 }})
+
+ {% if has_saved_cards %}
$routeUrls route name => URL to return
+ * @param array $throwForRoutes route names that should throw instead
+ */
+ private function stubRouterGenerate(array $routeUrls, array $throwForRoutes = []): void
+ {
+ $this->router->method('generate')->willReturnCallback(
+ function (string $route) use ($routeUrls, $throwForRoutes): string {
+ if (\in_array($route, $throwForRoutes, true)) {
+ throw new \RuntimeException('router exploded for route ' . $route);
+ }
+
+ return $routeUrls[$route] ?? '/admin/payment-methods';
+ },
+ );
+ }
+
+ // -------------------------------------------------------------------------
+ // setupRedirection() — happy path
+ // -------------------------------------------------------------------------
+
+ public function testSetupRedirection_buildsAuthorizationUrlAndStoresPkceStateInSession(): void
+ {
+ $this->stubRouterGenerate(['payplug_sylius_admin_auth_oauth_callback' => 'https://shop.example.com/payplug/auth/oauth-callback']);
+
+ $request = $this->buildRequest(['client_id' => 'client_abc', 'company_id' => 'company_xyz']);
+
+ $response = $this->controller->setupRedirection($request);
+
+ self::assertInstanceOf(RedirectResponse::class, $response);
+ self::assertStringStartsWith('https://api-qa.payplug.com/oauth2/auth?', $response->getTargetUrl());
+ self::assertStringContainsString('client_id=client_abc', $response->getTargetUrl());
+ self::assertStringContainsString('audience=' . urlencode('https://www.payplug.com'), $response->getTargetUrl());
+
+ $session = $request->getSession();
+ self::assertSame('client_abc', $session->get('payplug_client_id'));
+ self::assertSame('company_xyz', $session->get('payplug_company_id'));
+ self::assertNotNull($session->get('payplug_oauth_state'));
+ self::assertNotNull($session->get('payplug_oauth_code_verifier'));
+ }
+
+ // -------------------------------------------------------------------------
+ // setupRedirection() — failure redirects to payment method index (no id in session yet)
+ // -------------------------------------------------------------------------
+
+ public function testSetupRedirection_onFailure_logsAndRedirectsToPaymentMethodIndex(): void
+ {
+ $this->stubRouterGenerate(
+ ['sylius_admin_payment_method_index' => '/admin/payment-methods'],
+ throwForRoutes: ['payplug_sylius_admin_auth_oauth_callback'],
+ );
+
+ $this->logger->expects(self::once())->method('critical')
+ ->with('Error while perform Payplug OAuth Setup redirection', self::anything())
+ ;
+
+ $request = $this->buildRequest(['client_id' => 'client_abc']);
+
+ $response = $this->controller->setupRedirection($request);
+
+ self::assertInstanceOf(RedirectResponse::class, $response);
+ self::assertSame('payplug_sylius_payplug_plugin.admin.oauth_setup_error', $request->getSession()->getFlashBag()->peek('error')[0] ?? null);
+ }
+
+ // -------------------------------------------------------------------------
+ // oauthCallback() — state mismatch is rejected before any token exchange
+ // -------------------------------------------------------------------------
+
+ public function testOauthCallback_withMismatchedState_rejectsBeforeExchangingToken(): void
+ {
+ $this->stubRouterGenerate([]);
+ $this->oauthHttpClient->expects(self::never())->method('post');
+ $this->logger->expects(self::once())->method('critical')
+ ->with('Error while perform Payplug OAuth callback', self::anything())
+ ;
+
+ $request = $this->buildRequest(['code' => 'auth_code', 'state' => 'attacker-state']);
+ $request->getSession()->set('payplug_oauth_state', 'real-state');
+
+ $response = $this->controller->oauthCallback($request);
+
+ self::assertInstanceOf(RedirectResponse::class, $response);
+ }
+
+ public function testOauthCallback_withNoStateInSession_rejectsBeforeExchangingToken(): void
+ {
+ $this->stubRouterGenerate([]);
+ // Session never went through setupRedirection() (e.g. expired) — no expected state at all.
+ $this->oauthHttpClient->expects(self::never())->method('post');
+
+ $request = $this->buildRequest(['code' => 'auth_code', 'state' => 'some-state']);
+
+ $response = $this->controller->oauthCallback($request);
+
+ self::assertInstanceOf(RedirectResponse::class, $response);
+ }
+
+ public function testOauthCallback_withEmptyState_rejectsBeforeExchangingToken(): void
+ {
+ $this->stubRouterGenerate([]);
+ $this->oauthHttpClient->expects(self::never())->method('post');
+
+ $request = $this->buildRequest(['code' => 'auth_code']); // no "state" query param at all
+ $request->getSession()->set('payplug_oauth_state', '');
+
+ $response = $this->controller->oauthCallback($request);
+
+ self::assertInstanceOf(RedirectResponse::class, $response);
+ }
+
+ // -------------------------------------------------------------------------
+ // oauthCallback() — valid state, but no client id in session
+ // -------------------------------------------------------------------------
+
+ /**
+ * A missing/non-string client_id (e.g. session expired, or setupRedirection() was never hit)
+ * must be rejected before exchangeAuthorizationCode() is called, the same way a state mismatch
+ * already is — otherwise it falls through to a TypeError, logged as a noisy "critical" for
+ * what's really just an expired session.
+ */
+ public function testOauthCallback_withMissingClientId_rejectsBeforeExchangingToken(): void
+ {
+ $this->stubRouterGenerate([]);
+ $this->oauthHttpClient->expects(self::never())->method('post');
+
+ $request = $this->buildRequest(['code' => 'auth_code', 'state' => 'matching-state']);
+ $request->getSession()->set('payplug_oauth_state', 'matching-state');
+ $request->getSession()->set('payplug_oauth_code_verifier', 'verifier_123');
+ // Deliberately no 'payplug_client_id' set.
+
+ $response = $this->controller->oauthCallback($request);
+
+ self::assertInstanceOf(RedirectResponse::class, $response);
+ }
+
+ // -------------------------------------------------------------------------
+ // oauthCallback() — valid state, but no code verifier in session
+ // -------------------------------------------------------------------------
+
+ /**
+ * A missing/non-string code_verifier (e.g. session expired, or setupRedirection() was never
+ * hit) must be rejected before exchangeAuthorizationCode() is called, the same way a state
+ * mismatch already is — otherwise it falls through to a TypeError, logged as a noisy
+ * "critical" for what's really just an expired session.
+ */
+ public function testOauthCallback_withMissingCodeVerifier_rejectsBeforeExchangingToken(): void
+ {
+ $this->stubRouterGenerate([]);
+ $this->oauthHttpClient->expects(self::never())->method('post');
+
+ $request = $this->buildRequest(['code' => 'auth_code', 'state' => 'matching-state']);
+ $request->getSession()->set('payplug_oauth_state', 'matching-state');
+ // Deliberately no 'payplug_oauth_code_verifier' set.
+
+ $response = $this->controller->oauthCallback($request);
+
+ self::assertInstanceOf(RedirectResponse::class, $response);
+ }
+
+ // -------------------------------------------------------------------------
+ // oauthCallback() — valid state, but no payment method id in session
+ // -------------------------------------------------------------------------
+
+ public function testOauthCallback_withValidStateButNoPaymentMethodIdInSession_stopsAfterTokenExchange(): void
+ {
+ $this->stubRouterGenerate(['payplug_sylius_admin_auth_oauth_callback' => 'https://shop.example.com/payplug/auth/oauth-callback']);
+
+ $this->oauthHttpClient->expects(self::once())->method('post')->willReturn([
+ 'status' => 200,
+ 'body' => json_encode(['access_token' => 'jwt', 'expires_in' => 3600, 'token_type' => 'Bearer']),
+ ]);
+
+ // Never reached: the "no payment method id" guard throws first.
+ $this->paymentMethodRepository->expects(self::never())->method('find');
+
+ $request = $this->buildRequest(['code' => 'auth_code', 'state' => 'matching-state']);
+ $request->getSession()->set('payplug_client_id', 'client_abc');
+ $request->getSession()->set('payplug_oauth_state', 'matching-state');
+ $request->getSession()->set('payplug_oauth_code_verifier', 'verifier_123');
+ // Deliberately no 'payplug_sylius_oauth_payment_method_id' set.
+
+ $response = $this->controller->oauthCallback($request);
+
+ self::assertInstanceOf(RedirectResponse::class, $response);
+ self::assertSame('payplug_sylius_payplug_plugin.admin.oauth_setup_error', $request->getSession()->getFlashBag()->peek('error')[0] ?? null);
+ }
+
+ // -------------------------------------------------------------------------
+ // oauthCallback() — the connected account's email (PRE-3631)
+ // -------------------------------------------------------------------------
+
+ /**
+ * Builds a JWT-shaped id token carrying the given claims. The signature segment is a
+ * placeholder — the controller reads the payload for display and never verifies it.
+ *
+ * @param array $claims
+ */
+ private function idTokenWithClaims(array $claims): string
+ {
+ $encode = static fn (string $raw): string => rtrim(strtr(base64_encode($raw), '+/', '-_'), '=');
+
+ return $encode('{"alg":"RS256"}') . '.' . $encode((string) json_encode($claims)) . '.c2ln';
+ }
+
+ /**
+ * Drives oauthCallback() all the way through a successful login and returns the gateway config
+ * as it stands afterwards. $tokenResponse is the identity provider's token-endpoint payload.
+ *
+ * @param array $tokenResponse
+ * @param array $initialConfig gateway config as it stands before the login
+ *
+ * @return array
+ */
+ private function runSuccessfulCallback(array $tokenResponse, array $initialConfig = []): array
+ {
+ $this->stubRouterGenerate([
+ 'payplug_sylius_admin_auth_oauth_callback' => 'https://shop.example.com/payplug/auth/oauth-callback',
+ 'sylius_admin_payment_method_update' => '/admin/payment-methods/1/edit',
+ ]);
+
+ $this->oauthHttpClient->method('post')->willReturn([
+ 'status' => 200,
+ 'body' => json_encode($tokenResponse),
+ ]);
+
+ // Answers both createClientIdAndSecret() calls (test then live) without touching the network.
+ HttpClient::$REQUEST_HANDLER = new FakePayplugHttpRequest([
+ json_encode(['client_id' => 'generated_client', 'client_secret' => 'generated_secret']),
+ ]);
+
+ $storedConfig = $initialConfig;
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getFactoryName')->willReturn(PayPlugGatewayFactory::FACTORY_NAME);
+ $gatewayConfig->method('getConfig')->willReturnCallback(static fn (): array => $storedConfig);
+ $gatewayConfig->method('setConfig')->willReturnCallback(
+ static function (array $config) use (&$storedConfig): void {
+ $storedConfig = $config;
+ },
+ );
+
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $paymentMethod->method('getGatewayConfig')->willReturn($gatewayConfig);
+ $paymentMethod->method('getName')->willReturn('Carte bancaire');
+ $paymentMethod->method('getId')->willReturn(1);
+
+ $this->paymentMethodRepository->method('find')->willReturn($paymentMethod);
+ $this->validator->method('validate')->willReturn(new ConstraintViolationList());
+
+ $request = $this->buildRequest(['code' => 'auth_code', 'state' => 'matching-state']);
+ $session = $request->getSession();
+ $session->set('payplug_client_id', 'client_abc');
+ $session->set('payplug_company_id', 'company_xyz');
+ $session->set('payplug_oauth_state', 'matching-state');
+ $session->set('payplug_oauth_code_verifier', 'verifier_123');
+ $session->set('payplug_sylius_oauth_payment_method_id', 1);
+
+ $this->logger->expects(self::never())->method('critical');
+
+ $this->controller->oauthCallback($request);
+
+ return $storedConfig;
+ }
+
+ /**
+ * The `/account` endpoint carries no email — the id_token from this exchange is the only place
+ * the connected merchant's address appears, and it is gone once the callback returns, so it has
+ * to be persisted here for the admin screen to have anything to show.
+ */
+ public function testOauthCallback_storesTheEmailFromTheIdTokenOnTheGatewayConfig(): void
+ {
+ $config = $this->runSuccessfulCallback([
+ 'access_token' => 'jwt',
+ 'expires_in' => 3600,
+ 'token_type' => 'Bearer',
+ 'id_token' => $this->idTokenWithClaims(['email' => 'merchant@example.com']),
+ ]);
+
+ self::assertSame('merchant@example.com', $config['account_email'] ?? null);
+ }
+
+ /**
+ * The credentials are what the login exists to produce; the email is a display nicety captured
+ * alongside them. An identity provider that returns no id_token must therefore still yield a
+ * fully configured gateway.
+ */
+ public function testOauthCallback_withoutAnIdToken_stillStoresTheClientCredentials(): void
+ {
+ $config = $this->runSuccessfulCallback([
+ 'access_token' => 'jwt',
+ 'expires_in' => 3600,
+ 'token_type' => 'Bearer',
+ ]);
+
+ self::assertNull($config['account_email'] ?? null);
+ self::assertSame('generated_client', $config['live_client']['client_id'] ?? null);
+ self::assertSame('generated_client', $config['test_client']['client_id'] ?? null);
+ }
+
+ /**
+ * Re-authenticating against a different PayPlug account must not leave the previous account's
+ * address on screen — a stale email here would misreport which account takes the money.
+ */
+ public function testOauthCallback_overwritesAPreviouslyStoredEmail(): void
+ {
+ $config = $this->runSuccessfulCallback(
+ [
+ 'access_token' => 'jwt',
+ 'expires_in' => 3600,
+ 'token_type' => 'Bearer',
+ 'id_token' => $this->idTokenWithClaims(['email' => 'new-owner@example.com']),
+ ],
+ ['account_email' => 'previous-owner@example.com'],
+ );
+
+ self::assertSame('new-owner@example.com', $config['account_email'] ?? null);
+ }
+}
diff --git a/tests/PHPUnit/Action/Admin/Auth/UnifiedLogoutControllerTest.php b/tests/PHPUnit/Action/Admin/Auth/UnifiedLogoutControllerTest.php
new file mode 100644
index 00000000..8da4c54d
--- /dev/null
+++ b/tests/PHPUnit/Action/Admin/Auth/UnifiedLogoutControllerTest.php
@@ -0,0 +1,246 @@
+ would be invalid HTML — so the CSRF check is the only thing standing
+ * between a crafted link and a merchant losing a connection. Several tests below exist purely to
+ * pin that: a request that fails the check must mutate nothing at all.
+ */
+final class UnifiedLogoutControllerTest extends TestCase
+{
+ private const VALID_TOKEN = 'a-valid-csrf-token';
+
+ private RouterInterface&MockObject $router;
+
+ private RepositoryInterface&MockObject $paymentMethodRepository;
+
+ private LoggerInterface&MockObject $logger;
+
+ private SyliusTokenCache $tokenCache;
+
+ private UnifiedLogoutController $controller;
+
+ protected function setUp(): void
+ {
+ $this->router = $this->createMock(RouterInterface::class);
+ $this->paymentMethodRepository = $this->createMock(RepositoryInterface::class);
+ $this->logger = $this->createMock(LoggerInterface::class);
+ $this->tokenCache = new SyliusTokenCache(new ArrayAdapter());
+
+ $this->router->method('generate')->willReturnCallback(
+ static fn (string $route, array $parameters = []): string => '/admin/route/' . $route . '/' . ($parameters['id'] ?? ''),
+ );
+
+ $csrfTokenManager = $this->createMock(CsrfTokenManagerInterface::class);
+ $csrfTokenManager->method('isTokenValid')->willReturnCallback(
+ static fn (CsrfToken $token): bool => self::VALID_TOKEN === $token->getValue(),
+ );
+
+ $this->controller = new UnifiedLogoutController(
+ $this->router,
+ $this->paymentMethodRepository,
+ new GatewayConnectionRevoker($this->createMock(EntityManagerInterface::class), $this->tokenCache),
+ $csrfTokenManager,
+ $this->logger,
+ );
+ }
+
+ public function testLogout_clearsTheConnectionOfTheTargetedGatewayConfig(): void
+ {
+ $paymentMethod = $this->connectedPaymentMethod();
+ $this->paymentMethodRepository->method('find')->with(42)->willReturn($paymentMethod);
+
+ $this->controller->logout($this->buildRequest(self::VALID_TOKEN), 42);
+
+ $config = $paymentMethod->getGatewayConfig()?->getConfig() ?? [];
+ self::assertArrayNotHasKey('live_client', $config);
+ self::assertArrayNotHasKey('test_client', $config);
+ self::assertArrayNotHasKey('account_email', $config);
+ self::assertFalse($paymentMethod->isEnabled());
+ }
+
+ public function testLogout_redirectsBackToThePaymentMethodUpdateScreenWithASuccessFlash(): void
+ {
+ $this->paymentMethodRepository->method('find')->willReturn($this->connectedPaymentMethod());
+ $request = $this->buildRequest(self::VALID_TOKEN);
+
+ $response = $this->controller->logout($request, 42);
+
+ self::assertInstanceOf(RedirectResponse::class, $response);
+ self::assertSame('/admin/route/sylius_admin_payment_method_update/42', $response->getTargetUrl());
+ self::assertSame(
+ 'payplug_sylius_payplug_plugin.admin.logout_success',
+ $request->getSession()->getFlashBag()->peek('success')[0] ?? null,
+ );
+ }
+
+ public function testLogout_invalidCsrfToken_isRejectedAndChangesNothing(): void
+ {
+ $paymentMethod = $this->connectedPaymentMethod();
+ $this->paymentMethodRepository->method('find')->willReturn($paymentMethod);
+
+ try {
+ $this->controller->logout($this->buildRequest('forged-token'), 42);
+ self::fail('Expected a BadRequestHttpException for an invalid CSRF token.');
+ } catch (BadRequestHttpException) {
+ // expected
+ }
+
+ self::assertArrayHasKey('live_client', $paymentMethod->getGatewayConfig()?->getConfig() ?? []);
+ self::assertTrue($paymentMethod->isEnabled());
+ }
+
+ public function testLogout_missingCsrfToken_isRejected(): void
+ {
+ $this->paymentMethodRepository->method('find')->willReturn($this->connectedPaymentMethod());
+
+ $this->expectException(BadRequestHttpException::class);
+
+ $this->controller->logout($this->buildRequest(null), 42);
+ }
+
+ /**
+ * `security.csrf.token_manager` only exists while CSRF protection is enabled, so the dependency
+ * is optional and the check is skipped when it is absent — the same posture as Sylius's own
+ * token-in-the-query-string admin actions, which guard every check with
+ * sylius_csrf_protection_enabled(). An app that turns CSRF off has made that call for itself;
+ * the button must still work there rather than 400 on every click.
+ */
+ public function testLogout_whenCsrfProtectionIsDisabled_proceedsWithoutAToken(): void
+ {
+ $paymentMethod = $this->connectedPaymentMethod();
+ $this->paymentMethodRepository->method('find')->willReturn($paymentMethod);
+
+ $controller = new UnifiedLogoutController(
+ $this->router,
+ $this->paymentMethodRepository,
+ new GatewayConnectionRevoker($this->createMock(EntityManagerInterface::class), $this->tokenCache),
+ null,
+ $this->logger,
+ );
+
+ $controller->logout($this->buildRequest(null), 42);
+
+ self::assertArrayNotHasKey('live_client', $paymentMethod->getGatewayConfig()?->getConfig() ?? []);
+ self::assertFalse($paymentMethod->isEnabled());
+ }
+
+ public function testLogout_unknownPaymentMethod_isNotFound(): void
+ {
+ $this->paymentMethodRepository->method('find')->willReturn(null);
+
+ $this->expectException(NotFoundHttpException::class);
+
+ $this->controller->logout($this->buildRequest(self::VALID_TOKEN), 42);
+ }
+
+ public function testLogout_paymentMethodOfAnotherProvider_isNotFound(): void
+ {
+ $this->paymentMethodRepository->method('find')->willReturn($this->connectedPaymentMethod('stripe'));
+
+ $this->expectException(NotFoundHttpException::class);
+
+ $this->controller->logout($this->buildRequest(self::VALID_TOKEN), 42);
+ }
+
+ public function testLogout_whenRevokingFails_logsAndRedirectsWithAnErrorFlash(): void
+ {
+ $paymentMethod = new PaymentMethod();
+ $paymentMethod->setGatewayConfig($this->gatewayConfig(PayPlugGatewayFactory::FACTORY_NAME));
+ $this->paymentMethodRepository->method('find')->willReturn($paymentMethod);
+
+ $this->logger->expects(self::once())->method('critical')
+ ->with('Error while logging out the Payplug gateway', self::anything())
+ ;
+
+ $request = $this->buildRequest(self::VALID_TOKEN);
+ $response = $this->controllerWithFailingRevoker()->logout($request, 42);
+
+ self::assertInstanceOf(RedirectResponse::class, $response);
+ self::assertSame(
+ 'payplug_sylius_payplug_plugin.admin.logout_error',
+ $request->getSession()->getFlashBag()->peek('error')[0] ?? null,
+ );
+ }
+
+ /**
+ * GatewayConnectionRevoker is `final` and cannot be mocked, so the failure is injected one
+ * level down: a real revoker over an entity manager whose flush() throws, which is what a
+ * database error during logout actually looks like.
+ */
+ private function controllerWithFailingRevoker(): UnifiedLogoutController
+ {
+ $entityManager = $this->createMock(EntityManagerInterface::class);
+ $entityManager->method('flush')->willThrowException(new \RuntimeException('database exploded'));
+
+ $csrfTokenManager = $this->createMock(CsrfTokenManagerInterface::class);
+ $csrfTokenManager->method('isTokenValid')->willReturn(true);
+
+ return new UnifiedLogoutController(
+ $this->router,
+ $this->paymentMethodRepository,
+ new GatewayConnectionRevoker($entityManager, $this->tokenCache),
+ $csrfTokenManager,
+ $this->logger,
+ );
+ }
+
+ private function buildRequest(?string $csrfToken): Request
+ {
+ $request = new Request(null === $csrfToken ? [] : ['_csrf_token' => $csrfToken]);
+ $request->setSession(new Session(new MockArraySessionStorage()));
+
+ return $request;
+ }
+
+ private function connectedPaymentMethod(
+ string $factoryName = PayPlugGatewayFactory::FACTORY_NAME,
+ ): PaymentMethodInterface
+ {
+ $paymentMethod = new PaymentMethod();
+ $paymentMethod->setGatewayConfig($this->gatewayConfig($factoryName));
+ $paymentMethod->enable();
+
+ return $paymentMethod;
+ }
+
+ private function gatewayConfig(string $factoryName): GatewayConfig
+ {
+ $gatewayConfig = new GatewayConfig();
+ $gatewayConfig->setFactoryName($factoryName);
+ $gatewayConfig->setConfig([
+ 'live_client' => ['client_id' => 'client_live', 'client_secret' => 'secret_live'],
+ 'test_client' => ['client_id' => 'client_test', 'client_secret' => 'secret_test'],
+ 'account_email' => 'merchant@example.com',
+ ]);
+
+ return $gatewayConfig;
+ }
+}
diff --git a/tests/PHPUnit/Action/Admin/AuthorizedPaymentControllerTest.php b/tests/PHPUnit/Action/Admin/AuthorizedPaymentControllerTest.php
new file mode 100644
index 00000000..88e789f8
--- /dev/null
+++ b/tests/PHPUnit/Action/Admin/AuthorizedPaymentControllerTest.php
@@ -0,0 +1,429 @@
+operator = $this->createMock(AuthorizationOperatorInterface::class);
+ $this->paymentRepository = $this->createMock(PaymentRepositoryInterface::class);
+ $this->entityManager = $this->createMock(EntityManagerInterface::class);
+ $this->authorizationChecker = $this->createMock(AuthorizationCheckerInterface::class);
+ $this->authorizationChecker->method('isGranted')->with('ROLE_ADMINISTRATION_ACCESS')->willReturn(true);
+ $this->logger = $this->createMock(LoggerInterface::class);
+
+ $lock = $this->createMock(ILock::class);
+ $lock->method('acquire')->willReturn(true);
+ $stateMachine = $this->createMock(StateMachineInterface::class);
+ $stateMachine->method('can')->willReturn(true);
+
+ $router = $this->createMock(RouterInterface::class);
+ $router->method('generate')->willReturnCallback(
+ static fn (string $route, array $parameters = []): string => '/admin/' . $route . '/' . ($parameters['id'] ?? ''),
+ );
+
+ $csrfTokenManager = $this->createMock(CsrfTokenManagerInterface::class);
+ $csrfTokenManager->method('isTokenValid')->willReturnCallback(
+ static fn (CsrfToken $token): bool => 'payplug_authorization_42' === $token->getId() && self::VALID_TOKEN === $token->getValue(),
+ );
+
+ $this->controller = new AuthorizedPaymentController(
+ $this->paymentRepository,
+ new AuthorizedPaymentOperationProcessor(
+ $this->operator,
+ $lock,
+ $this->entityManager,
+ $stateMachine,
+ new MockClock('2026-09-24T10:00:00+00:00'),
+ $this->createMock(LoggerInterface::class),
+ ),
+ $router,
+ $this->authorizationChecker,
+ $csrfTokenManager,
+ $this->logger,
+ );
+ }
+
+ /**
+ * @return iterable
+ */
+ public static function amounts(): iterable
+ {
+ yield 'blank means the whole remainder' => ['', null];
+ yield 'integer' => ['12', 1200];
+ yield 'dot decimal' => ['12.5', 1250];
+ yield 'comma decimal' => ['12,50', 1250];
+ yield 'thousands space' => ['1 234,56', 123456];
+ yield 'too many decimals is refused downstream' => ['12.345', 0];
+ yield 'negative is refused downstream' => ['-5', 0];
+ yield 'garbage is refused downstream' => ['abc', 0];
+ yield 'nine digits is the ceiling' => ['999999999', 99999999900];
+ yield 'ten digits is refused downstream' => ['1234567890', 0];
+ yield 'an overflowing amount is refused, not a TypeError' => ['99999999999999999999', 0];
+ }
+
+ /**
+ * @dataProvider amounts
+ */
+ public function testParseAmount(string $raw, ?int $expected): void
+ {
+ self::assertSame($expected, AuthorizedPaymentController::parseAmount($raw, 'EUR'));
+ }
+
+ public function testParseAmount_isTheSameForAnyTwoDecimalCurrencyWhateverItsCase(): void
+ {
+ self::assertSame(1250, AuthorizedPaymentController::parseAmount('12,50', 'USD'));
+ self::assertSame(1250, AuthorizedPaymentController::parseAmount('12,50', 'eur'));
+ }
+
+ /**
+ * @return iterable
+ */
+ public static function unsupportedCurrencies(): iterable
+ {
+ yield 'zero-decimal currency' => ['JPY'];
+ yield 'another zero-decimal currency' => ['XPF'];
+ yield 'three-decimal currency' => ['KWD'];
+ yield 'empty currency' => [''];
+ yield 'malformed currency' => ['EU'];
+ yield 'currency with a digit' => ['E1R'];
+ }
+
+ /**
+ * @dataProvider unsupportedCurrencies
+ */
+ public function testParseAmount_ofATypedAmountInAnUnsupportedCurrency_isRefused(string $currency): void
+ {
+ try {
+ AuthorizedPaymentController::parseAmount('12.50', $currency);
+ self::fail('Expected the amount to be refused.');
+ } catch (AuthorizationOperationException $exception) {
+ self::assertSame('payplug_sylius_payplug_plugin.admin.authorization.error.unsupported_currency', $exception->getTranslationKey());
+ self::assertSame(['%currency%' => $currency], $exception->getTranslationParameters());
+ }
+ }
+
+ /**
+ * @dataProvider unsupportedCurrencies
+ */
+ public function testParseAmount_ofABlankAmountInAnUnsupportedCurrency_stillMeansTheWholeRemainder(
+ string $currency,
+ ): void
+ {
+ self::assertNull(AuthorizedPaymentController::parseAmount(" \u{00A0}", $currency));
+ }
+
+ public function testParseAmount_ofGarbageInAnUnsupportedCurrency_isStillAnInvalidAmount(): void
+ {
+ self::assertSame(0, AuthorizedPaymentController::parseAmount('abc', 'JPY'));
+ }
+
+ /**
+ * @return iterable
+ */
+ public static function typedAmountsInUnsupportedCurrencies(): iterable
+ {
+ yield 'capture in a zero-decimal currency' => ['capture', 'JPY'];
+ yield 'cancel in a three-decimal currency' => ['cancel', 'KWD'];
+ yield 'capture without a currency' => ['capture', ''];
+ yield 'cancel with a malformed currency' => ['cancel', 'EU'];
+ }
+
+ /**
+ * @dataProvider typedAmountsInUnsupportedCurrencies
+ */
+ public function testATypedAmountInAnUnsupportedCurrency_isRefusedBeforeUpcAndRecordsNothing(
+ string $action,
+ string $currency,
+ ): void
+ {
+ $payment = $this->authorizedPayment($currency);
+ $detailsBefore = $payment->getDetails();
+ $this->paymentRepository->method('find')->willReturn($payment);
+ $this->operator->expects(self::never())->method('capture');
+ $this->operator->expects(self::never())->method('cancel');
+ $this->entityManager->expects(self::never())->method('flush');
+ $this->logger->expects(self::once())->method('warning')->with(
+ self::stringContains('currency'),
+ ['sylius_payment_id' => 42, 'action' => $action, 'currency' => $currency],
+ );
+
+ $request = $this->request(['amount' => '5']);
+ $response = 'capture' === $action ? $this->controller->capture($request, 7, 42) : $this->controller->cancel($request, 7, 42);
+
+ self::assertSame('/admin/sylius_admin_order_show/7', $response->headers->get('Location'));
+ self::assertSame([[
+ 'message' => 'payplug_sylius_payplug_plugin.admin.authorization.error.unsupported_currency',
+ 'parameters' => ['%currency%' => $currency],
+ ]], $this->flashes($request, 'error'));
+ self::assertSame($detailsBefore, $payment->getDetails());
+ self::assertSame(PaymentInterface::STATE_AUTHORIZED, $payment->getState());
+ }
+
+ public function testCapture_ofTheWholeRemainderInAZeroDecimalCurrency_isSentAsBefore(): void
+ {
+ $this->paymentRepository->method('find')->willReturn($this->authorizedPayment('JPY'));
+ $this->operator->expects(self::once())->method('capture')
+ ->with(self::anything(), 'pay_1', self::anything(), 1000, 'JPY')
+ ->willReturn(new CaptureOutput(200, '{"operationIds":["op_c1"]}', null, null, null));
+ $this->logger->expects(self::never())->method('warning');
+
+ $request = $this->request(['amount' => '']);
+ $this->controller->capture($request, 7, 42);
+
+ self::assertSame(['payplug_sylius_payplug_plugin.admin.authorization.capture_success'], $this->flashes($request, 'success'));
+ }
+
+ public function testCapture_aboveTheRemainderInUsd_showsTheRemainingAmountInUsd(): void
+ {
+ $this->paymentRepository->method('find')->willReturn($this->authorizedPayment('USD'));
+
+ $request = $this->request(['amount' => '50']);
+ $this->controller->capture($request, 7, 42);
+
+ self::assertSame([[
+ 'message' => 'payplug_sylius_payplug_plugin.admin.authorization.error.amount_exceeds_remaining',
+ 'parameters' => ['%remaining%' => '10.00 USD'],
+ ]], $this->flashes($request, 'error'));
+ }
+
+ public function testCapture_capturesTheTypedAmountFlushesAndRedirectsToTheOrder(): void
+ {
+ $payment = $this->authorizedPayment();
+ $this->paymentRepository->method('find')->with(42)->willReturn($payment);
+ $this->operator->expects(self::once())->method('capture')
+ ->with(self::anything(), 'pay_1', self::anything(), 250)
+ ->willReturn(new CaptureOutput(200, '{"operationIds":["op_c1"]}', null, null, null));
+ $this->entityManager->expects(self::once())->method('flush');
+
+ $request = $this->request(['amount' => '2,50', 'version' => '0']);
+ $response = $this->controller->capture($request, 7, 42);
+
+ self::assertSame('/admin/sylius_admin_order_show/7', $response->headers->get('Location'));
+ self::assertSame(['payplug_sylius_payplug_plugin.admin.authorization.capture_success'], $this->flashes($request, 'success'));
+ self::assertSame(250, AuthorizationDetails::fromDetails($payment->getDetails())->capturedAmount());
+ }
+
+ public function testCapture_refusedByUpc_showsTheReasonAndFlushesNothing(): void
+ {
+ $this->paymentRepository->method('find')->willReturn($this->authorizedPayment());
+ $this->operator->method('capture')->willThrowException(new AuthorizationExpiredException('expired'));
+ $this->entityManager->expects(self::never())->method('flush');
+
+ $request = $this->request(['amount' => '']);
+ $this->controller->capture($request, 7, 42);
+
+ self::assertSame(['payplug_sylius_payplug_plugin.admin.authorization.error.expired'], $this->flashes($request, 'error'));
+ }
+
+ public function testCapture_aboveTheRemainder_showsTheRemainingAmount(): void
+ {
+ $this->paymentRepository->method('find')->willReturn($this->authorizedPayment());
+
+ $request = $this->request(['amount' => '50']);
+ $this->controller->capture($request, 7, 42);
+
+ self::assertSame([[
+ 'message' => 'payplug_sylius_payplug_plugin.admin.authorization.error.amount_exceeds_remaining',
+ 'parameters' => ['%remaining%' => '10.00 EUR'],
+ ]], $this->flashes($request, 'error'));
+ }
+
+ public function testCapture_withAnInvalidCsrfToken_movesNoMoney(): void
+ {
+ $this->operator->expects(self::never())->method('capture');
+
+ $this->expectException(BadRequestHttpException::class);
+
+ $this->controller->capture($this->request(['amount' => ''], 'forged'), 7, 42);
+ }
+
+ public function testCapture_withoutAdminRole_movesNoMoney(): void
+ {
+ $authorizationChecker = $this->createMock(AuthorizationCheckerInterface::class);
+ $authorizationChecker->method('isGranted')->willReturn(false);
+ $controller = new AuthorizedPaymentController(
+ $this->paymentRepository,
+ new AuthorizedPaymentOperationProcessor($this->operator, $this->createMock(ILock::class), $this->entityManager, $this->createMock(StateMachineInterface::class), new MockClock(), $this->createMock(LoggerInterface::class)),
+ $this->createMock(RouterInterface::class),
+ $authorizationChecker,
+ null,
+ $this->createMock(LoggerInterface::class),
+ );
+ $this->operator->expects(self::never())->method('capture');
+
+ $this->expectException(AccessDeniedHttpException::class);
+
+ $controller->capture($this->request(['amount' => '']), 7, 42);
+ }
+
+ public function testCapture_ofAPaymentFromAnotherOrder_is404(): void
+ {
+ $this->paymentRepository->method('find')->willReturn($this->authorizedPayment());
+ $this->operator->expects(self::never())->method('capture');
+
+ $this->expectException(NotFoundHttpException::class);
+
+ $this->controller->capture($this->request(['amount' => '']), 8, 42);
+ }
+
+ public function testCapture_withoutAVersion_isABadRequestAndMovesNoMoney(): void
+ {
+ $this->paymentRepository->method('find')->willReturn($this->authorizedPayment());
+ $this->operator->expects(self::never())->method('capture');
+
+ $this->expectException(BadRequestHttpException::class);
+
+ $this->controller->capture($this->request(['amount' => ''], self::VALID_TOKEN, false), 7, 42);
+ }
+
+ public function testCancel_withANonNumericVersion_isABadRequestAndMovesNoMoney(): void
+ {
+ $this->paymentRepository->method('find')->willReturn($this->authorizedPayment());
+ $this->operator->expects(self::never())->method('cancel');
+
+ $this->expectException(BadRequestHttpException::class);
+
+ $this->controller->cancel($this->request(['amount' => '', 'version' => 'abc']), 7, 42);
+ }
+
+ public function testCapture_withAnOverflowingAmount_isRefusedAsInvalidWithoutCallingUpc(): void
+ {
+ $this->paymentRepository->method('find')->willReturn($this->authorizedPayment());
+ $this->operator->expects(self::never())->method('capture');
+
+ $request = $this->request(['amount' => '99999999999999999999', 'version' => '0']);
+ $this->controller->capture($request, 7, 42);
+
+ self::assertSame(['payplug_sylius_payplug_plugin.admin.authorization.error.invalid_amount'], $this->flashes($request, 'error'));
+ }
+
+ public function testCapture_whenTheFlushFailsAfterUpcAccepted_tellsTheMerchantToCheckBeforeRetrying(): void
+ {
+ $this->paymentRepository->method('find')->willReturn($this->authorizedPayment());
+ $this->operator->method('capture')->willReturn(new CaptureOutput(200, '{"operationIds":["op_c1"]}', null, null, null));
+ $this->entityManager->method('flush')->willThrowException(new \RuntimeException('connection lost'));
+
+ $request = $this->request(['amount' => '', 'version' => '0']);
+ $this->controller->capture($request, 7, 42);
+
+ // Not "the payment was not changed": UPC did accept the capture.
+ self::assertSame(['payplug_sylius_payplug_plugin.admin.authorization.error.unexpected_error'], $this->flashes($request, 'error'));
+ }
+
+ /**
+ * @param array $body
+ */
+ private function request(array $body, string $csrfToken = self::VALID_TOKEN, bool $withVersion = true): Request
+ {
+ if ($withVersion) {
+ $body += ['version' => '0'];
+ }
+
+ $request = new Request([], [...$body, '_csrf_token' => $csrfToken]);
+ $request->setSession(new Session(new MockArraySessionStorage()));
+
+ return $request;
+ }
+
+ /**
+ * @return mixed[]
+ */
+ private function flashes(Request $request, string $type): array
+ {
+ $session = $request->getSession();
+ self::assertInstanceOf(Session::class, $session);
+
+ return $session->getFlashBag()->get($type);
+ }
+
+ private function authorizedPayment(string $currency = 'EUR'): Payment
+ {
+ $gatewayConfig = new GatewayConfig();
+ $gatewayConfig->setFactoryName(PayPlugGatewayFactory::FACTORY_NAME);
+ $gatewayConfig->setConfig([PayPlugGatewayFactory::HOSTED_FIELDS => true, PayPlugGatewayFactory::HF_IDENTIFIER => 'acct_1']);
+ $method = new PaymentMethod();
+ $method->setGatewayConfig($gatewayConfig);
+
+ $order = new class() extends Order {
+ public function getId(): int
+ {
+ return 7;
+ }
+ };
+
+ $payment = new class() extends Payment {
+ public function getId(): int
+ {
+ return 42;
+ }
+ };
+ $payment->setOrder($order);
+ $payment->setMethod($method);
+ $payment->setAmount(1000);
+ $payment->setCurrencyCode($currency);
+ $payment->setState(PaymentInterface::STATE_AUTHORIZED);
+ $payment->setDetails(AuthorizationDetails::open(
+ ['hosted_fields_payment_id' => 'pay_1'],
+ new PaymentOutput(201, '{}', null, null, null, '2026-09-30T10:00:00+00:00', 1000),
+ 1000,
+ ));
+
+ return $payment;
+ }
+}
diff --git a/tests/PHPUnit/ApiClient/PayPlugApiClientFactoryTest.php b/tests/PHPUnit/ApiClient/PayPlugApiClientFactoryTest.php
new file mode 100644
index 00000000..2b49a754
--- /dev/null
+++ b/tests/PHPUnit/ApiClient/PayPlugApiClientFactoryTest.php
@@ -0,0 +1,241 @@
+gatewayConfigRepository = $this->createMock(RepositoryInterface::class);
+ $this->cache = $this->createMock(CacheInterface::class);
+ $this->oauthHttpClient = $this->createMock(IOAuthHttpClient::class);
+ $this->tokenCache = $this->createMock(ITokenCache::class);
+
+ $oauth2Client = new OAuth2Client($this->oauthHttpClient, 'https://api-qa.payplug.com', '', '', 'https://www.payplug.com');
+ $tokenManager = new TokenManager($this->tokenCache, $oauth2Client);
+
+ $this->factory = new PayPlugApiClientFactory($this->gatewayConfigRepository, $this->cache, $tokenManager);
+ }
+
+ // -------------------------------------------------------------------------
+ // create() / createForPaymentMethod() — happy path, token freshly fetched
+ // -------------------------------------------------------------------------
+
+ public function testCreateForPaymentMethod_withValidClientCredentials_returnsApiClient(): void
+ {
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $paymentMethod->method('getGatewayConfig')->willReturn($this->buildGatewayConfig(isLive: false));
+
+ $this->tokenCache->method('get')->willReturn(null); // cache miss
+ $this->oauthHttpClient->method('post')->willReturn([
+ 'status' => 200,
+ 'body' => json_encode(['access_token' => 'fresh-jwt', 'expires_in' => 300, 'token_type' => 'Bearer']),
+ ]);
+
+ $client = $this->factory->createForPaymentMethod($paymentMethod);
+
+ self::assertInstanceOf(PayPlugApiClientInterface::class, $client);
+ }
+
+ public function testCreate_withNoGatewayConfigFound_throwsLogicException(): void
+ {
+ $this->gatewayConfigRepository->method('findOneBy')->willReturn(null);
+
+ $this->expectException(\LogicException::class);
+
+ $this->factory->create('payplug');
+ }
+
+ // -------------------------------------------------------------------------
+ // getTokenForGatewayConfig() — missing client config
+ // -------------------------------------------------------------------------
+
+ public function testCreateForPaymentMethod_withNoClientConfigForCurrentMode_throwsGatewayConfigurationException(): void
+ {
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getConfig')->willReturn(['live' => true]); // no 'live_client' key
+ $gatewayConfig->method('getFactoryName')->willReturn('payplug');
+ $paymentMethod->method('getGatewayConfig')->willReturn($gatewayConfig);
+
+ $this->expectException(GatewayConfigurationException::class);
+ $this->expectExceptionMessage('No client config found for payplug');
+
+ $this->factory->createForPaymentMethod($paymentMethod);
+ }
+
+ // -------------------------------------------------------------------------
+ // getTokenForGatewayConfig() — client config present but missing client_id/client_secret
+ // -------------------------------------------------------------------------
+
+ /**
+ * A present-but-incomplete client config (e.g. `client_secret` missing) must be rejected
+ * before any HTTP call is made — otherwise it reaches the token endpoint with an empty
+ * credential and a genuine misconfiguration gets reported as a connectivity failure instead.
+ */
+ public function testCreateForPaymentMethod_withEmptyClientSecret_throwsGatewayConfigurationExceptionWithoutCallingTokenEndpoint(): void
+ {
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getConfig')->willReturn([
+ 'live' => false,
+ 'test_client' => ['client_id' => 'client_test'], // no 'client_secret' key
+ ]);
+ $gatewayConfig->method('getFactoryName')->willReturn('payplug');
+ $paymentMethod->method('getGatewayConfig')->willReturn($gatewayConfig);
+
+ $this->oauthHttpClient->expects(self::never())->method('post');
+
+ $this->expectException(GatewayConfigurationException::class);
+ $this->expectExceptionMessage('No client config found for payplug');
+
+ $this->factory->createForPaymentMethod($paymentMethod);
+ }
+
+ // -------------------------------------------------------------------------
+ // getTokenForGatewayConfig() — token endpoint failure wrapped as GatewayConfigurationException
+ // -------------------------------------------------------------------------
+
+ /**
+ * TokenManager -> OAuth2Client throws ApiException on a non-2xx response; the factory must
+ * catch it and rethrow as GatewayConfigurationException (never leak the vendor exception type).
+ */
+ public function testCreateForPaymentMethod_whenTokenEndpointRejectsCredentials_wrapsFailureAsGatewayConfigurationException(): void
+ {
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $paymentMethod->method('getGatewayConfig')->willReturn($this->buildGatewayConfig(isLive: true));
+
+ $this->tokenCache->method('get')->willReturn(null);
+ $this->oauthHttpClient->method('post')->willReturn(['status' => 401, 'body' => '{"error":"invalid_client"}']);
+
+ $this->expectException(GatewayConfigurationException::class);
+ $this->expectExceptionMessage('Unable to connect to PayPlug API. Please check your credentials in the PayPlug plugin configuration.');
+
+ $this->factory->createForPaymentMethod($paymentMethod);
+ }
+
+ // -------------------------------------------------------------------------
+ // getTokenForGatewayConfig() — a cached token is reused, no HTTP call made
+ // -------------------------------------------------------------------------
+
+ public function testCreateForPaymentMethod_withCachedToken_doesNotCallTheTokenEndpoint(): void
+ {
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $paymentMethod->method('getGatewayConfig')->willReturn($this->buildGatewayConfig(isLive: false));
+
+ $this->tokenCache->method('get')->willReturn('cached-jwt');
+ $this->oauthHttpClient->expects(self::never())->method('post');
+
+ $this->factory->createForPaymentMethod($paymentMethod);
+ }
+
+ // -------------------------------------------------------------------------
+ // createForPaymentMethod() — credentials are scoped to the payment method, not the factory name
+ // -------------------------------------------------------------------------
+
+ /**
+ * Since PRE-3628 several enabled gateway configs may share a factory name — one per channel.
