Strangler-Refactoring der PAYONE-Zahlungslogik in eine testbare
Service-Schicht, ohne Verhalten in Checkout/Cron/IPN zu ändern.
Neue Services (app/Services/Payment/Payone):
- PayonePaymentService (+ PayonePaymentResult-DTO) für CC-/SEPA-Check
und Abo-Abbuchung
- PayoneRequestBuilder, PaymentMethodResolver, PayoneMethodConfig
- PayoneTransactionRecorder: zentrale PaymentTransaction-Erstellung
(API-Response, Invoice, Webhook) inkl. PCI-Redaction (cardpan/cardcvc2)
- PayoneWebhookHandler (+ PayoneWebhookResult): IPN/TSOK-Logik aus
Api\PayoneController; response('TSOK') statt echo/exit
- PayoneTransportException + Handler-Mapping (403) statt abort() im Service
Hotfixes (R1): var_dump/exit & bare exit() entfernt, Log-Redaction.
Security (R-Review):
- PAYONE_KEY_HASH (MD5-Hash, kein Klartext) mit Boot-Hard-Fail; schließt
zugleich die ''-Webhook-Bypass-Lücke. Artisan-Command payone:hash-key
(verdeckte Eingabe, optional --write) zur Hash-Erzeugung.
- Webhook: txaction Pflichtfeld, mode-Fallback auf payment->mode.
Pay\PayoneController ist @deprecated-Fassade (614 → 328 Zeilen),
delegiert an Services via Container-Singleton.
Migration: fehlende Spalte shopping_payments.carddata nachgezogen.
Tests: 47 grün (PayonePaymentService, Recorder, Webhook, Resolver,
TransportException, hash-key). End-to-End im Test-System verifiziert
(siehe dev/2026-06-09-payments).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
114 lines
3.9 KiB
PHP
114 lines
3.9 KiB
PHP
<?php
|
|
|
|
use App\Services\Payment\Payone\Exceptions\PayoneTransportException;
|
|
use App\Services\Payone;
|
|
use GuzzleHttp\Client;
|
|
use GuzzleHttp\Exception\ConnectException;
|
|
use GuzzleHttp\Handler\MockHandler;
|
|
use GuzzleHttp\HandlerStack;
|
|
use GuzzleHttp\Psr7\Request;
|
|
use GuzzleHttp\Psr7\Response;
|
|
use Illuminate\Support\Facades\Mail;
|
|
use Tests\TestCase;
|
|
|
|
uses(TestCase::class);
|
|
|
|
it('parst text/plain Antworten in ein assoziatives Array', function () {
|
|
$body = "status=OK\nreference=abc123\nerrormessage=\n";
|
|
$response = new Response(200, ['Content-Type' => 'text/plain;charset=UTF-8'], $body);
|
|
|
|
$parsed = Payone::parseResponse($response);
|
|
|
|
expect($parsed)->toBeArray()
|
|
->and($parsed['status'])->toBe('OK')
|
|
->and($parsed['reference'])->toBe('abc123')
|
|
->and($parsed['errormessage'])->toBe('');
|
|
});
|
|
|
|
it('parst Werte mit Gleichheitszeichen im Wert', function () {
|
|
$body = "status=OK\nfoo=bar=baz\n";
|
|
$response = new Response(200, ['Content-Type' => 'text/plain;charset=UTF-8'], $body);
|
|
|
|
$parsed = Payone::parseResponse($response);
|
|
|
|
expect($parsed['foo'])->toBe('bar=baz');
|
|
});
|
|
|
|
it('sendRequest liefert das geparste Array bei text/plain;charset=UTF-8', function () {
|
|
$mock = new MockHandler([
|
|
new Response(200, ['Content-Type' => 'text/plain;charset=UTF-8'], "status=APPROVED\ntxid=999\n"),
|
|
]);
|
|
$client = new Client(['handler' => HandlerStack::create($mock)]);
|
|
|
|
$result = Payone::sendRequest(['request' => 'authorization'], '', $client);
|
|
|
|
expect($result)->toBeArray()
|
|
->and($result['status'])->toBe('APPROVED')
|
|
->and($result['txid'])->toBe('999');
|
|
});
|
|
|
|
it('sendRequest wandelt Netzwerkfehler ohne HTTP-Antwort in PayoneTransportException (1002) um', function () {
|
|
Mail::fake();
|
|
|
|
$mockRequest = new Request('POST', Payone::PAYONE_SERVER_API_URL);
|
|
$mock = new MockHandler([
|
|
new ConnectException('cURL error 56: Recv failure: Connection reset by peer', $mockRequest),
|
|
]);
|
|
$client = new Client(['handler' => HandlerStack::create($mock)]);
|
|
|
|
$thrown = null;
|
|
try {
|
|
Payone::sendRequest(['request' => 'authorization'], '', $client);
|
|
} catch (PayoneTransportException $e) {
|
|
$thrown = $e;
|
|
}
|
|
|
|
expect($thrown)->toBeInstanceOf(PayoneTransportException::class)
|
|
->and($thrown->getMessage())->toContain('Fehlercode: 1002');
|
|
});
|
|
|
|
it('sendRequest wirft PayoneTransportException (1004) wenn die Antwort keinen Status enthält', function () {
|
|
Mail::fake();
|
|
|
|
$mock = new MockHandler([
|
|
new Response(200, ['Content-Type' => 'text/plain;charset=UTF-8'], "foo=bar\nbaz=qux\n"),
|
|
]);
|
|
$client = new Client(['handler' => HandlerStack::create($mock)]);
|
|
|
|
$thrown = null;
|
|
try {
|
|
Payone::sendRequest(['request' => 'authorization'], '', $client);
|
|
} catch (PayoneTransportException $e) {
|
|
$thrown = $e;
|
|
}
|
|
|
|
expect($thrown)->toBeInstanceOf(PayoneTransportException::class)
|
|
->and($thrown->getMessage())->toContain('Fehlercode: 1004');
|
|
});
|
|
|
|
it('exponiert die erwartete Post-Gateway-URL', function () {
|
|
expect(Payone::PAYONE_SERVER_API_URL)->toBe('https://api.pay1.de/post-gateway/');
|
|
});
|
|
|
|
/**
|
|
* Manuell auf dem Server ausführen, wenn TLS/Outbound geprüft werden soll:
|
|
* PAYONE_CONNECTIVITY_TEST=1 php artisan test --compact tests/Unit/Services/PayoneTest.php
|
|
*/
|
|
it('optional: Erreichbarkeit von api.pay1.de (TLS/Outbound)', function () {
|
|
if (! env('PAYONE_CONNECTIVITY_TEST')) {
|
|
$this->markTestSkipped('Setze PAYONE_CONNECTIVITY_TEST=1 für einen echten Netzwerk-Check.');
|
|
}
|
|
|
|
$client = new Client([
|
|
'timeout' => 15,
|
|
'connect_timeout' => 10,
|
|
'http_errors' => false,
|
|
]);
|
|
|
|
$response = $client->get('https://api.pay1.de/', [
|
|
'http_errors' => false,
|
|
]);
|
|
|
|
expect($response->getStatusCode())->toBeGreaterThanOrEqual(200)
|
|
->and($response->getStatusCode())->toBeLessThan(600);
|
|
})->group('payone-connectivity');
|