'cc',
+        'wallettype' => '',
+        'onlinebanktransfertype' => '',
+        'request' => 'authorization',
+        'pseudocardpan' => 'PSEUDO123',
+    ]);
+});
+
+it('resolves vor with no context needed', function (): void {
+    $config = PaymentMethodResolver::resolve('vor');
+
+    expect($config->toArray())->toMatchArray([
+        'clearingtype' => 'vor',
+        'wallettype' => '',
+        'onlinebanktransfertype' => '',
+        'request' => 'authorization',
+    ]);
+});
+
+it('resolves elv with bank data from context', function (): void {
+    $ctx = [
+        'elv' => [
+            'mandate_identification' => 'MAND001',
+            'iban' => 'DE89370400440532013000',
+            'bic' => 'COBADEFFXXX',
+            'bankaccountholder' => 'Max Mustermann',
+        ],
+    ];
+
+    $config = PaymentMethodResolver::resolve('elv', $ctx);
+
+    expect($config->toArray())->toMatchArray([
+        'clearingtype' => 'elv',
+        'request' => 'authorization',
+        'iban' => 'DE89370400440532013000',
+        'bic' => 'COBADEFFXXX',
+        'mandate_identification' => 'MAND001',
+        'bankaccountholder' => 'Max Mustermann',
+    ]);
+});
+
+// --- Compound methods ---
+
+it('resolves wlt#PPE for PayPal via PAYONE', function (): void {
+    $config = PaymentMethodResolver::resolve('wlt#PPE');
+
+    expect($config->toArray())->toMatchArray([
+        'clearingtype' => 'wlt',
+        'wallettype' => 'PPE',
+        'onlinebanktransfertype' => '',
+        'request' => 'authorization',
+    ]);
+});
+
+it('resolves wlt#PDT for paydirekt', function (): void {
+    $config = PaymentMethodResolver::resolve('wlt#PDT');
+
+    expect($config->toArray()['wallettype'])->toBe('PDT');
+});
+
+it('resolves sb#PNT for Sofort', function (): void {
+    $config = PaymentMethodResolver::resolve('sb#PNT');
+
+    expect($config->toArray())->toMatchArray([
+        'clearingtype' => 'sb',
+        'wallettype' => '',
+        'onlinebanktransfertype' => 'PNT',
+        'bankcountry' => 'DE',
+        'request' => 'authorization',
+    ]);
+});
+
+it('resolves sb#GPY for giropay', function (): void {
+    $config = PaymentMethodResolver::resolve('sb#GPY');
+
+    expect($config->toArray()['onlinebanktransfertype'])->toBe('GPY');
+});
+
+it('resolves fnc#MIV for MIVITA invoice', function (): void {
+    $config = PaymentMethodResolver::resolve('fnc#MIV');
+
+    expect($config->toArray())->toMatchArray([
+        'clearingtype' => 'fnc',
+        'wallettype' => '',
+        'onlinebanktransfertype' => 'MIV',
+        'request' => 'authorization',
+    ]);
+});
+
+// --- Error cases ---
+
+it('throws for unknown simple payment method', function (): void {
+    PaymentMethodResolver::resolve('unknown');
+})->throws(InvalidArgumentException::class, 'Unknown payment method: unknown');
+
+it('throws for unknown compound type', function (): void {
+    PaymentMethodResolver::resolve('xyz#FOO');
+})->throws(InvalidArgumentException::class, 'Unknown compound payment method type: xyz');
+
+it('throws for unknown fnc subtype', function (): void {
+    PaymentMethodResolver::resolve('fnc#PYV');
+})->throws(InvalidArgumentException::class, 'Unknown fnc subtype: PYV');

tests/Unit/Services/PayoneTest.php

@@ -1,5 +1,6 @@
 <?php
 
+use App\Services\Payment\Payone\Exceptions\PayoneTransportException;
 use App\Services\Payone;
 use GuzzleHttp\Client;
 use GuzzleHttp\Exception\ConnectException;
@@ -8,7 +9,6 @@ use GuzzleHttp\HandlerStack;
 use GuzzleHttp\Psr7\Request;
 use GuzzleHttp\Psr7\Response;
 use Illuminate\Support\Facades\Mail;
-use Symfony\Component\HttpKernel\Exception\HttpException;
 use Tests\TestCase;
 
 uses(TestCase::class);
@@ -47,7 +47,7 @@ it('sendRequest liefert das geparste Array bei text/plain;charset=UTF-8', functi
         ->and($result['txid'])->toBe('999');
 });
 
-it('sendRequest wandelt Netzwerkfehler ohne HTTP-Antwort in Fehler 1002 um', function () {
+it('sendRequest wandelt Netzwerkfehler ohne HTTP-Antwort in PayoneTransportException (1002) um', function () {
     Mail::fake();
 
     $mockRequest = new Request('POST', Payone::PAYONE_SERVER_API_URL);
@@ -59,15 +59,33 @@ it('sendRequest wandelt Netzwerkfehler ohne HTTP-Antwort in Fehler 1002 um', fun
     $thrown = null;
     try {
         Payone::sendRequest(['request' => 'authorization'], '', $client);
-    } catch (HttpException $e) {
+    } catch (PayoneTransportException $e) {
         $thrown = $e;
     }
 
-    expect($thrown)->toBeInstanceOf(HttpException::class)
-        ->and($thrown->getStatusCode())->toBe(403)
+    expect($thrown)->toBeInstanceOf(PayoneTransportException::class)
         ->and($thrown->getMessage())->toContain('Fehlercode: 1002');
 });
 
+it('sendRequest wirft PayoneTransportException (1004) wenn die Antwort keinen Status enthält', function () {
+    Mail::fake();
+
+    $mock = new MockHandler([
+        new Response(200, ['Content-Type' => 'text/plain;charset=UTF-8'], "foo=bar\nbaz=qux\n"),
+    ]);
+    $client = new Client(['handler' => HandlerStack::create($mock)]);
+
+    $thrown = null;
+    try {
+        Payone::sendRequest(['request' => 'authorization'], '', $client);
+    } catch (PayoneTransportException $e) {
+        $thrown = $e;
+    }
+
+    expect($thrown)->toBeInstanceOf(PayoneTransportException::class)
+        ->and($thrown->getMessage())->toContain('Fehlercode: 1004');
+});
+
 it('exponiert die erwartete Post-Gateway-URL', function () {
     expect(Payone::PAYONE_SERVER_API_URL)->toBe('https://api.pay1.de/post-gateway/');
 });