+ * `findOneBy(['factoryName' => ...])` then resolves to an arbitrary one of them, so a client
+ * built that way can sign a request for channel A with channel B's account credentials.
+ * createForPaymentMethod() must read the credentials off the payment method's own gateway
+ * config and never consult the repository; routing it back through that lookup is the
+ * production change that makes this test fail.
+ */
+ public function testCreateForPaymentMethod_withTwoChannelsSharingAFactoryName_usesEachChannelsOwnCredentials(): void
+ {
+ $frConfig = $this->buildGatewayConfig(isLive: false, clientId: 'client_fr', clientSecret: 'secret_fr');
+ $deConfig = $this->buildGatewayConfig(isLive: false, clientId: 'client_de', clientSecret: 'secret_de');
+
+ // Both rows are enabled and carry factoryName 'payplug', so Doctrine is free to return
+ // either one; the FR row stands in for "whichever one it picked".
+ $this->gatewayConfigRepository->method('findOneBy')->willReturn($frConfig);
+
+ $this->tokenCache->method('get')->willReturn(null); // cache miss for both client ids
+
+ /** @var list $sentCredentials */
+ $sentCredentials = [];
+ $this->oauthHttpClient->method('post')->willReturnCallback(
+ function (string $url, array $formParams, array $headers = []) use (&$sentCredentials): array {
+ $sentCredentials[] = $headers['Authorization'];
+
+ return [
+ 'status' => 200,
+ 'body' => json_encode(['access_token' => 'jwt', 'expires_in' => 300, 'token_type' => 'Bearer']),
+ ];
+ },
+ );
+
+ $this->factory->createForPaymentMethod($this->buildPaymentMethodOnChannel('FR', $frConfig));
+ $this->factory->createForPaymentMethod($this->buildPaymentMethodOnChannel('DE', $deConfig));
+
+ self::assertSame([
+ 'Basic ' . base64_encode('client_fr:secret_fr'),
+ 'Basic ' . base64_encode('client_de:secret_de'),
+ ], $sentCredentials);
+ }
+
+ private function buildPaymentMethodOnChannel(
+ string $channelCode,
+ GatewayConfigInterface $gatewayConfig,
+ ): PaymentMethodInterface&MockObject {
+ $channel = $this->createMock(ChannelInterface::class);
+ $channel->method('getCode')->willReturn($channelCode);
+
+ $paymentMethod = $this->createMock(CorePaymentMethodInterface::class);
+ $paymentMethod->method('isEnabled')->willReturn(true);
+ $paymentMethod->method('getChannels')->willReturn(new ArrayCollection([$channel]));
+ $paymentMethod->method('getGatewayConfig')->willReturn($gatewayConfig);
+
+ return $paymentMethod;
+ }
+
+ private function buildGatewayConfig(
+ bool $isLive,
+ string $clientId = 'client',
+ string $clientSecret = 'secret',
+ ): GatewayConfigInterface&MockObject {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getConfig')->willReturn([
+ 'live' => $isLive,
+ 'live_client' => ['client_id' => $clientId, 'client_secret' => $clientSecret],
+ 'test_client' => ['client_id' => $clientId, 'client_secret' => $clientSecret],
+ ]);
+ $gatewayConfig->method('getFactoryName')->willReturn('payplug');
+
+ return $gatewayConfig;
+ }
+}
diff --git a/tests/PHPUnit/Auth/GatewayConnectionRevokerTest.php b/tests/PHPUnit/Auth/GatewayConnectionRevokerTest.php
new file mode 100644
index 00000000..6cf0479d
--- /dev/null
+++ b/tests/PHPUnit/Auth/GatewayConnectionRevokerTest.php
@@ -0,0 +1,174 @@
+entityManager = $this->createMock(EntityManagerInterface::class);
+ $this->tokenCache = new SyliusTokenCache(new ArrayAdapter());
+ $this->revoker = new GatewayConnectionRevoker($this->entityManager, $this->tokenCache);
+ }
+
+ public function testRevoke_removesTheOAuthCredentialsFromTheGatewayConfig(): void
+ {
+ $paymentMethod = $this->paymentMethod();
+
+ $this->revoker->revoke($paymentMethod);
+
+ $config = $paymentMethod->getGatewayConfig()?->getConfig() ?? [];
+ self::assertArrayNotHasKey('live_client', $config);
+ self::assertArrayNotHasKey('test_client', $config);
+ self::assertArrayNotHasKey('account_email', $config);
+ }
+
+ public function testRevoke_keepsTheMerchantSettingsThatAreNotCredentials(): void
+ {
+ $paymentMethod = $this->paymentMethod(config: [
+ 'live' => true,
+ PayPlugGatewayFactory::ONE_CLICK => true,
+ 'fees_for' => 'merchant',
+ ]);
+
+ $this->revoker->revoke($paymentMethod);
+
+ $config = $paymentMethod->getGatewayConfig()?->getConfig() ?? [];
+ self::assertTrue($config['live']);
+ self::assertTrue($config[PayPlugGatewayFactory::ONE_CLICK]);
+ self::assertSame('merchant', $config['fees_for']);
+ }
+
+ public function testRevoke_disablesThePaymentMethod(): void
+ {
+ $paymentMethod = $this->paymentMethod();
+ $paymentMethod->enable();
+
+ $this->revoker->revoke($paymentMethod);
+
+ self::assertFalse($paymentMethod->isEnabled());
+ }
+
+ public function testRevoke_dropsTheCachedTokenOfBothEnvironments(): void
+ {
+ $this->tokenCache->set('upc_oauth_token:client_live', 'live-access-token', 3600);
+ $this->tokenCache->set('upc_oauth_token:client_test', 'test-access-token', 3600);
+
+ $this->revoker->revoke($this->paymentMethod());
+
+ self::assertNull($this->tokenCache->get('upc_oauth_token:client_live'));
+ self::assertNull($this->tokenCache->get('upc_oauth_token:client_test'));
+ }
+
+ public function testRevoke_leavesAnotherGatewaysCachedTokenAlone(): void
+ {
+ $this->tokenCache->set('upc_oauth_token:client_of_another_channel', 'other-access-token', 3600);
+
+ $this->revoker->revoke($this->paymentMethod());
+
+ self::assertSame('other-access-token', $this->tokenCache->get('upc_oauth_token:client_of_another_channel'));
+ }
+
+ public function testRevoke_hostedFieldsCbGateway_alsoClearsTheHostedFieldsAccountId(): void
+ {
+ $paymentMethod = $this->paymentMethod(config: [
+ PayPlugGatewayFactory::HOSTED_FIELDS => true,
+ PayPlugGatewayFactory::HF_IDENTIFIER => 'acc_123',
+ ]);
+
+ $this->revoker->revoke($paymentMethod);
+
+ self::assertArrayNotHasKey(PayPlugGatewayFactory::HF_IDENTIFIER, $paymentMethod->getGatewayConfig()?->getConfig() ?? []);
+ }
+
+ public function testRevoke_cbGatewayWithoutHostedFields_keepsTheHostedFieldsAccountId(): void
+ {
+ $paymentMethod = $this->paymentMethod(config: [
+ PayPlugGatewayFactory::HOSTED_FIELDS => false,
+ PayPlugGatewayFactory::HF_IDENTIFIER => 'acc_123',
+ ]);
+
+ $this->revoker->revoke($paymentMethod);
+
+ self::assertSame('acc_123', ($paymentMethod->getGatewayConfig()?->getConfig() ?? [])[PayPlugGatewayFactory::HF_IDENTIFIER] ?? null);
+ }
+
+ public function testRevoke_nonCbGateway_keepsTheHostedFieldsAccountId(): void
+ {
+ $paymentMethod = $this->paymentMethod(
+ factoryName: OneyGatewayFactory::FACTORY_NAME,
+ config: [
+ PayPlugGatewayFactory::HOSTED_FIELDS => true,
+ PayPlugGatewayFactory::HF_IDENTIFIER => 'acc_123',
+ ],
+ );
+
+ $this->revoker->revoke($paymentMethod);
+
+ self::assertSame('acc_123', ($paymentMethod->getGatewayConfig()?->getConfig() ?? [])[PayPlugGatewayFactory::HF_IDENTIFIER] ?? null);
+ }
+
+ public function testRevoke_persistsTheChangeOnce(): void
+ {
+ $this->entityManager->expects(self::once())->method('flush');
+
+ $this->revoker->revoke($this->paymentMethod());
+ }
+
+ public function testRevoke_paymentMethodWithoutGatewayConfig_throws(): void
+ {
+ $paymentMethod = new PaymentMethod();
+
+ $this->expectException(\LogicException::class);
+
+ $this->revoker->revoke($paymentMethod);
+ }
+
+ /**
+ * @param array $config merged over the credentials every connected gateway holds
+ */
+ private function paymentMethod(
+ string $factoryName = PayPlugGatewayFactory::FACTORY_NAME,
+ array $config = [],
+ ): PaymentMethodInterface {
+ $gatewayConfig = new GatewayConfig();
+ $gatewayConfig->setFactoryName($factoryName);
+ $gatewayConfig->setConfig([
+ 'live_client' => ['client_id' => 'client_live', 'client_secret' => 'secret_live'],
+ 'test_client' => ['client_id' => 'client_test', 'client_secret' => 'secret_test'],
+ 'account_email' => 'merchant@example.com',
+ ...$config,
+ ]);
+
+ $paymentMethod = new PaymentMethod();
+ $paymentMethod->setGatewayConfig($gatewayConfig);
+
+ return $paymentMethod;
+ }
+}
diff --git a/tests/PHPUnit/Auth/IdTokenEmailExtractorTest.php b/tests/PHPUnit/Auth/IdTokenEmailExtractorTest.php
new file mode 100644
index 00000000..7ba94f8c
--- /dev/null
+++ b/tests/PHPUnit/Auth/IdTokenEmailExtractorTest.php
@@ -0,0 +1,136 @@
+extractor = new IdTokenEmailExtractor();
+ }
+
+ /**
+ * Builds a JWT-shaped string whose payload segment is the given claims. The signature is
+ * deliberately a fixed placeholder: the extractor never verifies it (see the class docblock),
+ * so a real one would prove nothing that this doesn't.
+ *
+ * @param array $claims
+ */
+ private function idTokenWithClaims(array $claims): string
+ {
+ $encode = static fn (string $raw): string => rtrim(strtr(base64_encode($raw), '+/', '-_'), '=');
+
+ return $encode('{"alg":"RS256","typ":"JWT"}') . '.' . $encode((string) json_encode($claims)) . '.c2lnbmF0dXJl';
+ }
+
+ // -------------------------------------------------------------------------
+ // Happy path
+ // -------------------------------------------------------------------------
+
+ public function testExtract_returnsTheEmailClaim(): void
+ {
+ $idToken = $this->idTokenWithClaims(['sub' => 'user_1', 'email' => 'merchant@example.com']);
+
+ self::assertSame('merchant@example.com', $this->extractor->extract($idToken));
+ }
+
+ /**
+ * The payload is base64url-encoded, not plain base64: real PayPlug id tokens routinely contain
+ * `-` and `_` where standard base64 would emit `+` and `/`, and are stripped of `=` padding.
+ * Decoding one with plain base64_decode() would corrupt the JSON.
+ */
+ public function testExtract_decodesABase64UrlPayloadContainingUrlUnsafeCharacters(): void
+ {
+ $claims = ['email' => 'merchant@example.com', 'nonce' => '>>>???~~~'];
+ $idToken = $this->idTokenWithClaims($claims);
+
+ self::assertStringNotContainsString('+', explode('.', $idToken)[1]);
+ self::assertStringNotContainsString('/', explode('.', $idToken)[1]);
+ self::assertSame('merchant@example.com', $this->extractor->extract($idToken));
+ }
+
+ // -------------------------------------------------------------------------
+ // Absent / malformed input — every branch degrades to null, never throws
+ // -------------------------------------------------------------------------
+
+ public function testExtract_returnsNullWhenTheTokenIsNull(): void
+ {
+ self::assertNull($this->extractor->extract(null));
+ }
+
+ public function testExtract_returnsNullWhenTheTokenIsEmpty(): void
+ {
+ self::assertNull($this->extractor->extract(''));
+ }
+
+ public function testExtract_returnsNullWhenTheTokenIsNotThreeSegments(): void
+ {
+ self::assertNull($this->extractor->extract('header.payload'));
+ }
+
+ /**
+ * A payload segment whose length is ≡ 1 (mod 4) cannot be valid base64 — no encoder ever emits
+ * one — so the padding loop produces a string that base64_decode(..., true) rejects outright.
+ * The decode therefore short-circuits before json_decode() is ever reached.
+ */
+ public function testExtract_returnsNullWhenThePayloadIsNotDecodableBase64(): void
+ {
+ $encode = static fn (string $raw): string => rtrim(strtr(base64_encode($raw), '+/', '-_'), '=');
+
+ self::assertSame(1, \strlen('abcde') % 4);
+ self::assertNull($this->extractor->extract($encode('{}') . '.abcde.sig'));
+ }
+
+ public function testExtract_returnsNullWhenThePayloadIsNotValidJson(): void
+ {
+ $encode = static fn (string $raw): string => rtrim(strtr(base64_encode($raw), '+/', '-_'), '=');
+
+ self::assertNull($this->extractor->extract($encode('{}') . '.' . $encode('not json') . '.sig'));
+ }
+
+ public function testExtract_returnsNullWhenThePayloadIsAJsonScalarRatherThanAnObject(): void
+ {
+ $encode = static fn (string $raw): string => rtrim(strtr(base64_encode($raw), '+/', '-_'), '=');
+
+ self::assertNull($this->extractor->extract($encode('{}') . '.' . $encode('"just-a-string"') . '.sig'));
+ }
+
+ public function testExtract_returnsNullWhenTheEmailClaimIsAbsent(): void
+ {
+ $idToken = $this->idTokenWithClaims(['sub' => 'user_1', 'name' => 'A Merchant']);
+
+ self::assertNull($this->extractor->extract($idToken));
+ }
+
+ public function testExtract_returnsNullWhenTheEmailClaimIsNotAString(): void
+ {
+ $idToken = $this->idTokenWithClaims(['email' => ['merchant@example.com']]);
+
+ self::assertNull($this->extractor->extract($idToken));
+ }
+
+ /**
+ * The claim is rendered verbatim on an admin screen, so a value that isn't an address is
+ * treated as no value at all rather than echoed back.
+ */
+ public function testExtract_returnsNullWhenTheEmailClaimIsNotAnAddress(): void
+ {
+ $idToken = $this->idTokenWithClaims(['email' => 'not-an-email']);
+
+ self::assertNull($this->extractor->extract($idToken));
+ }
+
+ public function testExtract_returnsNullWhenTheEmailClaimIsEmpty(): void
+ {
+ $idToken = $this->idTokenWithClaims(['email' => '']);
+
+ self::assertNull($this->extractor->extract($idToken));
+ }
+}
diff --git a/tests/PHPUnit/Auth/SyliusOAuthHttpClientTest.php b/tests/PHPUnit/Auth/SyliusOAuthHttpClientTest.php
new file mode 100644
index 00000000..eede4155
--- /dev/null
+++ b/tests/PHPUnit/Auth/SyliusOAuthHttpClientTest.php
@@ -0,0 +1,128 @@
+httpClient = $this->createMock(HttpClientInterface::class);
+ $this->adapter = new SyliusOAuthHttpClient($this->httpClient);
+ }
+
+ // -------------------------------------------------------------------------
+ // post() — delegates to HttpClientInterface with form-encoded body
+ // -------------------------------------------------------------------------
+
+ /**
+ * Verifies the form params are sent as a URL-encoded body (not a raw array), and the given
+ * headers are passed through unchanged.
+ */
+ public function testPost_sendsFormEncodedBodyAndHeaders(): void
+ {
+ $response = $this->createMock(ResponseInterface::class);
+ $response->method('getStatusCode')->willReturn(200);
+ $response->method('getContent')->with(false)->willReturn('{"access_token":"jwt"}');
+
+ $this->httpClient->expects(self::once())
+ ->method('request')
+ ->with(
+ 'POST',
+ 'https://api-qa.payplug.com/oauth2/token',
+ [
+ 'body' => 'grant_type=authorization_code&client_id=client_abc',
+ 'headers' => ['Content-Type' => 'application/x-www-form-urlencoded'],
+ ],
+ )
+ ->willReturn($response)
+ ;
+
+ $result = $this->adapter->post(
+ 'https://api-qa.payplug.com/oauth2/token',
+ ['grant_type' => 'authorization_code', 'client_id' => 'client_abc'],
+ ['Content-Type' => 'application/x-www-form-urlencoded'],
+ );
+
+ self::assertSame(['status' => 200, 'body' => '{"access_token":"jwt"}'], $result);
+ }
+
+ // -------------------------------------------------------------------------
+ // post() — non-2xx status does not throw (caller decides how to react)
+ // -------------------------------------------------------------------------
+
+ /**
+ * getContent(false) is used specifically so a 4xx/5xx response body is still returned
+ * instead of throwing — OAuth2Client itself is responsible for checking the status.
+ */
+ public function testPost_onNon2xxStatus_returnsStatusAndBodyWithoutThrowing(): void
+ {
+ $response = $this->createMock(ResponseInterface::class);
+ $response->method('getStatusCode')->willReturn(401);
+ $response->method('getContent')->with(false)->willReturn('{"error":"invalid_client"}');
+
+ $this->httpClient->method('request')->willReturn($response);
+
+ $result = $this->adapter->post('https://api-qa.payplug.com/oauth2/token', ['grant_type' => 'client_credentials']);
+
+ self::assertSame(['status' => 401, 'body' => '{"error":"invalid_client"}'], $result);
+ }
+
+ // -------------------------------------------------------------------------
+ // post() — default empty headers array is accepted
+ // -------------------------------------------------------------------------
+
+ public function testPost_withNoHeadersArgument_defaultsToEmptyHeaders(): void
+ {
+ $response = $this->createMock(ResponseInterface::class);
+ $response->method('getStatusCode')->willReturn(200);
+ $response->method('getContent')->willReturn('{}');
+
+ $this->httpClient->expects(self::once())
+ ->method('request')
+ ->with(self::anything(), self::anything(), self::callback(
+ static fn (array $options): bool => [] === $options['headers'],
+ ))
+ ->willReturn($response)
+ ;
+
+ $this->adapter->post('https://api-qa.payplug.com/oauth2/token', ['grant_type' => 'client_credentials']);
+ }
+
+ // -------------------------------------------------------------------------
+ // post() — transport-level failure (network error) does not throw
+ // -------------------------------------------------------------------------
+
+ /**
+ * getStatusCode()/getContent() throw TransportExceptionInterface on a genuine network error
+ * (DNS, timeout, connection reset) regardless of the `false` passed to getContent() — that
+ * flag only suppresses HTTP status exceptions, not transport ones. This must be caught here
+ * and turned into a status the caller can react to (0, i.e. never a valid HTTP status),
+ * instead of leaking an uncaught exception into OAuth2Client/TokenManager, which only know
+ * how to translate a malformed HTTP response into ApiException, not a transport failure.
+ */
+ public function testPost_onTransportFailure_returnsZeroStatusInsteadOfThrowing(): void
+ {
+ $response = $this->createMock(ResponseInterface::class);
+ $response->method('getStatusCode')->willThrowException(new TransportException('Could not resolve host'));
+
+ $this->httpClient->method('request')->willReturn($response);
+
+ $result = $this->adapter->post('https://api-qa.payplug.com/oauth2/token', ['grant_type' => 'client_credentials']);
+
+ self::assertSame(0, $result['status']);
+ self::assertSame('Could not resolve host', $result['body']);
+ }
+}
diff --git a/tests/PHPUnit/Auth/SyliusTokenCacheTest.php b/tests/PHPUnit/Auth/SyliusTokenCacheTest.php
new file mode 100644
index 00000000..71331456
--- /dev/null
+++ b/tests/PHPUnit/Auth/SyliusTokenCacheTest.php
@@ -0,0 +1,115 @@
+pool = $this->createMock(CacheItemPoolInterface::class);
+ $this->cache = new SyliusTokenCache($this->pool);
+ }
+
+ // -------------------------------------------------------------------------
+ // get() — cache hit / miss
+ // -------------------------------------------------------------------------
+
+ public function testGet_onCacheHit_returnsTheStoredValue(): void
+ {
+ $item = $this->createMock(CacheItemInterface::class);
+ $item->method('isHit')->willReturn(true);
+ $item->method('get')->willReturn('cached-jwt');
+
+ $this->pool->method('getItem')->with('upc_oauth_token_client_abc')->willReturn($item);
+
+ self::assertSame('cached-jwt', $this->cache->get('upc_oauth_token:client_abc'));
+ }
+
+ public function testGet_onCacheMiss_returnsNull(): void
+ {
+ $item = $this->createMock(CacheItemInterface::class);
+ $item->method('isHit')->willReturn(false);
+
+ $this->pool->method('getItem')->willReturn($item);
+
+ self::assertNull($this->cache->get('upc_oauth_token:client_abc'));
+ }
+
+ // -------------------------------------------------------------------------
+ // set() — stores the value with the given TTL
+ // -------------------------------------------------------------------------
+
+ public function testSet_storesValueAndTtlThenSavesTheItem(): void
+ {
+ $item = $this->createMock(CacheItemInterface::class);
+ $item->expects(self::once())->method('set')->with('fresh-jwt');
+ $item->expects(self::once())->method('expiresAfter')->with(240);
+
+ $this->pool->method('getItem')->with('upc_oauth_token_client_abc')->willReturn($item);
+ $this->pool->expects(self::once())->method('save')->with($item);
+
+ $this->cache->set('upc_oauth_token:client_abc', 'fresh-jwt', 240);
+ }
+
+ // -------------------------------------------------------------------------
+ // delete()
+ // -------------------------------------------------------------------------
+
+ public function testDelete_removesTheSanitizedKeyFromThePool(): void
+ {
+ $this->pool->expects(self::once())->method('deleteItem')->with('upc_oauth_token_client_abc');
+
+ $this->cache->delete('upc_oauth_token:client_abc');
+ }
+
+ // -------------------------------------------------------------------------
+ // Key sanitization — PSR-6 reserved characters must never reach the pool
+ // -------------------------------------------------------------------------
+
+ /**
+ * Symfony's cache component rejects keys containing any of "{}()/\@:" with an
+ * InvalidArgumentException. TokenManager's own key format ("upc_oauth_token:{clientId}")
+ * contains a colon, so this is a real, not hypothetical, input.
+ *
+ * @dataProvider reservedCharacterKeys
+ */
+ public function testSanitizeKey_replacesEveryPsr6ReservedCharacter(
+ string $rawKey,
+ string $expectedSanitizedKey,
+ ): void
+ {
+ $item = $this->createMock(CacheItemInterface::class);
+ $item->method('isHit')->willReturn(false);
+
+ $this->pool->expects(self::once())->method('getItem')->with($expectedSanitizedKey)->willReturn($item);
+
+ $this->cache->get($rawKey);
+ }
+
+ /**
+ * @return iterable
+ */
+ public static function reservedCharacterKeys(): iterable
+ {
+ yield 'colon (TokenManager\'s real format)' => ['upc_oauth_token:client_abc', 'upc_oauth_token_client_abc'];
+ yield 'curly braces' => ['a{b}c', 'a_b_c'];
+ yield 'parentheses' => ['a(b)c', 'a_b_c'];
+ yield 'slash' => ['a/b', 'a_b'];
+ yield 'backslash' => ['a\\b', 'a_b'];
+ yield 'at sign' => ['a@b', 'a_b'];
+ yield 'all reserved characters combined' => ['{}()/\\@:', '________'];
+ yield 'no reserved characters' => ['plain_key_123', 'plain_key_123'];
+ }
+}
diff --git a/tests/PHPUnit/Checker/GatewayChannelConflictCheckerTest.php b/tests/PHPUnit/Checker/GatewayChannelConflictCheckerTest.php
new file mode 100644
index 00000000..0be806d2
--- /dev/null
+++ b/tests/PHPUnit/Checker/GatewayChannelConflictCheckerTest.php
@@ -0,0 +1,291 @@
+paymentMethodRepository = $this->createMock(PaymentMethodRepositoryInterface::class);
+ $this->checker = new GatewayChannelConflictChecker($this->paymentMethodRepository);
+ }
+
+ public function testFindConflicts_enabledRivalSharesChannel_isReported(): void
+ {
+ $subject = $this->paymentMethod(null, true, ['WEB_FR']);
+ $rival = $this->paymentMethod(7, true, ['WEB_FR'], 'CB 1');
+
+ $this->paymentMethodRepository
+ ->expects(self::once())
+ ->method('findEnabledByGatewayName')
+ ->with(PayPlugGatewayFactory::FACTORY_NAME)
+ ->willReturn([$rival])
+ ;
+
+ $conflicts = $this->checker->findConflicts($subject, PayPlugGatewayFactory::FACTORY_NAME);
+
+ self::assertCount(1, $conflicts);
+ self::assertSame('WEB_FR', $conflicts[0]['channel']->getCode());
+ self::assertSame('CB 1', $conflicts[0]['paymentMethod']->getName());
+ }
+
+ public function testFindConflicts_channelSetsAreDisjoint_isAllowed(): void
+ {
+ $subject = $this->paymentMethod(null, true, ['WEB_FR']);
+ $rival = $this->paymentMethod(7, true, ['WEB_IT'], 'CB 1');
+
+ $this->paymentMethodRepository->method('findEnabledByGatewayName')->willReturn([$rival]);
+
+ self::assertSame([], $this->checker->findConflicts($subject, PayPlugGatewayFactory::FACTORY_NAME));
+ }
+
+ public function testFindConflicts_twoSharedChannels_bothAreReported(): void
+ {
+ $subject = $this->paymentMethod(null, true, ['WEB_FR', 'WEB_IT', 'WEB_BE']);
+ $rival = $this->paymentMethod(7, true, ['WEB_IT', 'WEB_BE'], 'CB 1');
+
+ $this->paymentMethodRepository->method('findEnabledByGatewayName')->willReturn([$rival]);
+
+ $conflicts = $this->checker->findConflicts($subject, PayPlugGatewayFactory::FACTORY_NAME);
+
+ self::assertCount(2, $conflicts);
+ self::assertSame(
+ ['WEB_IT', 'WEB_BE'],
+ array_map(static fn (array $conflict): ?string => $conflict['channel']->getCode(), $conflicts),
+ );
+ }
+
+ public function testFindConflicts_subjectIsDisabled_isAllowedWithoutQuerying(): void
+ {
+ $subject = $this->paymentMethod(null, false, ['WEB_FR']);
+
+ $this->paymentMethodRepository->expects(self::never())->method('findEnabledByGatewayName');
+
+ self::assertSame([], $this->checker->findConflicts($subject, PayPlugGatewayFactory::FACTORY_NAME));
+ }
+
+ public function testFindConflicts_subjectHasNoChannel_isAllowedWithoutQuerying(): void
+ {
+ $subject = $this->paymentMethod(null, true, []);
+
+ $this->paymentMethodRepository->expects(self::never())->method('findEnabledByGatewayName');
+
+ self::assertSame([], $this->checker->findConflicts($subject, PayPlugGatewayFactory::FACTORY_NAME));
+ }
+
+ /**
+ * Editing an existing gateway must not make it conflict with itself.
+ */
+ public function testFindConflicts_rivalIsTheSubjectItself_isAllowed(): void
+ {
+ $subject = $this->paymentMethod(7, true, ['WEB_FR']);
+ $itself = $this->paymentMethod(7, true, ['WEB_FR'], 'CB 1');
+
+ $this->paymentMethodRepository->method('findEnabledByGatewayName')->willReturn([$itself]);
+
+ self::assertSame([], $this->checker->findConflicts($subject, PayPlugGatewayFactory::FACTORY_NAME));
+ }
+
+ /**
+ * The repository already filters on `enabled`, but the rule is re-asserted here so the whole
+ * rule is expressed — and testable — in one place.
+ */
+ public function testFindConflicts_rivalIsDisabled_isAllowed(): void
+ {
+ $subject = $this->paymentMethod(null, true, ['WEB_FR']);
+ $rival = $this->paymentMethod(7, false, ['WEB_FR'], 'CB 1');
+
+ $this->paymentMethodRepository->method('findEnabledByGatewayName')->willReturn([$rival]);
+
+ self::assertSame([], $this->checker->findConflicts($subject, PayPlugGatewayFactory::FACTORY_NAME));
+ }
+
+ public function testFindConflicts_rivalHasNoChannel_isAllowed(): void
+ {
+ $subject = $this->paymentMethod(null, true, ['WEB_FR']);
+ $rival = $this->paymentMethod(7, true, [], 'CB 1');
+
+ $this->paymentMethodRepository->method('findEnabledByGatewayName')->willReturn([$rival]);
+
+ self::assertSame([], $this->checker->findConflicts($subject, PayPlugGatewayFactory::FACTORY_NAME));
+ }
+
+ /**
+ * Different factory types never conflict: the lookup is scoped to the factory being saved.
+ */
+ public function testFindConflicts_queriesOnlyTheGivenFactory(): void
+ {
+ $subject = $this->paymentMethod(null, true, ['WEB_FR']);
+
+ $this->paymentMethodRepository
+ ->expects(self::once())
+ ->method('findEnabledByGatewayName')
+ ->with(OneyGatewayFactory::FACTORY_NAME)
+ ->willReturn([])
+ ;
+
+ self::assertSame([], $this->checker->findConflicts($subject, OneyGatewayFactory::FACTORY_NAME));
+ }
+
+ public function testFindClaimedChannels_enabledRivalChannels_areClaimed(): void
+ {
+ $subject = $this->paymentMethod(null, true, []);
+ $rival = $this->paymentMethod(7, true, ['WEB_FR', 'WEB_BE'], 'CB 1');
+
+ $this->paymentMethodRepository
+ ->expects(self::once())
+ ->method('findEnabledByGatewayName')
+ ->with(PayPlugGatewayFactory::FACTORY_NAME)
+ ->willReturn([$rival])
+ ;
+
+ $claimed = $this->checker->findClaimedChannels($subject, PayPlugGatewayFactory::FACTORY_NAME);
+
+ self::assertSame(['WEB_FR', 'WEB_BE'], array_keys($claimed));
+ self::assertSame('CB 1', $claimed['WEB_FR']->getName());
+ self::assertSame('CB 1', $claimed['WEB_BE']->getName());
+ }
+
+ public function testFindClaimedChannels_severalRivals_areAllReported(): void
+ {
+ $subject = $this->paymentMethod(null, true, []);
+ $firstRival = $this->paymentMethod(7, true, ['WEB_FR'], 'CB 1');
+ $secondRival = $this->paymentMethod(8, true, ['WEB_IT'], 'CB 2');
+
+ $this->paymentMethodRepository
+ ->method('findEnabledByGatewayName')
+ ->willReturn([$firstRival, $secondRival])
+ ;
+
+ $claimed = $this->checker->findClaimedChannels($subject, PayPlugGatewayFactory::FACTORY_NAME);
+
+ self::assertSame('CB 1', $claimed['WEB_FR']->getName());
+ self::assertSame('CB 2', $claimed['WEB_IT']->getName());
+ }
+
+ /**
+ * The channels the edited gateway already holds must stay selectable: a disabled checkbox is
+ * not submitted by the browser, so disabling a *checked* one would silently drop the channel
+ * on save. Leaving it selectable lets the POST_SUBMIT rule report the conflict instead.
+ */
+ public function testFindClaimedChannels_rivalIsTheSubjectItself_isNotClaimed(): void
+ {
+ $subject = $this->paymentMethod(7, true, ['WEB_FR']);
+ $itself = $this->paymentMethod(7, true, ['WEB_FR'], 'CB 1');
+
+ $this->paymentMethodRepository->method('findEnabledByGatewayName')->willReturn([$itself]);
+
+ self::assertSame([], $this->checker->findClaimedChannels($subject, PayPlugGatewayFactory::FACTORY_NAME));
+ }
+
+ /**
+ * Same guarantee as above, for the case the id comparison cannot catch: a *different* enabled
+ * payment method already holds a channel the subject also holds. Reachable through the admin
+ * alone — create A disabled on a channel (a disabled subject is exempt from `findConflicts()`),
+ * then create B enabled on it (A, being disabled, is neither a claim nor a conflict). Editing A
+ * afterwards must not disable its own checked box, or saving A silently drops the channel.
+ *
+ * The rival's other channels stay claimed.
+ */
+ public function testFindClaimedChannels_channelTheSubjectAlreadyHolds_isNotClaimed(): void
+ {
+ $subject = $this->paymentMethod(5, true, ['WEB_FR']);
+ $rival = $this->paymentMethod(6, true, ['WEB_FR', 'WEB_BE'], 'CB 1');
+
+ $this->paymentMethodRepository->method('findEnabledByGatewayName')->willReturn([$rival]);
+
+ $claimed = $this->checker->findClaimedChannels($subject, PayPlugGatewayFactory::FACTORY_NAME);
+
+ self::assertSame(['WEB_BE'], array_keys($claimed));
+ self::assertSame('CB 1', $claimed['WEB_BE']->getName());
+ }
+
+ public function testFindClaimedChannels_rivalIsDisabled_isNotClaimed(): void
+ {
+ $subject = $this->paymentMethod(null, true, []);
+ $rival = $this->paymentMethod(7, false, ['WEB_FR'], 'CB 1');
+
+ $this->paymentMethodRepository->method('findEnabledByGatewayName')->willReturn([$rival]);
+
+ self::assertSame([], $this->checker->findClaimedChannels($subject, PayPlugGatewayFactory::FACTORY_NAME));
+ }
+
+ /**
+ * Unlike `findConflicts()`, the picker is rendered before the admin has decided anything: the
+ * claimed set must not depend on the subject's own `enabled` flag or channel selection.
