Kevin
ccc6f85809
Strangler-Refactoring der PAYONE-Zahlungslogik in eine testbare
Service-Schicht, ohne Verhalten in Checkout/Cron/IPN zu ändern.
Neue Services (app/Services/Payment/Payone):
- PayonePaymentService (+ PayonePaymentResult-DTO) für CC-/SEPA-Check
und Abo-Abbuchung
- PayoneRequestBuilder, PaymentMethodResolver, PayoneMethodConfig
- PayoneTransactionRecorder: zentrale PaymentTransaction-Erstellung
(API-Response, Invoice, Webhook) inkl. PCI-Redaction (cardpan/cardcvc2)
- PayoneWebhookHandler (+ PayoneWebhookResult): IPN/TSOK-Logik aus
Api\PayoneController; response('TSOK') statt echo/exit
- PayoneTransportException + Handler-Mapping (403) statt abort() im Service
Hotfixes (R1): var_dump/exit & bare exit() entfernt, Log-Redaction.
Security (R-Review):
- PAYONE_KEY_HASH (MD5-Hash, kein Klartext) mit Boot-Hard-Fail; schließt
zugleich die ''-Webhook-Bypass-Lücke. Artisan-Command payone:hash-key
(verdeckte Eingabe, optional --write) zur Hash-Erzeugung.
- Webhook: txaction Pflichtfeld, mode-Fallback auf payment->mode.
Pay\PayoneController ist @deprecated-Fassade (614 → 328 Zeilen),
delegiert an Services via Container-Singleton.
Migration: fehlende Spalte shopping_payments.carddata nachgezogen.
Tests: 47 grün (PayonePaymentService, Recorder, Webhook, Resolver,
TransportException, hash-key). End-to-End im Test-System verifiziert
(siehe dev/2026-06-09-payments).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
101 lines
3.4 KiB
PHP
101 lines
3.4 KiB
PHP
<?php
|
|
|
|
namespace App\Services\Payment\Payone;
|
|
|
|
use App\Models\PaymentTransaction;
|
|
use App\Models\ShoppingPayment;
|
|
use App\Services\Util;
|
|
|
|
class PayoneTransactionRecorder
|
|
{
|
|
/**
|
|
* PCI-sensitive keys that must never be persisted in transmitted_data.
|
|
*
|
|
* @var list<string>
|
|
*/
|
|
private const REDACTED_KEYS = ['cardpan', 'cardcvc2'];
|
|
|
|
/**
|
|
* Records a PaymentTransaction from a PAYONE API response (ERROR, REDIRECT, APPROVED, …).
|
|
*
|
|
* @param array<string, mixed> $response
|
|
*/
|
|
public static function recordFromResponse(
|
|
ShoppingPayment $payment,
|
|
string $requestType,
|
|
array $response,
|
|
int $useridFallback = 0,
|
|
): PaymentTransaction {
|
|
return PaymentTransaction::create([
|
|
'shopping_payment_id' => $payment->id,
|
|
'request' => $requestType,
|
|
'txid' => $response['txid'] ?? 0,
|
|
'userid' => $response['userid'] ?? $useridFallback,
|
|
'status' => $response['status'] ?? 'UNKNOWN',
|
|
'txaction' => $response['txaction'] ?? null,
|
|
'transmitted_data' => self::redactPayload($response),
|
|
'errorcode' => $response['errorcode'] ?? null,
|
|
'errormessage' => $response['errormessage'] ?? null,
|
|
'customermessage' => $response['customermessage'] ?? null,
|
|
'mode' => $payment->mode,
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Records a synthetic transaction for FNC/MIV invoice payments (no PAYONE API call made).
|
|
*
|
|
* @param array<string, mixed> $requestPayload
|
|
*/
|
|
public static function recordInvoicePayment(
|
|
ShoppingPayment $payment,
|
|
string $requestType,
|
|
array $requestPayload,
|
|
): PaymentTransaction {
|
|
return PaymentTransaction::create([
|
|
'shopping_payment_id' => $payment->id,
|
|
'request' => $requestType,
|
|
'txid' => 0,
|
|
'userid' => 0,
|
|
'status' => 'FNCMIV',
|
|
'transmitted_data' => self::redactPayload($requestPayload),
|
|
'txaction' => 'invoice_open',
|
|
'mode' => $payment->mode,
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Records a transaction for an incoming PAYONE IPN/TSOK webhook callback.
|
|
*
|
|
* @param array<string, mixed> $data Raw callback payload (\Request::all()).
|
|
*/
|
|
public static function recordWebhookCallback(
|
|
ShoppingPayment $payment,
|
|
array $data,
|
|
): PaymentTransaction {
|
|
return PaymentTransaction::create([
|
|
'shopping_payment_id' => $payment->id,
|
|
'request' => 'transaction',
|
|
'txid' => $data['txid'] ?? 0,
|
|
'userid' => $data['userid'] ?? 0,
|
|
'status' => 'PAYONE',
|
|
'key' => $data['key'] ?? null,
|
|
'txaction' => $data['txaction'] ?? null,
|
|
'transmitted_data' => self::redactPayload(Util::utf8ize($data)),
|
|
'mode' => $data['mode'] ?? $payment->mode,
|
|
'errorcode' => $data['errorcode'] ?? null,
|
|
'errormessage' => $data['errormessage'] ?? null,
|
|
'customermessage' => $data['customermessage'] ?? null,
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Strips PCI-sensitive fields before persisting a payload.
|
|
*
|
|
* @param array<string, mixed> $payload
|
|
* @return array<string, mixed>
|
|
*/
|
|
private static function redactPayload(array $payload): array
|
|
{
|
|
return array_diff_key($payload, array_flip(self::REDACTED_KEYS));
|
|
}
|
|
}
|