+ */
+ public function testFindClaimedChannels_subjectIsDisabled_stillReportsClaims(): void
+ {
+ $subject = $this->paymentMethod(null, false, []);
+ $rival = $this->paymentMethod(7, true, ['WEB_FR'], 'CB 1');
+
+ $this->paymentMethodRepository->method('findEnabledByGatewayName')->willReturn([$rival]);
+
+ self::assertSame(
+ ['WEB_FR'],
+ array_keys($this->checker->findClaimedChannels($subject, PayPlugGatewayFactory::FACTORY_NAME)),
+ );
+ }
+
+ public function testFindClaimedChannels_queriesOnlyTheGivenFactory(): void
+ {
+ $subject = $this->paymentMethod(null, true, ['WEB_FR']);
+
+ $this->paymentMethodRepository
+ ->expects(self::once())
+ ->method('findEnabledByGatewayName')
+ ->with(OneyGatewayFactory::FACTORY_NAME)
+ ->willReturn([])
+ ;
+
+ self::assertSame([], $this->checker->findClaimedChannels($subject, OneyGatewayFactory::FACTORY_NAME));
+ }
+
+ /**
+ * @param list $channelCodes
+ *
+ * @return PaymentMethodInterface&MockObject
+ */
+ private function paymentMethod(
+ ?int $id,
+ bool $enabled,
+ array $channelCodes,
+ string $name = 'CB',
+ ): PaymentMethodInterface {
+ $channels = [];
+ foreach ($channelCodes as $channelCode) {
+ $channel = $this->createMock(ChannelInterface::class);
+ $channel->method('getCode')->willReturn($channelCode);
+ $channels[] = $channel;
+ }
+
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $paymentMethod->method('getId')->willReturn($id);
+ $paymentMethod->method('isEnabled')->willReturn($enabled);
+ $paymentMethod->method('getName')->willReturn($name);
+ $paymentMethod->method('getChannels')->willReturn(new ArrayCollection($channels));
+
+ return $paymentMethod;
+ }
+}
diff --git a/tests/PHPUnit/Command/Handler/CaptureAliasPaymentRequestHandlerTest.php b/tests/PHPUnit/Command/Handler/CaptureAliasPaymentRequestHandlerTest.php
new file mode 100644
index 00000000..fd7853d9
--- /dev/null
+++ b/tests/PHPUnit/Command/Handler/CaptureAliasPaymentRequestHandlerTest.php
@@ -0,0 +1,428 @@
+paymentRequestProvider = $this->createMock(PaymentRequestProviderInterface::class);
+ $this->stateMachine = $this->createMock(StateMachineInterface::class);
+ $this->unifiedApiPaymentCreator = $this->createMock(UnifiedApiPaymentCreatorInterface::class);
+ $this->session = $this->createMock(SessionInterface::class);
+ $sessionData = [];
+ $this->session->method('set')->willReturnCallback(static function (string $key, mixed $value) use (&$sessionData): void {
+ $sessionData[$key] = $value;
+ });
+ $this->session->method('get')->willReturnCallback(static function (string $key, mixed $default = null) use (&$sessionData): mixed {
+ return $sessionData[$key] ?? $default;
+ });
+
+ $request = new \Symfony\Component\HttpFoundation\Request();
+ $request->setSession($this->session);
+
+ $this->requestStack = new RequestStack();
+ $this->requestStack->push($request);
+ $this->payplugCardRepository = $this->createMock(RepositoryInterface::class);
+ $this->orderStateMutator = $this->createMock(IOrderStateMutator::class);
+ $this->logger = $this->createMock(LoggerInterface::class);
+ $this->urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+ $this->afterPayUrlProvider = $this->createMock(UrlProviderInterface::class);
+ $this->afterPayUrlProvider->method('getUrl')->willReturn('https://shop.test/order/00000042/pay');
+
+ $this->handler = new CaptureAliasPaymentRequestHandler(
+ $this->paymentRequestProvider,
+ $this->stateMachine,
+ $this->unifiedApiPaymentCreator,
+ new SelectedCardResolver($this->requestStack, $this->payplugCardRepository),
+ new PaymentCaptureContextBuilder($this->urlGenerator, $this->afterPayUrlProvider, new OrderAddressDtoCreator(), $this->requestStack),
+ new PaymentCaptureOutcomeApplier($this->logger, $this->stateMachine, $this->orderStateMutator, $this->requestStack),
+ );
+ }
+
+ /**
+ * @param CustomerInterface&MockObject|null $cardCustomer customer the selected Card belongs
+ * to; defaults to the paying order's
+ * own customer (the happy path) —
+ * pass a different mock to exercise
+ * the ownership-mismatch guard
+ * @param PaymentMethodInterface&MockObject|null $cardPaymentMethod payment method the selected
+ * Card was saved under; defaults to
+ * the payment's own method (the happy
+ * path) — pass a different mock to
+ * exercise the account-mismatch guard
+ */
+ private function paymentRequestWithSelectedCard(
+ ?Card $card,
+ ?array $gatewayConfig = ['hfIdentifier' => 'acct_123'],
+ ?CustomerInterface $cardCustomer = null,
+ ?AddressInterface $billingAddress = null,
+ ?PaymentMethodInterface $cardPaymentMethod = null,
+ ?string $customerEmail = 'customer@example.com',
+ ): PaymentRequestInterface&MockObject
+ {
+ $this->requestStack->getSession()->set('payplug_payment_method', self::SELECTED_CARD_ID);
+
+ $method = $this->createMock(PaymentMethodInterface::class);
+ if (null !== $gatewayConfig) {
+ $config = $this->createMock(GatewayConfigInterface::class);
+ $config->method('getConfig')->willReturn($gatewayConfig);
+ $method->method('getGatewayConfig')->willReturn($config);
+ }
+
+ $customer = $this->createMock(CustomerInterface::class);
+ $customer->method('getId')->willReturn(7);
+ $customer->method('getEmail')->willReturn($customerEmail);
+
+ $card?->setCustomer($cardCustomer ?? $customer);
+ $card?->setPaymentMethod($cardPaymentMethod ?? $method);
+ $this->payplugCardRepository->method('find')->with(self::SELECTED_CARD_ID)->willReturn($card);
+
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getCustomer')->willReturn($customer);
+ $order->method('getNumber')->willReturn('00000042');
+ $order->method('getBillingAddress')->willReturn($billingAddress);
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getId')->willReturn(42);
+ $payment->method('getDetails')->willReturn([]);
+ $payment->method('getMethod')->willReturn($method);
+ $payment->method('getOrder')->willReturn($order);
+ $payment->method('getAmount')->willReturn(1000);
+ $payment->method('getCurrencyCode')->willReturn('EUR');
+
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $paymentRequest->method('getPayment')->willReturn($payment);
+ $paymentRequest->method('getHash')->willReturn(Uuid::v4());
+
+ $this->paymentRequestProvider->method('provide')->willReturn($paymentRequest);
+
+ return $paymentRequest;
+ }
+
+ private function savedCard(): Card
+ {
+ return (new Card())->setExternalId('alias_existing_1')->setBrand('VISA')->setLast4('4242')
+ ->setExpirationMonth(12)->setExpirationYear(2030)->setCountryCode('FR')->setIsLive(false);
+ }
+
+ public function testInvoke_withNoCardSelected_failsThePaymentRequestInsteadOfCrashing(): void
+ {
+ $paymentRequest = $this->paymentRequestWithSelectedCard(null);
+
+ $this->unifiedApiPaymentCreator->expects(self::never())->method('createPayment');
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_FAIL);
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+
+ public function testInvoke_withGatewayConfigMissingAccountId_failsThePaymentRequestInsteadOfCrashing(): void
+ {
+ $paymentRequest = $this->paymentRequestWithSelectedCard($this->savedCard(), gatewayConfig: null);
+
+ $this->unifiedApiPaymentCreator->expects(self::never())->method('createPayment');
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_FAIL);
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+
+ public function testInvoke_onDirectSuccess_completesThePaymentRequestWithoutARedirect(): void
+ {
+ $paymentRequest = $this->paymentRequestWithSelectedCard($this->savedCard());
+
+ $this->unifiedApiPaymentCreator->method('createPayment')->willReturn(new PaymentOutput(201, '{"id":"pay_1"}', null, null, 'alias_existing_1'));
+
+ $paymentRequest->expects(self::once())->method('setResponseData')
+ ->with(self::callback(static fn (array $data): bool => !isset($data['redirect_url'])));
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_COMPLETE);
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+
+ public function testInvoke_onApiException_failsThePaymentRequest(): void
+ {
+ $paymentRequest = $this->paymentRequestWithSelectedCard($this->savedCard());
+
+ $this->unifiedApiPaymentCreator->method('createPayment')->willThrowException(new ApiException('boom'));
+
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_FAIL);
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+
+ public function testInvoke_withCardBelongingToAnotherCustomer_failsThePaymentRequest(): void
+ {
+ $anotherCustomer = $this->createMock(CustomerInterface::class);
+ $paymentRequest = $this->paymentRequestWithSelectedCard($this->savedCard(), cardCustomer: $anotherCustomer);
+
+ $this->unifiedApiPaymentCreator->expects(self::never())->method('createPayment');
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_FAIL);
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+
+ public function testInvoke_withCardBelongingToAnotherPaymentMethod_failsThePaymentRequest(): void
+ {
+ $anotherMethod = $this->createMock(PaymentMethodInterface::class);
+ $paymentRequest = $this->paymentRequestWithSelectedCard($this->savedCard(), cardPaymentMethod: $anotherMethod);
+
+ $this->unifiedApiPaymentCreator->expects(self::never())->method('createPayment');
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_FAIL);
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+
+ public function testInvoke_withNoCustomerEmail_failsThePaymentRequest(): void
+ {
+ $paymentRequest = $this->paymentRequestWithSelectedCard($this->savedCard(), customerEmail: null);
+
+ $this->unifiedApiPaymentCreator->expects(self::never())->method('createPayment');
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_FAIL);
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+
+ public function testInvoke_onDirectSuccessWithSuccessExecCode_appliesPaidOutcomeToOrderStateMutator(): void
+ {
+ $this->paymentRequestWithSelectedCard($this->savedCard());
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1","execCode":"0000"}', null, null, 'alias_existing_1'));
+
+ $this->orderStateMutator->expects(self::once())->method('apply')->with('42', PaymentOutcome::PAID);
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+
+ public function testInvoke_onRedirectOutcome_neverAppliesOrderStateMutator(): void
+ {
+ $paymentRequest = $this->paymentRequestWithSelectedCard($this->savedCard());
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1"}', 'https://example.com/3ds', null, 'alias_existing_1'));
+
+ $this->orderStateMutator->expects(self::never())->method('apply');
+ $paymentRequest->expects(self::once())->method('setResponseData')
+ ->with(['redirect_url' => 'https://example.com/3ds']);
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+
+ public function testInvoke_onRedirectHtmlOutcome_storesRedirectHtmlAndNeverAppliesOrderStateMutator(): void
+ {
+ $paymentRequest = $this->paymentRequestWithSelectedCard($this->savedCard());
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1","execCode":"0001"}', null, '', 'alias_existing_1'));
+
+ $this->orderStateMutator->expects(self::never())->method('apply');
+ $paymentRequest->expects(self::once())->method('setResponseData')
+ ->with(['redirect_html' => '']);
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+
+ public function testInvoke_setsSuccessAndCancelUrlOnTheUnifiedApiRequest(): void
+ {
+ $this->paymentRequestWithSelectedCard($this->savedCard());
+
+ $this->unifiedApiPaymentCreator->expects(self::once())->method('createPayment')
+ ->with(self::callback(function (PaymentDto $dto): bool {
+ self::assertSame('https://shop.test/order/00000042/pay', $dto->common->successUrl);
+ self::assertSame('https://shop.test/order/00000042/pay?status=canceled', $dto->common->cancelUrl);
+
+ return true;
+ }))
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1"}', null, null, 'alias_existing_1'));
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+
+ public function testInvoke_withABillingAddress_sendsItsFullNameAsThePaymentMethodDetails(): void
+ {
+ $billingAddress = $this->createMock(AddressInterface::class);
+ $billingAddress->method('getFullName')->willReturn('John Doe');
+
+ $this->paymentRequestWithSelectedCard($this->savedCard(), billingAddress: $billingAddress);
+
+ $this->unifiedApiPaymentCreator->expects(self::once())->method('createPayment')
+ ->with(self::callback(function (PaymentDto $dto): bool {
+ self::assertIsArray($dto->paymentMethod);
+ self::assertSame('John Doe', $dto->paymentMethod['details']['fullName'] ?? null);
+
+ return true;
+ }))
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1"}', null, null, 'alias_existing_1'));
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+
+ public function testInvoke_withNoBillingAddress_leavesPaymentMethodNull(): void
+ {
+ $this->paymentRequestWithSelectedCard($this->savedCard());
+
+ $this->unifiedApiPaymentCreator->expects(self::once())->method('createPayment')
+ ->with(self::callback(function (PaymentDto $dto): bool {
+ self::assertNull($dto->paymentMethod);
+
+ return true;
+ }))
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1"}', null, null, 'alias_existing_1'));
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+
+ public function testInvoke_onSuccess_storesTheUnifiedApiPaymentAndOperationIdsOnThePaymentDetails(): void
+ {
+ $paymentRequest = $this->paymentRequestWithSelectedCard($this->savedCard());
+ $payment = $paymentRequest->getPayment();
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1","execCode":"0000","operationIds":["op_1"]}', null, null, 'alias_existing_1'));
+
+ $payment->expects(self::once())->method('setDetails')
+ ->with(self::callback(static fn (array $details): bool => 'pay_1' === ($details['hosted_fields_payment_id'] ?? null) &&
+ 'op_1' === ($details['hosted_fields_operation_id'] ?? null) &&
+ 'alias_existing_1' === ($details['alias_id'] ?? null)));
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+
+ public function testInvoke_sendsTheSavedCardAliasOnlyThroughTheDtoAndCompletesWhenOutputCarriesNoAliasId(): void
+ {
+ $card = $this->savedCard();
+ $paymentRequest = $this->paymentRequestWithSelectedCard($card);
+ $payment = $paymentRequest->getPayment();
+
+ $this->unifiedApiPaymentCreator->expects(self::once())->method('createPayment')
+ ->with(self::callback(static function (PaymentDto $dto) use ($card): bool {
+ self::assertSame($card->getExternalId(), $dto->aliasId);
+ foreach (['id', 'storedId'] as $reserved) {
+ self::assertArrayNotHasKey($reserved, $dto->paymentMethod ?? []);
+ }
+
+ return true;
+ }))
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1","execCode":"0000"}', null, null, null));
+
+ $payment->expects(self::once())->method('setDetails')
+ ->with(self::callback(static fn (array $details): bool => 'alias_existing_1' === ($details['alias_id'] ?? null)));
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_COMPLETE);
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+
+ public function testInvoke_whenResponseHasNoPaymentId_stillCompletesAndLogsAWarning(): void
+ {
+ $paymentRequest = $this->paymentRequestWithSelectedCard($this->savedCard());
+ $payment = $paymentRequest->getPayment();
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"execCode":"0000","operationIds":["op_1"]}', null, null, null));
+
+ $payment->expects(self::once())->method('setDetails')
+ ->with(self::callback(static fn (array $details): bool => !isset($details['hosted_fields_payment_id']) &&
+ 'op_1' === ($details['hosted_fields_operation_id'] ?? null)));
+ $this->logger->expects(self::once())->method('warning')
+ ->with(self::stringContains('carried no payment id'), self::anything());
+ $this->orderStateMutator->expects(self::once())->method('apply')->with('42', PaymentOutcome::PAID);
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_COMPLETE);
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+
+ public function testInvoke_whenResponseHasAPaymentId_logsNoWarning(): void
+ {
+ $this->paymentRequestWithSelectedCard($this->savedCard());
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1","execCode":"0000","operationIds":["op_1"]}', null, null, null));
+
+ $this->logger->expects(self::never())->method('warning');
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+
+ public function testInvoke_onPending3ds_storesTheUnifiedApiPaymentAndOperationIdsOnThePaymentDetails(): void
+ {
+ $paymentRequest = $this->paymentRequestWithSelectedCard($this->savedCard());
+ $payment = $paymentRequest->getPayment();
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(200, '{"id":"pay_1","execCode":"0001","operationIds":["op_1"]}', 'https://example.com/3ds', null, 'alias_existing_1'));
+
+ $payment->expects(self::once())->method('setDetails')
+ ->with(self::callback(static fn (array $details): bool => 'pay_1' === ($details['hosted_fields_payment_id'] ?? null) &&
+ 'op_1' === ($details['hosted_fields_operation_id'] ?? null)));
+
+ $this->handler->__invoke(new CaptureAliasPaymentRequest(null));
+ }
+}
diff --git a/tests/PHPUnit/Command/Handler/CaptureHostedPaymentRequestHandlerTest.php b/tests/PHPUnit/Command/Handler/CaptureHostedPaymentRequestHandlerTest.php
new file mode 100644
index 00000000..09f20306
--- /dev/null
+++ b/tests/PHPUnit/Command/Handler/CaptureHostedPaymentRequestHandlerTest.php
@@ -0,0 +1,673 @@
+paymentRequestProvider = $this->createMock(PaymentRequestProviderInterface::class);
+ $this->stateMachine = $this->createMock(StateMachineInterface::class);
+ $this->unifiedApiPaymentCreator = $this->createMock(UnifiedApiPaymentCreatorInterface::class);
+ $this->operationStatusFetcher = $this->createMock(OperationStatusFetcherInterface::class);
+ $this->afterPayUrlProvider = $this->createMock(UrlProviderInterface::class);
+ $this->afterPayUrlProvider->method('getUrl')->willReturn('https://shop.test/order/00000042/pay');
+ $this->urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+ $this->logger = $this->createMock(LoggerInterface::class);
+ $this->requestStack = $this->createMock(RequestStack::class);
+ $this->orderStateMutator = $this->createMock(IOrderStateMutator::class);
+ $this->payplugCardFactory = $this->createMock(FactoryInterface::class);
+ $this->payplugCardRepository = $this->createMock(RepositoryInterface::class);
+ $this->managerRegistry = $this->createMock(ManagerRegistry::class);
+
+ $this->handler = new CaptureHostedPaymentRequestHandler(
+ $this->paymentRequestProvider,
+ $this->stateMachine,
+ $this->unifiedApiPaymentCreator,
+ $this->operationStatusFetcher,
+ new PaymentCaptureContextBuilder($this->urlGenerator, $this->afterPayUrlProvider, new OrderAddressDtoCreator(), $this->requestStack),
+ new PaymentCaptureOutcomeApplier($this->logger, $this->stateMachine, $this->orderStateMutator, $this->requestStack),
+ new PayplugCardPersister($this->payplugCardFactory, $this->payplugCardRepository, $this->managerRegistry),
+ $this->logger,
+ );
+ }
+
+ private function paymentRequestWithPayment(
+ array $details,
+ int $amount = 1000,
+ string $currency = 'EUR',
+ ?array $gatewayConfig = ['hfIdentifier' => 'acct_123'],
+ ?AddressInterface $billingAddress = null,
+ ): PaymentRequestInterface&MockObject
+ {
+ $method = $this->createMock(PaymentMethodInterface::class);
+ if (null !== $gatewayConfig) {
+ $config = $this->createMock(GatewayConfigInterface::class);
+ $config->method('getConfig')->willReturn($gatewayConfig);
+ $method->method('getGatewayConfig')->willReturn($config);
+ }
+
+ $customer = $this->createMock(CustomerInterface::class);
+ $customer->method('getId')->willReturn(7);
+ $customer->method('getEmail')->willReturn('customer@example.com');
+
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getCustomer')->willReturn($customer);
+ $order->method('getBillingAddress')->willReturn($billingAddress);
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getId')->willReturn(42);
+ $payment->method('getDetails')->willReturn($details);
+ $payment->method('getMethod')->willReturn($method);
+ $payment->method('getOrder')->willReturn($order);
+ $payment->method('getAmount')->willReturn($amount);
+ $payment->method('getCurrencyCode')->willReturn($currency);
+
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $paymentRequest->method('getPayment')->willReturn($payment);
+ $paymentRequest->method('getHash')->willReturn(Uuid::v4());
+
+ $this->paymentRequestProvider->method('provide')->willReturn($paymentRequest);
+
+ return $paymentRequest;
+ }
+
+ public function testInvoke_onDirectSuccess_completesThePaymentRequestWithoutARedirect(): void
+ {
+ $paymentRequest = $this->paymentRequestWithPayment([
+ 'hosted_fields_token' => 'hf_token_abc',
+ 'hosted_fields_selected_brand' => 'VISA',
+ ]);
+
+ $this->unifiedApiPaymentCreator->method('createPayment')->willReturn(new PaymentOutput(201, '{"id":"pay_1"}', null, null, null));
+
+ $paymentRequest->expects(self::once())->method('setResponseData')
+ ->with(self::callback(static fn (array $data): bool => !isset($data['redirect_url'])));
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_COMPLETE);
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest($paymentRequest->getId()));
+ }
+
+ public function testInvoke_whenNoHostedFieldsTokenStored_failsThePaymentRequestInsteadOfCrashing(): void
+ {
+ $paymentRequest = $this->paymentRequestWithPayment([]);
+
+ $this->unifiedApiPaymentCreator->expects(self::never())->method('createPayment');
+ $paymentRequest->expects(self::once())->method('setResponseData')
+ ->with(self::callback(static fn (array $data): bool => isset($data['error'])));
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_FAIL);
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_whenGatewayConfigIsMissingAccountOrSubmerchantId_failsThePaymentRequestInsteadOfCrashing(): void
+ {
+ $paymentRequest = $this->paymentRequestWithPayment(['hosted_fields_token' => 'hf_token_abc'], gatewayConfig: null);
+
+ $this->unifiedApiPaymentCreator->expects(self::never())->method('createPayment');
+ $paymentRequest->expects(self::once())->method('setResponseData')
+ ->with(self::callback(static fn (array $data): bool => isset($data['error'])));
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_FAIL);
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_onApiException_failsThePaymentRequest(): void
+ {
+ $paymentRequest = $this->paymentRequestWithPayment(['hosted_fields_token' => 'hf_token_abc']);
+
+ $this->unifiedApiPaymentCreator->method('createPayment')->willThrowException(new ApiException('boom'));
+
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_FAIL);
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_whenCustomerEmailIsMissing_failsThePaymentRequestInsteadOfCallingUnifiedApiPaymentCreator(): void
+ {
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getConfig')->willReturn(['hfIdentifier' => 'acct_123']);
+ $method->method('getGatewayConfig')->willReturn($gatewayConfig);
+ $customer = $this->createMock(CustomerInterface::class);
+ $customer->method('getEmail')->willReturn(null);
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getCustomer')->willReturn($customer);
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getId')->willReturn(42);
+ $payment->method('getDetails')->willReturn(['hosted_fields_token' => 'hf_token_abc']);
+ $payment->method('getMethod')->willReturn($method);
+ $payment->method('getOrder')->willReturn($order);
+ $payment->method('getAmount')->willReturn(1000);
+ $payment->method('getCurrencyCode')->willReturn('EUR');
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $paymentRequest->method('getPayment')->willReturn($payment);
+ $paymentRequest->method('getHash')->willReturn(Uuid::v4());
+ $this->paymentRequestProvider->method('provide')->willReturn($paymentRequest);
+
+ $this->unifiedApiPaymentCreator->expects(self::never())->method('createPayment');
+ $paymentRequest->expects(self::once())->method('setResponseData')
+ ->with(self::callback(static fn (array $data): bool => isset($data['error'])));
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_FAIL);
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_onDirectSuccessWithoutExecCode_neverAppliesOrderStateMutator(): void
+ {
+ $this->paymentRequestWithPayment(['hosted_fields_token' => 'hf_token_abc']);
+
+ $this->unifiedApiPaymentCreator->method('createPayment')->willReturn(new PaymentOutput(201, '{"id":"pay_1"}', null, null, null));
+
+ $this->orderStateMutator->expects(self::never())->method('apply');
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_onDirectSuccessWithSuccessExecCode_appliesPaidOutcomeToOrderStateMutator(): void
+ {
+ $this->paymentRequestWithPayment(['hosted_fields_token' => 'hf_token_abc']);
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1","execCode":"0000"}', null, null, null));
+
+ $this->orderStateMutator->expects(self::once())->method('apply')->with('42', PaymentOutcome::PAID);
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_onDirectSuccessWithFailureExecCode_appliesFailedOutcomeToOrderStateMutator(): void
+ {
+ $this->paymentRequestWithPayment(['hosted_fields_token' => 'hf_token_abc']);
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1","execCode":"9999"}', null, null, null));
+
+ $this->orderStateMutator->expects(self::once())->method('apply')->with('42', PaymentOutcome::FAILED);
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_onRedirectOutcome_neverAppliesOrderStateMutator(): void
+ {
+ $paymentRequest = $this->paymentRequestWithPayment(['hosted_fields_token' => 'hf_token_abc']);
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1"}', 'https://example.com/3ds', null, null));
+
+ $this->orderStateMutator->expects(self::never())->method('apply');
+ $paymentRequest->expects(self::once())->method('setResponseData')
+ ->with(['redirect_url' => 'https://example.com/3ds']);
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_onPending3ds_storesTheUnifiedApiPaymentAndOperationIdsOnThePaymentDetails(): void
+ {
+ $paymentRequest = $this->paymentRequestWithPayment(['hosted_fields_token' => 'hf_token_abc']);
+ $payment = $paymentRequest->getPayment();
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(200, '{"id":"pay_1","execCode":"0001","operationIds":["op_1"]}', 'https://example.com/3ds', null, null));
+
+ $payment->expects(self::once())->method('setDetails')
+ ->with(self::callback(static fn (array $details): bool => 'pay_1' === $details['hosted_fields_payment_id'] &&
+ 'op_1' === $details['hosted_fields_operation_id']));
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_whenResponseBodyHasNoId_neverStoresAHostedFieldsPaymentOrOperationId(): void
+ {
+ $paymentRequest = $this->paymentRequestWithPayment(['hosted_fields_token' => 'hf_token_abc']);
+ $payment = $paymentRequest->getPayment();
+
+ $this->unifiedApiPaymentCreator->method('createPayment')->willReturn(new PaymentOutput(201, '{}', null, null, null));
+
+ $payment->expects(self::once())->method('setDetails')
+ ->with(self::callback(static fn (array $details): bool => !isset($details['hosted_fields_payment_id']) &&
+ !isset($details['hosted_fields_operation_id'])));
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_whenResponseHasNoPaymentId_stillCompletesAndLogsAWarning(): void
+ {
+ $paymentRequest = $this->paymentRequestWithPayment(['hosted_fields_token' => 'hf_token_abc']);
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"execCode":"0000","operationIds":["op_1"]}', null, null, null));
+
+ $this->logger->expects(self::once())->method('warning')
+ ->with(self::stringContains('carried no payment id'), self::anything());
+ $this->orderStateMutator->expects(self::once())->method('apply')->with('42', PaymentOutcome::PAID);
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_COMPLETE);
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_whenResponseHasAPaymentId_logsNoWarning(): void
+ {
+ $this->paymentRequestWithPayment(['hosted_fields_token' => 'hf_token_abc']);
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1","execCode":"0000","operationIds":["op_1"]}', null, null, null));
+
+ $this->logger->expects(self::never())->method('warning');
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_onRedirectHtmlOutcome_storesRedirectHtmlAndNeverAppliesOrderStateMutator(): void
+ {
+ $paymentRequest = $this->paymentRequestWithPayment(['hosted_fields_token' => 'hf_token_abc']);
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1","execCode":"0001"}', null, '', null));
+
+ $this->orderStateMutator->expects(self::never())->method('apply');
+ $paymentRequest->expects(self::once())->method('setResponseData')
+ ->with(['redirect_html' => '']);
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_setsSuccessAndCancelUrlOnTheUnifiedApiRequest(): void
+ {
+ $this->paymentRequestWithPayment(['hosted_fields_token' => 'hf_token_abc']);
+
+ $this->unifiedApiPaymentCreator->expects(self::once())->method('createPayment')
+ ->with(self::callback(function (HostedFieldDto $dto): bool {
+ self::assertSame('https://shop.test/order/00000042/pay', $dto->common->successUrl);
+ self::assertSame('https://shop.test/order/00000042/pay?status=canceled', $dto->common->cancelUrl);
+
+ return true;
+ }))
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1"}', null, null, null));
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_withABillingAddress_sendsItsFullNameAlongsideSelectedBrand(): void
+ {
+ $billingAddress = $this->createMock(AddressInterface::class);
+ $billingAddress->method('getFullName')->willReturn('John Doe');
+
+ $this->paymentRequestWithPayment(
+ ['hosted_fields_token' => 'hf_token_abc', 'hosted_fields_selected_brand' => 'VISA'],
+ billingAddress: $billingAddress,
+ );
+
+ $this->unifiedApiPaymentCreator->expects(self::once())->method('createPayment')
+ ->with(self::callback(function (HostedFieldDto $dto): bool {
+ self::assertIsArray($dto->paymentMethod);
+ self::assertSame('John Doe', $dto->paymentMethod['details']['fullName'] ?? null);
+ self::assertSame('VISA', $dto->paymentMethod['details']['selectedBrand'] ?? null);
+
+ return true;
+ }))
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1"}', null, null, null));
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_withNoBillingAddress_omitsFullNameButStillSendsSelectedBrand(): void
+ {
+ $this->paymentRequestWithPayment(['hosted_fields_token' => 'hf_token_abc', 'hosted_fields_selected_brand' => 'VISA']);
+
+ $this->unifiedApiPaymentCreator->expects(self::once())->method('createPayment')
+ ->with(self::callback(function (HostedFieldDto $dto): bool {
+ self::assertIsArray($dto->paymentMethod);
+ self::assertArrayNotHasKey('fullName', $dto->paymentMethod['details'] ?? []);
+ self::assertSame('VISA', $dto->paymentMethod['details']['selectedBrand'] ?? null);
+
+ return true;
+ }))
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1"}', null, null, null));
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_whenSaveCardRequestedWithNoFullNameOrBrandAvailable_omitsSaveFutureUsageInsteadOfFailingThePayment(): void
+ {
+ $paymentRequest = $this->paymentRequestWithPayment([
+ 'hosted_fields_token' => 'hf_token_abc',
+ 'hosted_fields_save_card' => true,
+ ]);
+
+ $this->unifiedApiPaymentCreator->expects(self::once())->method('createPayment')
+ ->with(self::callback(function (HostedFieldDto $dto): bool {
+ self::assertNull($dto->paymentMethod);
+
+ return true;
+ }))
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1"}', null, null, null));
+
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_COMPLETE);
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_whenSaveCardRequestedAndAliasReturned_persistsANewCard(): void
+ {
+ $billingAddress = $this->createMock(AddressInterface::class);
+ $billingAddress->method('getFullName')->willReturn('John Doe');
+
+ $paymentRequest = $this->paymentRequestWithPayment([
+ 'hosted_fields_token' => 'hf_token_abc',
+ 'hosted_fields_selected_brand' => 'VISA',
+ 'hosted_fields_save_card' => true,
+ 'hosted_fields_last4' => '4242',
+ 'hosted_fields_expiration_month' => 12,
+ 'hosted_fields_expiration_year' => 2030,
+ 'hosted_fields_country' => 'FR',
+ ], billingAddress: $billingAddress);
+
+ $this->unifiedApiPaymentCreator->expects(self::once())->method('createPayment')
+ ->with(self::callback(function (HostedFieldDto $dto): bool {
+ self::assertSame('ONE_CLICK', $dto->recurringMode);
+ self::assertIsArray($dto->paymentMethod);
+ self::assertTrue($dto->paymentMethod['saveFutureUsage'] ?? false);
+ self::assertSame('VISA', $dto->paymentMethod['details']['selectedBrand'] ?? null);
+
+ return true;
+ }))
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1","execCode":"0000"}', null, null, 'alias_new_1'));
+
+ $card = new Card();
+ $this->payplugCardFactory->method('createNew')->willReturn($card);
+ $this->payplugCardRepository->expects(self::once())->method('add')->with($card);
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+
+ self::assertSame('alias_new_1', $card->getExternalId());
+ self::assertSame('VISA', $card->getBrand());
+ self::assertSame('4242', $card->getLast4());
+ self::assertSame(12, $card->getExpirationMonth());
+ self::assertSame(2030, $card->getExpirationYear());
+ self::assertSame('FR', $card->getCountryCode());
+ }
+
+ public function testInvoke_neverSetsHfTokenIdOrStoredIdInPaymentMethod(): void
+ {
+ $billingAddress = $this->createMock(AddressInterface::class);
+ $billingAddress->method('getFullName')->willReturn('John Doe');
+ $this->paymentRequestWithPayment([
+ 'hosted_fields_token' => 'hf_token_abc',
+ 'hosted_fields_selected_brand' => 'VISA',
+ 'hosted_fields_save_card' => true,
+ ], billingAddress: $billingAddress);
+
+ $this->unifiedApiPaymentCreator->expects(self::once())->method('createPayment')
+ ->with(self::callback(static function (HostedFieldDto $dto): bool {
+ self::assertIsArray($dto->paymentMethod);
+ foreach (['hfToken', 'id', 'storedId'] as $reserved) {
+ self::assertArrayNotHasKey($reserved, $dto->paymentMethod);
+ }
+ self::assertSame('hf_token_abc', $dto->hfToken);
+
+ return true;
+ }))
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1","execCode":"0000"}', null, null, 'alias_new_1'));
+ $this->payplugCardFactory->method('createNew')->willReturn(new Card());
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_whenSaveCardRequestedAndUnifiedApiOperationIdAvailable_enrichesTheCardWithExpirationFetchedFromTheUnifiedApi(): void
+ {
+ $this->paymentRequestWithPayment([
+ 'hosted_fields_token' => 'hf_token_abc',
+ 'hosted_fields_selected_brand' => 'VISA',
+ 'hosted_fields_save_card' => true,
+ 'hosted_fields_country' => 'BE',
+ ]);
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1","execCode":"0000","operationIds":["op_1"]}', null, null, 'alias_new_1'));
+
+ // Real shape confirmed against a staging operation response: card metadata lives under
+ // paymentMethod.card (network, a masked code6x4 PAN standing in for a dedicated last4
+ // field) and paymentMethod.details (selectedBrand, validityDate in "YYYY-MM" form). No
+ // country field exists anywhere on that response.
+ $this->operationStatusFetcher->expects(self::once())->method('getOperation')
+ ->with('op_1')
+ ->willReturn(['status' => 200, 'body' => json_encode([
+ 'paymentMethod' => [
+ 'id' => 'alias_new_1',
+ 'card' => [
+ 'code6x4' => '424242XXXXXX4242',
+ 'network' => 'VISA',
+ ],
+ 'details' => [
+ 'fullName' => 'John Doe',
+ 'validityDate' => '2027-12',
+ 'selectedBrand' => 'VISA',
+ ],
+ ],
+ ])]);
+
+ $card = new Card();
+ $this->payplugCardFactory->method('createNew')->willReturn($card);
+ $this->payplugCardRepository->expects(self::once())->method('add')->with($card);
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+
+ self::assertSame('4242', $card->getLast4());
+ self::assertSame('BE', $card->getCountryCode());
+ self::assertSame(12, $card->getExpirationMonth());
+ self::assertSame(2027, $card->getExpirationYear());
+ }
+
+ public function testInvoke_whenSaveCardRequestedAndFetchingTheOperationFails_stillPersistsTheCardUsingDetailsFallback(): void
+ {
+ $this->paymentRequestWithPayment([
+ 'hosted_fields_token' => 'hf_token_abc',
+ 'hosted_fields_selected_brand' => 'VISA',
+ 'hosted_fields_save_card' => true,
+ 'hosted_fields_last4' => '4242',
+ 'hosted_fields_expiration_month' => 12,
+ 'hosted_fields_expiration_year' => 2030,
+ 'hosted_fields_country' => 'FR',
+ ]);
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1","execCode":"0000","operationIds":["op_1"]}', null, null, 'alias_new_1'));
+
+ $this->operationStatusFetcher->method('getOperation')->willThrowException(new ApiException('boom'));
+
+ $card = new Card();
+ $this->payplugCardFactory->method('createNew')->willReturn($card);
+ $this->payplugCardRepository->expects(self::once())->method('add')->with($card);
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+
+ self::assertSame('4242', $card->getLast4());
+ self::assertSame(12, $card->getExpirationMonth());
+ self::assertSame(2030, $card->getExpirationYear());
+ self::assertSame('FR', $card->getCountryCode());
+ }
+
+ /**
+ * @dataProvider malformedOperationResponseBodyProvider
+ */
+ public function testInvoke_whenSaveCardRequestedAndOperationResponseShapeIsMalformed_stillPersistsTheCardUsingDetailsFallback(
+ string $body,
+ ): void {
+ $this->paymentRequestWithPayment([
+ 'hosted_fields_token' => 'hf_token_abc',
+ 'hosted_fields_selected_brand' => 'VISA',
+ 'hosted_fields_save_card' => true,
+ 'hosted_fields_last4' => '4242',
+ 'hosted_fields_expiration_month' => 12,
+ 'hosted_fields_expiration_year' => 2030,
+ 'hosted_fields_country' => 'FR',
+ ]);
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1","execCode":"0000","operationIds":["op_1"]}', null, null, 'alias_new_1'));
+
+ $this->operationStatusFetcher->method('getOperation')->willReturn(['status' => 200, 'body' => $body]);
+
+ $card = new Card();
+ $this->payplugCardFactory->method('createNew')->willReturn($card);
+ $this->payplugCardRepository->expects(self::once())->method('add')->with($card);
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+
+ self::assertSame('4242', $card->getLast4());
+ self::assertSame(12, $card->getExpirationMonth());
+ self::assertSame(2030, $card->getExpirationYear());
+ self::assertSame('FR', $card->getCountryCode());
+ }
+
+ /** @return array */
+ public static function malformedOperationResponseBodyProvider(): array
+ {
+ return [
+ 'non-array body' => ['"just a string"'],
+ 'paymentMethod key missing' => [json_encode(['id' => 'op_1'])],
+ 'card key missing' => [json_encode(['paymentMethod' => ['details' => ['selectedBrand' => 'VISA']]])],
+ 'details key missing' => [json_encode(['paymentMethod' => ['card' => ['network' => 'VISA']]])],
+ 'validityDate does not match the expected YYYY-MM format' => [json_encode(['paymentMethod' => ['details' => ['validityDate' => '1225']]])],
+ 'validityDate has an out-of-range month' => [json_encode(['paymentMethod' => ['details' => ['validityDate' => '2027-13']]])],
+ 'code6x4 shorter than 4 characters' => [json_encode(['paymentMethod' => ['card' => ['code6x4' => '42']]])],
+ ];
+ }
+
+ public function testInvoke_whenSaveCardNotRequested_neverPersistsACard(): void
+ {
+ $this->paymentRequestWithPayment([
+ 'hosted_fields_token' => 'hf_token_abc',
+ 'hosted_fields_save_card' => false,
+ ]);
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1","execCode":"0000"}', null, null, null));
+
+ $this->payplugCardRepository->expects(self::never())->method('add');
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_whenSaveCardRequestedButNoAliasReturned_neverPersistsACard(): void
+ {
+ $this->paymentRequestWithPayment([
+ 'hosted_fields_token' => 'hf_token_abc',
+ 'hosted_fields_save_card' => true,
+ ]);
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1","execCode":"0000"}', null, null, null));
+
+ $this->payplugCardRepository->expects(self::never())->method('add');
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_whenSaveCardRequestedButMethodIsNotCorePaymentMethod_neverPersistsACard(): void
+ {
+ // Card::$paymentMethod requires Sylius Core's PaymentMethodInterface, which every real
+ // Sylius-wired payment method satisfies — a test double built against only the base
+ // Payment component's PaymentMethodInterface exercises the guard that skips persisting a
+ // card entirely rather than flushing one with that mandatory field left unset.
+ $method = $this->createMock(BasePaymentMethodInterface::class);
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getConfig')->willReturn(['hfIdentifier' => 'acct_123']);
+ $method->method('getGatewayConfig')->willReturn($gatewayConfig);
+ $customer = $this->createMock(CustomerInterface::class);
+ $customer->method('getId')->willReturn(7);
+ $customer->method('getEmail')->willReturn('customer@example.com');
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getCustomer')->willReturn($customer);
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getId')->willReturn(42);
+ $payment->method('getDetails')->willReturn(['hosted_fields_token' => 'hf_token_abc', 'hosted_fields_save_card' => true]);
+ $payment->method('getMethod')->willReturn($method);
+ $payment->method('getOrder')->willReturn($order);
+ $payment->method('getAmount')->willReturn(1000);
+ $payment->method('getCurrencyCode')->willReturn('EUR');
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $paymentRequest->method('getPayment')->willReturn($payment);
+ $paymentRequest->method('getHash')->willReturn(Uuid::v4());
+ $this->paymentRequestProvider->method('provide')->willReturn($paymentRequest);
+
+ $this->unifiedApiPaymentCreator->method('createPayment')
+ ->willReturn(new PaymentOutput(201, '{"id":"pay_1","execCode":"0000"}', null, null, 'alias_new_1'));
+
+ $this->payplugCardRepository->expects(self::never())->method('add');
+
+ $this->handler->__invoke(new CaptureHostedPaymentRequest(null));
+ }
+}
diff --git a/tests/PHPUnit/Command/Handler/NotifyHostedPaymentRequestHandlerTest.php b/tests/PHPUnit/Command/Handler/NotifyHostedPaymentRequestHandlerTest.php
new file mode 100644
index 00000000..1e15f62a
--- /dev/null
+++ b/tests/PHPUnit/Command/Handler/NotifyHostedPaymentRequestHandlerTest.php
@@ -0,0 +1,223 @@
+paymentRequestProvider = $this->createMock(PaymentRequestProviderInterface::class);
+ $this->stateMachine = $this->createMock(StateMachineInterface::class);
+ $this->lock = $this->createMock(ILock::class);
+ $this->paymentRepository = $this->createMock(IPaymentRepository::class);
+ $this->orderStateMutator = $this->createMock(IOrderStateMutator::class);
+ $this->configurationRepository = $this->createMock(ScopedConfigurationRepositoryInterface::class);
+ // The handler scopes before reading; these tests stub one account, so it scopes to itself.
+ $this->configurationRepository->method('forPaymentMethod')->willReturnSelf();
+ $this->logger = $this->createMock(LoggerInterface::class);
+
+ $this->handler = new NotifyHostedPaymentRequestHandler(
+ $this->paymentRequestProvider,
+ $this->stateMachine,
+ $this->lock,
+ $this->paymentRepository,
+ $this->orderStateMutator,
+ $this->configurationRepository,
+ $this->logger,
+ );
+ }
+
+ private function paymentRequestWithPayload(
+ array $httpRequest,
+ int $paymentId = 42,
+ int $paymentAmount = 1000,
+ ): PaymentRequestInterface&MockObject
+ {
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getId')->willReturn($paymentId);
+ $payment->method('getAmount')->willReturn($paymentAmount);
+ // The handler resolves the webhook secret from the payment's own method's gateway config.
+ $payment->method('getMethod')->willReturn($this->createMock(PaymentMethodInterface::class));
+
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $paymentRequest->method('getPayload')->willReturn(['http_request' => $httpRequest]);
+ $paymentRequest->method('getPayment')->willReturn($payment);
+ $this->paymentRequestProvider->method('provide')->willReturn($paymentRequest);
+
+ return $paymentRequest;
+ }
+
+ public function testInvoke_onValidNotification_savesTreatsAndAppliesTheOutcome(): void
+ {
+ $body = \json_encode(['id' => 'op_123', 'execCode' => '0000', 'orderId' => '42', 'amount' => 1000]);
+ $paymentRequest = $this->paymentRequestWithPayload([
+ 'content' => $body,
+ 'headers' => ['Authorization' => ['Bearer shared-secret']],
+ ]);
+
+ $this->configurationRepository->method('get')->with('payplug_webhook_authorization_header')->willReturn('Bearer shared-secret');
+ $this->lock->method('acquire')->willReturn(true);
+ $this->paymentRepository->method('isTreated')->with('op_123')->willReturn(false);
+
+ $this->paymentRepository->expects(self::once())->method('save');
+ $this->paymentRepository->expects(self::once())->method('markTreated')->with('op_123');
+ $this->orderStateMutator->expects(self::once())->method('apply')->with('42', PaymentOutcome::PAID);
+ $this->lock->expects(self::once())->method('release');
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_COMPLETE);
+
+ $this->handler->__invoke(new NotifyHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_onPendingThreeDsOutcome_doesNothingAndReleasesTheLock(): void
+ {
+ $body = \json_encode(['id' => 'op_123', 'execCode' => '0001', 'orderId' => '42', 'amount' => 1000]);
+ $this->paymentRequestWithPayload([
+ 'content' => $body,
+ 'headers' => ['Authorization' => ['Bearer shared-secret']],
+ ]);
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->lock->method('acquire')->willReturn(true);
+
+ $this->paymentRepository->expects(self::never())->method('isTreated');
+ $this->paymentRepository->expects(self::never())->method('save');
+ $this->orderStateMutator->expects(self::never())->method('apply');
+ $this->lock->expects(self::once())->method('release');
+ $this->stateMachine->expects(self::never())->method('apply');
+
+ $this->handler->__invoke(new NotifyHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_whenLockIsHeld_releasesNothingAndCompletesWithoutApplying(): void
+ {
+ $paymentRequest = $this->paymentRequestWithPayload(['content' => '{}', 'headers' => []]);
+ $this->lock->method('acquire')->willReturn(false);
+
+ $this->paymentRepository->expects(self::never())->method('save');
+ $this->orderStateMutator->expects(self::never())->method('apply');
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_COMPLETE);
+
+ $this->handler->__invoke(new NotifyHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_whenAlreadyTreated_isIdempotentAndDoesNotReapply(): void
+ {
+ $body = \json_encode(['id' => 'op_123', 'execCode' => '0000', 'orderId' => '42', 'amount' => 1000]);
+ $this->paymentRequestWithPayload([
+ 'content' => $body,
+ 'headers' => ['Authorization' => ['Bearer shared-secret']],
+ ]);
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->lock->method('acquire')->willReturn(true);
+ $this->paymentRepository->method('isTreated')->with('op_123')->willReturn(true);
+
+ $this->paymentRepository->expects(self::never())->method('save');
+ $this->orderStateMutator->expects(self::never())->method('apply');
+ $this->lock->expects(self::once())->method('release');
+
+ $this->handler->__invoke(new NotifyHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_whenOrderIdDoesNotMatchThePaymentRequestsOwnPayment_failsWithoutApplyingTheOutcome(): void
+ {
+ // The webhook body claims to be about order/payment "999", but the notify hash this
+ // request arrived on belongs to a PaymentRequest whose own payment id is 42. Applying the
+ // outcome here would mutate the wrong payment.
+ $body = \json_encode(['id' => 'op_123', 'execCode' => '0000', 'orderId' => '999', 'amount' => 1000]);
+ $paymentRequest = $this->paymentRequestWithPayload([
+ 'content' => $body,
+ 'headers' => ['Authorization' => ['Bearer shared-secret']],
+ ], 42, 1000);
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->lock->method('acquire')->willReturn(true);
+
+ $this->paymentRepository->expects(self::never())->method('save');
+ $this->paymentRepository->expects(self::never())->method('markTreated');
+ $this->orderStateMutator->expects(self::never())->method('apply');
+ $this->logger->expects(self::once())->method('error');
+ $this->lock->expects(self::once())->method('release');
+ $paymentRequest->expects(self::once())->method('setResponseData');
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_FAIL);
+
+ $this->handler->__invoke(new NotifyHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_whenAmountDoesNotMatchThePaymentRequestsOwnPayment_failsWithoutApplyingTheOutcome(): void
+ {
+ $body = \json_encode(['id' => 'op_123', 'execCode' => '0000', 'orderId' => '42', 'amount' => 500]);
+ $paymentRequest = $this->paymentRequestWithPayload([
+ 'content' => $body,
+ 'headers' => ['Authorization' => ['Bearer shared-secret']],
+ ], 42, 1000);
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->lock->method('acquire')->willReturn(true);
+
+ $this->paymentRepository->expects(self::never())->method('save');
+ $this->orderStateMutator->expects(self::never())->method('apply');
+ $this->logger->expects(self::once())->method('error');
+ $this->lock->expects(self::once())->method('release');
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_FAIL);
+
+ $this->handler->__invoke(new NotifyHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_onInvalidSignature_logsReleasesTheLockAndFailsThePaymentRequest(): void
+ {
+ $paymentRequest = $this->paymentRequestWithPayload([
+ 'content' => '{}',
+ 'headers' => ['Authorization' => ['Bearer wrong-secret']],
+ ]);
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->lock->method('acquire')->willReturn(true);
+
+ $this->logger->expects(self::once())->method('error');
+ $this->lock->expects(self::once())->method('release');
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_FAIL);
+
+ $this->handler->__invoke(new NotifyHostedPaymentRequest(null));
+ }
+}
diff --git a/tests/PHPUnit/Command/Handler/StatusHostedPaymentRequestHandlerTest.php b/tests/PHPUnit/Command/Handler/StatusHostedPaymentRequestHandlerTest.php
new file mode 100644
index 00000000..064d7b12
--- /dev/null
+++ b/tests/PHPUnit/Command/Handler/StatusHostedPaymentRequestHandlerTest.php
@@ -0,0 +1,175 @@
+paymentRequestProvider = $this->createMock(PaymentRequestProviderInterface::class);
+ $this->stateMachine = $this->createMock(StateMachineInterface::class);
+ $this->operationStatusFetcher = $this->createMock(OperationStatusFetcherInterface::class);
+ $this->webhookNotificationHandler = $this->createMock(HostedFieldsWebhookNotificationHandler::class);
+ $this->logger = $this->createMock(LoggerInterface::class);
+
+ $this->handler = new StatusHostedPaymentRequestHandler(
+ $this->paymentRequestProvider,
+ $this->stateMachine,
+ $this->operationStatusFetcher,
+ $this->webhookNotificationHandler,
+ $this->logger,
+ );
+ }
+
+ /** @param mixed[] $details */
+ private function paymentRequest(
+ string $state = PaymentInterface::STATE_PROCESSING,
+ array $details = [],
+ ): PaymentRequestInterface&MockObject
+ {
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getState')->willReturn($state);
+ $payment->method('getDetails')->willReturn($details);
+ // The poll authenticates against the payment's own method's account.
+ $payment->method('getMethod')->willReturn($this->createMock(PaymentMethodInterface::class));
+
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $paymentRequest->method('getPayment')->willReturn($payment);
+ $this->paymentRequestProvider->method('provide')->willReturn($paymentRequest);
+
+ return $paymentRequest;
+ }
+
+ public function testInvoke_withNoForcedStatus_andPaymentAlreadyResolved_skipsPollingAndCompletesRequest(): void
+ {
+ $paymentRequest = $this->paymentRequest(PaymentInterface::STATE_COMPLETED, ['hosted_fields_operation_id' => 'op_123']);
+
+ $this->operationStatusFetcher->expects(self::never())->method('getOperation');
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_COMPLETE);
+
+ $this->handler->__invoke(new StatusHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_withNoForcedStatus_andNoOperationIdStored_skipsPollingAndCompletesRequest(): void
+ {
+ $paymentRequest = $this->paymentRequest(PaymentInterface::STATE_PROCESSING, []);
+
+ $this->operationStatusFetcher->expects(self::never())->method('getOperation');
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_COMPLETE);
+
+ $this->handler->__invoke(new StatusHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_withNoForcedStatus_andFinalExecCode_appliesOutcomeViaWebhookHandler(): void
+ {
+ $paymentRequest = $this->paymentRequest(PaymentInterface::STATE_PROCESSING, ['hosted_fields_operation_id' => 'op_123']);
+ $payment = $paymentRequest->getPayment();
+ $body = json_encode(['id' => 'op_123', 'execCode' => '0000', 'orderId' => '000000072', 'amount' => 7400]);
+
+ $this->operationStatusFetcher->expects(self::once())->method('getOperation')->with('op_123')
+ ->willReturn(['status' => 200, 'body' => $body]);
+ $this->webhookNotificationHandler->expects(self::once())->method('treat')->with($payment, $body, []);
+
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_COMPLETE);
+
+ $this->handler->__invoke(new StatusHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_withNoForcedStatus_andPendingExecCode_stillDelegatesToWebhookHandler(): void
+ {
+ $paymentRequest = $this->paymentRequest(PaymentInterface::STATE_PROCESSING, ['hosted_fields_operation_id' => 'op_123']);
+ $payment = $paymentRequest->getPayment();
+ $body = json_encode(['id' => 'op_123', 'execCode' => '0001', 'orderId' => '000000072', 'amount' => 7400]);
+
+ $this->operationStatusFetcher->method('getOperation')->willReturn(['status' => 200, 'body' => $body]);
+ $this->webhookNotificationHandler->expects(self::once())->method('treat')->with($payment, $body, []);
+
+ $this->handler->__invoke(new StatusHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_withNoForcedStatus_whenFetcherFails_logsAndStillCompletesRequest(): void
+ {
+ $paymentRequest = $this->paymentRequest(PaymentInterface::STATE_PROCESSING, ['hosted_fields_operation_id' => 'op_123']);
+
+ $this->operationStatusFetcher->method('getOperation')->willThrowException(new ApiException('boom'));
+ $this->webhookNotificationHandler->expects(self::never())->method('treat');
+ $this->logger->expects(self::once())->method('error');
+
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_COMPLETE);
+
+ $this->handler->__invoke(new StatusHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_withNoForcedStatus_whenWebhookHandlerRejectsThePayload_logsAndStillCompletesRequest(): void
+ {
+ $paymentRequest = $this->paymentRequest(PaymentInterface::STATE_PROCESSING, ['hosted_fields_operation_id' => 'op_123']);
+ $body = json_encode(['id' => 'op_123', 'execCode' => '0000', 'orderId' => '000000072', 'amount' => 7400]);
+
+ $this->operationStatusFetcher->method('getOperation')->willReturn(['status' => 200, 'body' => $body]);
+ $this->webhookNotificationHandler->method('treat')->willThrowException(new InvalidNotificationException('mismatch'));
+ $this->logger->expects(self::once())->method('error');
+
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_COMPLETE);
+
+ $this->handler->__invoke(new StatusHostedPaymentRequest(null));
+ }
+
+ public function testInvoke_withForcedCanceledStatus_cancelsThePaymentWhenAllowed(): void
+ {
+ $paymentRequest = $this->paymentRequest();
+ $payment = $paymentRequest->getPayment();
+
+ $this->stateMachine->method('can')->with($payment, PaymentTransitions::GRAPH, PaymentTransitions::TRANSITION_CANCEL)->willReturn(true);
+ $this->operationStatusFetcher->expects(self::never())->method('getOperation');
+ $this->stateMachine->expects(self::exactly(2))->method('apply');
+
+ $this->handler->__invoke(new StatusHostedPaymentRequest(null, 'canceled'));
+ }
+
+ public function testInvoke_withForcedCanceledStatus_whenTransitionNotAllowed_stillCompletesThePaymentRequest(): void
+ {
+ $paymentRequest = $this->paymentRequest();
+
+ $this->stateMachine->method('can')->willReturn(false);
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_COMPLETE);
+
+ $this->handler->__invoke(new StatusHostedPaymentRequest(null, 'canceled'));
+ }
+}
diff --git a/tests/PHPUnit/Command/Provider/CaptureHostedPaymentRequestCommandProviderTest.php b/tests/PHPUnit/Command/Provider/CaptureHostedPaymentRequestCommandProviderTest.php
new file mode 100644
index 00000000..c05fbe86
--- /dev/null
+++ b/tests/PHPUnit/Command/Provider/CaptureHostedPaymentRequestCommandProviderTest.php
@@ -0,0 +1,136 @@
+setSession(new Session(new MockArraySessionStorage()));
+
+ $this->requestStack = new RequestStack();
+ $this->requestStack->push($request);
+ $this->payplugCardRepository = $this->createMock(RepositoryInterface::class);
+
+ $this->provider = new CaptureHostedPaymentRequestCommandProvider(new SelectedCardResolver($this->requestStack, $this->payplugCardRepository));
+ }
+
+ private function paymentRequestWithDetails(array $details): PaymentRequestInterface&MockObject
+ {
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getDetails')->willReturn($details);
+
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $paymentRequest->method('getPayment')->willReturn($payment);
+ $paymentRequest->method('getId')->willReturn('1');
+
+ return $paymentRequest;
+ }
+
+ public function testProvide_withNoCardSelected_returnsCaptureHostedPaymentRequest(): void
+ {
+ $paymentRequest = $this->paymentRequestWithDetails([]);
+
+ self::assertInstanceOf(CaptureHostedPaymentRequest::class, $this->provider->provide($paymentRequest));
+ }
+
+ public function testProvide_withOtherCardSentinelSelected_returnsCaptureHostedPaymentRequest(): void
+ {
+ $this->requestStack->getSession()->set('payplug_payment_method', 'other');
+ $paymentRequest = $this->paymentRequestWithDetails([]);
+
+ self::assertInstanceOf(CaptureHostedPaymentRequest::class, $this->provider->provide($paymentRequest));
+ }
+
+ public function testProvide_withExistingCardSelectedAndNotYetCaptured_returnsCaptureAliasPaymentRequest(): void
+ {
+ $this->requestStack->getSession()->set('payplug_payment_method', self::SELECTED_CARD_ID);
+ $this->payplugCardRepository->method('find')->with(self::SELECTED_CARD_ID)->willReturn(new Card());
+ $paymentRequest = $this->paymentRequestWithDetails([]);
+
+ self::assertInstanceOf(CaptureAliasPaymentRequest::class, $this->provider->provide($paymentRequest));
+ }
+
+ public function testProvide_withExistingCardSelectedButAlreadyCaptured_returnsOfflineCaptureRequest(): void
+ {
+ $card = new Card();
+ $card->setExternalId('alias_existing_1');
+
+ $this->requestStack->getSession()->set('payplug_payment_method', self::SELECTED_CARD_ID);
+ $this->payplugCardRepository->method('find')->with(self::SELECTED_CARD_ID)->willReturn($card);
+ $paymentRequest = $this->paymentRequestWithDetails([
+ 'alias_payment_created_at' => '2026-08-17T10:00:00+00:00',
+ 'alias_id' => 'alias_existing_1',
+ ]);
+
+ self::assertInstanceOf(OfflineCapturePaymentRequest::class, $this->provider->provide($paymentRequest));
+ }
+
+ public function testProvide_withDifferentCardSelectedAfterEarlierAliasAttempt_returnsFreshCaptureAliasPaymentRequest(): void
+ {
+ $card = new Card();
+ $card->setExternalId('alias_new');
+
+ $this->requestStack->getSession()->set('payplug_payment_method', self::SELECTED_CARD_ID);
+ $this->payplugCardRepository->method('find')->with(self::SELECTED_CARD_ID)->willReturn($card);
+ $paymentRequest = $this->paymentRequestWithDetails([
+ 'alias_payment_created_at' => '2026-08-17T10:00:00+00:00',
+ 'alias_id' => 'alias_old',
+ ]);
+
+ self::assertInstanceOf(CaptureAliasPaymentRequest::class, $this->provider->provide($paymentRequest));
+ }
+
+ public function testProvide_withNoCardSelectedAfterEarlierAliasAttempt_returnsOfflineCaptureRequestInsteadOfADuplicateCapture(): void
+ {
+ $paymentRequest = $this->paymentRequestWithDetails([
+ 'alias_payment_created_at' => '2026-08-17T10:00:00+00:00',
+ 'alias_id' => 'alias_old',
+ ]);
+
+ self::assertInstanceOf(OfflineCapturePaymentRequest::class, $this->provider->provide($paymentRequest));
+ }
+
+ public function testProvide_withHostedFieldsTokenAlreadyCaptured_returnsOfflineCaptureRequest(): void
+ {
+ $paymentRequest = $this->paymentRequestWithDetails(['hosted_fields_created_at' => '2026-08-17T10:00:00+00:00']);
+
+ self::assertInstanceOf(OfflineCapturePaymentRequest::class, $this->provider->provide($paymentRequest));
+ }
+
+ public function testProvide_withSelectedCardIdNoLongerFound_fallsBackToCaptureHostedPaymentRequest(): void
+ {
+ $this->requestStack->getSession()->set('payplug_payment_method', self::SELECTED_CARD_ID);
+ $this->payplugCardRepository->method('find')->with(self::SELECTED_CARD_ID)->willReturn(null);
+ $paymentRequest = $this->paymentRequestWithDetails([]);
+
+ self::assertInstanceOf(CaptureHostedPaymentRequest::class, $this->provider->provide($paymentRequest));
+ }
+}
diff --git a/tests/PHPUnit/Command/Provider/CapturePaymentRequestCommandProviderTest.php b/tests/PHPUnit/Command/Provider/CapturePaymentRequestCommandProviderTest.php
new file mode 100644
index 00000000..2801cbfb
--- /dev/null
+++ b/tests/PHPUnit/Command/Provider/CapturePaymentRequestCommandProviderTest.php
@@ -0,0 +1,103 @@
+hostedFieldsCommandProvider = $this->createMock(PaymentRequestCommandProviderInterface::class);
+ $this->provider = new CapturePaymentRequestCommandProvider($this->hostedFieldsCommandProvider);
+ }
+
+ public function testProvide_forPayplugWithHostedFieldsEnabled_delegatesToHostedFieldsProvider(): void
+ {
+ $paymentRequest = $this->paymentRequestWithConfig([
+ 'factoryName' => PayPlugGatewayFactory::FACTORY_NAME,
+ 'config' => [PayPlugGatewayFactory::HOSTED_FIELDS => true],
+ ]);
+
+ $expected = new CaptureHostedPaymentRequest('1');
+ $this->hostedFieldsCommandProvider->expects(self::once())->method('provide')
+ ->with($paymentRequest)->willReturn($expected);
+
+ self::assertSame($expected, $this->provider->provide($paymentRequest));
+ }
+
+ public function testProvide_forPayplugWithoutHostedFields_usesLegacyFlow(): void
+ {
+ $paymentRequest = $this->paymentRequestWithConfig([
+ 'factoryName' => PayPlugGatewayFactory::FACTORY_NAME,
+ 'config' => [PayPlugGatewayFactory::HOSTED_FIELDS => false],
+ ]);
+
+ $this->hostedFieldsCommandProvider->expects(self::never())->method('provide');
+
+ self::assertInstanceOf(CapturePaymentRequest::class, $this->provider->provide($paymentRequest));
+ }
+
+ /**
+ * Other gateways (Oney, Bancontact, ...) never satisfy the Hosted Fields check regardless of
+ * their own config shape, since it's gated on the `payplug` factory name first — behavior for
+ * them must stay exactly as it was before this delegation was introduced.
+ */
+ public function testProvide_forOtherGatewayFactory_neverDelegatesEvenIfConfigHappensToHaveHostedFieldsKey(): void
+ {
+ $paymentRequest = $this->paymentRequestWithConfig([
+ 'factoryName' => 'payplug_oney',
+ 'config' => [PayPlugGatewayFactory::HOSTED_FIELDS => true],
+ ]);
+
+ $this->hostedFieldsCommandProvider->expects(self::never())->method('provide');
+
+ self::assertInstanceOf(CapturePaymentRequest::class, $this->provider->provide($paymentRequest));
+ }
+
+ public function testProvide_whenNoGatewayConfig_usesLegacyFlow(): void
+ {
+ $paymentRequest = $this->paymentRequestWithConfig(null);
+
+ $this->hostedFieldsCommandProvider->expects(self::never())->method('provide');
+
+ self::assertInstanceOf(CapturePaymentRequest::class, $this->provider->provide($paymentRequest));
+ }
+
+ public function testProvide_whenAlreadyCreated_returnsOfflineCaptureRequest(): void
+ {
+ $paymentRequest = $this->paymentRequestWithConfig(
+ ['factoryName' => PayPlugGatewayFactory::FACTORY_NAME, 'config' => [PayPlugGatewayFactory::HOSTED_FIELDS => false]],
+ ['status' => 'captured', 'payment_id' => 'pay_1'],
+ );
+
+ self::assertInstanceOf(OfflineCapturePaymentRequest::class, $this->provider->provide($paymentRequest));
+ }
+
+ public function testSupports_onlyForCaptureAction(): void
+ {
+ $captureRequest = $this->createMock(PaymentRequestInterface::class);
+ $captureRequest->method('getAction')->willReturn(PaymentRequestInterface::ACTION_CAPTURE);
+ self::assertTrue($this->provider->supports($captureRequest));
+
+ $notifyRequest = $this->createMock(PaymentRequestInterface::class);
+ $notifyRequest->method('getAction')->willReturn(PaymentRequestInterface::ACTION_NOTIFY);
+ self::assertFalse($this->provider->supports($notifyRequest));
+ }
+}
diff --git a/tests/PHPUnit/Command/Provider/NotifyPaymentRequestCommandProviderTest.php b/tests/PHPUnit/Command/Provider/NotifyPaymentRequestCommandProviderTest.php
new file mode 100644
index 00000000..ef0d431b
--- /dev/null
+++ b/tests/PHPUnit/Command/Provider/NotifyPaymentRequestCommandProviderTest.php
@@ -0,0 +1,80 @@
+hostedFieldsCommandProvider = $this->createMock(PaymentRequestCommandProviderInterface::class);
+ $this->provider = new NotifyPaymentRequestCommandProvider($this->hostedFieldsCommandProvider);
+ }
+
+ public function testProvide_forPayplugWithHostedFieldsEnabled_delegatesToHostedFieldsProvider(): void
+ {
+ $paymentRequest = $this->paymentRequestWithConfig([
+ 'factoryName' => PayPlugGatewayFactory::FACTORY_NAME,
+ 'config' => [PayPlugGatewayFactory::HOSTED_FIELDS => true],
+ ]);
+
+ $expected = new NotifyHostedPaymentRequest('1');
+ $this->hostedFieldsCommandProvider->expects(self::once())->method('provide')
+ ->with($paymentRequest)->willReturn($expected);
+
+ self::assertSame($expected, $this->provider->provide($paymentRequest));
+ }
+
+ /**
+ * Other gateways (Oney, Bancontact, ...) never satisfy the Hosted Fields check regardless of
+ * their own config shape, since it's gated on the `payplug` factory name first — behavior for
+ * them must stay exactly as it was before this delegation was introduced.
+ */
+ public function testProvide_forOtherGatewayFactory_neverDelegatesEvenIfConfigHappensToHaveHostedFieldsKey(): void
+ {
+ $paymentRequest = $this->paymentRequestWithConfig([
+ 'factoryName' => 'payplug_oney',
+ 'config' => [PayPlugGatewayFactory::HOSTED_FIELDS => true],
+ ]);
+
+ $this->hostedFieldsCommandProvider->expects(self::never())->method('provide');
+
+ self::assertInstanceOf(NotifyPaymentRequest::class, $this->provider->provide($paymentRequest));
+ }
+
+ public function testProvide_whenNoGatewayConfig_usesLegacyFlow(): void
+ {
+ $paymentRequest = $this->paymentRequestWithConfig(null);
+
+ $this->hostedFieldsCommandProvider->expects(self::never())->method('provide');
+
+ self::assertInstanceOf(NotifyPaymentRequest::class, $this->provider->provide($paymentRequest));
+ }
+
+ public function testSupports_onlyForNotifyAction(): void
+ {
+ $notifyRequest = $this->createMock(PaymentRequestInterface::class);
+ $notifyRequest->method('getAction')->willReturn(PaymentRequestInterface::ACTION_NOTIFY);
+ self::assertTrue($this->provider->supports($notifyRequest));
+
+ $captureRequest = $this->createMock(PaymentRequestInterface::class);
+ $captureRequest->method('getAction')->willReturn(PaymentRequestInterface::ACTION_CAPTURE);
+ self::assertFalse($this->provider->supports($captureRequest));
+ }
+}
diff --git a/tests/PHPUnit/Command/Provider/PaymentRequestWithGatewayConfigTrait.php b/tests/PHPUnit/Command/Provider/PaymentRequestWithGatewayConfigTrait.php
new file mode 100644
index 00000000..91859e0f
--- /dev/null
+++ b/tests/PHPUnit/Command/Provider/PaymentRequestWithGatewayConfigTrait.php
@@ -0,0 +1,46 @@
+}|null $gatewayConfig
+ * @param array $details
+ */
+ private function paymentRequestWithConfig(
+ ?array $gatewayConfig,
+ array $details = [],
+ ): PaymentRequestInterface&MockObject
+ {
+ $method = $this->createMock(PaymentMethodInterface::class);
+ if (null !== $gatewayConfig) {
+ $config = $this->createMock(GatewayConfigInterface::class);
+ $config->method('getFactoryName')->willReturn($gatewayConfig['factoryName']);
+ $config->method('getConfig')->willReturn($gatewayConfig['config']);
+ $method->method('getGatewayConfig')->willReturn($config);
+ }
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getMethod')->willReturn($method);
+ $payment->method('getDetails')->willReturn($details);
+
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $paymentRequest->method('getPayment')->willReturn($payment);
+ $paymentRequest->method('getId')->willReturn('1');
+
+ return $paymentRequest;
+ }
+}
diff --git a/tests/PHPUnit/Command/Provider/StatusPaymentRequestCommandProviderTest.php b/tests/PHPUnit/Command/Provider/StatusPaymentRequestCommandProviderTest.php
new file mode 100644
index 00000000..248753df
--- /dev/null
+++ b/tests/PHPUnit/Command/Provider/StatusPaymentRequestCommandProviderTest.php
@@ -0,0 +1,87 @@
+requestStack = $this->createMock(RequestStack::class);
+ $this->hostedFieldsCommandProvider = $this->createMock(PaymentRequestCommandProviderInterface::class);
+ $this->provider = new StatusPaymentRequestCommandProvider($this->requestStack, $this->hostedFieldsCommandProvider);
+ }
+
+ public function testProvide_forPayplugWithHostedFieldsEnabled_delegatesToHostedFieldsProvider(): void
+ {
+ $paymentRequest = $this->paymentRequestWithConfig([
+ 'factoryName' => PayPlugGatewayFactory::FACTORY_NAME,
+ 'config' => [PayPlugGatewayFactory::HOSTED_FIELDS => true],
+ ]);
+
+ $expected = new StatusHostedPaymentRequest('1');
+ $this->hostedFieldsCommandProvider->expects(self::once())->method('provide')
+ ->with($paymentRequest)->willReturn($expected);
+ $this->requestStack->expects(self::never())->method('getCurrentRequest');
+
+ self::assertSame($expected, $this->provider->provide($paymentRequest));
+ }
+
+ /**
+ * Other gateways (Oney, Bancontact, ...) never satisfy the Hosted Fields check regardless of
+ * their own config shape, since it's gated on the `payplug` factory name first — behavior for
+ * them must stay exactly as it was before this delegation was introduced.
+ */
+ public function testProvide_forOtherGatewayFactory_neverDelegatesEvenIfConfigHappensToHaveHostedFieldsKey(): void
+ {
+ $paymentRequest = $this->paymentRequestWithConfig([
+ 'factoryName' => 'payplug_oney',
+ 'config' => [PayPlugGatewayFactory::HOSTED_FIELDS => true],
+ ]);
+ $this->requestStack->method('getCurrentRequest')->willReturn(null);
+
+ $this->hostedFieldsCommandProvider->expects(self::never())->method('provide');
+
+ self::assertInstanceOf(StatusPaymentRequest::class, $this->provider->provide($paymentRequest));
+ }
+
+ public function testProvide_whenNoGatewayConfig_usesLegacyFlow(): void
+ {
+ $paymentRequest = $this->paymentRequestWithConfig(null);
+ $this->requestStack->method('getCurrentRequest')->willReturn(null);
+
+ $this->hostedFieldsCommandProvider->expects(self::never())->method('provide');
+
+ self::assertInstanceOf(StatusPaymentRequest::class, $this->provider->provide($paymentRequest));
+ }
+
+ public function testSupports_onlyForStatusAction(): void
+ {
+ $statusRequest = $this->createMock(PaymentRequestInterface::class);
+ $statusRequest->method('getAction')->willReturn(PaymentRequestInterface::ACTION_STATUS);
+ self::assertTrue($this->provider->supports($statusRequest));
+
+ $captureRequest = $this->createMock(PaymentRequestInterface::class);
+ $captureRequest->method('getAction')->willReturn(PaymentRequestInterface::ACTION_CAPTURE);
+ self::assertFalse($this->provider->supports($captureRequest));
+ }
+}
diff --git a/tests/PHPUnit/Config/HostedFieldsSdkUrlConfigurationTest.php b/tests/PHPUnit/Config/HostedFieldsSdkUrlConfigurationTest.php
new file mode 100644
index 00000000..d2901b11
--- /dev/null
+++ b/tests/PHPUnit/Config/HostedFieldsSdkUrlConfigurationTest.php
@@ -0,0 +1,48 @@
+paymentMethodRepository = $this->createMock(RepositoryInterface::class);
+ $this->cartContext = $this->createMock(CartContextInterface::class);
+ $this->paymentDataCreator = $this->createMock(PayPlugPaymentDataCreator::class);
+ $this->apiClientFactory = $this->createMock(PayPlugApiClientFactoryInterface::class);
+
+ $this->controller = new IntegratedPaymentController(
+ $this->cartContext,
+ $this->paymentMethodRepository,
+ $this->createMock(OrderRepositoryInterface::class),
+ $this->paymentDataCreator,
+ $this->apiClientFactory,
+ $this->createMock(EntityManagerInterface::class),
+ $this->createMock(LoggerInterface::class),
+ );
+ }
+
+ /**
+ * The iframe posts a payment method id, so the account the payment is created on must be the
+ * one configured on *that* payment method. Resolving the client by factory name instead would
+ * pick an arbitrary one of the several gateway configs that may now share it — one per channel
+ * since PRE-3628 — and create the payment on another channel's PayPlug account.
+ */
+ public function testInitPayment_createsThePaymentOnTheAccountOfTheSubmittedPaymentMethod(): void
+ {
+ $paymentMethod = $this->payPlugPaymentMethod(channelCode: 'WEB_FR');
+ $this->paymentMethodRepository->method('find')->with(42)->willReturn($paymentMethod);
+
+ $this->givenCartOnChannel('WEB_FR');
+
+ $this->paymentDataCreator->method('create')->willReturn(new ArrayObject());
+
+ $payplugPayment = $this->createMock(PayplugPayment::class);
+ $payplugPayment->id = 'pay_1';
+ $payplugPayment->is_live = false;
+
+ $apiClient = $this->createMock(PayPlugApiClientInterface::class);
+ $apiClient->method('createPayment')->willReturn($payplugPayment);
+
+ $this->apiClientFactory->expects(self::once())
+ ->method('createForPaymentMethod')
+ ->with(self::identicalTo($paymentMethod))
+ ->willReturn($apiClient);
+
+ $response = $this->controller->initPaymentAction(Request::create('/payplug/integrated-payment/init/42'), 42);
+
+ self::assertSame(201, $response->getStatusCode());
+ }
+
+ /**
+ * The id is shopper-supplied. With one CB gateway per channel — each connected to a different
+ * PayPlug account since PRE-3628 — accepting a payment method that does not belong to the
+ * order's channel would create the payment on another merchant's account, and the IPN would
+ * then verify it against that merchant's key and mark this order paid.
+ */
+ public function testInitPayment_refusesAPaymentMethodFromAnotherChannel(): void
+ {
+ $paymentMethod = $this->payPlugPaymentMethod(channelCode: 'WEB_IT');
+ $this->paymentMethodRepository->method('find')->with(42)->willReturn($paymentMethod);
+
+ $this->givenCartOnChannel('WEB_FR');
+
+ $this->apiClientFactory->expects(self::never())->method('createForPaymentMethod');
+
+ $this->expectException(BadRequestHttpException::class);
+ $this->expectExceptionMessage('not available on this channel');
+
+ $this->controller->initPaymentAction(Request::create('/payplug/integrated-payment/init/42'), 42);
+ }
+
+ /**
+ * A disconnected gateway is left disabled by GatewayConnectionRevoker, and its credentials are
+ * gone — creating a payment on it would fail at best and resolve stale credentials at worst.
+ */
+ public function testInitPayment_refusesADisabledPaymentMethod(): void
+ {
+ $paymentMethod = $this->payPlugPaymentMethod(channelCode: 'WEB_FR', enabled: false);
+ $this->paymentMethodRepository->method('find')->with(42)->willReturn($paymentMethod);
+
+ $this->givenCartOnChannel('WEB_FR');
+
+ $this->apiClientFactory->expects(self::never())->method('createForPaymentMethod');
+
+ $this->expectException(BadRequestHttpException::class);
+ $this->expectExceptionMessage('not enabled');
+
+ $this->controller->initPaymentAction(Request::create('/payplug/integrated-payment/init/42'), 42);
+ }
+
+ public function testInitPayment_refusesAPaymentMethodOfAnotherFactory(): void
+ {
+ $paymentMethod = $this->payPlugPaymentMethod(channelCode: 'WEB_FR', factoryName: 'payplug_oney');
+ $this->paymentMethodRepository->method('find')->with(42)->willReturn($paymentMethod);
+
+ $this->givenCartOnChannel('WEB_FR');
+
+ $this->apiClientFactory->expects(self::never())->method('createForPaymentMethod');
+
+ $this->expectException(BadRequestHttpException::class);
+ $this->expectExceptionMessage('Unsupported payment method of Integrated Payment');
+
+ $this->controller->initPaymentAction(Request::create('/payplug/integrated-payment/init/42'), 42);
+ }
+
+ private function givenCartOnChannel(string $channelCode): void
+ {
+ $channel = $this->createMock(ChannelInterface::class);
+ $channel->method('getCode')->willReturn($channelCode);
+
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getLastPayment')->willReturn($this->createMock(PaymentInterface::class));
+ $order->method('getChannel')->willReturn($channel);
+
+ $this->cartContext->method('getCart')->willReturn($order);
+ }
+
+ private function payPlugPaymentMethod(
+ string $channelCode,
+ bool $enabled = true,
+ string $factoryName = PayPlugGatewayFactory::FACTORY_NAME,
+ ): PaymentMethodInterface&MockObject {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getFactoryName')->willReturn($factoryName);
+
+ $channel = $this->createMock(ChannelInterface::class);
+ $channel->method('getCode')->willReturn($channelCode);
+
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $paymentMethod->method('getGatewayConfig')->willReturn($gatewayConfig);
+ $paymentMethod->method('isEnabled')->willReturn($enabled);
+ $paymentMethod->method('getChannels')->willReturn(new ArrayCollection([$channel]));
+
+ return $paymentMethod;
+ }
+}
diff --git a/tests/PHPUnit/Controller/IpnActionTest.php b/tests/PHPUnit/Controller/IpnActionTest.php
new file mode 100644
index 00000000..f8ad7e49
--- /dev/null
+++ b/tests/PHPUnit/Controller/IpnActionTest.php
@@ -0,0 +1,104 @@
+logger = $this->createMock(LoggerInterface::class);
+ $this->paymentNotificationHandler = $this->createMock(PaymentNotificationHandler::class);
+ $this->refundNotificationHandler = $this->createMock(RefundNotificationHandler::class);
+ $this->apiClientFactory = $this->createMock(PayPlugApiClientFactoryInterface::class);
+ $this->paymentRepository = $this->createMock(PaymentRepositoryInterface::class);
+ $this->entityManager = $this->createMock(EntityManagerInterface::class);
+
+ $this->action = new IpnAction(
+ $this->logger,
+ $this->paymentNotificationHandler,
+ $this->refundNotificationHandler,
+ $this->apiClientFactory,
+ $this->paymentRepository,
+ $this->entityManager,
+ );
+ }
+
+ private function paymentWithGatewayConfig(): PaymentInterface&MockObject
+ {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getFactoryName')->willReturn(PayPlugGatewayFactory::FACTORY_NAME);
+
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $method->method('getGatewayConfig')->willReturn($gatewayConfig);
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getMethod')->willReturn($method);
+
+ return $payment;
+ }
+
+ /**
+ * The webhook must sign its `treat()` call with the credentials of the account the payment was
+ * actually created on. Resolving the client by factory name instead would pick an arbitrary one
+ * of the several gateway configs that may now share it — one per channel since PRE-3628.
+ */
+ public function testInvoke_forALegacyPayment_buildsTheApiClientFromThePaymentsOwnMethod(): void
+ {
+ $payment = $this->paymentWithGatewayConfig();
+ $this->paymentRepository->method('findOneByPayPlugPaymentId')->willReturn($payment);
+
+ $request = Request::create('/payplug/ipn', 'POST', content: \json_encode(['id' => 'pay_1']));
+
+ $this->apiClientFactory->expects(self::once())
+ ->method('createForPaymentMethod')
+ ->with(self::identicalTo($payment->getMethod()))
+ ->willReturn($this->createMock(PayPlugApiClientInterface::class));
+
+ $response = $this->action->__invoke($request);
+
+ self::assertSame(200, $response->getStatusCode());
+ }
+
+ public function testInvoke_whenPaymentIsNotFound_returnsUnauthorized(): void
+ {
+ $this->paymentRepository->method('findOneByPayPlugPaymentId')->willReturn(null);
+
+ $request = Request::create('/payplug/ipn', 'POST', content: \json_encode(['id' => 'pay_1']));
+
+ $response = $this->action->__invoke($request);
+
+ self::assertSame(401, $response->getStatusCode());
+ }
+}
diff --git a/tests/PHPUnit/Controller/UnifiedApiIpnActionTest.php b/tests/PHPUnit/Controller/UnifiedApiIpnActionTest.php
new file mode 100644
index 00000000..d95658dd
--- /dev/null
+++ b/tests/PHPUnit/Controller/UnifiedApiIpnActionTest.php
@@ -0,0 +1,160 @@
+logger = $this->createMock(LoggerInterface::class);
+ $this->hostedFieldsWebhookNotificationHandler = $this->createMock(HostedFieldsWebhookNotificationHandler::class);
+ $this->paymentRepository = $this->createMock(PaymentRepositoryInterface::class);
+
+ $this->action = new UnifiedApiIpnAction(
+ $this->logger,
+ $this->hostedFieldsWebhookNotificationHandler,
+ $this->paymentRepository,
+ );
+ }
+
+ private function paymentWithGatewayConfig(bool $hostedFields): PaymentInterface&MockObject
+ {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getFactoryName')->willReturn(PayPlugGatewayFactory::FACTORY_NAME);
+ $gatewayConfig->method('getConfig')->willReturn([PayPlugGatewayFactory::HOSTED_FIELDS => $hostedFields]);
+
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $method->method('getGatewayConfig')->willReturn($gatewayConfig);
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getMethod')->willReturn($method);
+
+ return $payment;
+ }
+
+ public function testInvoke_forAHostedFieldsPayment_delegatesToTheWebhookNotificationHandler(): void
+ {
+ $payment = $this->paymentWithGatewayConfig(hostedFields: true);
+ $this->paymentRepository->method('findOneByPayPlugPaymentId')->with('pay_1')->willReturn($payment);
+
+ $request = Request::create('/payplug/v2/ipn', 'POST', content: \json_encode(['id' => 'pay_1', 'execCode' => '0000']));
+ $request->headers->set('Authorization', 'Bearer shared-secret');
+
+ $this->hostedFieldsWebhookNotificationHandler->expects(self::once())->method('treat')
+ ->with($payment, $request->getContent(), self::callback(static fn (array $headers): bool => 'Bearer shared-secret' === ($headers['authorization'] ?? null)));
+
+ $response = $this->action->__invoke($request);
+
+ self::assertSame(200, $response->getStatusCode());
+ }
+
+ public function testInvoke_forAHostedFieldsPayment_whenNotificationIsInvalid_logsAndStillReturns200(): void
+ {
+ $payment = $this->paymentWithGatewayConfig(hostedFields: true);
+ $this->paymentRepository->method('findOneByPayPlugPaymentId')->willReturn($payment);
+ $this->hostedFieldsWebhookNotificationHandler->method('treat')->willThrowException(new InvalidNotificationException('boom'));
+
+ $request = Request::create('/payplug/v2/ipn', 'POST', content: \json_encode(['id' => 'pay_1']));
+
+ $this->logger->expects(self::once())->method('error');
+
+ $response = $this->action->__invoke($request);
+
+ self::assertSame(200, $response->getStatusCode());
+ }
+
+ public function testInvoke_forANonUnifiedApiPayment_returnsUnauthorizedWithoutCallingTheWebhookNotificationHandler(): void
+ {
+ $payment = $this->paymentWithGatewayConfig(hostedFields: false);
+ $this->paymentRepository->method('findOneByPayPlugPaymentId')->willReturn($payment);
+
+ $request = Request::create('/payplug/v2/ipn', 'POST', content: \json_encode(['id' => 'pay_1']));
+
+ $this->hostedFieldsWebhookNotificationHandler->expects(self::never())->method('treat');
+
+ $response = $this->action->__invoke($request);
+
+ self::assertSame(401, $response->getStatusCode());
+ }
+
+ public function testInvoke_whenPaymentIsNotFound_returnsUnauthorized(): void
+ {
+ $this->paymentRepository->method('findOneByPayPlugPaymentId')->willReturn(null);
+
+ $request = Request::create('/payplug/v2/ipn', 'POST', content: \json_encode(['id' => 'pay_1']));
+
+ $response = $this->action->__invoke($request);
+
+ self::assertSame(401, $response->getStatusCode());
+ }
+
+ public function testInvoke_whenBodyHasNoId_returnsUnauthorized(): void
+ {
+ $this->paymentRepository->expects(self::never())->method('findOneByPayPlugPaymentId');
+
+ $request = Request::create('/payplug/v2/ipn', 'POST', content: '{}');
+
+ $response = $this->action->__invoke($request);
+
+ self::assertSame(401, $response->getStatusCode());
+ }
+
+ /**
+ * PayPlug's webhook can be delivered before CaptureHostedPaymentRequestHandler's own
+ * hosted_fields_payment_id/hosted_fields_operation_id write has committed (Sylius's
+ * doctrine_transaction messenger middleware only commits once that whole handler returns) —
+ * findOneByPayPlugPaymentId() briefly returns null for a payment that does exist.
+ */
+ public function testInvoke_whenPaymentNotYetVisibleOnFirstLookup_retriesAndStillDelegatesToTheWebhookNotificationHandler(): void
+ {
+ $payment = $this->paymentWithGatewayConfig(hostedFields: true);
+ $this->paymentRepository->expects(self::exactly(3))->method('findOneByPayPlugPaymentId')
+ ->with('pay_1')
+ ->willReturnOnConsecutiveCalls(null, null, $payment);
+
+ $request = Request::create('/payplug/v2/ipn', 'POST', content: \json_encode(['id' => 'pay_1', 'execCode' => '0000']));
+
+ $this->hostedFieldsWebhookNotificationHandler->expects(self::once())->method('treat')
+ ->with($payment, $request->getContent(), self::isType('array'));
+
+ $response = $this->action->__invoke($request);
+
+ self::assertSame(200, $response->getStatusCode());
+ }
+
+ public function testInvoke_whenPaymentNeverBecomesVisible_stopsRetryingAndReturnsUnauthorized(): void
+ {
+ $this->paymentRepository->expects(self::exactly(4))->method('findOneByPayPlugPaymentId')->with('pay_1')->willReturn(null);
+
+ $request = Request::create('/payplug/v2/ipn', 'POST', content: \json_encode(['id' => 'pay_1']));
+
+ $this->hostedFieldsWebhookNotificationHandler->expects(self::never())->method('treat');
+
+ $response = $this->action->__invoke($request);
+
+ self::assertSame(401, $response->getStatusCode());
+ }
+}
diff --git a/tests/PHPUnit/Entity/PayPlugOperationTest.php b/tests/PHPUnit/Entity/PayPlugOperationTest.php
new file mode 100644
index 00000000..68cc1173
--- /dev/null
+++ b/tests/PHPUnit/Entity/PayPlugOperationTest.php
@@ -0,0 +1,46 @@
+getOrderId());
+ self::assertSame('op_123', $operation->getOperationId());
+ self::assertSame('0000', $operation->getExecCode());
+ self::assertSame(PaymentOutcome::PAID, $operation->getOutcome());
+ self::assertSame(1000, $operation->getAmount());
+ self::assertFalse($operation->isTreated());
+ }
+
+ public function testMarkTreated_setsTreatedToTrue(): void
+ {
+ $operation = new PayPlugOperation('42', 'op_123', '0000', PaymentOutcome::PAID, 1000);
+
+ $operation->markTreated();
+
+ self::assertTrue($operation->isTreated());
+ }
+
+ public function testToOperationData_returnsEquivalentValueObject(): void
+ {
+ $operation = new PayPlugOperation('42', 'op_123', '0000', PaymentOutcome::PAID, 1000);
+
+ $data = $operation->toOperationData();
+
+ self::assertSame('op_123', $data->operationId);
+ self::assertSame('0000', $data->execCode);
+ self::assertSame(PaymentOutcome::PAID, $data->outcome);
+ self::assertSame(1000, $data->amount);
+ self::assertSame('42', $data->orderId);
+ }
+}
diff --git a/tests/PHPUnit/EventSubscriber/PostPaymentSelectEventSubscriberTest.php b/tests/PHPUnit/EventSubscriber/PostPaymentSelectEventSubscriberTest.php
new file mode 100644
index 00000000..f4212c4c
--- /dev/null
+++ b/tests/PHPUnit/EventSubscriber/PostPaymentSelectEventSubscriberTest.php
@@ -0,0 +1,405 @@
+requestStack = $this->createMock(RequestStack::class);
+ $this->entityManager = $this->createMock(EntityManagerInterface::class);
+ $this->stateMachine = $this->createMock(StateMachineInterface::class);
+ $this->hostedFieldsPaymentProcessor = $this->createMock(HostedFieldsPaymentProcessorInterface::class);
+
+ $this->subscriber = new PostPaymentSelectEventSubscriber(
+ $this->requestStack,
+ $this->entityManager,
+ $this->stateMachine,
+ $this->hostedFieldsPaymentProcessor,
+ );
+ }
+
+ public function testHandle_withHostedFieldsToken_delegatesToProcessorAndCompletesCheckout(): void
+ {
+ $request = Request::create('/checkout/select-payment', 'POST', [
+ 'hostedfields_token' => 'hf_token_abc',
+ 'hostedfields_selected_brand' => 'VISA',
+ 'hostedfields_save_card' => 'true',
+ 'hostedfields_last4' => '4242',
+ 'hostedfields_exp_month' => '12',
+ 'hostedfields_exp_year' => '2030',
+ 'hostedfields_country' => 'FR',
+ ]);
+ $request->attributes->set('_route', 'sylius_shop_checkout_select_payment');
+ $this->requestStack->method('getCurrentRequest')->willReturn($request);
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getMethod')->willReturn(
+ $this->buildPaymentMethod(PayPlugGatewayFactory::FACTORY_NAME, [PayPlugGatewayFactory::HOSTED_FIELDS => true]),
+ );
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getLastPayment')->willReturn($payment);
+ $payment->method('getOrder')->willReturn($order);
+
+ $event = $this->createMock(ResourceControllerEvent::class);
+ $event->method('getSubject')->willReturn($order);
+
+ $this->hostedFieldsPaymentProcessor->expects(self::once())
+ ->method('process')
+ ->with($payment, new HostedFieldsCaptureData('hf_token_abc', 'VISA', true, '4242', 12, 2030, 'FR'))
+ ;
+
+ $this->stateMachine->method('can')
+ ->with($order, OrderCheckoutTransitions::GRAPH, OrderCheckoutTransitions::TRANSITION_COMPLETE)
+ ->willReturn(true)
+ ;
+ $this->stateMachine->expects(self::once())->method('apply');
+ $this->entityManager->expects(self::once())->method('flush');
+
+ $this->subscriber->handle($event);
+ }
+
+ /**
+ * A crafted POST carrying a hosted fields token must not be able to complete checkout
+ * for a payment method that does not have Hosted Fields enabled.
+ */
+ public function testHandle_withHostedFieldsTokenButHostedFieldsNotEnabled_doesNotProcessNorCompleteCheckout(): void
+ {
+ $request = Request::create('/checkout/select-payment', 'POST', [
+ 'hostedfields_token' => 'hf_token_abc',
+ 'hostedfields_selected_brand' => 'VISA',
+ 'hostedfields_save_card' => 'true',
+ 'hostedfields_last4' => '4242',
+ 'hostedfields_exp_month' => '12',
+ 'hostedfields_exp_year' => '2030',
+ 'hostedfields_country' => 'FR',
+ ]);
+ $request->attributes->set('_route', 'sylius_shop_checkout_select_payment');
+ $this->requestStack->method('getCurrentRequest')->willReturn($request);
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getMethod')->willReturn(
+ $this->buildPaymentMethod(PayPlugGatewayFactory::FACTORY_NAME, [PayPlugGatewayFactory::HOSTED_FIELDS => false]),
+ );
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getLastPayment')->willReturn($payment);
+ $payment->method('getOrder')->willReturn($order);
+
+ $event = $this->createMock(ResourceControllerEvent::class);
+ $event->method('getSubject')->willReturn($order);
+
+ $this->hostedFieldsPaymentProcessor->expects(self::never())->method('process');
+ $this->stateMachine->expects(self::never())->method('apply');
+ $this->entityManager->expects(self::never())->method('flush');
+
+ $this->subscriber->handle($event);
+ }
+
+ /**
+ * A crafted POST carrying a hosted fields token must not be able to complete checkout
+ * for a payment method on a different gateway entirely, even if that gateway's config
+ * coincidentally has a truthy value under the same HOSTED_FIELDS key. The factory-name
+ * check must still gate first.
+ */
+ public function testHandle_withHostedFieldsTokenButDifferentFactory_doesNotProcessNorCompleteCheckout(): void
+ {
+ $request = Request::create('/checkout/select-payment', 'POST', [
+ 'hostedfields_token' => 'hf_token_abc',
+ 'hostedfields_selected_brand' => 'VISA',
+ 'hostedfields_save_card' => 'true',
+ 'hostedfields_last4' => '4242',
+ 'hostedfields_exp_month' => '12',
+ 'hostedfields_exp_year' => '2030',
+ 'hostedfields_country' => 'FR',
+ ]);
+ $request->attributes->set('_route', 'sylius_shop_checkout_select_payment');
+ $this->requestStack->method('getCurrentRequest')->willReturn($request);
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getMethod')->willReturn(
+ $this->buildPaymentMethod('offline', [PayPlugGatewayFactory::HOSTED_FIELDS => true]),
+ );
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getLastPayment')->willReturn($payment);
+ $payment->method('getOrder')->willReturn($order);
+
+ $event = $this->createMock(ResourceControllerEvent::class);
+ $event->method('getSubject')->willReturn($order);
+
+ $this->hostedFieldsPaymentProcessor->expects(self::never())->method('process');
+ $this->stateMachine->expects(self::never())->method('apply');
+ $this->entityManager->expects(self::never())->method('flush');
+
+ $this->subscriber->handle($event);
+ }
+
+ /**
+ * A payplug payment method whose config predates the Hosted Fields flag (key absent
+ * entirely, e.g. a legacy config) must not be treated as Hosted-Fields-enabled. Pins
+ * the `?? false` default explicitly, distinct from an explicit `false` value.
+ */
+ public function testHandle_withHostedFieldsTokenButConfigKeyAbsent_doesNotProcessNorCompleteCheckout(): void
+ {
+ $request = Request::create('/checkout/select-payment', 'POST', [
+ 'hostedfields_token' => 'hf_token_abc',
+ 'hostedfields_selected_brand' => 'VISA',
+ 'hostedfields_save_card' => 'true',
+ 'hostedfields_last4' => '4242',
+ 'hostedfields_exp_month' => '12',
+ 'hostedfields_exp_year' => '2030',
+ 'hostedfields_country' => 'FR',
+ ]);
+ $request->attributes->set('_route', 'sylius_shop_checkout_select_payment');
+ $this->requestStack->method('getCurrentRequest')->willReturn($request);
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getMethod')->willReturn(
+ $this->buildPaymentMethod(PayPlugGatewayFactory::FACTORY_NAME, []),
+ );
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getLastPayment')->willReturn($payment);
+ $payment->method('getOrder')->willReturn($order);
+
+ $event = $this->createMock(ResourceControllerEvent::class);
+ $event->method('getSubject')->willReturn($order);
+
+ $this->hostedFieldsPaymentProcessor->expects(self::never())->method('process');
+ $this->stateMachine->expects(self::never())->method('apply');
+ $this->entityManager->expects(self::never())->method('flush');
+
+ $this->subscriber->handle($event);
+ }
+
+ /**
+ * Pins the dispatch precedence that alterRequestConfigurationForInlineCardCapture() mirrors:
+ * when both token fields are present, handle() treats the request as Hosted Fields (no
+ * payment_id is ever written). Flipping this order without flipping the redirect ternary would
+ * send a payment_id-less order to sylius_shop_order_pay.
+ */
+ public function testHandle_withBothTokens_isProcessedAsHostedFields(): void
+ {
+ $request = Request::create('/checkout/select-payment', 'POST', [
+ 'payplug_integrated_payment_token' => 'pay_123',
+ 'hostedfields_token' => 'hf_token_abc',
+ 'hostedfields_selected_brand' => 'CB',
+ 'hostedfields_last4' => '4242',
+ 'hostedfields_exp_month' => '12',
+ 'hostedfields_exp_year' => '2030',
+ 'hostedfields_country' => 'FR',
+ ]);
+ $request->attributes->set('_route', 'sylius_shop_checkout_select_payment');
+ $this->requestStack->method('getCurrentRequest')->willReturn($request);
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getMethod')->willReturn(
+ $this->buildPaymentMethod(PayPlugGatewayFactory::FACTORY_NAME, [PayPlugGatewayFactory::HOSTED_FIELDS => true]),
+ );
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getLastPayment')->willReturn($payment);
+ $payment->method('getOrder')->willReturn($order);
+
+ $event = $this->createMock(ResourceControllerEvent::class);
+ $event->method('getSubject')->willReturn($order);
+
+ // Hosted Fields path: the processor is used and no payment_id is written to the details.
+ $this->hostedFieldsPaymentProcessor->expects(self::once())
+ ->method('process')
+ ->with($payment, new HostedFieldsCaptureData('hf_token_abc', 'CB', false, '4242', 12, 2030, 'FR'))
+ ;
+ $payment->expects(self::never())->method('setDetails');
+
+ $this->subscriber->handle($event);
+ }
+
+ public function testHandle_withHostedFieldsTokenButNoPaymentMethod_doesNotProcess(): void
+ {
+ $request = Request::create('/checkout/select-payment', 'POST', [
+ 'hostedfields_token' => 'hf_token_abc',
+ 'hostedfields_last4' => '4242',
+ 'hostedfields_exp_month' => '12',
+ 'hostedfields_exp_year' => '2030',
+ 'hostedfields_country' => 'FR',
+ ]);
+ $request->attributes->set('_route', 'sylius_shop_checkout_select_payment');
+ $this->requestStack->method('getCurrentRequest')->willReturn($request);
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getMethod')->willReturn(null);
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getLastPayment')->willReturn($payment);
+
+ $event = $this->createMock(ResourceControllerEvent::class);
+ $event->method('getSubject')->willReturn($order);
+
+ $this->hostedFieldsPaymentProcessor->expects(self::never())->method('process');
+ $this->entityManager->expects(self::never())->method('flush');
+
+ $this->subscriber->handle($event);
+ }
+
+ public function testHandle_withoutAnyToken_doesNothing(): void
+ {
+ $request = Request::create('/checkout/select-payment', 'POST');
+ $request->attributes->set('_route', 'sylius_shop_checkout_select_payment');
+ $this->requestStack->method('getCurrentRequest')->willReturn($request);
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getLastPayment')->willReturn($payment);
+
+ $event = $this->createMock(ResourceControllerEvent::class);
+ $event->method('getSubject')->willReturn($order);
+
+ $this->hostedFieldsPaymentProcessor->expects(self::never())->method('process');
+ $this->entityManager->expects(self::never())->method('flush');
+
+ $this->subscriber->handle($event);
+ }
+
+ // -------------------------------------------------------------------------
+ // alterRequestConfigurationForInlineCardCapture()
+ // -------------------------------------------------------------------------
+
+ /**
+ * Integrated Payment relays a real PayPlug payment_id, so the redirect override to
+ * `sylius_shop_order_pay` (Payum capture/status) must stay in place.
+ */
+ public function testAlterRequestConfiguration_withIntegratedPaymentToken_overridesRedirect(): void
+ {
+ $request = Request::create('/checkout/select-payment', 'POST', [
+ 'payplug_integrated_payment_token' => 'pay_123',
+ ]);
+ $request->attributes->set('_route', 'sylius_shop_checkout_select_payment');
+ $request->attributes->set('_sylius', ['redirect' => ['route' => 'sylius_shop_checkout_complete']]);
+
+ $this->subscriber->alterRequestConfigurationForInlineCardCapture($this->buildRequestEvent($request));
+
+ self::assertSame(
+ [
+ 'redirect' => [
+ 'route' => 'sylius_shop_order_pay',
+ 'parameters' => ['tokenValue' => 'resource.tokenValue'],
+ ],
+ ],
+ $request->attributes->get('_sylius'),
+ );
+ }
+
+ /**
+ * Both Integrated Payment and Hosted Fields target `sylius_shop_order_pay` (Payum
+ * capture/status for Integrated Payment; for Hosted Fields, the same `payplug`-tagged
+ * Capture/Notify/StatusPaymentRequestCommandProvider trio delegates to their
+ * Hosted-Fields-specific counterparts — see PayPlugGatewayFactory::isHostedFieldsConfig() —
+ * so the payment is actually created/confirmed through UPC.
+ */
+ public function testAlterRequestConfigurationForInlineCardCapture_forHostedFieldsToken_redirectsToOrderPay(): void
+ {
+ $request = Request::create('/checkout/select-payment', 'POST', [
+ 'hostedfields_token' => 'hf_token_abc',
+ 'hostedfields_selected_brand' => 'VISA',
+ ]);
+ $request->attributes->set('_route', 'sylius_shop_checkout_select_payment');
+ $request->attributes->set('_sylius', ['redirect' => ['route' => 'sylius_shop_checkout_complete']]);
+
+ $this->subscriber->alterRequestConfigurationForInlineCardCapture($this->buildRequestEvent($request));
+
+ self::assertSame(
+ [
+ 'redirect' => [
+ 'route' => 'sylius_shop_order_pay',
+ 'parameters' => ['tokenValue' => 'resource.tokenValue'],
+ ],
+ ],
+ $request->attributes->get('_sylius'),
+ );
+ }
+
+ /**
+ * A crafted request carrying both token fields is dispatched as Hosted Fields by handle()
+ * (it checks hasHostedFieldsToken() first). Since PRE-3551 both paths redirect to the same
+ * route, so this just pins that the redirect override still applies regardless of which
+ * token(s) are present.
+ */
+ public function testAlterRequestConfiguration_withBothTokens_followsHandleAndRedirectsToOrderPay(): void
+ {
+ $request = Request::create('/checkout/select-payment', 'POST', [
+ 'payplug_integrated_payment_token' => 'pay_123',
+ 'hostedfields_token' => 'hf_token_abc',
+ ]);
+ $request->attributes->set('_route', 'sylius_shop_checkout_select_payment');
+ $request->attributes->set('_sylius', []);
+
+ $this->subscriber->alterRequestConfigurationForInlineCardCapture($this->buildRequestEvent($request));
+
+ $syliusRequestConfig = $request->attributes->get('_sylius');
+ self::assertSame('sylius_shop_order_pay', $syliusRequestConfig['redirect']['route']);
+ }
+
+ public function testAlterRequestConfiguration_withoutAnyToken_leavesRedirectUntouched(): void
+ {
+ $request = Request::create('/checkout/select-payment', 'POST');
+ $request->attributes->set('_route', 'sylius_shop_checkout_select_payment');
+ $syliusRequestConfig = ['redirect' => ['route' => 'sylius_shop_checkout_complete']];
+ $request->attributes->set('_sylius', $syliusRequestConfig);
+
+ $this->subscriber->alterRequestConfigurationForInlineCardCapture($this->buildRequestEvent($request));
+
+ self::assertSame($syliusRequestConfig, $request->attributes->get('_sylius'));
+ }
+
+ // -------------------------------------------------------------------------
+ // Helpers
+ // -------------------------------------------------------------------------
+
+ private function buildRequestEvent(Request $request): RequestEvent
+ {
+ return new RequestEvent(
+ $this->createMock(HttpKernelInterface::class),
+ $request,
+ HttpKernelInterface::MAIN_REQUEST,
+ );
+ }
+
+ private function buildPaymentMethod(string $factoryName, array $config = []): PaymentMethodInterface&MockObject
+ {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getFactoryName')->willReturn($factoryName);
+ $gatewayConfig->method('getConfig')->willReturn($config);
+
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $paymentMethod->method('getGatewayConfig')->willReturn($gatewayConfig);
+
+ return $paymentMethod;
+ }
+}
diff --git a/tests/PHPUnit/Gateway/Form/Extension/PayPlugGatewayConfigurationTypeExtensionFormSubmissionTest.php b/tests/PHPUnit/Gateway/Form/Extension/PayPlugGatewayConfigurationTypeExtensionFormSubmissionTest.php
new file mode 100644
index 00000000..ebc4732a
--- /dev/null
+++ b/tests/PHPUnit/Gateway/Form/Extension/PayPlugGatewayConfigurationTypeExtensionFormSubmissionTest.php
@@ -0,0 +1,242 @@
+ gatewayConfig -> config).
+ *
+ * The base-currency-per-channel check that used to also be exercised here (via
+ * AbstractGatewayConfigurationType's own PRE_SUBMIT listener) has moved to
+ * PaymentMethodTypeExtension's POST_SUBMIT listener on the root PaymentMethodType form; it is
+ * covered by AbstractGatewayConfigurationTypeTest and PayPlugGatewayConfigurationTypeTest's hook
+ * tests instead, since this file's minimal 3-level tree doesn't wire up PaymentMethodTypeExtension.
+ */
+final class PayPlugGatewayConfigurationTypeExtensionFormSubmissionTest extends TypeTestCase
+{
+ use ValidatorExtensionTrait;
+
+ private const ACCOUNT_ID_ERROR = 'payplug_sylius_payplug_plugin.form.account_id_required';
+
+ protected function getTypes(): array
+ {
+ $translator = $this->createMock(TranslatorInterface::class);
+ $translator->method('trans')->willReturnCallback(static fn (string $id) => $id);
+
+ return [
+ new PayPlugGatewayConfigurationType($translator),
+ ];
+ }
+
+ protected function getTypeExtensions(): array
+ {
+ $translator = $this->createMock(TranslatorInterface::class);
+ $translator->method('trans')->willReturnCallback(static fn (string $id) => $id);
+
+ return [
+ new PayPlugGatewayConfigurationTypeExtension($translator),
+ ];
+ }
+
+ public function testSubmit_hostedFieldsModeWithBlankIdentifier_isInvalidWithAccountIdError(): void
+ {
+ $form = $this->createRootForm();
+
+ $form->submit([
+ 'gatewayConfig' => [
+ 'config' => [
+ PayPlugGatewayFactory::ONE_CLICK => false,
+ PayPlugGatewayFactory::DEFERRED_CAPTURE => false,
+ PayPlugGatewayFactory::DISPLAY_MODE_FIELD => PayPlugGatewayFactory::DISPLAY_MODE_HOSTED_FIELDS,
+ PayPlugGatewayFactory::HF_IDENTIFIER => '',
+ ],
+ ],
+ ]);
+
+ self::assertTrue($form->isSubmitted());
+ self::assertFalse($form->isValid(), 'Form must be invalid when hosted_fields is selected but the account id is blank.');
+
+ $configForm = $form->get('gatewayConfig')->get('config');
+
+ $identifierErrors = $configForm->get(PayPlugGatewayFactory::HF_IDENTIFIER)->getErrors();
+ self::assertCount(1, $identifierErrors);
+ self::assertSame(self::ACCOUNT_ID_ERROR, $identifierErrors[0]->getMessage());
+ }
+
+ /**
+ * The account id is now the only hosted-fields requirement — the SubMerchant ID field it used
+ * to be paired with is gone, so filling this one alone must be enough to save the form.
+ */
+ public function testSubmit_hostedFieldsModeWithIdentifierFilled_isValid(): void
+ {
+ $form = $this->createRootForm();
+
+ $form->submit([
+ 'gatewayConfig' => [
+ 'config' => [
+ PayPlugGatewayFactory::ONE_CLICK => false,
+ PayPlugGatewayFactory::DEFERRED_CAPTURE => false,
+ PayPlugGatewayFactory::DISPLAY_MODE_FIELD => PayPlugGatewayFactory::DISPLAY_MODE_HOSTED_FIELDS,
+ PayPlugGatewayFactory::HF_IDENTIFIER => 'acct_123',
+ ],
+ ],
+ ]);
+
+ self::assertTrue($form->isSubmitted());
+ self::assertTrue($form->isValid());
+ }
+
+ /**
+ * Regression coverage for "the radio reverts to redirected on reload": DISPLAY_MODE_FIELD is
+ * `mapped => false`, and the PRE_SET_DATA listener that used to pre-select it there got its
+ * setData() call silently overwritten by Symfony's own DataMapper::mapDataToForms(), which
+ * resets every unmapped child back to its configured (null) default immediately after
+ * PRE_SET_DATA dispatches, before POST_SET_DATA fires. Moving the pre-selection to
+ * POST_SET_DATA fixes it, since nothing runs after that to reset it again.
+ */
+ public function testSetData_existingIntegratedPaymentConfig_preselectsIntegratedPaymentRadio(): void
+ {
+ $form = $this->createRootForm();
+ $configForm = $form->get('gatewayConfig')->get('config');
+
+ $configForm->setData([
+ PayPlugGatewayFactory::ONE_CLICK => false,
+ PayPlugGatewayFactory::DEFERRED_CAPTURE => false,
+ PayPlugGatewayFactory::INTEGRATED_PAYMENT => true,
+ PayPlugGatewayFactory::HOSTED_FIELDS => false,
+ ]);
+
+ self::assertSame(
+ PayPlugGatewayFactory::DISPLAY_MODE_INTEGRATED_PAYMENT,
+ $configForm->get(PayPlugGatewayFactory::DISPLAY_MODE_FIELD)->getData(),
+ );
+ }
+
+ public function testSetData_existingHostedFieldsConfig_preselectsHostedFieldsRadio(): void
+ {
+ $form = $this->createRootForm();
+ $configForm = $form->get('gatewayConfig')->get('config');
+
+ $configForm->setData([
+ PayPlugGatewayFactory::ONE_CLICK => false,
+ PayPlugGatewayFactory::DEFERRED_CAPTURE => false,
+ PayPlugGatewayFactory::INTEGRATED_PAYMENT => false,
+ PayPlugGatewayFactory::HOSTED_FIELDS => true,
+ PayPlugGatewayFactory::HF_IDENTIFIER => 'acct_123',
+ ]);
+
+ self::assertSame(
+ PayPlugGatewayFactory::DISPLAY_MODE_HOSTED_FIELDS,
+ $configForm->get(PayPlugGatewayFactory::DISPLAY_MODE_FIELD)->getData(),
+ );
+ }
+
+ public function testSetData_neitherFlagSet_leavesRadioUnselected(): void
+ {
+ $form = $this->createRootForm();
+ $configForm = $form->get('gatewayConfig')->get('config');
+
+ $configForm->setData([
+ PayPlugGatewayFactory::ONE_CLICK => false,
+ PayPlugGatewayFactory::DEFERRED_CAPTURE => false,
+ PayPlugGatewayFactory::INTEGRATED_PAYMENT => false,
+ PayPlugGatewayFactory::HOSTED_FIELDS => false,
+ ]);
+
+ self::assertNull($configForm->get(PayPlugGatewayFactory::DISPLAY_MODE_FIELD)->getData());
+ }
+
+ public function testSubmit_integratedPaymentMode_withBlankFields_isValid(): void
+ {
+ // The conditional requirement only applies to hosted_fields; other modes must not be
+ // affected by a blank identifier field.
+ $form = $this->createRootForm();
+
+ $form->submit([
+ 'gatewayConfig' => [
+ 'config' => [
+ PayPlugGatewayFactory::ONE_CLICK => false,
+ PayPlugGatewayFactory::DEFERRED_CAPTURE => false,
+ PayPlugGatewayFactory::DISPLAY_MODE_FIELD => PayPlugGatewayFactory::DISPLAY_MODE_INTEGRATED_PAYMENT,
+ PayPlugGatewayFactory::HF_IDENTIFIER => '',
+ ],
+ ],
+ ]);
+
+ self::assertTrue($form->isValid());
+ }
+
+ /**
+ * A payment method configured before the SubMerchant ID field was removed still carries
+ * `hfSubMerchantId` in its stored config. Re-saving it must not fail on the now-unknown key,
+ * and the leftover value is simply ignored — GatewayCredentialsResolver no longer reads it.
+ */
+ public function testSubmit_hostedFieldsModeWithALeftoverSubMerchantIdInStoredConfig_isValid(): void
+ {
+ $form = $this->createRootForm();
+ $configForm = $form->get('gatewayConfig')->get('config');
+ $configForm->setData([
+ PayPlugGatewayFactory::ONE_CLICK => false,
+ PayPlugGatewayFactory::DEFERRED_CAPTURE => false,
+ PayPlugGatewayFactory::HOSTED_FIELDS => true,
+ PayPlugGatewayFactory::HF_IDENTIFIER => 'acct_123',
+ 'hfSubMerchantId' => 'sub_456',
+ ]);
+
+ $form->submit([
+ 'gatewayConfig' => [
+ 'config' => [
+ PayPlugGatewayFactory::ONE_CLICK => false,
+ PayPlugGatewayFactory::DEFERRED_CAPTURE => false,
+ PayPlugGatewayFactory::DISPLAY_MODE_FIELD => PayPlugGatewayFactory::DISPLAY_MODE_HOSTED_FIELDS,
+ PayPlugGatewayFactory::HF_IDENTIFIER => 'acct_123',
+ ],
+ ],
+ ]);
+
+ self::assertTrue($form->isValid());
+ }
+
+ /**
+ * Builds a minimal but realistic 3-level tree: root (the PaymentMethod form, exposing
+ * "channels") -> gatewayConfig -> config (PayPlugGatewayConfigurationType, the type under
+ * test).
+ */
+ private function createRootForm(): \Symfony\Component\Form\FormInterface
+ {
+ $paymentMethod = new class() {
+ public function getId(): ?int
+ {
+ return 1;
+ }
+ };
+
+ $root = $this->factory->createBuilder(FormType::class, $paymentMethod, ['data_class' => null]);
+ $root->add('channels', TextType::class, ['mapped' => false]);
+
+ $gatewayConfig = $root->create('gatewayConfig', FormType::class, ['mapped' => false]);
+ $gatewayConfig->add('config', PayPlugGatewayConfigurationType::class);
+
+ $root->add($gatewayConfig);
+
+ return $root->getForm();
+ }
+}
diff --git a/tests/PHPUnit/Gateway/Form/Extension/PayPlugGatewayConfigurationTypeExtensionTest.php b/tests/PHPUnit/Gateway/Form/Extension/PayPlugGatewayConfigurationTypeExtensionTest.php
new file mode 100644
index 00000000..cd5561a2
--- /dev/null
+++ b/tests/PHPUnit/Gateway/Form/Extension/PayPlugGatewayConfigurationTypeExtensionTest.php
@@ -0,0 +1,118 @@
+extension = new PayPlugGatewayConfigurationTypeExtension($this->createMock(TranslatorInterface::class));
+ }
+
+ public function testBuildForm_addsOneClickCheckboxField(): void
+ {
+ [, $addCalls] = $this->buildFormAndCollectAddCalls();
+
+ [$name, $type, $options] = $addCalls[0];
+ self::assertSame(PayPlugGatewayFactory::ONE_CLICK, $name);
+ self::assertSame(CheckboxType::class, $type);
+ self::assertSame('payplug_sylius_payplug_plugin.form.one_click_enable', $options['label']);
+ self::assertFalse($options['required']);
+ }
+
+ public function testBuildForm_addsDeferredCaptureCheckboxField(): void
+ {
+ [, $addCalls] = $this->buildFormAndCollectAddCalls();
+
+ [$name, $type, $options] = $addCalls[1];
+ self::assertSame(PayPlugGatewayFactory::DEFERRED_CAPTURE, $name);
+ self::assertSame(CheckboxType::class, $type);
+ self::assertSame('payplug_sylius_payplug_plugin.form.deferred_capture_enable', $options['label']);
+ self::assertFalse($options['required']);
+ }
+
+ public function testBuildForm_addsDisplayModeChoiceField(): void
+ {
+ [, $addCalls] = $this->buildFormAndCollectAddCalls();
+
+ [$name, $type, $options] = $addCalls[2];
+ self::assertSame(PayPlugGatewayFactory::DISPLAY_MODE_FIELD, $name);
+ self::assertSame(ChoiceType::class, $type);
+ self::assertFalse($options['mapped']);
+ self::assertFalse($options['required']);
+ self::assertTrue($options['expanded']);
+ self::assertSame(
+ [
+ 'payplug_sylius_payplug_plugin.form.integrated_payment_enable' => PayPlugGatewayFactory::DISPLAY_MODE_INTEGRATED_PAYMENT,
+ 'payplug_sylius_payplug_plugin.ui.hosted_fields_option' => PayPlugGatewayFactory::DISPLAY_MODE_HOSTED_FIELDS,
+ ],
+ $options['choices'],
+ );
+ }
+
+ public function testBuildForm_addsHfIdentifierTextField(): void
+ {
+ [, $addCalls] = $this->buildFormAndCollectAddCalls();
+
+ [$name, $type, $options] = $addCalls[3];
+ self::assertSame(PayPlugGatewayFactory::HF_IDENTIFIER, $name);
+ self::assertSame(TextType::class, $type);
+ self::assertSame('payplug_sylius_payplug_plugin.ui.hf_identifier_label', $options['label']);
+ self::assertFalse($options['required']);
+ }
+
+ /**
+ * The SubMerchant ID field was removed once UPC made `submerchantExternalId` optional: only the
+ * EUR MID configurations carry a submerchant, and Hosted Fields here targets the multi-currency
+ * ones, so the key is omitted from every payload rather than sent empty. HF_IDENTIFIER is the
+ * last field added.
+ */
+ public function testBuildForm_addsNoFieldAfterHfIdentifier(): void
+ {
+ [, $addCalls] = $this->buildFormAndCollectAddCalls();
+
+ self::assertArrayNotHasKey(4, $addCalls);
+ }
+
+ public function testGetExtendedTypes_returnsPayPlugGatewayConfigurationType(): void
+ {
+ self::assertSame([PayPlugGatewayConfigurationType::class], PayPlugGatewayConfigurationTypeExtension::getExtendedTypes());
+ }
+
+ /**
+ * @return array{0: FormBuilderInterface, 1: array}>}
+ */
+ private function buildFormAndCollectAddCalls(): array
+ {
+ $builder = $this->createMock(FormBuilderInterface::class);
+
+ $addCalls = [];
+ $builder
+ ->method('add')
+ ->willReturnCallback(function ($name, $type = null, array $options = []) use (&$addCalls, $builder) {
+ $addCalls[] = [$name, $type, $options];
+
+ return $builder;
+ })
+ ;
+ $builder->method('addEventListener')->willReturn($builder);
+
+ $this->extension->buildForm($builder, []);
+
+ return [$builder, $addCalls];
+ }
+}
diff --git a/tests/PHPUnit/Gateway/Form/Extension/PaymentMethodTypeExtensionFormSubmissionTest.php b/tests/PHPUnit/Gateway/Form/Extension/PaymentMethodTypeExtensionFormSubmissionTest.php
new file mode 100644
index 00000000..b470fe11
--- /dev/null
+++ b/tests/PHPUnit/Gateway/Form/Extension/PaymentMethodTypeExtensionFormSubmissionTest.php
@@ -0,0 +1,280 @@
+add('channels', ChannelChoiceType::class, $alreadyResolvedOptions + [...])`
+ * survives a *second* trip through ChannelChoiceType's real OptionsResolver and its normalizers;
+ * 2. that an error added to the `channels` child stays there instead of bubbling to the root
+ * (ChoiceType sets `error_bubbling => false`, unlike a compound FormType);
+ * 3. that `Form::add()` from inside POST_SET_DATA really re-maps the model data into the replaced
+ * child, rather than leaving it empty.
+ *
+ * All three are facts about Symfony, not about this plugin, so they are exactly the kind of thing
+ * that changes under a minor bump without any of our own code moving.
+ *
+ * The root form here is assembled by hand rather than through Sylius' own PaymentMethodType, whose
+ * constructor drags in the translations tree, GatewayConfigType and two generators. What it does
+ * reproduce faithfully is the shape this extension reaches into: a root carrying `enabled`, a real
+ * `channels` ChannelChoiceType and a `gatewayConfig.config` subtree, with the extension's listeners
+ * attached to the real root builder.
+ */
+final class PaymentMethodTypeExtensionFormSubmissionTest extends TypeTestCase
+{
+ private const CONFLICT_MESSAGE_ID = 'payplug_sylius_payplug_plugin.form.gateway_channel_conflict';
+
+ private ChannelInterface $channelFr;
+
+ private ChannelInterface $channelIt;
+
+ /** @var PaymentMethodRepositoryInterface&MockObject */
+ private PaymentMethodRepositoryInterface $paymentMethodRepository;
+
+ protected function setUp(): void
+ {
+ $this->channelFr = $this->buildChannel('WEB_FR', 'EUR');
+ $this->channelIt = $this->buildChannel('WEB_IT', 'EUR');
+ $this->paymentMethodRepository = $this->createMock(PaymentMethodRepositoryInterface::class);
+
+ parent::setUp();
+ }
+
+ protected function getTypes(): array
+ {
+ $channelRepository = $this->createMock(RepositoryInterface::class);
+ $channelRepository->method('findAll')->willReturn([$this->channelFr, $this->channelIt]);
+
+ return [
+ new ChannelChoiceType($channelRepository),
+ new PayPlugGatewayConfigurationType($this->translator()),
+ ];
+ }
+
+ /**
+ * A channel another *enabled* CB gateway already holds must come back as a submit-time error on
+ * the `channels` field itself — not bubbled to the root, where the admin form would render it
+ * detached from the field that caused it.
+ */
+ public function testSubmit_channelClaimedByAnotherEnabledGateway_isRejectedOnTheChannelsField(): void
+ {
+ $this->givenRivalGatewayHolding($this->channelFr, 'CB — France');
+
+ $form = $this->createRootForm($this->payPlugPaymentMethod());
+
+ $form->submit([
+ 'enabled' => '1',
+ 'channels' => ['WEB_FR'],
+ ]);
+
+ self::assertTrue($form->isSubmitted());
+ self::assertFalse($form->isValid());
+
+ $channelsErrors = $form->get('channels')->getErrors();
+ self::assertCount(1, $channelsErrors);
+ self::assertSame(
+ self::CONFLICT_MESSAGE_ID . '|WEB_FR|CB — France',
+ $channelsErrors[0]->getMessage(),
+ );
+
+ self::assertCount(
+ 0,
+ $form->getErrors(),
+ 'The conflict must stay on the channels field — ChoiceType does not bubble.',
+ );
+ }
+
+ /**
+ * The mirror case: a free channel submits cleanly. Guards against the rule firing on everything.
+ */
+ public function testSubmit_channelHeldByNobody_isAccepted(): void
+ {
+ $this->givenRivalGatewayHolding($this->channelFr, 'CB — France');
+
+ $form = $this->createRootForm($this->payPlugPaymentMethod());
+
+ $form->submit([
+ 'enabled' => '1',
+ 'channels' => ['WEB_IT'],
+ ]);
+
+ self::assertTrue($form->isValid(), 'WEB_IT is held by nobody, so the submission must pass.');
+ self::assertCount(0, $form->get('channels')->getErrors(true));
+ }
+
+ /**
+ * PRE-3629, through the real ChannelChoiceType: the replaced `channels` child must still render
+ * both choices — proving the resolved options survived the second pass through the resolver —
+ * with only the claimed one carrying `disabled` and a `title` naming the claiming method.
+ */
+ public function testSetData_channelClaimedByAnotherEnabledGateway_isRenderedDisabled(): void
+ {
+ $this->givenRivalGatewayHolding($this->channelIt, 'CB — Italy');
+
+ $form = $this->createRootForm($this->payPlugPaymentMethod());
+
+ $channelChoices = $form->get('channels')->createView()->children;
+
+ self::assertCount(2, $channelChoices, 'Both channels must still be offered.');
+
+ $byValue = [];
+ foreach ($channelChoices as $choiceView) {
+ $byValue[$choiceView->vars['value']] = $choiceView->vars['attr'];
+ }
+
+ self::assertArrayNotHasKey('disabled', $byValue['WEB_FR'], 'WEB_FR is free and must stay selectable.');
+ self::assertTrue($byValue['WEB_IT']['disabled'] ?? false, 'WEB_IT is claimed and must be disabled.');
+ self::assertSame(
+ self::CONFLICT_MESSAGE_ID . '|WEB_IT|CB — Italy',
+ $byValue['WEB_IT']['title'] ?? null,
+ );
+ }
+
+ /**
+ * Channels the edited method already holds stay selectable even when the checker would report
+ * them: browsers do not submit disabled checkboxes, so disabling a *checked* one would silently
+ * drop the channel on save. This is the render-side half of that rule, exercised against the
+ * real ChoiceType rather than a stub.
+ */
+ public function testSetData_channelAlreadyHeldByTheEditedMethod_staysSelectable(): void
+ {
+ $subject = $this->payPlugPaymentMethod();
+ $subject->addChannel($this->channelFr);
+
+ $this->givenRivalGatewayHolding($this->channelFr, 'CB — France');
+
+ $form = $this->createRootForm($subject);
+
+ foreach ($form->get('channels')->createView()->children as $choiceView) {
+ if ('WEB_FR' === $choiceView->vars['value']) {
+ self::assertArrayNotHasKey(
+ 'disabled',
+ $choiceView->vars['attr'],
+ 'A channel the edited method already holds must stay selectable.',
+ );
+ }
+ }
+ }
+
+ /**
+ * Rivals are what `findEnabledByGatewayName()` returns, so stubbing that one method is enough to
+ * drive the real GatewayChannelConflictChecker.
+ */
+ private function givenRivalGatewayHolding(ChannelInterface $channel, string $name): void
+ {
+ $rival = $this->createMock(PaymentMethodInterface::class);
+ $rival->method('getId')->willReturn(99);
+ $rival->method('getName')->willReturn($name);
+ $rival->method('isEnabled')->willReturn(true);
+ $rival->method('getChannels')->willReturn(new \Doctrine\Common\Collections\ArrayCollection([$channel]));
+
+ $this->paymentMethodRepository
+ ->method('findEnabledByGatewayName')
+ ->with(PayPlugGatewayFactory::FACTORY_NAME)
+ ->willReturn([$rival]);
+ }
+
+ private function payPlugPaymentMethod(): PaymentMethod
+ {
+ $gatewayConfig = new GatewayConfig();
+ $gatewayConfig->setFactoryName(PayPlugGatewayFactory::FACTORY_NAME);
+ $gatewayConfig->setGatewayName(PayPlugGatewayFactory::FACTORY_NAME);
+ // Redirected mode: neither display-mode flag set. The CB type only gates on base currency
+ // for integrated payment, so this keeps these tests about the channel-conflict rule alone.
+ $gatewayConfig->setConfig([
+ PayPlugGatewayFactory::INTEGRATED_PAYMENT => false,
+ PayPlugGatewayFactory::HOSTED_FIELDS => false,
+ ]);
+
+ $paymentMethod = new PaymentMethod();
+ $paymentMethod->setCode('payplug_cb');
+ $paymentMethod->setGatewayConfig($gatewayConfig);
+
+ return $paymentMethod;
+ }
+
+ /**
+ * The shape `PaymentMethodTypeExtension` reaches into: `enabled`, a real `channels`
+ * ChannelChoiceType, and `gatewayConfig.config` — with the extension's own listeners attached
+ * to the real root builder, so they run through Symfony's real event dispatch.
+ */
+ private function createRootForm(PaymentMethod $paymentMethod): FormInterface
+ {
+ $extension = new PaymentMethodTypeExtension(
+ new GatewayChannelConflictChecker($this->paymentMethodRepository),
+ $this->translator(),
+ );
+
+ $builder = $this->factory->createBuilder(FormType::class, $paymentMethod, [
+ 'data_class' => PaymentMethod::class,
+ ]);
+
+ $builder->add('enabled', CheckboxType::class, ['required' => false]);
+ $builder->add('channels', ChannelChoiceType::class, [
+ 'multiple' => true,
+ 'expanded' => true,
+ ]);
+
+ $gatewayConfig = $builder->create('gatewayConfig', FormType::class, ['mapped' => false]);
+ $gatewayConfig->add('config', PayPlugGatewayConfigurationType::class, ['mapped' => false]);
+ $builder->add($gatewayConfig);
+
+ $extension->buildForm($builder, []);
+
+ return $builder->getForm();
+ }
+
+ private function buildChannel(string $code, string $currencyCode): ChannelInterface
+ {
+ $currency = new Currency();
+ $currency->setCode($currencyCode);
+
+ $channel = new Channel();
+ $channel->setCode($code);
+ $channel->setName($code);
+ $channel->setBaseCurrency($currency);
+
+ return $channel;
+ }
+
+ private function translator(): TranslatorInterface
+ {
+ $translator = $this->createMock(TranslatorInterface::class);
+ $translator->method('trans')->willReturnCallback(
+ static fn (string $id, array $parameters = []): string => \implode(
+ '|',
+ [$id, ...\array_values($parameters)],
+ ),
+ );
+
+ return $translator;
+ }
+}
diff --git a/tests/PHPUnit/Gateway/Form/Extension/PaymentMethodTypeExtensionTest.php b/tests/PHPUnit/Gateway/Form/Extension/PaymentMethodTypeExtensionTest.php
new file mode 100644
index 00000000..482a02ec
--- /dev/null
+++ b/tests/PHPUnit/Gateway/Form/Extension/PaymentMethodTypeExtensionTest.php
@@ -0,0 +1,352 @@
+translator = $this->createMock(TranslatorInterface::class);
+ $this->translator->method('trans')->willReturnCallback(static fn (string $id) => $id);
+ }
+
+ /**
+ * PRE-3553: Integrated Payment is EUR-only, and the error must land on the `channels` field.
+ */
+ public function testPostSubmit_integratedPaymentOnNonEurChannel_addsCurrencyErrorOnChannels(): void
+ {
+ self::assertSame(
+ ['payplug_sylius_payplug_plugin.form.integrated_payment_currency_incompatible'],
+ $this->submitPayPlugPaymentMethod([PayPlugGatewayFactory::INTEGRATED_PAYMENT => true], 'USD'),
+ );
+ }
+
+ public function testPostSubmit_integratedPaymentOnEuroChannel_addsNoError(): void
+ {
+ self::assertSame(
+ [],
+ $this->submitPayPlugPaymentMethod([PayPlugGatewayFactory::INTEGRATED_PAYMENT => true], 'EUR'),
+ );
+ }
+
+ /**
+ * The CB gate narrows the check to Integrated Payment: Hosted Fields works in any currency.
+ */
+ public function testPostSubmit_hostedFieldsOnNonEurChannel_addsNoError(): void
+ {
+ self::assertSame(
+ [],
+ $this->submitPayPlugPaymentMethod([PayPlugGatewayFactory::HOSTED_FIELDS => true], 'USD'),
+ );
+ }
+
+ /**
+ * This extension must target the base `PaymentMethodType`, not the AdminBundle subtype, so that
+ * the AdminBundle form (which extends the base type) inherits the listener too.
+ */
+ public function testGetExtendedTypes_returnsPaymentMethodType(): void
+ {
+ self::assertSame([PaymentMethodType::class], PaymentMethodTypeExtension::getExtendedTypes());
+ }
+
+ /**
+ * PRE-3629: a channel held by another *enabled* CB gateway renders as an unselectable choice,
+ * with the same wording the POST_SUBMIT rule would have produced had it been submitted.
+ */
+ public function testPostSetData_channelClaimedByAnotherEnabledGateway_isRenderedDisabled(): void
+ {
+ $choiceAttr = $this->rebuiltChannelsOptions()['choice_attr'];
+
+ self::assertSame(
+ [
+ 'disabled' => true,
+ 'title' => 'payplug_sylius_payplug_plugin.form.gateway_channel_conflict|WEB_FR|CB 1',
+ ],
+ $choiceAttr($this->channel('WEB_FR')),
+ );
+ }
+
+ public function testPostSetData_unclaimedChannel_staysSelectable(): void
+ {
+ $choiceAttr = $this->rebuiltChannelsOptions()['choice_attr'];
+
+ self::assertSame([], $choiceAttr($this->channel('WEB_IT')));
+ }
+
+ /**
+ * The field is replaced rather than configured in place, so everything Sylius put on it —
+ * `multiple`, `expanded`, its label — has to survive the round trip.
+ */
+ public function testPostSetData_rebuiltChannelsField_keepsItsOriginalOptions(): void
+ {
+ $options = $this->rebuiltChannelsOptions();
+
+ self::assertTrue($options['multiple']);
+ self::assertTrue($options['expanded']);
+ self::assertSame('sylius.form.payment_method.channels', $options['label']);
+ }
+
+ /**
+ * Payment methods belonging to other plugins share this form; their channel picker is none of
+ * our business.
+ */
+ public function testPostSetData_paymentMethodIsNotOneOfOurs_leavesTheChannelsFieldUntouched(): void
+ {
+ self::assertNull($this->runPostSetData(new \stdClass()));
+ }
+
+ /**
+ * Runs the extension's POST_SET_DATA listener over a CB payment method, against a rival CB
+ * gateway that is enabled and holds `WEB_FR`.
+ *
+ * @return array the options handed to `add('channels', ...)`
+ */
+ private function rebuiltChannelsOptions(): array
+ {
+ $captured = $this->runPostSetData($this->payPlugPaymentMethod());
+
+ self::assertIsArray($captured);
+ self::assertSame('channels', $captured['name']);
+ self::assertSame(ChannelChoiceType::class, $captured['type']);
+ self::assertIsCallable($captured['options']['choice_attr']);
+
+ return $captured['options'];
+ }
+
+ /**
+ * @return array{name: string, type: string, options: array}|null
+ * the `add()` call the listener made, or null when it left the form alone
+ */
+ private function runPostSetData(mixed $data): ?array
+ {
+ $rival = $this->createMock(PaymentMethodInterface::class);
+ $rival->method('getId')->willReturn(7);
+ $rival->method('isEnabled')->willReturn(true);
+ $rival->method('getName')->willReturn('CB 1');
+ $rival->method('getChannels')->willReturn(new ArrayCollection([$this->channel('WEB_FR')]));
+
+ $repository = $this->createMock(PaymentMethodRepositoryInterface::class);
+ $repository->method('findEnabledByGatewayName')->willReturn([$rival]);
+
+ $captured = null;
+ $form = $this->buildRootForm(
+ $this->channelsForm(),
+ function (string $name, string $type, array $options) use (&$captured): void {
+ $captured = ['name' => $name, 'type' => $type, 'options' => $options];
+ },
+ );
+
+ // Renders the parameters into the result so the assertions can pin *which* channel and
+ // which rival payment method the tooltip names, not just that some message was translated.
+ $translator = $this->createMock(TranslatorInterface::class);
+ $translator->method('trans')->willReturnCallback(
+ static fn (string $id, array $parameters = []): string => \implode(
+ '|',
+ [$id, ...\array_values($parameters)],
+ ),
+ );
+
+ ($this->captureListener(FormEvents::POST_SET_DATA, $repository, $translator))(new FormEvent($form, $data));
+
+ return $captured;
+ }
+
+ /**
+ * Stand-in for the `channels` field Sylius' own CoreBundle extension added, carrying the
+ * resolved options the listener has to copy forward.
+ */
+ private function channelsForm(): FormInterface
+ {
+ $formConfig = $this->createMock(FormConfigInterface::class);
+ $formConfig->method('getOptions')->willReturn([
+ 'multiple' => true,
+ 'expanded' => true,
+ 'label' => 'sylius.form.payment_method.channels',
+ 'choice_attr' => null,
+ ]);
+
+ $channelsForm = $this->createMock(FormInterface::class);
+ $channelsForm->method('getConfig')->willReturn($formConfig);
+
+ return $channelsForm;
+ }
+
+ private function payPlugPaymentMethod(): PaymentMethodInterface
+ {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getFactoryName')->willReturn(PayPlugGatewayFactory::FACTORY_NAME);
+ $gatewayConfig->method('getConfig')->willReturn([]);
+
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $paymentMethod->method('getId')->willReturn(null);
+ $paymentMethod->method('getGatewayConfig')->willReturn($gatewayConfig);
+ $paymentMethod->method('getChannels')->willReturn(new ArrayCollection());
+
+ return $paymentMethod;
+ }
+
+ private function channel(string $code): ChannelInterface
+ {
+ $channel = $this->createMock(ChannelInterface::class);
+ $channel->method('getCode')->willReturn($code);
+
+ return $channel;
+ }
+
+ /**
+ * Runs the extension's POST_SUBMIT listener over a CB payment method carrying a single channel.
+ *
+ * @param array $mappedGatewayConfig as returned by GatewayConfigInterface::getConfig()
+ *
+ * @return list messages of the FormErrors added to the `channels` child
+ */
+ private function submitPayPlugPaymentMethod(array $mappedGatewayConfig, string $baseCurrencyCode): array
+ {
+ $currency = $this->createMock(CurrencyInterface::class);
+ $currency->method('getCode')->willReturn($baseCurrencyCode);
+
+ $channel = $this->createMock(ChannelInterface::class);
+ $channel->method('getCode')->willReturn('channel_code');
+ $channel->method('getBaseCurrency')->willReturn($currency);
+
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getFactoryName')->willReturn(PayPlugGatewayFactory::FACTORY_NAME);
+ $gatewayConfig->method('getConfig')->willReturn($mappedGatewayConfig);
+
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $paymentMethod->method('getGatewayConfig')->willReturn($gatewayConfig);
+ $paymentMethod->method('getChannels')->willReturn(new ArrayCollection([$channel]));
+
+ $errors = [];
+ $channelsForm = $this->createMock(FormInterface::class);
+ $channelsForm->method('addError')->willReturnCallback(
+ function (FormError $error) use (&$errors, $channelsForm): FormInterface {
+ $errors[] = $error->getMessage();
+
+ return $channelsForm;
+ },
+ );
+
+ $repository = $this->createMock(PaymentMethodRepositoryInterface::class);
+ $repository->method('findEnabledByGatewayName')->willReturn([]);
+
+ ($this->captureListener(FormEvents::POST_SUBMIT, $repository))(
+ new FormEvent($this->buildRootForm($channelsForm), $paymentMethod),
+ );
+
+ return $errors;
+ }
+
+ /**
+ * Minimal stand-in for the `paymentMethod` → `gatewayConfig` → `config` form tree the extension
+ * walks to resolve the gateway's configuration type.
+ */
+ private function buildRootForm(FormInterface $channelsForm, ?callable $onAdd = null): FormInterface
+ {
+ $resolvedType = $this->createMock(ResolvedFormTypeInterface::class);
+ $resolvedType->method('getInnerType')->willReturn(new PayPlugGatewayConfigurationType($this->translator));
+
+ $formConfig = $this->createMock(FormConfigInterface::class);
+ $formConfig->method('getType')->willReturn($resolvedType);
+
+ $configForm = $this->createMock(FormInterface::class);
+ $configForm->method('getConfig')->willReturn($formConfig);
+
+ $gatewayConfigForm = $this->createMock(FormInterface::class);
+ $gatewayConfigForm->method('has')->willReturnCallback(static fn (string $name): bool => 'config' === $name);
+ $gatewayConfigForm->method('get')->willReturn($configForm);
+
+ $form = $this->createMock(FormInterface::class);
+ $form->method('has')->willReturnCallback(
+ static fn (string $name): bool => \in_array($name, ['gatewayConfig', 'channels'], true),
+ );
+ $form->method('get')->willReturnCallback(
+ static fn (string $name): FormInterface => 'channels' === $name ? $channelsForm : $gatewayConfigForm,
+ );
+ $form->method('add')->willReturnCallback(
+ function (string $name, string $type, array $options) use ($onAdd, $form): FormInterface {
+ if (null !== $onAdd) {
+ $onAdd($name, $type, $options);
+ }
+
+ return $form;
+ },
+ );
+
+ return $form;
+ }
+
+ private function captureListener(
+ string $wantedEventName,
+ PaymentMethodRepositoryInterface $repository,
+ ?TranslatorInterface $translator = null,
+ ): callable {
+ $extension = new PaymentMethodTypeExtension(
+ new GatewayChannelConflictChecker($repository),
+ $translator ?? $this->translator,
+ );
+
+ $listener = null;
+ $builder = $this->createMock(FormBuilderInterface::class);
+ $builder->method('addEventListener')->willReturnCallback(
+ function (string $eventName, callable $callback) use (
+ $wantedEventName,
+ &$listener,
+ $builder,
+ ): FormBuilderInterface {
+ if ($wantedEventName === $eventName) {
+ $listener = $callback;
+ }
+
+ return $builder;
+ },
+ );
+
+ $extension->buildForm($builder, []);
+
+ self::assertIsCallable($listener);
+
+ return $listener;
+ }
+}
diff --git a/tests/PHPUnit/Gateway/Form/Extension/ScalapayGatewayConfigurationTypeExtensionTest.php b/tests/PHPUnit/Gateway/Form/Extension/ScalapayGatewayConfigurationTypeExtensionTest.php
new file mode 100644
index 00000000..5e5f636d
--- /dev/null
+++ b/tests/PHPUnit/Gateway/Form/Extension/ScalapayGatewayConfigurationTypeExtensionTest.php
@@ -0,0 +1,71 @@
+extension = new ScalapayGatewayConfigurationTypeExtension();
+ }
+
+ public function testBuildForm_addsMinAmountMoneyField(): void
+ {
+ [, $addCalls] = $this->buildFormAndCollectAddCalls();
+
+ [$name, $type, $options] = $addCalls[0];
+ self::assertSame(ScalapayGatewayFactory::MIN_AMOUNT, $name);
+ self::assertSame(MoneyType::class, $type);
+ self::assertSame('EUR', $options['currency']);
+ self::assertFalse($options['required']);
+ }
+
+ public function testBuildForm_addsMaxAmountMoneyField(): void
+ {
+ [, $addCalls] = $this->buildFormAndCollectAddCalls();
+
+ [$name, $type, $options] = $addCalls[1];
+ self::assertSame(ScalapayGatewayFactory::MAX_AMOUNT, $name);
+ self::assertSame(MoneyType::class, $type);
+ self::assertSame('EUR', $options['currency']);
+ self::assertFalse($options['required']);
+ }
+
+ public function testGetExtendedTypes_returnsScalapayGatewayConfigurationType(): void
+ {
+ self::assertSame([ScalapayGatewayConfigurationType::class], ScalapayGatewayConfigurationTypeExtension::getExtendedTypes());
+ }
+
+ /**
+ * @return array{0: FormBuilderInterface, 1: array}>}
+ */
+ private function buildFormAndCollectAddCalls(): array
+ {
+ $builder = $this->createMock(FormBuilderInterface::class);
+
+ $addCalls = [];
+ $builder
+ ->method('add')
+ ->willReturnCallback(function ($name, $type = null, array $options = []) use (&$addCalls, $builder) {
+ $addCalls[] = [$name, $type, $options];
+
+ return $builder;
+ })
+ ;
+
+ $this->extension->buildForm($builder, []);
+
+ return [$builder, $addCalls];
+ }
+}
diff --git a/tests/PHPUnit/Gateway/Form/Type/AbstractGatewayConfigurationTypeTest.php b/tests/PHPUnit/Gateway/Form/Type/AbstractGatewayConfigurationTypeTest.php
new file mode 100644
index 00000000..1f8eb048
--- /dev/null
+++ b/tests/PHPUnit/Gateway/Form/Type/AbstractGatewayConfigurationTypeTest.php
@@ -0,0 +1,90 @@
+translator = $this->createMock(TranslatorInterface::class);
+ $this->translator->method('trans')->willReturnCallback(static fn (string $id) => $id);
+
+ $this->type = new AbstractGatewayConfigurationType(
+ $this->translator,
+ );
+ }
+
+ /**
+ * Default hook implementation: every gateway subtype that doesn't override it keeps
+ * today's behavior of always enforcing the base currency.
+ */
+ public function testShouldValidateBaseCurrency_defaultImplementation_alwaysReturnsTrue(): void
+ {
+ self::assertTrue($this->type->shouldValidateBaseCurrency([]));
+ self::assertTrue($this->type->shouldValidateBaseCurrency(['anything' => 'irrelevant']));
+ }
+
+ /**
+ * Default hook implementation: every gateway subtype that doesn't override it keeps today's
+ * generic per-gateway wording (only `PayPlugGatewayConfigurationType` overrides this, for a
+ * message specific to Integrated Payment).
+ */
+ public function testBaseCurrencyViolationMessage_defaultImplementation_returnsGenericKey(): void
+ {
+ $channel = $this->createMock(ChannelInterface::class);
+ $channel->method('getCode')->willReturn('channel_code');
+
+ self::assertSame(
+ 'payplug_sylius_payplug_plugin.form.base_currency_not_euro',
+ $this->type->baseCurrencyViolationMessage($channel),
+ );
+ }
+
+ public function testGetBaseCurrencyCode_defaultImplementation_isEuro(): void
+ {
+ self::assertSame('EUR', $this->type->getBaseCurrencyCode());
+ }
+
+ /**
+ * The only subtype that narrows the hook: Integrated Payment is the only display mode that
+ * requires every associated channel to be EUR.
+ *
+ * Keyed by the persisted `integratedPayment`/`hostedFields` booleans, which is what the caller
+ * passes (`GatewayConfigInterface::getConfig()`); the `hostedFieldsMode` form field is unmapped
+ * and never appears in that array.
+ */
+ public function testShouldValidateBaseCurrency_payPlugType_onlyAppliesToIntegratedPayment(): void
+ {
+ $type = new PayPlugGatewayConfigurationType(
+ $this->translator,
+ );
+
+ self::assertTrue($type->shouldValidateBaseCurrency([
+ PayPlugGatewayFactory::INTEGRATED_PAYMENT => true,
+ ]));
+ self::assertFalse($type->shouldValidateBaseCurrency([
+ PayPlugGatewayFactory::HOSTED_FIELDS => true,
+ ]));
+ self::assertFalse($type->shouldValidateBaseCurrency([]));
+ }
+}
diff --git a/tests/PHPUnit/Gateway/Form/Type/PayPlugGatewayConfigurationTypeTest.php b/tests/PHPUnit/Gateway/Form/Type/PayPlugGatewayConfigurationTypeTest.php
new file mode 100644
index 00000000..8edacc1e
--- /dev/null
+++ b/tests/PHPUnit/Gateway/Form/Type/PayPlugGatewayConfigurationTypeTest.php
@@ -0,0 +1,92 @@
+translator = $this->createMock(TranslatorInterface::class);
+ $this->translator->method('trans')->willReturnCallback(static fn (string $id) => $id);
+
+ $this->type = new PayPlugGatewayConfigurationType(
+ $this->translator,
+ );
+ }
+
+ /**
+ * The arrays below are keyed by the persisted `integratedPayment`/`hostedFields` booleans
+ * written by `PayPlugGatewayFactory::resolveDisplayModeFlags()`, i.e. the shape the production
+ * caller hands the hook (`GatewayConfigInterface::getConfig()`). The `hostedFieldsMode` form
+ * field is unmapped and never reaches the persisted config.
+ */
+ public function testShouldValidateBaseCurrency_integratedPaymentSelected_returnsTrue(): void
+ {
+ self::assertTrue($this->shouldValidateBaseCurrency([
+ PayPlugGatewayFactory::INTEGRATED_PAYMENT => true,
+ ]));
+ }
+
+ public function testShouldValidateBaseCurrency_hostedFieldsSelected_returnsFalse(): void
+ {
+ self::assertFalse($this->shouldValidateBaseCurrency([
+ PayPlugGatewayFactory::HOSTED_FIELDS => true,
+ ]));
+ }
+
+ public function testShouldValidateBaseCurrency_noModeSelected_returnsFalse(): void
+ {
+ self::assertFalse($this->shouldValidateBaseCurrency([]));
+ }
+
+ /**
+ * PRE-3553: this must be a message specific to Integrated Payment, not the generic
+ * `base_currency_not_euro` wording used by every other gateway subtype - since
+ * shouldValidateBaseCurrency() above only lets this fire when integrated_payment is
+ * selected, it doesn't need to branch on mode itself.
+ */
+ public function testBaseCurrencyViolationMessage_returnsIntegratedPaymentSpecificKey(): void
+ {
+ $channel = $this->createMock(ChannelInterface::class);
+
+ self::assertSame(
+ 'payplug_sylius_payplug_plugin.form.integrated_payment_currency_incompatible',
+ $this->baseCurrencyViolationMessage($channel),
+ );
+ }
+
+ private function shouldValidateBaseCurrency(array $data): bool
+ {
+ $method = new \ReflectionMethod(PayPlugGatewayConfigurationType::class, 'shouldValidateBaseCurrency');
+ $method->setAccessible(true);
+
+ /** @var bool $result */
+ $result = $method->invoke($this->type, $data);
+
+ return $result;
+ }
+
+ private function baseCurrencyViolationMessage(ChannelInterface $channel): string
+ {
+ $method = new \ReflectionMethod(PayPlugGatewayConfigurationType::class, 'baseCurrencyViolationMessage');
+ $method->setAccessible(true);
+
+ /** @var string $result */
+ $result = $method->invoke($this->type, $channel);
+
+ return $result;
+ }
+}
diff --git a/tests/PHPUnit/Gateway/PayPlugGatewayFactoryTest.php b/tests/PHPUnit/Gateway/PayPlugGatewayFactoryTest.php
new file mode 100644
index 00000000..7a1ae459
--- /dev/null
+++ b/tests/PHPUnit/Gateway/PayPlugGatewayFactoryTest.php
@@ -0,0 +1,131 @@
+ true]),
+ );
+ }
+
+ public function testResolveDisplayMode_hostedFieldsTrueAndIntegratedPaymentTrue_hostedFieldsWins(): void
+ {
+ self::assertSame(
+ PayPlugGatewayFactory::DISPLAY_MODE_HOSTED_FIELDS,
+ PayPlugGatewayFactory::resolveDisplayMode([
+ PayPlugGatewayFactory::HOSTED_FIELDS => true,
+ PayPlugGatewayFactory::INTEGRATED_PAYMENT => true,
+ ]),
+ );
+ }
+
+ public function testResolveDisplayMode_integratedPaymentTrue_returnsIntegratedPayment(): void
+ {
+ self::assertSame(
+ PayPlugGatewayFactory::DISPLAY_MODE_INTEGRATED_PAYMENT,
+ PayPlugGatewayFactory::resolveDisplayMode([PayPlugGatewayFactory::INTEGRATED_PAYMENT => true]),
+ );
+ }
+
+ public function testResolveDisplayMode_neitherFlagSet_returnsNull(): void
+ {
+ self::assertNull(PayPlugGatewayFactory::resolveDisplayMode([]));
+ }
+
+ public function testResolveDisplayMode_bothFlagsFalse_returnsNull(): void
+ {
+ self::assertNull(PayPlugGatewayFactory::resolveDisplayMode([
+ PayPlugGatewayFactory::HOSTED_FIELDS => false,
+ PayPlugGatewayFactory::INTEGRATED_PAYMENT => false,
+ ]));
+ }
+
+ // -------------------------------------------------------------------------
+ // resolveDisplayModeFlags()
+ // -------------------------------------------------------------------------
+
+ public function testResolveDisplayModeFlags_hostedFields_setsHostedFieldsOnlyTrue(): void
+ {
+ self::assertSame(
+ [PayPlugGatewayFactory::INTEGRATED_PAYMENT => false, PayPlugGatewayFactory::HOSTED_FIELDS => true],
+ PayPlugGatewayFactory::resolveDisplayModeFlags(PayPlugGatewayFactory::DISPLAY_MODE_HOSTED_FIELDS),
+ );
+ }
+
+ public function testResolveDisplayModeFlags_integratedPayment_setsIntegratedPaymentOnlyTrue(): void
+ {
+ self::assertSame(
+ [PayPlugGatewayFactory::INTEGRATED_PAYMENT => true, PayPlugGatewayFactory::HOSTED_FIELDS => false],
+ PayPlugGatewayFactory::resolveDisplayModeFlags(PayPlugGatewayFactory::DISPLAY_MODE_INTEGRATED_PAYMENT),
+ );
+ }
+
+ public function testResolveDisplayModeFlags_null_setsBothFalse(): void
+ {
+ self::assertSame(
+ [PayPlugGatewayFactory::INTEGRATED_PAYMENT => false, PayPlugGatewayFactory::HOSTED_FIELDS => false],
+ PayPlugGatewayFactory::resolveDisplayModeFlags(null),
+ );
+ }
+
+ public function testResolveDisplayModeFlags_unknownValue_setsBothFalse(): void
+ {
+ self::assertSame(
+ [PayPlugGatewayFactory::INTEGRATED_PAYMENT => false, PayPlugGatewayFactory::HOSTED_FIELDS => false],
+ PayPlugGatewayFactory::resolveDisplayModeFlags('not_a_real_mode'),
+ );
+ }
+
+ // -------------------------------------------------------------------------
+ // missingHostedFieldsRequirements()
+ // -------------------------------------------------------------------------
+
+ public function testMissingHostedFieldsRequirements_hostedFieldsNotSelected_returnsEmpty(): void
+ {
+ self::assertSame([], PayPlugGatewayFactory::missingHostedFieldsRequirements([
+ PayPlugGatewayFactory::DISPLAY_MODE_FIELD => PayPlugGatewayFactory::DISPLAY_MODE_INTEGRATED_PAYMENT,
+ ]));
+ }
+
+ public function testMissingHostedFieldsRequirements_hostedFieldsSelectedIdentifierMissing_returnsIdentifier(): void
+ {
+ self::assertSame(
+ [PayPlugGatewayFactory::HF_IDENTIFIER],
+ PayPlugGatewayFactory::missingHostedFieldsRequirements([
+ PayPlugGatewayFactory::DISPLAY_MODE_FIELD => PayPlugGatewayFactory::DISPLAY_MODE_HOSTED_FIELDS,
+ ]),
+ );
+ }
+
+ public function testMissingHostedFieldsRequirements_hostedFieldsSelectedIdentifierBlank_returnsIdentifier(): void
+ {
+ self::assertSame(
+ [PayPlugGatewayFactory::HF_IDENTIFIER],
+ PayPlugGatewayFactory::missingHostedFieldsRequirements([
+ PayPlugGatewayFactory::DISPLAY_MODE_FIELD => PayPlugGatewayFactory::DISPLAY_MODE_HOSTED_FIELDS,
+ PayPlugGatewayFactory::HF_IDENTIFIER => ' ',
+ ]),
+ );
+ }
+
+ public function testMissingHostedFieldsRequirements_hostedFieldsSelectedIdentifierFilled_returnsEmpty(): void
+ {
+ self::assertSame([], PayPlugGatewayFactory::missingHostedFieldsRequirements([
+ PayPlugGatewayFactory::DISPLAY_MODE_FIELD => PayPlugGatewayFactory::DISPLAY_MODE_HOSTED_FIELDS,
+ PayPlugGatewayFactory::HF_IDENTIFIER => 'acct_123',
+ ]));
+ }
+}
diff --git a/tests/PHPUnit/Gateway/Validator/Constraints/HasNoGatewayChannelConflictValidatorTest.php b/tests/PHPUnit/Gateway/Validator/Constraints/HasNoGatewayChannelConflictValidatorTest.php
new file mode 100644
index 00000000..811add4e
--- /dev/null
+++ b/tests/PHPUnit/Gateway/Validator/Constraints/HasNoGatewayChannelConflictValidatorTest.php
@@ -0,0 +1,144 @@
+paymentMethodRepository = $this->createMock(PaymentMethodRepositoryInterface::class);
+
+ return new HasNoGatewayChannelConflictValidator(
+ new GatewayChannelConflictChecker($this->paymentMethodRepository),
+ );
+ }
+
+ /**
+ * The point of the constraint: the same rule the admin form enforces, reached through
+ * PaymentMethodValidator, so a resource-controller or API write cannot leave two enabled
+ * gateways of one factory sharing a channel.
+ */
+ public function testValidate_channelClaimedByAnotherEnabledGateway_addsAViolationOnChannels(): void
+ {
+ $channel = $this->channel('WEB_FR');
+
+ $this->givenEnabledGateways([
+ $this->paymentMethod(id: 7, channels: [$channel], name: 'CB — France'),
+ ]);
+
+ $this->validator->validate(
+ $this->paymentMethod(id: 8, channels: [$channel]),
+ new HasNoGatewayChannelConflict(),
+ );
+
+ $this->buildViolation('payplug_sylius_payplug_plugin.form.gateway_channel_conflict')
+ ->setParameter('%channel%', 'WEB_FR')
+ ->setParameter('%payment_method%', 'CB — France')
+ ->atPath('property.path.channels')
+ ->assertRaised();
+ }
+
+ public function testValidate_disjointChannels_addsNoViolation(): void
+ {
+ $this->givenEnabledGateways([
+ $this->paymentMethod(id: 7, channels: [$this->channel('WEB_FR')], name: 'CB — France'),
+ ]);
+
+ $this->validator->validate(
+ $this->paymentMethod(id: 8, channels: [$this->channel('WEB_IT')]),
+ new HasNoGatewayChannelConflict(),
+ );
+
+ $this->assertNoViolation();
+ }
+
+ /**
+ * A disabled subject claims nothing — that is what makes logging a gateway out release its
+ * channels for another config (PRE-3632). The repository must not even be consulted.
+ */
+ public function testValidate_disabledSubject_isNotEvenChecked(): void
+ {
+ $this->paymentMethodRepository->expects(self::never())->method('findEnabledByGatewayName');
+
+ $this->validator->validate(
+ $this->paymentMethod(id: 8, channels: [$this->channel('WEB_FR')], enabled: false),
+ new HasNoGatewayChannelConflict(),
+ );
+
+ $this->assertNoViolation();
+ }
+
+ public function testValidate_aValueThatIsNotAPaymentMethod_addsNoViolation(): void
+ {
+ $this->validator->validate('not a payment method', new HasNoGatewayChannelConflict());
+
+ $this->assertNoViolation();
+ }
+
+ public function testValidate_theWrongConstraint_throws(): void
+ {
+ $this->expectException(UnexpectedTypeException::class);
+
+ $this->validator->validate($this->paymentMethod(id: 8, channels: []), new NotBlank());
+ }
+
+ /**
+ * @param list $paymentMethods
+ */
+ private function givenEnabledGateways(array $paymentMethods): void
+ {
+ $this->paymentMethodRepository
+ ->method('findEnabledByGatewayName')
+ ->with(PayPlugGatewayFactory::FACTORY_NAME)
+ ->willReturn($paymentMethods);
+ }
+
+ /**
+ * @param list $channels
+ */
+ private function paymentMethod(
+ int $id,
+ array $channels,
+ string $name = 'CB',
+ bool $enabled = true,
+ ): PaymentMethodInterface&MockObject {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getFactoryName')->willReturn(PayPlugGatewayFactory::FACTORY_NAME);
+
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $paymentMethod->method('getId')->willReturn($id);
+ $paymentMethod->method('getName')->willReturn($name);
+ $paymentMethod->method('isEnabled')->willReturn($enabled);
+ $paymentMethod->method('getGatewayConfig')->willReturn($gatewayConfig);
+ $paymentMethod->method('getChannels')->willReturn(new ArrayCollection($channels));
+
+ return $paymentMethod;
+ }
+
+ private function channel(string $code): ChannelInterface&MockObject
+ {
+ $channel = $this->createMock(ChannelInterface::class);
+ $channel->method('getCode')->willReturn($code);
+
+ return $channel;
+ }
+}
diff --git a/tests/PHPUnit/Gateway/Validator/Constraints/IsCanSavePaymentMethodValidatorTest.php b/tests/PHPUnit/Gateway/Validator/Constraints/IsCanSavePaymentMethodValidatorTest.php
new file mode 100644
index 00000000..782ad9c6
--- /dev/null
+++ b/tests/PHPUnit/Gateway/Validator/Constraints/IsCanSavePaymentMethodValidatorTest.php
@@ -0,0 +1,136 @@
+apiClientFactory = $this->createMock(PayPlugApiClientFactoryInterface::class);
+
+ return new IsCanSavePaymentMethodValidator($this->apiClientFactory);
+ }
+
+ /**
+ * @dataProvider skipListedFactoryProvider
+ */
+ public function testValidate_skipListedFactory_noViolationAndAccountNeverInspected(string $factoryName): void
+ {
+ $apiClient = $this->createMock(PayPlugApiClientInterface::class);
+ $apiClient->expects(self::never())->method('getAccount');
+
+ $this->apiClientFactory
+ ->expects(self::once())
+ ->method('createForPaymentMethod')
+ ->willReturn($apiClient)
+ ;
+
+ $this->validator->validate($this->buildPaymentMethod($factoryName), new IsCanSavePaymentMethod());
+
+ $this->assertNoViolation();
+ }
+
+ /**
+ * @return iterable
+ */
+ public static function skipListedFactoryProvider(): iterable
+ {
+ yield 'payplug' => [PayPlugGatewayFactory::FACTORY_NAME];
+ yield 'payplug_oney' => [OneyGatewayFactory::FACTORY_NAME];
+ }
+
+ public function testValidate_nonSkipListedFactory_notEnabledOnAccount_raisesNoAccessViolation(): void
+ {
+ $apiClient = $this->mockApiClientWithAccount([
+ 'is_live' => true,
+ 'payment_methods' => [
+ 'scalapay' => ['enabled' => false],
+ ],
+ ]);
+ $this->apiClientFactory->method('createForPaymentMethod')->willReturn($apiClient);
+
+ $constraint = new IsCanSavePaymentMethod();
+ $this->validator->validate($this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME), $constraint);
+
+ $this->buildViolation(sprintf($constraint->noAccessMessage, ScalapayGatewayFactory::FACTORY_NAME))
+ ->assertRaised()
+ ;
+ }
+
+ public function testValidate_nonSkipListedFactory_enabledButNotLive_raisesNoTestKeyViolation(): void
+ {
+ $apiClient = $this->mockApiClientWithAccount([
+ 'is_live' => false,
+ 'payment_methods' => [
+ 'scalapay' => ['enabled' => true],
+ ],
+ ]);
+ $this->apiClientFactory->method('createForPaymentMethod')->willReturn($apiClient);
+
+ $constraint = new IsCanSavePaymentMethod();
+ $this->validator->validate($this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME), $constraint);
+
+ $this->buildViolation(sprintf($constraint->noTestKeyMessage, ScalapayGatewayFactory::FACTORY_NAME))
+ ->assertRaised()
+ ;
+ }
+
+ public function testValidate_nonSkipListedFactory_enabledAndLive_noViolation(): void
+ {
+ $apiClient = $this->mockApiClientWithAccount([
+ 'is_live' => true,
+ 'payment_methods' => [
+ 'scalapay' => ['enabled' => true],
+ ],
+ ]);
+ $this->apiClientFactory->method('createForPaymentMethod')->willReturn($apiClient);
+
+ $this->validator->validate($this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME), new IsCanSavePaymentMethod());
+
+ $this->assertNoViolation();
+ }
+
+ private function mockApiClientWithAccount(array $account): PayPlugApiClientInterface&MockObject
+ {
+ $apiClient = $this->createMock(PayPlugApiClientInterface::class);
+ $apiClient->method('getAccount')->willReturn($account);
+
+ return $apiClient;
+ }
+
+ private function buildPaymentMethod(string $factoryName): PaymentMethodInterface&MockObject
+ {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getFactoryName')->willReturn($factoryName);
+
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $paymentMethod->method('isEnabled')->willReturn(true);
+ $paymentMethod->method('getGatewayConfig')->willReturn($gatewayConfig);
+ $paymentMethod->method('getChannels')->willReturn(new ArrayCollection());
+
+ return $paymentMethod;
+ }
+}
diff --git a/tests/PHPUnit/Gateway/Validator/Constraints/IsScalapayAmountRangeValidValidatorTest.php b/tests/PHPUnit/Gateway/Validator/Constraints/IsScalapayAmountRangeValidValidatorTest.php
new file mode 100644
index 00000000..3574934f
--- /dev/null
+++ b/tests/PHPUnit/Gateway/Validator/Constraints/IsScalapayAmountRangeValidValidatorTest.php
@@ -0,0 +1,255 @@
+apiClientFactory = $this->createMock(PayPlugApiClientFactoryInterface::class);
+ $this->logger = $this->createMock(LoggerInterface::class);
+
+ return new IsScalapayAmountRangeValidValidator($this->apiClientFactory, new AccountAmountRangeResolver(), $this->logger);
+ }
+
+ public function testValidate_nonScalapayFactory_noViolationAndApiNeverCalled(): void
+ {
+ $this->apiClientFactory->expects(self::never())->method('createForPaymentMethod');
+
+ $paymentMethod = $this->buildPaymentMethod(OneyGatewayFactory::FACTORY_NAME, []);
+ $this->validator->validate($paymentMethod, new IsScalapayAmountRangeValid());
+
+ $this->assertNoViolation();
+ }
+
+ public function testValidate_noAmountsConfigured_noViolationAndApiNeverCalled(): void
+ {
+ $this->apiClientFactory->expects(self::never())->method('createForPaymentMethod');
+
+ $paymentMethod = $this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME, []);
+ $this->validator->validate($paymentMethod, new IsScalapayAmountRangeValid());
+
+ $this->assertNoViolation();
+ }
+
+ public function testValidate_minGreaterThanMax_raisesViolationWithoutCallingApi(): void
+ {
+ $this->apiClientFactory->expects(self::never())->method('createForPaymentMethod');
+
+ $config = [ScalapayGatewayFactory::MIN_AMOUNT => 5000, ScalapayGatewayFactory::MAX_AMOUNT => 1000];
+ $paymentMethod = $this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME, $config);
+
+ $constraint = new IsScalapayAmountRangeValid();
+ $this->validator->validate($paymentMethod, $constraint);
+
+ $this->buildViolation($constraint->minGreaterThanMaxMessage)->assertRaised();
+ }
+
+ public function testValidate_minBelowApiMin_raisesOutOfRangeViolation(): void
+ {
+ $apiClient = $this->mockApiClientWithAccount(500, 200000);
+ $this->apiClientFactory->method('createForPaymentMethod')->willReturn($apiClient);
+
+ $config = [ScalapayGatewayFactory::MIN_AMOUNT => 100];
+ $paymentMethod = $this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME, $config);
+
+ $constraint = new IsScalapayAmountRangeValid();
+ $this->validator->validate($paymentMethod, $constraint);
+
+ $this->buildViolation($constraint->outOfRangeMessage)
+ ->setParameter('%min_amount%', '5.00')
+ ->setParameter('%max_amount%', '2000.00')
+ ->assertRaised()
+ ;
+ }
+
+ public function testValidate_maxAboveApiMax_raisesOutOfRangeViolation(): void
+ {
+ $apiClient = $this->mockApiClientWithAccount(500, 200000);
+ $this->apiClientFactory->method('createForPaymentMethod')->willReturn($apiClient);
+
+ $config = [ScalapayGatewayFactory::MAX_AMOUNT => 300000];
+ $paymentMethod = $this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME, $config);
+
+ $constraint = new IsScalapayAmountRangeValid();
+ $this->validator->validate($paymentMethod, $constraint);
+
+ $this->buildViolation($constraint->outOfRangeMessage)
+ ->setParameter('%min_amount%', '5.00')
+ ->setParameter('%max_amount%', '2000.00')
+ ->assertRaised()
+ ;
+ }
+
+ public function testValidate_withinApiBounds_noViolation(): void
+ {
+ $apiClient = $this->mockApiClientWithAccount(500, 200000);
+ $this->apiClientFactory->method('createForPaymentMethod')->willReturn($apiClient);
+
+ $config = [ScalapayGatewayFactory::MIN_AMOUNT => 1000, ScalapayGatewayFactory::MAX_AMOUNT => 100000];
+ $paymentMethod = $this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME, $config);
+
+ $this->validator->validate($paymentMethod, new IsScalapayAmountRangeValid());
+
+ $this->assertNoViolation();
+ }
+
+ public function testValidate_apiThrowsUnauthorizedException_noViolation(): void
+ {
+ $apiClient = $this->createMock(PayPlugApiClientInterface::class);
+ $apiClient->method('getAccount')->willThrowException(new UnauthorizedException('unauthorized'));
+ $this->apiClientFactory->method('createForPaymentMethod')->willReturn($apiClient);
+
+ // Failing open leaves the range unvalidated, so the skip must at least be traceable.
+ $this->logger->expects(self::once())->method('warning');
+
+ $config = [ScalapayGatewayFactory::MIN_AMOUNT => 1000];
+ $paymentMethod = $this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME, $config);
+
+ $this->validator->validate($paymentMethod, new IsScalapayAmountRangeValid());
+
+ $this->assertNoViolation();
+ }
+
+ public function testValidate_apiThrowsConnectionException_noViolation(): void
+ {
+ $apiClient = $this->createMock(PayPlugApiClientInterface::class);
+ $apiClient->method('getAccount')->willThrowException(new ConnectionException('network blip'));
+ $this->apiClientFactory->method('createForPaymentMethod')->willReturn($apiClient);
+
+ $this->logger->expects(self::once())->method('warning');
+
+ $config = [ScalapayGatewayFactory::MIN_AMOUNT => 1000];
+ $paymentMethod = $this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME, $config);
+
+ $this->validator->validate($paymentMethod, new IsScalapayAmountRangeValid());
+
+ $this->assertNoViolation();
+ }
+
+ /**
+ * The account authorizes no EUR range for Scalapay at all, so there is nothing to check the
+ * configured range against. Same fail-open outcome as an API error, and logged for the same
+ * reason.
+ */
+ public function testValidate_accountHasNoEurRange_noViolationButLogged(): void
+ {
+ $apiClient = $this->createMock(PayPlugApiClientInterface::class);
+ $apiClient->method('getAccount')->willReturn([
+ 'configuration' => ['min_amounts' => ['USD' => 500], 'max_amounts' => ['USD' => 200000]],
+ 'payment_methods' => [],
+ ]);
+ $this->apiClientFactory->method('createForPaymentMethod')->willReturn($apiClient);
+
+ $this->logger->expects(self::once())->method('warning');
+
+ $config = [ScalapayGatewayFactory::MIN_AMOUNT => 1000];
+ $paymentMethod = $this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME, $config);
+
+ $this->validator->validate($paymentMethod, new IsScalapayAmountRangeValid());
+
+ $this->assertNoViolation();
+ }
+
+ /**
+ * The gateway config is a plain serialized array, so a direct DB edit or an import script can
+ * leave a non-int in it. PaymentMethodValidator::process() has no try/catch: a malformed value
+ * must degrade to "not configured" rather than 500 the admin save with an assertion error.
+ */
+ public function testValidate_malformedConfiguredAmounts_noViolationButLogged(): void
+ {
+ $this->apiClientFactory->expects(self::never())->method('createForPaymentMethod');
+ $this->logger->expects(self::once())->method('warning');
+
+ $config = [ScalapayGatewayFactory::MIN_AMOUNT => '1000', ScalapayGatewayFactory::MAX_AMOUNT => 'nonsense'];
+ $paymentMethod = $this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME, $config);
+
+ $this->validator->validate($paymentMethod, new IsScalapayAmountRangeValid());
+
+ $this->assertNoViolation();
+ }
+
+ public function testValidate_disabledMethod_noViolationAndApiNeverCalled(): void
+ {
+ $this->apiClientFactory->expects(self::never())->method('createForPaymentMethod');
+
+ $config = [ScalapayGatewayFactory::MIN_AMOUNT => 1000, ScalapayGatewayFactory::MAX_AMOUNT => 100000];
+ $paymentMethod = $this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME, $config, false);
+
+ $this->validator->validate($paymentMethod, new IsScalapayAmountRangeValid());
+
+ $this->assertNoViolation();
+ }
+
+ /**
+ * API range: min=500, max=200000 (cents). Merchant sets only max_amount=300, leaving
+ * min_amount blank. At checkout, the blank side falls back to the API bound (500), making
+ * the *effective* range inverted (500 > 300) even though neither configured value alone
+ * looks invalid against its own matching API bound.
+ */
+ public function testValidate_onlyMaxConfiguredBelowEffectiveMin_raisesMinGreaterThanMaxViolation(): void
+ {
+ $apiClient = $this->mockApiClientWithAccount(500, 200000);
+ $this->apiClientFactory->method('createForPaymentMethod')->willReturn($apiClient);
+
+ $config = [ScalapayGatewayFactory::MAX_AMOUNT => 300];
+ $paymentMethod = $this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME, $config);
+
+ $constraint = new IsScalapayAmountRangeValid();
+ $this->validator->validate($paymentMethod, $constraint);
+
+ $this->buildViolation($constraint->minGreaterThanMaxMessage)->assertRaised();
+ }
+
+ private function mockApiClientWithAccount(int $minAmount, int $maxAmount): PayPlugApiClientInterface&MockObject
+ {
+ $apiClient = $this->createMock(PayPlugApiClientInterface::class);
+ $apiClient->method('getAccount')->willReturn([
+ 'configuration' => [
+ 'min_amounts' => ['EUR' => $minAmount],
+ 'max_amounts' => ['EUR' => $maxAmount],
+ ],
+ 'payment_methods' => [],
+ ]);
+
+ return $apiClient;
+ }
+
+ private function buildPaymentMethod(
+ string $factoryName,
+ array $config,
+ bool $enabled = true,
+ ): PaymentMethodInterface&MockObject
+ {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getFactoryName')->willReturn($factoryName);
+ $gatewayConfig->method('getConfig')->willReturn($config);
+
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $paymentMethod->method('getGatewayConfig')->willReturn($gatewayConfig);
+ $paymentMethod->method('isEnabled')->willReturn($enabled);
+
+ return $paymentMethod;
+ }
+}
diff --git a/tests/PHPUnit/Handler/HostedFieldsWebhookNotificationHandlerTest.php b/tests/PHPUnit/Handler/HostedFieldsWebhookNotificationHandlerTest.php
new file mode 100644
index 00000000..b89d3427
--- /dev/null
+++ b/tests/PHPUnit/Handler/HostedFieldsWebhookNotificationHandlerTest.php
@@ -0,0 +1,744 @@
+paymentRepository = $this->createMock(IPaymentRepository::class);
+ $this->orderStateMutator = $this->createMock(IOrderStateMutator::class);
+ $this->configurationRepository = $this->createMock(ScopedConfigurationRepositoryInterface::class);
+ // The handler scopes before reading; these tests stub one account, so it scopes to itself.
+ $this->configurationRepository->method('forPaymentMethod')->willReturnSelf();
+ $this->lock = $this->createMock(ILock::class);
+ $this->lock->method('acquire')->willReturn(true);
+ $this->logger = $this->createMock(LoggerInterface::class);
+ $this->payplugCardFactory = $this->createMock(FactoryInterface::class);
+ $this->payplugCardRepository = $this->createMock(RepositoryInterface::class);
+ $this->managerRegistry = $this->createMock(ManagerRegistry::class);
+
+ $this->handler = new HostedFieldsWebhookNotificationHandler(
+ $this->paymentRepository,
+ $this->orderStateMutator,
+ $this->configurationRepository,
+ $this->lock,
+ $this->logger,
+ new PayplugCardPersister($this->payplugCardFactory, $this->payplugCardRepository, $this->managerRegistry),
+ );
+ }
+
+ /**
+ * @param mixed[] $details
+ */
+ private function payment(
+ int $id = 42,
+ int $amount = 1000,
+ ?string $orderNumber = null,
+ array $details = [],
+ ?PaymentMethodInterface $method = null,
+ ?CustomerInterface $customer = null,
+ ): PaymentInterface&MockObject {
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getId')->willReturn($id);
+ $payment->method('getAmount')->willReturn($amount);
+ $payment->method('getDetails')->willReturn($details);
+ // A UHF payment always has a method — treat() resolves the webhook secret from its gateway
+ // config — so the tests that don't care which one still get one.
+ $payment->method('getMethod')->willReturn($method ?? $this->createMock(PaymentMethodInterface::class));
+
+ if (null !== $orderNumber || null !== $customer) {
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getNumber')->willReturn($orderNumber);
+ $order->method('getCustomer')->willReturn($customer);
+ $payment->method('getOrder')->willReturn($order);
+ } else {
+ $payment->method('getOrder')->willReturn(null);
+ }
+
+ return $payment;
+ }
+
+ public function testTreat_onValidNotification_savesTreatsAndAppliesTheOutcomeAgainstTheResolvedPayment(): void
+ {
+ // orderId here ("42") matches the payment id fallback used when the payment has no order
+ // yet — the same fallback CaptureHostedPaymentRequestHandler uses when sending orderId to
+ // PayPlug at creation time (order number if present, else the payment id).
+ $body = \json_encode(['id' => 'op_123', 'execCode' => '0000', 'orderId' => '42', 'amount' => 1000]);
+
+ $this->configurationRepository->method('get')->with('payplug_webhook_authorization_header')->willReturn('Bearer shared-secret');
+ $this->paymentRepository->method('isTreated')->with('op_123')->willReturn(false);
+
+ $this->lock->expects(self::once())->method('acquire')->with('payplug_upc_treat_op_123', 30)->willReturn(true);
+ $this->lock->expects(self::once())->method('release')->with('payplug_upc_treat_op_123');
+ $this->paymentRepository->expects(self::once())->method('save');
+ $this->paymentRepository->expects(self::once())->method('markTreated')->with('op_123');
+ $this->orderStateMutator->expects(self::once())->method('apply')->with('42', PaymentOutcome::PAID);
+
+ $this->handler->treat($this->payment(42, 1000), $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ /**
+ * Guards the race StatusHostedPaymentRequestHandler's GET polling fallback can create: if a
+ * genuine webhook delivery for the same operation is already inside treat() (lock held), a
+ * concurrent caller must back off rather than double-apply.
+ */
+ public function testTreat_whenLockCannotBeAcquired_doesNothingAndReturnsSilently(): void
+ {
+ $body = \json_encode(['id' => 'op_123', 'execCode' => '0000', 'orderId' => '42', 'amount' => 1000]);
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ // A fresh mock rather than reconfiguring $this->lock: setUp()'s unconditional
+ // ->method('acquire')->willReturn(true) stub would otherwise still win over this one.
+ $this->lock = $this->createMock(ILock::class);
+ $this->lock->method('acquire')->willReturn(false);
+ $this->handler = new HostedFieldsWebhookNotificationHandler(
+ $this->paymentRepository,
+ $this->orderStateMutator,
+ $this->configurationRepository,
+ $this->lock,
+ $this->logger,
+ new PayplugCardPersister($this->payplugCardFactory, $this->payplugCardRepository, $this->managerRegistry),
+ );
+
+ $this->paymentRepository->expects(self::never())->method('isTreated');
+ $this->paymentRepository->expects(self::never())->method('save');
+ $this->paymentRepository->expects(self::never())->method('markTreated');
+ $this->orderStateMutator->expects(self::never())->method('apply');
+ $this->lock->expects(self::never())->method('release');
+
+ $this->handler->treat($this->payment(42, 1000), $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ public function testTreat_onPendingThreeDsExecCode_doesNothingAndReturnsSilently(): void
+ {
+ $body = \json_encode(['id' => 'op_123', 'execCode' => '0001', 'orderId' => '42', 'amount' => 1000]);
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+
+ $this->lock->expects(self::never())->method('acquire');
+ $this->paymentRepository->expects(self::never())->method('isTreated');
+ $this->paymentRepository->expects(self::never())->method('save');
+ $this->paymentRepository->expects(self::never())->method('markTreated');
+ $this->orderStateMutator->expects(self::never())->method('apply');
+
+ $this->handler->treat($this->payment(42, 1000), $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ /**
+ * Regression for the live incident on 2026-08-21 (order 000000074): the notifier fired a
+ * webhook mid-3DS-challenge (execCode 0001) before the real, final one (execCode 0000). The
+ * premature call must not consume isTreated()'s dedupe slot, or the later, correct
+ * notification has nothing left to do — the payment ends up permanently stuck instead of paid.
+ */
+ public function testTreat_onPendingExecCodeFollowedByFinalExecCode_appliesOnlyTheFinalOutcome(): void
+ {
+ $pendingBody = \json_encode(['id' => 'op_123', 'execCode' => '0001', 'orderId' => '42', 'amount' => 1000]);
+ $finalBody = \json_encode(['id' => 'op_123', 'execCode' => '0000', 'orderId' => '42', 'amount' => 1000]);
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->paymentRepository->method('isTreated')->with('op_123')->willReturn(false);
+
+ $this->handler->treat($this->payment(42, 1000), $pendingBody, ['Authorization' => 'Bearer shared-secret']);
+
+ $this->paymentRepository->expects(self::once())->method('save');
+ $this->paymentRepository->expects(self::once())->method('markTreated')->with('op_123');
+ $this->orderStateMutator->expects(self::once())->method('apply')->with('42', PaymentOutcome::PAID);
+
+ $this->handler->treat($this->payment(42, 1000), $finalBody, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ public function testTreat_onRealPlatformShapedNotification_stillParsesTheFourFieldsWebhookNotificationHelperNeeds(): void
+ {
+ // Captured from Datadog (staging notifier webhook attempts): the platform sends a much
+ // richer, nested payload than the {id, execCode, orderId, amount} shape our own tests
+ // otherwise use. WebhookNotificationHelper::parse() only reads those four top-level
+ // fields and ignores everything else, so this locks in that the extra nesting (customer,
+ // authentication, paymentMethod, account...) and sibling fields (paymentId, stan,
+ // descriptor...) never break parsing.
+ $body = \json_encode([
+ 'operationType' => 'PAYMENT',
+ 'customer' => ['id' => '130', 'email' => 'test-client@example.com'],
+ 'authentication' => ['status' => 'Y', 'globalStatus' => 'OK', 'mode' => 'FRICTIONLESS', 'preference' => 'NO_PREF', 'version' => '2', 'enrolledCard' => 'Y'],
+ 'paymentMethod' => ['card' => ['bank' => 'EXAMPLE BANK', 'country' => 'GB', 'usage' => 'debit', 'code6x4' => '446421XXXXXX0000', 'type' => 'VISA', 'network' => 'VISA'], 'details' => ['validityDate' => '2030-12', 'selectedBrand' => 'VISA']],
+ 'account' => ['id' => 'PLUGINS_UHF_QA'],
+ 'additionalData' => 'Playful Paradise Cap',
+ 'currency' => 'EUR',
+ 'amount' => 7400,
+ 'descriptor' => 'PPG',
+ 'authorizationCode' => '452743',
+ 'bankResponse' => '00',
+ 'schemeTransactionId' => 'G8N6XKPB07CO5JT',
+ 'execCode' => '0000',
+ 'message' => 'Successful operation',
+ 'orderId' => '000000065',
+ 'stan' => '333446',
+ 'id' => 'e4d04233-a15d-4815-af91-698c3eb61c36',
+ 'paymentId' => 'b1dde7ce-d069-43dd-b49d-9f2f1cd9d671',
+ ]);
+
+ $this->configurationRepository->method('get')->with('payplug_webhook_authorization_header')->willReturn('Bearer shared-secret');
+ $this->paymentRepository->method('isTreated')->with('e4d04233-a15d-4815-af91-698c3eb61c36')->willReturn(false);
+
+ $this->paymentRepository->expects(self::once())->method('save');
+ $this->paymentRepository->expects(self::once())->method('markTreated')->with('e4d04233-a15d-4815-af91-698c3eb61c36');
+ $this->orderStateMutator->expects(self::once())->method('apply')->with('42', PaymentOutcome::PAID);
+
+ $this->handler->treat($this->payment(42, 7400, '000000065'), $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ public function testTreat_whenAlreadyTreated_isIdempotentAndDoesNotReapply(): void
+ {
+ $body = \json_encode(['id' => 'op_123', 'execCode' => '0000', 'orderId' => '42', 'amount' => 1000]);
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->paymentRepository->method('isTreated')->with('op_123')->willReturn(true);
+
+ $this->paymentRepository->expects(self::never())->method('save');
+ $this->orderStateMutator->expects(self::never())->method('apply');
+ $this->lock->expects(self::once())->method('release')->with('payplug_upc_treat_op_123');
+
+ $this->handler->treat($this->payment(42, 1000), $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ public function testTreat_onInvalidSignature_throwsInvalidNotificationExceptionWithoutApplyingTheOutcome(): void
+ {
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+
+ $this->paymentRepository->expects(self::never())->method('save');
+ $this->orderStateMutator->expects(self::never())->method('apply');
+
+ $this->expectException(InvalidNotificationException::class);
+
+ $this->handler->treat($this->payment(), '{}', ['Authorization' => 'Bearer wrong-secret']);
+ }
+
+ public function testTreat_onOrderIdMismatch_logsAndSkipsWithoutApplyingTheOutcome(): void
+ {
+ // Now that no Authorization header is required (see WebhookNotificationHelper), this
+ // orderId/amount cross-check is the only remaining protection against a notification
+ // being applied to the wrong payment on the static, per-account IPN receiver.
+ $body = \json_encode(['id' => 'op_123', 'execCode' => '0000', 'orderId' => 'some-other-order', 'amount' => 1000]);
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+
+ $this->logger->expects(self::once())->method('error');
+ $this->paymentRepository->expects(self::never())->method('save');
+ $this->paymentRepository->expects(self::never())->method('markTreated');
+ $this->orderStateMutator->expects(self::never())->method('apply');
+
+ $this->handler->treat($this->payment(42, 1000), $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ public function testTreat_onAmountMismatch_logsAndSkipsWithoutApplyingTheOutcome(): void
+ {
+ $body = \json_encode(['id' => 'op_123', 'execCode' => '0000', 'orderId' => '42', 'amount' => 999]);
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+
+ $this->logger->expects(self::once())->method('error');
+ $this->paymentRepository->expects(self::never())->method('save');
+ $this->orderStateMutator->expects(self::never())->method('apply');
+
+ $this->handler->treat($this->payment(42, 1000), $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ /**
+ * A 3DS-challenge capture never gets an alias back synchronously — this webhook, fired once
+ * the challenge is validated, is the only place a 3DS payment's card ever gets saved. The
+ * alias/card metadata is already in the webhook body itself: same paymentMethod.{id, card,
+ * details} shape as the operation resource CaptureHostedPaymentRequestHandler fetches
+ * separately for a frictionless payment.
+ */
+ public function testTreat_onPaidOutcomeWithSaveCardRequested_persistsANewCard(): void
+ {
+ $body = \json_encode([
+ 'id' => 'op_123',
+ 'execCode' => '0000',
+ 'orderId' => '42',
+ 'amount' => 1000,
+ 'paymentMethod' => [
+ 'id' => 'card_new_1',
+ 'card' => ['network' => 'VISA', 'code6x4' => '424242XXXXXX4242'],
+ 'details' => ['selectedBrand' => 'VISA', 'validityDate' => '2030-12'],
+ ],
+ ]);
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->paymentRepository->method('isTreated')->willReturn(false);
+
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $customer = $this->createMock(CustomerInterface::class);
+ $payment = $this->payment(42, 1000, details: ['hosted_fields_save_card' => true], method: $method, customer: $customer);
+
+ $card = new Card();
+ $this->payplugCardFactory->method('createNew')->willReturn($card);
+ $this->payplugCardRepository->expects(self::once())->method('add')->with($card);
+
+ $this->handler->treat($payment, $body, ['Authorization' => 'Bearer shared-secret']);
+
+ self::assertSame('card_new_1', $card->getExternalId());
+ self::assertSame('VISA', $card->getBrand());
+ self::assertSame('4242', $card->getLast4());
+ self::assertSame(12, $card->getExpirationMonth());
+ self::assertSame(2030, $card->getExpirationYear());
+ }
+
+ public function testTreat_onPaidOutcomeWithSaveCardRequestedAndAliasInStoredId_persistsANewCard(): void
+ {
+ // Shape of a real staging webhook: the alias is in paymentMethod.storedId and there is no
+ // paymentMethod.id. The card is masked and the ids are fixtures.
+ $body = \json_encode([
+ 'operationType' => 'PAYMENT',
+ 'customer' => ['id' => '130', 'email' => 'test-client@example.com'],
+ 'authentication' => ['status' => 'Y', 'globalStatus' => 'OK', 'mode' => 'FRICTIONLESS', 'version' => '2'],
+ 'paymentMethod' => [
+ 'storedId' => 'card_new_1',
+ 'card' => ['network' => 'VISA', 'type' => 'VISA', 'code6x4' => '446421XXXXXX0000'],
+ 'details' => ['fullName' => 'John Doe', 'validityDate' => '2030-12', 'selectedBrand' => 'VISA'],
+ ],
+ 'account' => ['id' => 'PLUGINS_UHF_QA'],
+ 'currency' => 'EUR',
+ 'amount' => 1000,
+ 'execCode' => '0000',
+ 'message' => 'Successful operation',
+ 'orderId' => '42',
+ 'id' => 'op_715ac841',
+ ]);
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->paymentRepository->method('isTreated')->willReturn(false);
+
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $customer = $this->createMock(CustomerInterface::class);
+ $payment = $this->payment(42, 1000, '42', ['hosted_fields_save_card' => true], $method, $customer);
+
+ $card = new Card();
+ $this->payplugCardFactory->method('createNew')->willReturn($card);
+ $this->payplugCardRepository->expects(self::once())->method('add')->with($card);
+ $this->logger->expects(self::never())->method('error');
+
+ $this->handler->treat($payment, $body, ['Authorization' => 'Bearer shared-secret']);
+
+ self::assertSame('card_new_1', $card->getExternalId());
+ self::assertSame('VISA', $card->getBrand());
+ self::assertSame('0000', $card->getLast4());
+ self::assertSame(12, $card->getExpirationMonth());
+ self::assertSame(2030, $card->getExpirationYear());
+ }
+
+ public function testTreat_onPaidOutcomeWithoutSaveCardRequested_doesNotPersistACard(): void
+ {
+ $body = \json_encode([
+ 'id' => 'op_123',
+ 'execCode' => '0000',
+ 'orderId' => '42',
+ 'amount' => 1000,
+ 'paymentMethod' => ['id' => 'card_new_1', 'card' => ['network' => 'VISA', 'code6x4' => '424242XXXXXX4242']],
+ ]);
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->paymentRepository->method('isTreated')->willReturn(false);
+
+ $payment = $this->payment(42, 1000, details: ['hosted_fields_save_card' => false]);
+
+ $this->payplugCardRepository->expects(self::never())->method('add');
+
+ $this->handler->treat($payment, $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ public function testTreat_onPaidOutcomeWithSaveCardRequestedButNoAliasInPayload_logsAndDoesNotPersistACard(): void
+ {
+ $body = \json_encode([
+ 'id' => 'op_123',
+ 'execCode' => '0000',
+ 'orderId' => '42',
+ 'amount' => 1000,
+ // No paymentMethod.id — e.g. this operation never involved an alias at all.
+ 'paymentMethod' => ['card' => ['network' => 'VISA', 'code6x4' => '424242XXXXXX4242']],
+ ]);
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->paymentRepository->method('isTreated')->willReturn(false);
+
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $customer = $this->createMock(CustomerInterface::class);
+ $payment = $this->payment(42, 1000, details: ['hosted_fields_save_card' => true], method: $method, customer: $customer);
+
+ $this->logger->expects(self::once())->method('error')
+ ->with(self::stringContains('no alias id'), self::anything());
+ $this->payplugCardRepository->expects(self::never())->method('add');
+
+ $this->handler->treat($payment, $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ public function testTreat_onNonPaidOutcome_doesNotAttemptToPersistACard(): void
+ {
+ // execCode "9999" maps to PaymentOutcome::FAILED (not PAID, not the 0001 pending case
+ // already covered elsewhere) — the card-save branch must not even be attempted.
+ $body = \json_encode([
+ 'id' => 'op_123',
+ 'execCode' => '9999',
+ 'orderId' => '42',
+ 'amount' => 1000,
+ 'paymentMethod' => ['id' => 'card_new_1', 'card' => ['network' => 'VISA', 'code6x4' => '424242XXXXXX4242']],
+ ]);
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->paymentRepository->method('isTreated')->willReturn(false);
+
+ $payment = $this->payment(42, 1000, details: ['hosted_fields_save_card' => true]);
+
+ $this->payplugCardRepository->expects(self::never())->method('add');
+
+ $this->handler->treat($payment, $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ public function testTreat_onPaidOutcomeWithSaveCardRequestedAndCardAlreadySaved_doesNotPersistADuplicate(): void
+ {
+ $body = \json_encode([
+ 'id' => 'op_123',
+ 'execCode' => '0000',
+ 'orderId' => '42',
+ 'amount' => 1000,
+ 'paymentMethod' => ['id' => 'card_existing_1', 'card' => ['network' => 'VISA', 'code6x4' => '424242XXXXXX4242']],
+ ]);
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->paymentRepository->method('isTreated')->willReturn(false);
+
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $customer = $this->createMock(CustomerInterface::class);
+ $payment = $this->payment(42, 1000, details: ['hosted_fields_save_card' => true], method: $method, customer: $customer);
+
+ $this->payplugCardRepository->method('findOneBy')->with(['externalId' => 'card_existing_1', 'isLive' => false])->willReturn(new Card());
+ $this->payplugCardRepository->expects(self::never())->method('add');
+
+ $this->handler->treat($payment, $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ /**
+ * When the notification's operation id matches one recorded under $details['refunds']
+ * (RefundPaymentProcessor stores it there for both full and partial UHF refunds), this is a
+ * refund confirmation, not the payment's own outcome — ExecCodeMapper's "0000" => PAID mapping
+ * would otherwise misreport a successful refund as the payment being paid. The amount check
+ * must use the refund's own recorded amount (500), not the payment's full amount (1000).
+ */
+ public function testTreat_onNotificationMatchingAKnownRefundId_appliesRefundedInsteadOfThePaymentOutcome(): void
+ {
+ $body = \json_encode(['id' => 'op_refund_1', 'execCode' => '0000', 'orderId' => '42', 'amount' => 500]);
+ $details = ['refunds' => [['internal_id' => 77, 'id' => 'op_refund_1', 'amount' => 500]]];
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->paymentRepository->method('isTreated')->with('op_refund_1')->willReturn(false);
+
+ $this->paymentRepository->expects(self::once())->method('save');
+ $this->paymentRepository->expects(self::once())->method('markTreated')->with('op_refund_1');
+ $this->orderStateMutator->expects(self::once())->method('apply')->with('42', PaymentOutcome::REFUNDED);
+
+ $this->handler->treat($this->payment(42, 1000, null, $details), $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ /**
+ * A refund confirmation is matched against its OWN recorded amount (500), not the payment's
+ * full amount (1000) — the pre-fix behavior (comparing against the payment's full amount)
+ * would reject every partial-refund confirmation, which is exactly the bug this feature fixes.
+ */
+ public function testTreat_onRefundNotificationAmountMismatch_logsAndSkipsWithoutApplyingTheOutcome(): void
+ {
+ $body = \json_encode(['id' => 'op_refund_1', 'execCode' => '0000', 'orderId' => '42', 'amount' => 400]);
+ $details = ['refunds' => [['internal_id' => 77, 'id' => 'op_refund_1', 'amount' => 500]]];
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+
+ $this->logger->expects(self::once())->method('error');
+ $this->paymentRepository->expects(self::never())->method('save');
+ $this->orderStateMutator->expects(self::never())->method('apply');
+
+ $this->handler->treat($this->payment(42, 1000, null, $details), $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ /**
+ * A full UHF refund records its operation id with internal_id: null (RefundPaymentProcessor::
+ * processHostedFields() has no Sylius $refundId to attach) — still resolvable and REFUNDED.
+ */
+ public function testTreat_onFullRefundNotification_appliesRefundedUsingTheFullRefundAmount(): void
+ {
+ $body = \json_encode(['id' => 'op_refund_full', 'execCode' => '0000', 'orderId' => '42', 'amount' => 1000]);
+ $details = ['refunds' => [['internal_id' => null, 'id' => 'op_refund_full', 'amount' => 1000]]];
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->paymentRepository->method('isTreated')->with('op_refund_full')->willReturn(false);
+
+ $this->orderStateMutator->expects(self::once())->method('apply')->with('42', PaymentOutcome::REFUNDED);
+
+ $this->handler->treat($this->payment(42, 1000, null, $details), $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ /**
+ * RefundPaymentProcessor's createRefund() call can return a 2xx response with no operationIds
+ * (logged as an error there) — the refund entry it records then has id: null, so this
+ * confirmation's own operationId ("op_refund_unresolved") can never match it by id. Falling
+ * back to the unresolved entry's own recorded amount (500) is what still lets this be
+ * classified as REFUNDED instead of being dropped or misapplied as a plain payment
+ * confirmation.
+ */
+ public function testTreat_onNotificationForARefundWithNoCapturedOperationId_fallsBackToTheUnresolvedRefundEntry(): void
+ {
+ $body = \json_encode(['id' => 'op_refund_unresolved', 'execCode' => '0000', 'orderId' => '42', 'amount' => 500]);
+ $details = ['refunds' => [['internal_id' => 77, 'id' => null, 'amount' => 500]]];
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->paymentRepository->method('isTreated')->with('op_refund_unresolved')->willReturn(false);
+
+ $this->paymentRepository->expects(self::once())->method('save');
+ $this->paymentRepository->expects(self::once())->method('markTreated')->with('op_refund_unresolved');
+ $this->orderStateMutator->expects(self::once())->method('apply')->with('42', PaymentOutcome::REFUNDED);
+
+ $this->handler->treat($this->payment(42, 1000, null, $details), $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ /**
+ * The refund's own execCode indicates failure (anything other than "0000") — the outcome
+ * must never be forced to REFUNDED (money never moved), nor passed through as-is to the
+ * Payment's own state machine: PaymentOutcome::FAILED maps to TRANSITION_FAIL (see
+ * SyliusOrderStateMutator), which means "this PAYMENT failed," not "this refund attempt
+ * failed" — the underlying payment already succeeded, only the refund didn't. Only logging +
+ * idempotency tracking happen; orderStateMutator must never be called. The matched refund
+ * entry is also flagged 'failed' => true on the Payment itself — see
+ * RefundPaymentProcessor::sumRecordedRefunds(), which relies on this flag to exclude money
+ * that was accepted synchronously but never actually moved from a later full refund's
+ * remaining-balance calculation.
+ */
+ public function testTreat_onRefundNotificationWithFailureExecCode_neverTouchesThePaymentStateButStillMarksTreated(): void
+ {
+ $body = \json_encode(['id' => 'op_refund_1', 'execCode' => '9999', 'orderId' => '42', 'amount' => 500]);
+ $details = ['refunds' => [['internal_id' => 77, 'id' => 'op_refund_1', 'amount' => 500]]];
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->paymentRepository->method('isTreated')->with('op_refund_1')->willReturn(false);
+
+ $payment = $this->payment(42, 1000, null, $details);
+ $payment->expects(self::once())->method('setDetails')->with(self::callback(
+ static function (array $details): bool {
+ return [[
+ 'internal_id' => 77,
+ 'id' => 'op_refund_1',
+ 'amount' => 500,
+ 'failed' => true,
+ ]] === $details['refunds'];
+ },
+ ));
+
+ $this->paymentRepository->expects(self::once())->method('save');
+ $this->paymentRepository->expects(self::once())->method('markTreated')->with('op_refund_1');
+ $this->orderStateMutator->expects(self::never())->method('apply');
+ $this->logger->expects(self::once())->method('error');
+
+ $this->handler->treat($payment, $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ /**
+ * The 'failed' flag write goes through RefundDetailsLockKey — the same lock key
+ * RefundPaymentProcessor::processHostedFields()/processHostedFieldsWithAmount() acquire
+ * around their own (network-call-spanning) read-modify-write of this same
+ * $details['refunds'] array — not the per-operation 'payplug_upc_treat_' lock applyLocked()
+ * uses afterwards. Both locks are acquired/released here: the refund-details one first
+ * (guarding the setDetails() write below), the treat one second (guarding
+ * isTreated()/markTreated()/save()).
+ */
+ public function testTreat_onRefundNotificationWithFailureExecCode_acquiresTheSharedRefundDetailsLockKeyBeforeWritingTheFailedFlag(): void
+ {
+ $body = \json_encode(['id' => 'op_refund_1', 'execCode' => '9999', 'orderId' => '42', 'amount' => 500]);
+ $details = ['refunds' => [['internal_id' => 77, 'id' => 'op_refund_1', 'amount' => 500]]];
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->paymentRepository->method('isTreated')->with('op_refund_1')->willReturn(false);
+
+ $acquiredKeys = [];
+ $this->lock = $this->createMock(ILock::class);
+ $this->lock->method('acquire')->willReturnCallback(static function (string $key, int $ttl) use (&$acquiredKeys): bool {
+ $acquiredKeys[] = [$key, $ttl];
+
+ return true;
+ });
+ $this->handler = new HostedFieldsWebhookNotificationHandler(
+ $this->paymentRepository,
+ $this->orderStateMutator,
+ $this->configurationRepository,
+ $this->lock,
+ $this->logger,
+ new PayplugCardPersister($this->payplugCardFactory, $this->payplugCardRepository, $this->managerRegistry),
+ );
+
+ $this->handler->treat($this->payment(42, 1000, null, $details), $body, ['Authorization' => 'Bearer shared-secret']);
+
+ self::assertSame(
+ [['payplug_upc_refund_details_42', 30], ['payplug_upc_treat_op_refund_1', 30]],
+ $acquiredKeys,
+ );
+ }
+
+ /**
+ * A refund creation (RefundPaymentProcessor::processHostedFields()/
+ * processHostedFieldsWithAmount()) is in progress for this payment right now, holding
+ * RefundDetailsLockKey. The notification must NOT be marked treated in that case — returning
+ * without ever calling applyLocked() leaves isTreated()/markTreated() untouched, so a later
+ * redelivery of the same notification gets a fresh chance to record the 'failed' flag once
+ * that refund creation has released the lock — instead of the flag being silently lost forever
+ * because this delivery was marked treated without ever recording it.
+ */
+ public function testTreat_onRefundNotificationWithFailureExecCode_whenRefundDetailsLockCannotBeAcquired_doesNotMarkTreated(): void
+ {
+ $body = \json_encode(['id' => 'op_refund_1', 'execCode' => '9999', 'orderId' => '42', 'amount' => 500]);
+ $details = ['refunds' => [['internal_id' => 77, 'id' => 'op_refund_1', 'amount' => 500]]];
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+
+ $this->lock = $this->createMock(ILock::class);
+ $this->lock->method('acquire')->willReturnCallback(
+ static fn (string $key): bool => 'payplug_upc_refund_details_42' !== $key,
+ );
+ $this->handler = new HostedFieldsWebhookNotificationHandler(
+ $this->paymentRepository,
+ $this->orderStateMutator,
+ $this->configurationRepository,
+ $this->lock,
+ $this->logger,
+ new PayplugCardPersister($this->payplugCardFactory, $this->payplugCardRepository, $this->managerRegistry),
+ );
+
+ $payment = $this->payment(42, 1000, null, $details);
+ $payment->expects(self::never())->method('setDetails');
+ $this->paymentRepository->expects(self::never())->method('isTreated');
+ $this->paymentRepository->expects(self::never())->method('save');
+ $this->paymentRepository->expects(self::never())->method('markTreated');
+ $this->orderStateMutator->expects(self::never())->method('apply');
+ // Once for the "non-success outcome" log, once for the lock-contention log.
+ $this->logger->expects(self::exactly(2))->method('error');
+
+ $this->handler->treat($payment, $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ /**
+ * A delayed/redelivered copy of the ORIGINAL payment-creation notification must never be
+ * misclassified as a refund confirmation just because this payment also has an unresolved
+ * (id: null) refund entry sitting in $details['refunds'] — the known payment-creation
+ * operation id (hosted_fields_operation_id) excludes it from the unresolved-entry fallback.
+ */
+ public function testTreat_onRedeliveredPaymentNotification_isNotMisclassifiedAsTheUnresolvedRefund(): void
+ {
+ $body = \json_encode(['id' => 'op_payment_1', 'execCode' => '0000', 'orderId' => '42', 'amount' => 1000]);
+ $details = [
+ 'hosted_fields_operation_id' => 'op_payment_1',
+ 'refunds' => [['internal_id' => 77, 'id' => null, 'amount' => 500]],
+ ];
+
+ $this->configurationRepository->method('get')->willReturn('Bearer shared-secret');
+ $this->paymentRepository->method('isTreated')->with('op_payment_1')->willReturn(false);
+
+ $this->paymentRepository->expects(self::once())->method('save');
+ $this->paymentRepository->expects(self::once())->method('markTreated')->with('op_payment_1');
+ $this->orderStateMutator->expects(self::once())->method('apply')->with('42', PaymentOutcome::PAID);
+
+ $this->handler->treat($this->payment(42, 1000, null, $details), $body, ['Authorization' => 'Bearer shared-secret']);
+ }
+
+ public function testTreat_onADeferredCapturePaymentsOwnConfirmation_appliesAuthorizedNotPaid(): void
+ {
+ $body = \json_encode(['id' => 'op_auth', 'execCode' => '0000', 'orderId' => '42', 'amount' => 1000, 'maxCaptureDate' => '2026-10-01T12:00:00+00:00']);
+ $payment = $this->payment(42, 1000, null, [
+ 'hosted_fields_operation_id' => 'op_auth',
+ AuthorizationDetails::DEFERRED => true,
+ AuthorizationDetails::AUTHORIZED_AMOUNT => 1000,
+ ]);
+
+ $this->paymentRepository->method('isTreated')->willReturn(false);
+ $this->orderStateMutator->expects(self::once())->method('apply')->with('42', PaymentOutcome::AUTHORIZED);
+ // A 3DS authorization only learns its capture deadline here.
+ $payment->expects(self::once())->method('setDetails')->with(self::callback(
+ static fn (array $details): bool => '2026-10-01T12:00:00+00:00' === $details[AuthorizationDetails::MAX_CAPTURE_DATE],
+ ));
+
+ $this->handler->treat($payment, (string) $body, []);
+ }
+
+ public function testTreat_onACaptureConfirmation_onlyTracksItWithoutTouchingThePaymentState(): void
+ {
+ $body = \json_encode(['id' => 'op_c1', 'execCode' => '0000', 'orderId' => '42', 'amount' => 300]);
+ $payment = $this->payment(42, 1000, null, [
+ AuthorizationDetails::DEFERRED => true,
+ AuthorizationDetails::AUTHORIZED_AMOUNT => 1000,
+ AuthorizationDetails::CAPTURES => [['id' => 'op_c1', 'amount' => 300]],
+ ]);
+
+ $this->paymentRepository->method('isTreated')->willReturn(false);
+ $this->paymentRepository->expects(self::once())->method('markTreated')->with('op_c1');
+ // Its "0000" must never reach the payment as PAID: the capture's effect was already
+ // applied synchronously, and a partial capture leaves the payment authorized.
+ $this->orderStateMutator->expects(self::never())->method('apply');
+ $payment->expects(self::never())->method('setDetails');
+
+ $this->handler->treat($payment, (string) $body, []);
+ }
+
+ public function testTreat_onAFailedCaptureConfirmation_flagsTheCaptureFailedAndAlertsTheMerchant(): void
+ {
+ $body = \json_encode(['id' => 'op_c1', 'execCode' => '4001', 'orderId' => '42', 'amount' => 300]);
+ $payment = $this->payment(42, 1000, null, [
+ AuthorizationDetails::DEFERRED => true,
+ AuthorizationDetails::AUTHORIZED_AMOUNT => 1000,
+ AuthorizationDetails::CAPTURES => [['id' => 'op_c1', 'amount' => 300]],
+ ]);
+
+ $this->paymentRepository->method('isTreated')->willReturn(false);
+ $this->orderStateMutator->expects(self::never())->method('apply');
+ $this->logger->expects(self::once())->method('critical');
+ $payment->expects(self::once())->method('setDetails')->with(self::callback(
+ static fn (array $details): bool => true === $details[AuthorizationDetails::CAPTURES][0]['failed'],
+ ));
+
+ $this->handler->treat($payment, (string) $body, []);
+ }
+}
diff --git a/tests/PHPUnit/Handler/PaymentNotificationHandlerTest.php b/tests/PHPUnit/Handler/PaymentNotificationHandlerTest.php
index 62d92df0..a1bd28e6 100644
--- a/tests/PHPUnit/Handler/PaymentNotificationHandlerTest.php
+++ b/tests/PHPUnit/Handler/PaymentNotificationHandlerTest.php
@@ -4,7 +4,9 @@
namespace Tests\PayPlug\SyliusPayPlugPlugin\PHPUnit\Handler;
+use Doctrine\DBAL\Exception\UniqueConstraintViolationException;
use Doctrine\ORM\EntityManagerInterface;
+use Doctrine\Persistence\ManagerRegistry;
use Payplug\Resource\Payment as PayplugPayment;
use PayPlug\SyliusPayPlugPlugin\ApiClient\PayPlugApiClientInterface;
use PayPlug\SyliusPayPlugPlugin\Entity\Card;
@@ -39,6 +41,8 @@ final class PaymentNotificationHandlerTest extends TestCase
private RequestStack&MockObject $requestStack;
+ private ManagerRegistry&MockObject $managerRegistry;
+
private PaymentNotificationHandler $handler;
protected function setUp(): void
@@ -50,6 +54,7 @@ protected function setUp(): void
$this->entityManager = $this->createMock(EntityManagerInterface::class);
$this->lockFactory = $this->createMock(LockFactory::class);
$this->requestStack = $this->createMock(RequestStack::class);
+ $this->managerRegistry = $this->createMock(ManagerRegistry::class);
$this->handler = new PaymentNotificationHandler(
$this->logger,
@@ -59,6 +64,7 @@ protected function setUp(): void
$this->entityManager,
$this->lockFactory,
$this->requestStack,
+ $this->managerRegistry,
);
}
@@ -328,6 +334,61 @@ public function testTreat_withIsPaidAndMissingCustomerId_doesNotSaveCard(): void
self::assertSame(PayPlugApiClientInterface::STATUS_CAPTURED, $details['status']);
}
+ // -------------------------------------------------------------------------
+ // treat() — card saving: concurrent save for the same alias does not throw
+ // -------------------------------------------------------------------------
+
+ /**
+ * Two payments notified concurrently for the same card alias can both pass the findOneBy()
+ * guard before either commits; the DB-level unique constraint then rejects the second add().
+ * Verifies that race is swallowed rather than propagated as an uncaught exception.
+ */
+ public function testTreat_whenAddLosesARaceAgainstAConcurrentSaveForTheSameAlias_doesNotThrow(): void
+ {
+ $lock = $this->buildLock();
+ $this->lockFactory->method('createLock')->willReturn($lock);
+
+ $customer = $this->createMock(CustomerInterface::class);
+ $this->customerRepository->method('find')->with(9)->willReturn($customer);
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getMethod')->willReturn($this->createMock(PaymentMethodInterface::class));
+ $this->entityManager->method('refresh');
+
+ $paymentResource = $this->buildPayment([
+ 'id' => 'pay_008',
+ 'is_paid' => true,
+ 'is_live' => false,
+ 'created_at' => time(),
+ 'metadata' => ['customer_id' => 9],
+ 'card' => ['id' => 'card_external_race', 'brand' => 'Visa', 'country' => 'FR', 'last4' => '4242', 'exp_month' => 12, 'exp_year' => 2030],
+ ]);
+
+ $this->payplugCardRepository->method('findOneBy')->willReturn(null);
+
+ $card = $this->createMock(Card::class);
+ $card->method('setCustomer')->willReturnSelf();
+ $card->method('setPaymentMethod')->willReturnSelf();
+ $card->method('setExternalId')->willReturnSelf();
+ $card->method('setBrand')->willReturnSelf();
+ $card->method('setCountryCode')->willReturnSelf();
+ $card->method('setLast4')->willReturnSelf();
+ $card->method('setExpirationMonth')->willReturnSelf();
+ $card->method('setExpirationYear')->willReturnSelf();
+ $card->method('setIsLive')->willReturnSelf();
+
+ $this->payplugCardFactory->method('createNew')->willReturn($card);
+ $this->payplugCardRepository->method('add')->with($card)
+ ->willThrowException($this->createMock(UniqueConstraintViolationException::class));
+ $this->managerRegistry->expects(self::once())->method('resetManager');
+
+ $details = new \ArrayObject(['status' => PayPlugApiClientInterface::STATUS_CREATED]);
+
+ $this->handler->treat($payment, $paymentResource, $details);
+
+ self::assertSame(PayPlugApiClientInterface::STATUS_CAPTURED, $details['status']);
+ }
+
// -------------------------------------------------------------------------
// treat() — card NOT saved when card already exists in repo
// -------------------------------------------------------------------------
diff --git a/tests/PHPUnit/OrderPay/Provider/CaptureHttpResponseProviderTest.php b/tests/PHPUnit/OrderPay/Provider/CaptureHttpResponseProviderTest.php
new file mode 100644
index 00000000..d274d115
--- /dev/null
+++ b/tests/PHPUnit/OrderPay/Provider/CaptureHttpResponseProviderTest.php
@@ -0,0 +1,108 @@
+provider = new CaptureHttpResponseProvider();
+ $this->requestConfiguration = $this->createMock(RequestConfiguration::class);
+ }
+
+ private function paymentRequest(string $action, array $responseData): PaymentRequestInterface&MockObject
+ {
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $paymentRequest->method('getAction')->willReturn($action);
+ $paymentRequest->method('getResponseData')->willReturn($responseData);
+
+ return $paymentRequest;
+ }
+
+ public function testSupports_whenRedirectUrlIsSetOnCapture_returnsTrue(): void
+ {
+ $paymentRequest = $this->paymentRequest(PaymentRequestInterface::ACTION_CAPTURE, ['redirect_url' => 'https://example.com/3ds']);
+
+ self::assertTrue($this->provider->supports($this->requestConfiguration, $paymentRequest));
+ }
+
+ public function testSupports_whenRedirectHtmlIsSetOnCapture_returnsTrue(): void
+ {
+ $paymentRequest = $this->paymentRequest(PaymentRequestInterface::ACTION_CAPTURE, ['redirect_html' => '']);
+
+ self::assertTrue($this->provider->supports($this->requestConfiguration, $paymentRequest));
+ }
+
+ public function testSupports_whenActionIsNotCapture_returnsFalse(): void
+ {
+ $paymentRequest = $this->paymentRequest(PaymentRequestInterface::ACTION_NOTIFY, ['redirect_url' => 'https://example.com/3ds']);
+
+ self::assertFalse($this->provider->supports($this->requestConfiguration, $paymentRequest));
+ }
+
+ public function testSupports_whenNeitherRedirectFieldIsSet_returnsFalse(): void
+ {
+ $paymentRequest = $this->paymentRequest(PaymentRequestInterface::ACTION_CAPTURE, ['status' => 'processing']);
+
+ self::assertFalse($this->provider->supports($this->requestConfiguration, $paymentRequest));
+ }
+
+ public function testGetResponse_whenRedirectUrlIsSet_returnsARedirectResponse(): void
+ {
+ $paymentRequest = $this->paymentRequest(PaymentRequestInterface::ACTION_CAPTURE, ['redirect_url' => 'https://example.com/3ds']);
+
+ $response = $this->provider->getResponse($this->requestConfiguration, $paymentRequest);
+
+ self::assertInstanceOf(RedirectResponse::class, $response);
+ self::assertSame('https://example.com/3ds', $response->getTargetUrl());
+ }
+
+ public function testGetResponse_whenRedirectHtmlIsSet_returnsThatHtmlAsTheResponseContent(): void
+ {
+ $html = '3DS challenge form';
+ $paymentRequest = $this->paymentRequest(PaymentRequestInterface::ACTION_CAPTURE, ['redirect_html' => $html]);
+
+ $response = $this->provider->getResponse($this->requestConfiguration, $paymentRequest);
+
+ self::assertSame($html, $response->getContent());
+ }
+
+ /**
+ * Not a real-world case (the handler only ever sets one or the other), but proves the
+ * precedence explicitly rather than leaving it implicit: redirect_html wins if both are set.
+ */
+ public function testGetResponse_whenBothRedirectFieldsAreSet_prefersRedirectHtml(): void
+ {
+ $html = '3DS challenge form';
+ $paymentRequest = $this->paymentRequest(PaymentRequestInterface::ACTION_CAPTURE, [
+ 'redirect_url' => 'https://example.com/3ds',
+ 'redirect_html' => $html,
+ ]);
+
+ $response = $this->provider->getResponse($this->requestConfiguration, $paymentRequest);
+
+ self::assertSame($html, $response->getContent());
+ }
+
+ public function testGetResponse_whenNeitherRedirectFieldIsSet_throws(): void
+ {
+ $paymentRequest = $this->paymentRequest(PaymentRequestInterface::ACTION_CAPTURE, []);
+
+ $this->expectException(\LogicException::class);
+
+ $this->provider->getResponse($this->requestConfiguration, $paymentRequest);
+ }
+}
diff --git a/tests/PHPUnit/PaymentProcessing/AuthorizedPaymentOperationProcessorTest.php b/tests/PHPUnit/PaymentProcessing/AuthorizedPaymentOperationProcessorTest.php
new file mode 100644
index 00000000..c99683b9
--- /dev/null
+++ b/tests/PHPUnit/PaymentProcessing/AuthorizedPaymentOperationProcessorTest.php
@@ -0,0 +1,534 @@
+operator = $this->createMock(AuthorizationOperatorInterface::class);
+ $this->lock = $this->createMock(ILock::class);
+ $this->lock->method('acquire')->willReturn(true);
+ $this->entityManager = $this->createMock(EntityManagerInterface::class);
+ $this->stateMachine = $this->createMock(StateMachineInterface::class);
+ $this->stateMachine->method('can')->willReturn(true);
+ $this->clock = new MockClock('2026-09-24T10:00:00+00:00');
+
+ $this->processor = new AuthorizedPaymentOperationProcessor(
+ $this->operator,
+ $this->lock,
+ $this->entityManager,
+ $this->stateMachine,
+ $this->clock,
+ $this->createMock(LoggerInterface::class),
+ );
+ }
+
+ public function testCapture_partial_recordsTheOperationAndKeepsThePaymentAuthorized(): void
+ {
+ $payment = $this->authorizedPayment(1000);
+
+ $this->operator->expects(self::once())->method('capture')
+ ->with(self::isInstanceOf(PaymentMethod::class), 'pay_1', '42', 300)
+ ->willReturn($this->captureOutput('op_c1'));
+ $this->stateMachine->expects(self::never())->method('apply');
+
+ $this->processor->capture($payment, 300, 0);
+
+ $authorization = AuthorizationDetails::fromDetails($payment->getDetails());
+ self::assertSame(300, $authorization->capturedAmount());
+ self::assertSame(700, $authorization->remainingAmount());
+ self::assertSame(['operation' => 'capture', 'amount' => 300], $authorization->findOperation('op_c1'));
+ }
+
+ public function testCapture_ofTheRemainder_sendsTheExactRemainderAndCompletesThePayment(): void
+ {
+ $payment = $this->authorizedPayment(1000);
+ $payment->setDetails(AuthorizationDetails::withOperation($payment->getDetails(), AuthorizationDetails::OPERATION_CAPTURE, 'op_c1', 300));
+
+ // Never "no amount": the Unified API reads that as the ORIGINAL authorized amount and
+ // refuses it as a duplicate once part of it has been captured.
+ $this->operator->expects(self::once())->method('capture')
+ // Second operation on this authorization: numbered so Payplug doesn't see a duplicate.
+ ->with(self::anything(), 'pay_1', '42', 700, 'EUR', 2)
+ ->willReturn($this->captureOutput('op_c2'));
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($payment, PaymentTransitions::GRAPH, PaymentTransitions::TRANSITION_COMPLETE);
+
+ $this->processor->capture($payment, null, 1);
+
+ self::assertSame(0, AuthorizationDetails::fromDetails($payment->getDetails())->remainingAmount());
+ }
+
+ public function testCancel_ofTheRestAfterAPartialCancellation_sendsTheExactRemainder(): void
+ {
+ $payment = $this->authorizedPayment(1000);
+ $payment->setDetails(AuthorizationDetails::withOperation($payment->getDetails(), AuthorizationDetails::OPERATION_CANCELLATION, 'op_v1', 400));
+
+ $this->operator->expects(self::once())->method('cancel')
+ ->with(self::anything(), 'pay_1', '42', 600)
+ ->willReturn(new CancellationOutput(200, '{"execCode":"0000","operationIds":["op_v2"]}', null, null));
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($payment, PaymentTransitions::GRAPH, PaymentTransitions::TRANSITION_CANCEL);
+
+ $this->processor->cancel($payment, null, 1);
+ }
+
+ public function testCapture_takesTheDeadlineUpcReturns(): void
+ {
+ $payment = $this->authorizedPayment(1000);
+ $this->operator->method('capture')->willReturn(
+ new CaptureOutput(200, '{"operationIds":["op_c1"]}', 300, 1000, '2026-09-30T00:00:00+00:00'),
+ );
+
+ $this->processor->capture($payment, 300);
+
+ self::assertSame('2026-09-30T00:00:00+00:00', $payment->getDetails()[AuthorizationDetails::MAX_CAPTURE_DATE]);
+ }
+
+ public function testCapture_aboveTheRemainder_isRefusedWithoutCallingUpc(): void
+ {
+ $payment = $this->authorizedPayment(1000);
+ $this->operator->expects(self::never())->method('capture');
+
+ $exception = $this->catchRefusal(fn () => $this->processor->capture($payment, 1001));
+
+ self::assertSame('payplug_sylius_payplug_plugin.admin.authorization.error.amount_exceeds_remaining', $exception->getTranslationKey());
+ self::assertSame(['%remaining%' => '10.00 EUR'], $exception->getTranslationParameters());
+ }
+
+ public function testCapture_aboveTheRemainderInUsd_formatsTheRemainingAmountInUsd(): void
+ {
+ $payment = $this->authorizedPayment(1000, currency: 'USD');
+ $this->operator->expects(self::never())->method('capture');
+
+ $exception = $this->catchRefusal(fn () => $this->processor->capture($payment, 1001));
+
+ self::assertSame(['%remaining%' => '10.00 USD'], $exception->getTranslationParameters());
+ }
+
+ /**
+ * @return iterable
+ */
+ public static function typedAmountCurrencies(): iterable
+ {
+ yield 'EUR' => ['EUR', true];
+ yield 'USD' => ['USD', true];
+ yield 'lowercase eur' => ['eur', true];
+ yield 'zero-decimal JPY' => ['JPY', false];
+ yield 'zero-decimal XPF' => ['XPF', false];
+ yield 'three-decimal KWD' => ['KWD', false];
+ yield 'empty' => ['', false];
+ yield 'malformed' => ['EU', false];
+ yield 'with a digit' => ['E1R', false];
+ yield 'no currency' => [null, false];
+ }
+
+ /**
+ * @dataProvider typedAmountCurrencies
+ */
+ public function testSupportsTypedAmounts_onlyForATwoDecimalCurrency(?string $currency, bool $expected): void
+ {
+ self::assertSame($expected, AuthorizedPaymentOperationProcessor::supportsTypedAmounts($currency));
+ }
+
+ /**
+ * @return iterable
+ */
+ public static function explicitAmountsInUnsupportedCurrencies(): iterable
+ {
+ yield 'capture in JPY' => ['capture', 'JPY'];
+ yield 'cancel in KWD' => ['cancel', 'KWD'];
+ yield 'capture without a currency' => ['capture', ''];
+ }
+
+ /**
+ * @dataProvider explicitAmountsInUnsupportedCurrencies
+ */
+ public function testAnExplicitAmountInAnUnsupportedCurrency_isRefusedBeforeUpcAndRecordsNothing(
+ string $operation,
+ string $currency,
+ ): void
+ {
+ $payment = $this->authorizedPayment(1000, currency: $currency);
+ $detailsBefore = $payment->getDetails();
+ $this->operator->expects(self::never())->method('capture');
+ $this->operator->expects(self::never())->method('cancel');
+ $this->entityManager->expects(self::never())->method('flush');
+
+ $exception = $this->catchRefusal(fn () => 'capture' === $operation
+ ? $this->processor->capture($payment, 500)
+ : $this->processor->cancel($payment, 500));
+
+ self::assertSame('payplug_sylius_payplug_plugin.admin.authorization.error.unsupported_currency', $exception->getTranslationKey());
+ self::assertSame(['%currency%' => $currency], $exception->getTranslationParameters());
+ self::assertSame($detailsBefore, $payment->getDetails());
+ }
+
+ public function testCapture_ofTheWholeRemainderInAZeroDecimalCurrency_sendsTheStoredAmount(): void
+ {
+ $payment = $this->authorizedPayment(1000, currency: 'JPY');
+ $this->operator->expects(self::once())->method('capture')
+ ->with(self::anything(), 'pay_1', '42', 1000, 'JPY')
+ ->willReturn($this->captureOutput('op_c1'));
+
+ $this->processor->capture($payment, null);
+
+ self::assertSame(1000, AuthorizationDetails::fromDetails($payment->getDetails())->capturedAmount());
+ }
+
+ public function testCapture_withAStaleVersion_isRefusedSoAReplayedFormCannotCaptureTwice(): void
+ {
+ $payment = $this->authorizedPayment(1000);
+ $payment->setDetails(AuthorizationDetails::withOperation($payment->getDetails(), AuthorizationDetails::OPERATION_CAPTURE, 'op_c1', 300));
+ $this->operator->expects(self::never())->method('capture');
+
+ $exception = $this->catchRefusal(fn () => $this->processor->capture($payment, 300, 0));
+
+ self::assertSame('payplug_sylius_payplug_plugin.admin.authorization.error.stale', $exception->getTranslationKey());
+ }
+
+ public function testCapture_flushesTheRecordBeforeReleasingTheLock(): void
+ {
+ $calls = [];
+ $this->lock = $this->createMock(ILock::class);
+ $this->lock->method('acquire')->willReturn(true);
+ $this->lock->method('release')->willReturnCallback(static function () use (&$calls): void {
+ $calls[] = 'release';
+ });
+ $this->entityManager->method('flush')->willReturnCallback(static function () use (&$calls): void {
+ $calls[] = 'flush';
+ });
+ $processor = new AuthorizedPaymentOperationProcessor($this->operator, $this->lock, $this->entityManager, $this->stateMachine, $this->clock, $this->createMock(LoggerInterface::class));
+ $this->operator->method('capture')->willReturn($this->captureOutput('op_c1'));
+
+ $processor->capture($this->authorizedPayment(1000), 300, 0);
+
+ // A second request taking the lock the moment it is released must already see the
+ // recorded operation, or its version check passes and UPC is asked to capture twice.
+ self::assertSame(['flush', 'release'], $calls);
+ }
+
+ public function testCancel_flushesTheRecordBeforeReleasingTheLock(): void
+ {
+ $calls = [];
+ $this->lock = $this->createMock(ILock::class);
+ $this->lock->method('acquire')->willReturn(true);
+ $this->lock->method('release')->willReturnCallback(static function () use (&$calls): void {
+ $calls[] = 'release';
+ });
+ $this->entityManager->method('flush')->willReturnCallback(static function () use (&$calls): void {
+ $calls[] = 'flush';
+ });
+ $processor = new AuthorizedPaymentOperationProcessor($this->operator, $this->lock, $this->entityManager, $this->stateMachine, $this->clock, $this->createMock(LoggerInterface::class));
+ $this->operator->method('cancel')->willReturn(new CancellationOutput(200, '{"operationIds":["op_x1"]}', null, null, null));
+
+ $processor->cancel($this->authorizedPayment(1000), 400, 0);
+
+ self::assertSame(['flush', 'release'], $calls);
+ }
+
+ public function testOnCompleteTransition_flushesTheCaptureBeforeReleasingTheLock(): void
+ {
+ $calls = [];
+ $this->lock = $this->createMock(ILock::class);
+ $this->lock->method('acquire')->willReturn(true);
+ $this->lock->method('release')->willReturnCallback(static function () use (&$calls): void {
+ $calls[] = 'release';
+ });
+ $this->entityManager->method('flush')->willReturnCallback(static function () use (&$calls): void {
+ $calls[] = 'flush';
+ });
+ $processor = new AuthorizedPaymentOperationProcessor($this->operator, $this->lock, $this->entityManager, $this->stateMachine, $this->clock, $this->createMock(LoggerInterface::class));
+ $this->operator->method('capture')->willReturn($this->captureOutput('op_c1'));
+
+ $processor->onCompleteTransition($this->transitionEvent($this->authorizedPayment(1000)));
+
+ self::assertSame(['flush', 'release'], $calls);
+ }
+
+ public function testCapture_whenTheFlushFailsAfterUpcAccepted_releasesTheLockAndRethrows(): void
+ {
+ $this->lock = $this->createMock(ILock::class);
+ $this->lock->method('acquire')->willReturn(true);
+ $this->lock->expects(self::once())->method('release');
+ $this->entityManager->method('flush')->willThrowException(new \RuntimeException('connection lost'));
+ $processor = new AuthorizedPaymentOperationProcessor($this->operator, $this->lock, $this->entityManager, $this->stateMachine, $this->clock, $this->createMock(LoggerInterface::class));
+ $this->operator->expects(self::once())->method('capture')->willReturn($this->captureOutput('op_c1'));
+
+ $this->expectException(\RuntimeException::class);
+
+ $processor->capture($this->authorizedPayment(1000), 300, 0);
+ }
+
+ public function testCapture_refusedByUpc_flushesNothing(): void
+ {
+ $this->operator->method('capture')->willThrowException(new PaymentNotCapturableException('nope'));
+ $this->entityManager->expects(self::never())->method('flush');
+
+ $this->catchRefusal(fn () => $this->processor->capture($this->authorizedPayment(1000), 300, 0));
+ }
+
+ public function testCapture_whileAnotherOperationHoldsTheLock_isRefused(): void
+ {
+ $lock = $this->createMock(ILock::class);
+ $lock->method('acquire')->with('payplug_upc_authorization_42', 30)->willReturn(false);
+ $processor = new AuthorizedPaymentOperationProcessor($this->operator, $lock, $this->entityManager, $this->stateMachine, $this->clock, $this->createMock(LoggerInterface::class));
+ $this->operator->expects(self::never())->method('capture');
+
+ $exception = $this->catchRefusal(fn () => $processor->capture($this->authorizedPayment(1000), 300));
+
+ self::assertSame('payplug_sylius_payplug_plugin.admin.authorization.error.in_progress', $exception->getTranslationKey());
+ }
+
+ public function testCapture_afterTheDeadline_isRefusedWithoutCallingUpc(): void
+ {
+ $payment = $this->authorizedPayment(1000, '2026-09-24T09:00:00+00:00');
+ $this->operator->expects(self::never())->method('capture');
+
+ $exception = $this->catchRefusal(fn () => $this->processor->capture($payment, null));
+
+ self::assertSame('payplug_sylius_payplug_plugin.admin.authorization.error.expired', $exception->getTranslationKey());
+ self::assertFalse($this->processor->canCapture($payment));
+ }
+
+ public function testCapture_onAPaymentNotAuthorized_isRefused(): void
+ {
+ $payment = $this->authorizedPayment(1000);
+ $payment->setState(PaymentInterface::STATE_COMPLETED);
+
+ $exception = $this->catchRefusal(fn () => $this->processor->capture($payment, null));
+
+ self::assertSame('payplug_sylius_payplug_plugin.admin.authorization.error.not_authorized', $exception->getTranslationKey());
+ }
+
+ /**
+ * @return iterable
+ */
+ public static function upcRefusals(): iterable
+ {
+ yield 'expired' => [new AuthorizationExpiredException('Authorization expired'), 'expired'];
+ yield 'not capturable' => [new PaymentNotCapturableException('Payment is not capturable'), 'not_operable'];
+ // Staging, 2026-09-24: every capture after the first on this account → HTTP 200 + 4011.
+ yield 'second capture' => [new MultipleCaptureNotAllowedException('Duplicate request.'), 'multiple_capture_not_allowed'];
+ yield 'generic' => [new ApiException('HTTP 500'), 'api_error'];
+ }
+
+ /**
+ * @dataProvider upcRefusals
+ */
+ public function testCapture_refusedByUpc_leavesDetailsAndStateUntouched(
+ \Throwable $upcException,
+ string $reason,
+ ): void
+ {
+ $payment = $this->authorizedPayment(1000);
+ $detailsBefore = $payment->getDetails();
+ $this->operator->method('capture')->willThrowException($upcException);
+ $this->stateMachine->expects(self::never())->method('apply');
+ $this->lock->expects(self::once())->method('release')->with('payplug_upc_authorization_42');
+
+ $exception = $this->catchRefusal(fn () => $this->processor->capture($payment, null));
+
+ self::assertSame('payplug_sylius_payplug_plugin.admin.authorization.error.' . $reason, $exception->getTranslationKey());
+ self::assertSame($detailsBefore, $payment->getDetails());
+ self::assertSame(PaymentInterface::STATE_AUTHORIZED, $payment->getState());
+ }
+
+ public function testCancel_full_sendsNoAmountAndCancelsThePayment(): void
+ {
+ $payment = $this->authorizedPayment(1000);
+
+ $this->operator->expects(self::once())->method('cancel')
+ ->with(self::anything(), 'pay_1', '42', null)
+ ->willReturn(new CancellationOutput(200, '{"operationIds":["op_v1"]}', 1000, 1000));
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($payment, PaymentTransitions::GRAPH, PaymentTransitions::TRANSITION_CANCEL);
+
+ $this->processor->cancel($payment, null, 0);
+
+ self::assertSame(1000, AuthorizationDetails::fromDetails($payment->getDetails())->cancelledAmount());
+ }
+
+ public function testCancel_partial_keepsTheRestCapturable(): void
+ {
+ $payment = $this->authorizedPayment(1000);
+
+ $this->operator->expects(self::once())->method('cancel')
+ ->with(self::anything(), 'pay_1', '42', 400)
+ ->willReturn(new CancellationOutput(200, '{"operationIds":["op_v1"]}', 400, 1000));
+ $this->stateMachine->expects(self::never())->method('apply');
+
+ $this->processor->cancel($payment, 400);
+
+ self::assertSame(600, AuthorizationDetails::fromDetails($payment->getDetails())->remainingAmount());
+ self::assertTrue($this->processor->canCapture($payment));
+ }
+
+ public function testCancel_partialNotAllowedByTheContract_isExplained(): void
+ {
+ $payment = $this->authorizedPayment(1000);
+ $this->operator->method('cancel')->willThrowException(new PartialCancellationNotAllowedException('not enabled'));
+
+ $exception = $this->catchRefusal(fn () => $this->processor->cancel($payment, 400));
+
+ self::assertSame('payplug_sylius_payplug_plugin.admin.authorization.error.partial_cancellation_not_allowed', $exception->getTranslationKey());
+ }
+
+ public function testCancel_afterACapture_isNeitherOfferedNorSent(): void
+ {
+ $payment = $this->authorizedPayment(1000);
+ $payment->setDetails(AuthorizationDetails::withOperation($payment->getDetails(), AuthorizationDetails::OPERATION_CAPTURE, 'op_c1', 300));
+ $this->operator->expects(self::never())->method('cancel');
+
+ self::assertFalse($this->processor->canCancel($payment));
+ self::assertTrue($this->processor->canCapture($payment));
+
+ $exception = $this->catchRefusal(fn () => $this->processor->cancel($payment, null));
+ self::assertSame('payplug_sylius_payplug_plugin.admin.authorization.error.cancel_after_capture', $exception->getTranslationKey());
+ }
+
+ public function testOnCompleteTransition_capturesWhatIsStillAuthorized(): void
+ {
+ $payment = $this->authorizedPayment(1000);
+ $this->operator->expects(self::once())->method('capture')
+ ->with(self::anything(), 'pay_1', '42', 1000, 'EUR')
+ ->willReturn($this->captureOutput('op_c1'));
+ // Already inside the "complete" transition: must not apply it a second time.
+ $this->stateMachine->expects(self::never())->method('apply');
+
+ $this->processor->onCompleteTransition($this->transitionEvent($payment));
+
+ self::assertSame(1000, AuthorizationDetails::fromDetails($payment->getDetails())->capturedAmount());
+ }
+
+ public function testOnCompleteTransition_isANoOpOnceNothingIsLeftToCapture(): void
+ {
+ $payment = $this->authorizedPayment(1000);
+ $payment->setDetails(AuthorizationDetails::withOperation($payment->getDetails(), AuthorizationDetails::OPERATION_CAPTURE, 'op_c1', 1000));
+ $this->operator->expects(self::never())->method('capture');
+
+ $this->processor->onCompleteTransition($this->transitionEvent($payment));
+ }
+
+ public function testOnCompleteTransition_ignoresAnImmediateCapturePayment(): void
+ {
+ $payment = $this->authorizedPayment(1000);
+ $payment->setDetails(['hosted_fields_payment_id' => 'pay_1']);
+ $this->operator->expects(self::never())->method('capture');
+
+ $this->processor->onCompleteTransition($this->transitionEvent($payment));
+ }
+
+ public function testOnCompleteTransition_abortsTheTransitionWhenTheCaptureIsRefused(): void
+ {
+ $payment = $this->authorizedPayment(1000);
+ $this->operator->method('capture')->willThrowException(new ApiException('HTTP 500'));
+
+ $this->expectException(AuthorizationOperationException::class);
+
+ $this->processor->onCompleteTransition($this->transitionEvent($payment));
+ }
+
+ private function authorizedPayment(
+ int $amount,
+ ?string $maxCaptureDate = '2026-09-30T10:00:00+00:00',
+ string $currency = 'EUR',
+ ): Payment
+ {
+ $gatewayConfig = new GatewayConfig();
+ $gatewayConfig->setFactoryName(PayPlugGatewayFactory::FACTORY_NAME);
+ $gatewayConfig->setConfig([
+ PayPlugGatewayFactory::HOSTED_FIELDS => true,
+ PayPlugGatewayFactory::HF_IDENTIFIER => 'acct_1',
+ PayPlugGatewayFactory::DEFERRED_CAPTURE => true,
+ ]);
+ $method = new PaymentMethod();
+ $method->setGatewayConfig($gatewayConfig);
+
+ $payment = new class() extends Payment {
+ public function getId(): int
+ {
+ return 42;
+ }
+ };
+ // Sylius's core Payment asserts it has an order; one without a number yet makes the
+ // orderId sent to UPC fall back to the payment id ("42").
+ $payment->setOrder(new Order());
+ $payment->setMethod($method);
+ $payment->setAmount($amount);
+ $payment->setCurrencyCode($currency);
+ $payment->setState(PaymentInterface::STATE_AUTHORIZED);
+ $payment->setDetails(AuthorizationDetails::open(
+ ['hosted_fields_payment_id' => 'pay_1'],
+ new PaymentOutput(201, '{}', null, null, null, $maxCaptureDate, $amount),
+ $amount,
+ ));
+
+ return $payment;
+ }
+
+ private function captureOutput(string $operationId): CaptureOutput
+ {
+ return new CaptureOutput(200, (string) \json_encode(['operationIds' => [$operationId]]), null, null, null);
+ }
+
+ private function transitionEvent(PaymentInterface $payment): TransitionEvent
+ {
+ return new TransitionEvent($payment, new Marking([PaymentInterface::STATE_AUTHORIZED => 1]));
+ }
+
+ private function catchRefusal(\Closure $operation): AuthorizationOperationException
+ {
+ try {
+ $operation();
+ } catch (AuthorizationOperationException $exception) {
+ return $exception;
+ }
+
+ self::fail('Expected an AuthorizationOperationException.');
+ }
+}
diff --git a/tests/PHPUnit/PaymentProcessing/NullHostedFieldsPaymentProcessorTest.php b/tests/PHPUnit/PaymentProcessing/NullHostedFieldsPaymentProcessorTest.php
new file mode 100644
index 00000000..a4a24faa
--- /dev/null
+++ b/tests/PHPUnit/PaymentProcessing/NullHostedFieldsPaymentProcessorTest.php
@@ -0,0 +1,46 @@
+logger = $this->createMock(LoggerInterface::class);
+ $this->processor = new NullHostedFieldsPaymentProcessor($this->logger);
+ }
+
+ public function testProcess_storesCardMetadataAlongsideTokenAndBrand(): void
+ {
+ $this->logger->expects(self::once())->method('info');
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getDetails')->willReturn(['existing_key' => 'kept']);
+ $payment->expects(self::once())->method('setDetails')->with([
+ 'existing_key' => 'kept',
+ 'hosted_fields_token' => 'hf_token_abc',
+ 'hosted_fields_selected_brand' => 'VISA',
+ 'hosted_fields_save_card' => true,
+ 'hosted_fields_last4' => '4242',
+ 'hosted_fields_expiration_month' => 12,
+ 'hosted_fields_expiration_year' => 2030,
+ 'hosted_fields_country' => 'FR',
+ 'status' => PaymentInterface::STATE_PROCESSING,
+ ]);
+
+ $this->processor->process($payment, new HostedFieldsCaptureData('hf_token_abc', 'VISA', true, '4242', 12, 2030, 'FR'));
+ }
+}
diff --git a/tests/PHPUnit/PaymentProcessing/RefundPaymentProcessorTest.php b/tests/PHPUnit/PaymentProcessing/RefundPaymentProcessorTest.php
index 3a2d3763..943db412 100644
--- a/tests/PHPUnit/PaymentProcessing/RefundPaymentProcessorTest.php
+++ b/tests/PHPUnit/PaymentProcessing/RefundPaymentProcessorTest.php
@@ -14,16 +14,24 @@
use PayPlug\SyliusPayPlugPlugin\Gateway\WeroGatewayFactory;
use PayPlug\SyliusPayPlugPlugin\PaymentProcessing\RefundPaymentProcessor;
use PayPlug\SyliusPayPlugPlugin\Repository\RefundHistoryRepositoryInterface;
+use PayPlug\SyliusPayPlugPlugin\Upc\AuthorizationDetails;
+use PayPlug\SyliusPayPlugPlugin\Upc\RefundCreatorInterface;
+use PayplugUnifiedCore\Contracts\ILock;
+use PayplugUnifiedCore\Exceptions\ApiException;
use PHPUnit\Framework\MockObject\MockObject;
use PHPUnit\Framework\TestCase;
use Psr\Log\LoggerInterface;
+use Sylius\Component\Core\Model\OrderInterface;
use Sylius\Component\Core\Model\PaymentInterface;
use Sylius\Component\Core\Model\PaymentMethodInterface;
use Sylius\Component\Payment\Model\GatewayConfigInterface;
use Sylius\Component\Resource\Exception\UpdateHandlingException;
use Sylius\Component\Resource\Repository\RepositoryInterface;
use Sylius\RefundPlugin\Entity\RefundPayment;
+use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\RequestStack;
+use Symfony\Component\HttpFoundation\Session\Session;
+use Symfony\Component\HttpFoundation\Session\Storage\MockArraySessionStorage;
use Symfony\Contracts\Translation\TranslatorInterface;
final class RefundPaymentProcessorTest extends TestCase
@@ -42,6 +50,10 @@ final class RefundPaymentProcessorTest extends TestCase
private PayPlugApiClientInterface&MockObject $apiClient;
+ private RefundCreatorInterface&MockObject $refundCreator;
+
+ private ILock&MockObject $lock;
+
private RefundPaymentProcessor $processor;
protected function setUp(): void
@@ -53,6 +65,9 @@ protected function setUp(): void
$this->payplugRefundHistoryRepository = $this->createMock(RefundHistoryRepositoryInterface::class);
$this->apiClientFactory = $this->createMock(PayPlugApiClientFactoryInterface::class);
$this->apiClient = $this->createMock(PayPlugApiClientInterface::class);
+ $this->refundCreator = $this->createMock(RefundCreatorInterface::class);
+ $this->lock = $this->createMock(ILock::class);
+ $this->lock->method('acquire')->willReturn(true);
$this->apiClientFactory->method('createForPaymentMethod')->willReturn($this->apiClient);
@@ -63,6 +78,8 @@ protected function setUp(): void
$this->refundPaymentRepository,
$this->payplugRefundHistoryRepository,
$this->apiClientFactory,
+ $this->refundCreator,
+ $this->lock,
);
}
@@ -238,10 +255,640 @@ public function testProcessWithAmount_apiThrowsException_throwsUpdateHandlingExc
$this->processor->processWithAmount($payment, 300, 42);
}
+ // -------------------------------------------------------------------------
+ // process() — Hosted Fields (UHF) full refund → calls RefundCreatorInterface
+ // -------------------------------------------------------------------------
+
+ /**
+ * Calls process() with a Hosted-Fields-configured payment. Verifies the UHF refund creator
+ * is called with the payment's hosted_fields_payment_id and no amount (full refund), and the
+ * legacy PayPlugApiClient is never touched.
+ */
+ public function testProcess_hostedFields_callsRefundCreatorWithoutAmount(): void
+ {
+ $payment = $this->buildHostedFieldsPayment(['hosted_fields_payment_id' => 'pay_hf_123']);
+
+ $this->refundCreator->expects(self::once())
+ ->method('createRefund')
+ ->with(self::isInstanceOf(PaymentMethodInterface::class), 'pay_hf_123', '000000042', null)
+ ->willReturn(['status' => 200, 'body' => '{}']);
+ $this->apiClient->expects(self::never())->method('refundPayment');
+
+ $this->processor->process($payment);
+ }
+
+ /**
+ * A full refund now records the refund's own operation id under $details['refunds'] (with a
+ * null internal_id, since there's no Sylius RefundPayment/$refundId in this flow) — otherwise
+ * HostedFieldsWebhookNotificationHandler could never resolve the payment for the async webhook
+ * confirming this refund, since PaymentRepository::findOneByPayPlugPaymentId() matches on
+ * ids present somewhere in Payment::details.
+ */
+ public function testProcess_hostedFields_recordsTheRefundOperationIdInDetails(): void
+ {
+ $payment = $this->buildHostedFieldsPayment(['hosted_fields_payment_id' => 'pay_hf_123']);
+ $payment->expects(self::once())->method('setDetails')->with(self::callback(
+ static function (array $details): bool {
+ return [[
+ 'internal_id' => null,
+ 'id' => 'op_ref_full',
+ 'amount' => 2400,
+ ]] === $details['refunds'];
+ },
+ ));
+
+ $this->refundCreator->method('createRefund')
+ ->with(self::isInstanceOf(PaymentMethodInterface::class), 'pay_hf_123', '000000042', null)
+ ->willReturn(['status' => 200, 'body' => json_encode(['operationIds' => ['op_ref_full']])]);
+
+ $this->processor->process($payment);
+ }
+
+ /**
+ * A full refund (process()) triggered after an earlier partial refund must record the
+ * REMAINING amount actually refunded by omitting $amount to createRefund() — not
+ * $payment->getAmount() (the original total, 2400 here) — per
+ * UnifiedApiPaymentService::createRefund()'s own documented "omitting $amount refunds the
+ * full remaining amount" behavior. Recording the original total instead would make
+ * matchesPayment() reject this refund's own webhook confirmation (500 already refunded, 1900
+ * really remaining) forever.
+ */
+ public function testProcess_hostedFields_afterAPriorPartialRefund_recordsTheRemainingAmountNotTheOriginalTotal(): void
+ {
+ $existingRefunds = [['internal_id' => 77, 'id' => 'op_ref_1', 'amount' => 500]];
+ $payment = $this->buildHostedFieldsPayment([
+ 'hosted_fields_payment_id' => 'pay_hf_123',
+ 'refunds' => $existingRefunds,
+ ]);
+ $payment->expects(self::once())->method('setDetails')->with(self::callback(
+ static function (array $details) use ($existingRefunds): bool {
+ return [...$existingRefunds, [
+ 'internal_id' => null,
+ 'id' => 'op_ref_full',
+ 'amount' => 1900,
+ ]] === $details['refunds'];
+ },
+ ));
+
+ $this->refundCreator->method('createRefund')
+ ->with(self::isInstanceOf(PaymentMethodInterface::class), 'pay_hf_123', '000000042', null)
+ ->willReturn(['status' => 200, 'body' => json_encode(['operationIds' => ['op_ref_full']])]);
+
+ $this->processor->process($payment);
+ }
+
+ /**
+ * A deferred-capture payment whose authorization was partly cancelled before being captured
+ * only ever received the captured amount (1700 of 2400 here): that, not the payment's own
+ * amount, is what a full refund actually returns.
+ */
+ public function testProcess_hostedFields_onAPartlyCancelledDeferredPayment_recordsTheCapturedAmount(): void
+ {
+ $payment = $this->buildHostedFieldsPayment([
+ 'hosted_fields_payment_id' => 'pay_hf_123',
+ AuthorizationDetails::DEFERRED => true,
+ AuthorizationDetails::AUTHORIZED_AMOUNT => 2400,
+ AuthorizationDetails::CANCELLATIONS => [['id' => 'op_v1', 'amount' => 700]],
+ AuthorizationDetails::CAPTURES => [['id' => 'op_c1', 'amount' => 1700]],
+ ]);
+ $payment->expects(self::once())->method('setDetails')->with(self::callback(
+ static fn (array $details): bool => [['internal_id' => null, 'id' => 'op_ref_full', 'amount' => 1700]] === $details['refunds'],
+ ));
+
+ $this->refundCreator->method('createRefund')
+ ->willReturn(['status' => 200, 'body' => json_encode(['operationIds' => ['op_ref_full']])]);
+
+ $this->processor->process($payment);
+ }
+
+ /**
+ * An earlier refund attempt flagged 'failed' => true by
+ * HostedFieldsWebhookNotificationHandler::markMatchedRefundAsFailed() (its createRefund() call
+ * was accepted synchronously, but the async confirmation later reported it never actually
+ * completed) must not count against the remaining balance — a full refund triggered after it
+ * still records the ORIGINAL total (2400), not 2400 minus the failed attempt's amount.
+ */
+ public function testProcess_hostedFields_afterAFailedPriorRefund_ignoresItInTheRemainingAmountCalculation(): void
+ {
+ $existingRefunds = [['internal_id' => 77, 'id' => 'op_ref_1', 'amount' => 500, 'failed' => true]];
+ $payment = $this->buildHostedFieldsPayment([
+ 'hosted_fields_payment_id' => 'pay_hf_123',
+ 'refunds' => $existingRefunds,
+ ]);
+ $payment->expects(self::once())->method('setDetails')->with(self::callback(
+ static function (array $details) use ($existingRefunds): bool {
+ return [...$existingRefunds, [
+ 'internal_id' => null,
+ 'id' => 'op_ref_full',
+ 'amount' => 2400,
+ ]] === $details['refunds'];
+ },
+ ));
+
+ $this->refundCreator->method('createRefund')
+ ->with(self::isInstanceOf(PaymentMethodInterface::class), 'pay_hf_123', '000000042', null)
+ ->willReturn(['status' => 200, 'body' => json_encode(['operationIds' => ['op_ref_full']])]);
+
+ $this->processor->process($payment);
+ }
+
+ /**
+ * processHostedFields() must compute its remaining-balance sum from Payment::details read
+ * AFTER acquiring RefundDetailsLockKey, not from a snapshot taken before it — otherwise a
+ * concurrent HostedFieldsWebhookNotificationHandler::markMatchedRefundAsFailed() call (run
+ * while this refund creation's own network call to createRefund() is in flight, both holding
+ * the same lock key at different times) would have its 'failed' flag silently dropped when
+ * this method's own stale pre-lock $details gets written back. Simulated here via
+ * willReturnOnConsecutiveCalls: the first two getDetails() calls (prepare()'s own read, then
+ * the pre-lock Assert::string(hosted_fields_payment_id) check) see the refund as NOT failed
+ * yet; the third (taken once the lock is held, per processHostedFields()'s own re-read) sees
+ * it flagged failed — exactly as if the webhook's write landed in between. Only that third
+ * snapshot may ever reach setDetails().
+ */
+ public function testProcess_hostedFields_reReadsDetailsAfterAcquiringTheLock_soAConcurrentlyFlaggedFailedRefundIsNotLost(): void
+ {
+ $beforeLock = [
+ 'hosted_fields_payment_id' => 'pay_hf_123',
+ 'refunds' => [['internal_id' => 77, 'id' => 'op_ref_1', 'amount' => 500]],
+ ];
+ $afterLock = [
+ 'hosted_fields_payment_id' => 'pay_hf_123',
+ 'refunds' => [['internal_id' => 77, 'id' => 'op_ref_1', 'amount' => 500, 'failed' => true]],
+ ];
+
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getFactoryName')->willReturn(PayPlugGatewayFactory::FACTORY_NAME);
+ $gatewayConfig->method('getConfig')->willReturn([PayPlugGatewayFactory::HOSTED_FIELDS => true]);
+
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $paymentMethod->method('getGatewayConfig')->willReturn($gatewayConfig);
+
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getNumber')->willReturn('000000042');
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getMethod')->willReturn($paymentMethod);
+ $payment->method('getDetails')->willReturnOnConsecutiveCalls($beforeLock, $beforeLock, $afterLock);
+ $payment->method('getOrder')->willReturn($order);
+ $payment->method('getAmount')->willReturn(2400);
+ $payment->method('getId')->willReturn(42);
+
+ // The failed entry (500) must NOT be subtracted from the original total (2400): had the
+ // pre-lock snapshot been used instead, this would incorrectly come out to 1900.
+ $payment->expects(self::once())->method('setDetails')->with(self::callback(
+ static function (array $details) use ($afterLock): bool {
+ return [...$afterLock['refunds'], [
+ 'internal_id' => null,
+ 'id' => 'op_ref_full',
+ 'amount' => 2400,
+ ]] === $details['refunds'];
+ },
+ ));
+
+ $this->refundCreator->method('createRefund')
+ ->with(self::isInstanceOf(PaymentMethodInterface::class), 'pay_hf_123', '000000042', null)
+ ->willReturn(['status' => 200, 'body' => json_encode(['operationIds' => ['op_ref_full']])]);
+
+ $this->processor->process($payment);
+ }
+
+ /**
+ * The lock key for a full refund and a partial refund on the SAME payment must be identical —
+ * otherwise the two can run concurrently and both succeed, double-refunding money, exactly
+ * the scenario the lock exists to prevent.
+ */
+ public function testProcess_andProcessWithAmount_useTheSameLockKeyForTheSamePayment(): void
+ {
+ $acquiredKeys = [];
+ $this->lock = $this->createMock(ILock::class);
+ $this->lock->method('acquire')->willReturnCallback(static function (string $key) use (&$acquiredKeys): bool {
+ $acquiredKeys[] = $key;
+
+ return true;
+ });
+ $this->processor = new RefundPaymentProcessor(
+ $this->requestStack,
+ $this->logger,
+ $this->translator,
+ $this->refundPaymentRepository,
+ $this->payplugRefundHistoryRepository,
+ $this->apiClientFactory,
+ $this->refundCreator,
+ $this->lock,
+ );
+
+ $this->refundCreator->method('createRefund')->willReturn(['status' => 200, 'body' => '{}']);
+ $refundPayment = $this->createMock(RefundPayment::class);
+ $this->refundPaymentRepository->method('findOneBy')->willReturn($refundPayment);
+ $this->payplugRefundHistoryRepository->method('findOneBy')->willReturn(null);
+
+ $this->processor->process($this->buildHostedFieldsPayment(['hosted_fields_payment_id' => 'pay_hf_123']));
+ $this->processor->processWithAmount($this->buildHostedFieldsPayment(['hosted_fields_payment_id' => 'pay_hf_123']), 500, 77);
+
+ self::assertCount(2, $acquiredKeys);
+ self::assertSame($acquiredKeys[0], $acquiredKeys[1]);
+ }
+
+ /**
+ * A full refund has no RefundHistory/refundId to check-then-act on (mirrors the legacy
+ * process()'s own lack of one), so the ILock guard is its only protection against a
+ * concurrent second call for the same payment double-refunding.
+ */
+ public function testProcess_hostedFields_whenLockCannotBeAcquired_throwsUpdateHandlingExceptionWithoutCallingRefundCreator(): void
+ {
+ $this->expectException(UpdateHandlingException::class);
+
+ $payment = $this->buildHostedFieldsPayment(['hosted_fields_payment_id' => 'pay_hf_123']);
+ $this->lock = $this->createMock(ILock::class);
+ $this->lock->method('acquire')->willReturn(false);
+ $this->processor = new RefundPaymentProcessor(
+ $this->requestStack,
+ $this->logger,
+ $this->translator,
+ $this->refundPaymentRepository,
+ $this->payplugRefundHistoryRepository,
+ $this->apiClientFactory,
+ $this->refundCreator,
+ $this->lock,
+ );
+
+ $this->refundCreator->expects(self::never())->method('createRefund');
+ $this->logger->expects(self::once())->method('error');
+
+ $this->processor->process($payment);
+ }
+
+ /**
+ * The UHF refund creator throws an ApiException (a UPC exception, always a subtype of the
+ * base \Exception). Verifies the processor catches it the same way as the legacy client's
+ * exceptions, logs an error, and re-throws UpdateHandlingException.
+ */
+ public function testProcess_hostedFields_apiExceptionThrowsUpdateHandlingException(): void
+ {
+ $this->expectException(UpdateHandlingException::class);
+
+ $payment = $this->buildHostedFieldsPayment(['hosted_fields_payment_id' => 'pay_hf_fail']);
+
+ $this->refundCreator->method('createRefund')->willThrowException(new ApiException('API error'));
+ $this->logger->expects(self::once())->method('error');
+
+ $this->processor->process($payment);
+ }
+
+ // -------------------------------------------------------------------------
+ // processWithAmount() — Hosted Fields (UHF) partial refund → RefundCreatorInterface +
+ // RefundHistory bookkeeping
+ // -------------------------------------------------------------------------
+
+ /**
+ * Calls processWithAmount() on a Hosted-Fields payment. Verifies the UHF refund creator is
+ * called with the amount, setDetails() records the refund's own operation id (from the
+ * response's operationIds[0]) under $details['refunds'], and a RefundHistory entry is
+ * persisted — externalId stays null, mirroring the legacy flow's own convention that this
+ * field is reserved for the async webhook-confirmed refund, not the synchronous BO one.
+ */
+ public function testProcessWithAmount_hostedFields_createsRefundHistoryEntryFromOperationIds(): void
+ {
+ $payment = $this->buildHostedFieldsPayment(['hosted_fields_payment_id' => 'pay_hf_partial']);
+ $payment->expects(self::once())->method('setDetails')->with(self::callback(
+ static function (array $details): bool {
+ return [[
+ 'internal_id' => 77,
+ 'id' => 'op_ref_1',
+ 'amount' => 500,
+ ]] === $details['refunds'];
+ },
+ ));
+
+ $this->refundCreator
+ ->method('createRefund')
+ ->with(self::isInstanceOf(PaymentMethodInterface::class), 'pay_hf_partial', '000000042', 500)
+ ->willReturn(['status' => 200, 'body' => json_encode(['operationIds' => ['op_ref_1']])]);
+
+ $refundPayment = $this->createMock(RefundPayment::class);
+ $this->refundPaymentRepository->method('findOneBy')->with(['id' => 77])->willReturn($refundPayment);
+
+ $this->payplugRefundHistoryRepository->expects(self::once())->method('add')->with(self::callback(
+ static function (RefundHistory $refundHistory): bool {
+ return null === $refundHistory->getExternalId() &&
+ 500 === $refundHistory->getValue() &&
+ $refundHistory->isProcessed();
+ },
+ ));
+
+ $this->processor->processWithAmount($payment, 500, 77);
+ }
+
+ public function testProcessWithAmount_hostedFields_apiExceptionThrowsUpdateHandlingException(): void
+ {
+ $this->expectException(UpdateHandlingException::class);
+
+ $payment = $this->buildHostedFieldsPayment(['hosted_fields_payment_id' => 'pay_hf_partial_fail']);
+
+ $this->refundCreator->method('createRefund')->willThrowException(new ApiException('fail'));
+ $this->logger->expects(self::once())->method('error');
+
+ $this->processor->processWithAmount($payment, 300, 42);
+ }
+
+ /**
+ * The whole check-then-act sequence (RefundHistory lookup + createRefund() call) is also
+ * guarded by ILock, keyed by $refundId: without it, two concurrent calls for the same
+ * $refundId could both pass the RefundHistory check below before either persists one, and
+ * both would go on to call createRefund() — a lock is what actually serializes the two
+ * attempts, a plain check-then-act on its own cannot.
+ */
+ public function testProcessWithAmount_hostedFields_whenLockCannotBeAcquired_throwsUpdateHandlingExceptionWithoutCallingRefundCreator(): void
+ {
+ $this->expectException(UpdateHandlingException::class);
+
+ $payment = $this->buildHostedFieldsPayment(['hosted_fields_payment_id' => 'pay_hf_partial']);
+ $this->lock = $this->createMock(ILock::class);
+ $this->lock->method('acquire')->willReturn(false);
+ $this->processor = new RefundPaymentProcessor(
+ $this->requestStack,
+ $this->logger,
+ $this->translator,
+ $this->refundPaymentRepository,
+ $this->payplugRefundHistoryRepository,
+ $this->apiClientFactory,
+ $this->refundCreator,
+ $this->lock,
+ );
+
+ $this->refundPaymentRepository->expects(self::never())->method('findOneBy');
+ $this->refundCreator->expects(self::never())->method('createRefund');
+ $this->logger->expects(self::once())->method('error');
+
+ $this->processor->processWithAmount($payment, 500, 77);
+ }
+
+ /**
+ * Unlike the legacy flow (which forwards Sylius's own $refundId to the API as a de-facto
+ * idempotency key), UPC's createRefund() has no idempotency-key parameter at all. A retried
+ * delivery of the same RefundPaymentGenerated message (e.g. after a transient failure once
+ * the RefundHistory for this $refundId was already persisted) must not call createRefund()
+ * again — this is the local guard closing that window.
+ */
+ public function testProcessWithAmount_hostedFields_alreadyProcessed_skipsDuplicateRefundCall(): void
+ {
+ $payment = $this->buildHostedFieldsPayment(['hosted_fields_payment_id' => 'pay_hf_partial']);
+ $payment->expects(self::never())->method('setDetails');
+
+ $refundPayment = $this->createMock(RefundPayment::class);
+ $this->refundPaymentRepository->method('findOneBy')->with(['id' => 77])->willReturn($refundPayment);
+
+ $existingRefundHistory = $this->createMock(RefundHistory::class);
+ $this->payplugRefundHistoryRepository
+ ->method('findOneBy')
+ ->with(['refundPayment' => $refundPayment])
+ ->willReturn($existingRefundHistory);
+
+ $this->refundCreator->expects(self::never())->method('createRefund');
+ $this->payplugRefundHistoryRepository->expects(self::never())->method('add');
+
+ $this->processor->processWithAmount($payment, 500, 77);
+ }
+
+ /**
+ * createRefund() returns a 2xx response whose body has no operationIds (malformed/unexpected
+ * shape). The refund still succeeded (money moved) and is still recorded, but with no
+ * tracking id — this must not pass silently, so an error is logged (actionable: without an
+ * operation id, HostedFieldsWebhookNotificationHandler can never match the eventual webhook
+ * confirmation back to this refund).
+ */
+ public function testProcessWithAmount_hostedFields_onMissingOperationIds_logsAnError(): void
+ {
+ $payment = $this->buildHostedFieldsPayment(['hosted_fields_payment_id' => 'pay_hf_partial']);
+
+ $this->refundCreator->method('createRefund')->willReturn(['status' => 200, 'body' => '{}']);
+
+ $refundPayment = $this->createMock(RefundPayment::class);
+ $this->refundPaymentRepository->method('findOneBy')->willReturn($refundPayment);
+ $this->payplugRefundHistoryRepository->method('findOneBy')->willReturn(null);
+
+ $this->logger->expects(self::once())->method('error');
+ $this->payplugRefundHistoryRepository->expects(self::once())->method('add');
+
+ $this->processor->processWithAmount($payment, 500, 77);
+ }
+
+ /**
+ * Two sequential partial refunds against the same Hosted-Fields payment must accumulate in
+ * $details['refunds'] rather than the second call overwriting the first — mirrors the
+ * legacy gateway's own Behat coverage for this exact scenario ("Two Partial refund of one
+ * product"), which UHF otherwise has no equivalent for at any test level.
+ */
+ public function testProcessWithAmount_hostedFields_secondPartialRefund_appendsToExistingRefunds(): void
+ {
+ $existingRefunds = [['internal_id' => 77, 'id' => 'op_ref_1', 'amount' => 500]];
+ $payment = $this->buildHostedFieldsPayment([
+ 'hosted_fields_payment_id' => 'pay_hf_partial',
+ 'refunds' => $existingRefunds,
+ ]);
+ $payment->expects(self::once())->method('setDetails')->with(self::callback(
+ static function (array $details) use ($existingRefunds): bool {
+ return [...$existingRefunds, [
+ 'internal_id' => 78,
+ 'id' => 'op_ref_2',
+ 'amount' => 300,
+ ]] === $details['refunds'];
+ },
+ ));
+
+ $this->refundCreator
+ ->method('createRefund')
+ ->with(self::isInstanceOf(PaymentMethodInterface::class), 'pay_hf_partial', '000000042', 300)
+ ->willReturn(['status' => 200, 'body' => json_encode(['operationIds' => ['op_ref_2']])]);
+
+ $refundPayment = $this->createMock(RefundPayment::class);
+ $this->refundPaymentRepository->method('findOneBy')->with(['id' => 78])->willReturn($refundPayment);
+ $this->payplugRefundHistoryRepository->method('findOneBy')->willReturn(null);
+
+ $this->processor->processWithAmount($payment, 300, 78);
+ }
+
+ /**
+ * prepare() must skip the legacy PayPlugApiClientFactory entirely for a Hosted-Fields
+ * payment — building it would mint an OAuth2 token that's never used.
+ */
+ public function testProcessWithAmount_hostedFields_neverCreatesTheLegacyApiClient(): void
+ {
+ $payment = $this->buildHostedFieldsPayment(['hosted_fields_payment_id' => 'pay_hf_partial']);
+
+ $this->refundCreator->method('createRefund')->willReturn(['status' => 200, 'body' => '{}']);
+ $refundPayment = $this->createMock(RefundPayment::class);
+ $this->refundPaymentRepository->method('findOneBy')->willReturn($refundPayment);
+ $this->payplugRefundHistoryRepository->method('findOneBy')->willReturn(null);
+
+ $this->apiClientFactory->expects(self::never())->method('createForPaymentMethod');
+
+ $this->processor->processWithAmount($payment, 500, 77);
+ }
+
+ /**
+ * When the payment has no order (edge case), orderId falls back to the payment's own id —
+ * same convention CaptureHostedPaymentRequestHandler already uses at creation time.
+ */
+ public function testProcess_hostedFields_withNoOrder_fallsBackToThePaymentIdAsOrderId(): void
+ {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getFactoryName')->willReturn(PayPlugGatewayFactory::FACTORY_NAME);
+ $gatewayConfig->method('getConfig')->willReturn([PayPlugGatewayFactory::HOSTED_FIELDS => true]);
+
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $paymentMethod->method('getGatewayConfig')->willReturn($gatewayConfig);
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getMethod')->willReturn($paymentMethod);
+ $payment->method('getDetails')->willReturn(['hosted_fields_payment_id' => 'pay_hf_no_order']);
+ $payment->method('getOrder')->willReturn(null);
+ $payment->method('getId')->willReturn(99);
+ $payment->method('getAmount')->willReturn(2400);
+
+ $this->refundCreator->expects(self::once())
+ ->method('createRefund')
+ ->with(self::isInstanceOf(PaymentMethodInterface::class), 'pay_hf_no_order', '99', null)
+ ->willReturn(['status' => 200, 'body' => '{}']);
+
+ $this->processor->process($payment);
+ }
+
// -------------------------------------------------------------------------
// Helpers
// -------------------------------------------------------------------------
+ // -------------------------------------------------------------------------
+ // Hosted Fields (UHF) refund without hosted_fields_payment_id → clean refusal
+ // -------------------------------------------------------------------------
+
+ /** @return iterable}> */
+ public static function detailsWithoutAPaymentId(): iterable
+ {
+ yield 'key absent' => [['hosted_fields_operation_id' => 'op_1']];
+ yield 'empty string' => [['hosted_fields_payment_id' => '', 'hosted_fields_operation_id' => 'op_1']];
+ yield 'not a string' => [['hosted_fields_payment_id' => 123, 'hosted_fields_operation_id' => 'op_1']];
+ }
+
+ /** @dataProvider detailsWithoutAPaymentId */
+ public function testProcess_hostedFields_withoutAPaymentId_refusesWithoutTouchingTheApiOrTheLock(
+ array $details,
+ ): void
+ {
+ $lock = $this->createMock(ILock::class);
+ $lock->expects(self::never())->method('acquire');
+ $processor = $this->buildProcessor($this->requestStack, $lock);
+ $payment = $this->buildHostedFieldsPayment($details);
+ $payment->expects(self::never())->method('setDetails');
+
+ $this->refundCreator->expects(self::never())->method('createRefund');
+ $this->logger->expects(self::once())->method('error')->with(
+ self::stringContains('has no hosted_fields_payment_id'),
+ [
+ 'sylius_payment_id' => 42,
+ 'order_number' => '000000042',
+ 'hosted_fields_operation_id' => 'op_1',
+ ],
+ );
+ $this->expectException(UpdateHandlingException::class);
+
+ $processor->process($payment);
+ }
+
+ /** @dataProvider detailsWithoutAPaymentId */
+ public function testProcessWithAmount_hostedFields_withoutAPaymentId_refusesAndRecordsNothing(array $details): void
+ {
+ $lock = $this->createMock(ILock::class);
+ $lock->expects(self::never())->method('acquire');
+ $processor = $this->buildProcessor($this->requestStack, $lock);
+ $payment = $this->buildHostedFieldsPayment($details);
+ $payment->expects(self::never())->method('setDetails');
+
+ $this->refundCreator->expects(self::never())->method('createRefund');
+ $this->payplugRefundHistoryRepository->expects(self::never())->method('add');
+ $this->logger->expects(self::once())->method('error')
+ ->with(self::stringContains('has no hosted_fields_payment_id'), self::anything());
+ $this->expectException(UpdateHandlingException::class);
+
+ $processor->processWithAmount($payment, 500, 77);
+ }
+
+ public function testProcess_hostedFields_withoutAPaymentId_tellsTheAdminWhy(): void
+ {
+ $session = new Session(new MockArraySessionStorage());
+ $request = new Request();
+ $request->setSession($session);
+ $requestStack = new RequestStack();
+ $requestStack->push($request);
+ $this->translator->method('trans')
+ ->with('payplug_sylius_payplug_plugin.ui.payment_refund_missing_payment_id', ['%order%' => '000000042'])
+ ->willReturn('cannot be refunded');
+ $processor = $this->buildProcessor($requestStack, $this->lock);
+
+ try {
+ $processor->process($this->buildHostedFieldsPayment([]));
+ self::fail('Expected UpdateHandlingException.');
+ } catch (UpdateHandlingException) {
+ }
+
+ self::assertSame(['cannot be refunded'], $session->getFlashBag()->get('error'));
+ }
+
+ public function testProcessWithAmount_hostedFields_withoutAPaymentId_tellsTheAdminWhy(): void
+ {
+ $session = new Session(new MockArraySessionStorage());
+ $request = new Request();
+ $request->setSession($session);
+ $requestStack = new RequestStack();
+ $requestStack->push($request);
+ $this->translator->method('trans')->willReturn('cannot be refunded');
+ $processor = $this->buildProcessor($requestStack, $this->lock);
+
+ try {
+ $processor->processWithAmount($this->buildHostedFieldsPayment([]), 500, 77);
+ self::fail('Expected UpdateHandlingException.');
+ } catch (UpdateHandlingException) {
+ }
+
+ self::assertSame(['cannot be refunded'], $session->getFlashBag()->get('error'));
+ }
+
+ public function testProcess_hostedFields_withoutAPaymentIdAndWithoutARequest_stillRefusesCleanly(): void
+ {
+ $processor = $this->buildProcessor(new RequestStack(), $this->lock);
+
+ $this->refundCreator->expects(self::never())->method('createRefund');
+ $this->expectException(UpdateHandlingException::class);
+
+ $processor->process($this->buildHostedFieldsPayment([]));
+ }
+
+ public function testProcess_hostedFields_withoutAPaymentIdAndARequestWithoutASession_stillRefusesCleanly(): void
+ {
+ $requestStack = new RequestStack();
+ $requestStack->push(new Request());
+ $processor = $this->buildProcessor($requestStack, $this->lock);
+
+ $this->refundCreator->expects(self::never())->method('createRefund');
+ $this->expectException(UpdateHandlingException::class);
+
+ $processor->process($this->buildHostedFieldsPayment([]));
+ }
+
+ private function buildProcessor(RequestStack $requestStack, ILock $lock): RefundPaymentProcessor
+ {
+ return new RefundPaymentProcessor(
+ $requestStack,
+ $this->logger,
+ $this->translator,
+ $this->refundPaymentRepository,
+ $this->payplugRefundHistoryRepository,
+ $this->apiClientFactory,
+ $this->refundCreator,
+ $lock,
+ );
+ }
+
private function buildPayment(string $factoryName, array $details): PaymentInterface&MockObject
{
$gatewayConfig = $this->createMock(GatewayConfigInterface::class);
@@ -256,4 +903,26 @@ private function buildPayment(string $factoryName, array $details): PaymentInter
return $payment;
}
+
+ private function buildHostedFieldsPayment(array $details): PaymentInterface&MockObject
+ {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getFactoryName')->willReturn(PayPlugGatewayFactory::FACTORY_NAME);
+ $gatewayConfig->method('getConfig')->willReturn([PayPlugGatewayFactory::HOSTED_FIELDS => true]);
+
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $paymentMethod->method('getGatewayConfig')->willReturn($gatewayConfig);
+
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getNumber')->willReturn('000000042');
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getMethod')->willReturn($paymentMethod);
+ $payment->method('getDetails')->willReturn($details);
+ $payment->method('getOrder')->willReturn($order);
+ $payment->method('getAmount')->willReturn(2400);
+ $payment->method('getId')->willReturn(42);
+
+ return $payment;
+ }
}
diff --git a/tests/PHPUnit/Provider/SupportedMethodsProviderTest.php b/tests/PHPUnit/Provider/SupportedMethodsProviderTest.php
index 6e015ea5..bec3d0e7 100644
--- a/tests/PHPUnit/Provider/SupportedMethodsProviderTest.php
+++ b/tests/PHPUnit/Provider/SupportedMethodsProviderTest.php
@@ -8,9 +8,12 @@
use PayPlug\SyliusPayPlugPlugin\ApiClient\PayPlugApiClientInterface;
use PayPlug\SyliusPayPlugPlugin\Gateway\BancontactGatewayFactory;
use PayPlug\SyliusPayPlugPlugin\Gateway\PayPlugGatewayFactory;
+use PayPlug\SyliusPayPlugPlugin\Gateway\ScalapayGatewayFactory;
use PayPlug\SyliusPayPlugPlugin\Provider\SupportedMethodsProvider;
+use PayPlug\SyliusPayPlugPlugin\Resolver\AccountAmountRangeResolver;
use PHPUnit\Framework\MockObject\MockObject;
use PHPUnit\Framework\TestCase;
+use Psr\Log\NullLogger;
use Sylius\Component\Core\Model\PaymentMethodInterface;
use Sylius\Component\Currency\Context\CurrencyContextInterface;
use Sylius\Component\Payment\Model\GatewayConfigInterface;
@@ -25,15 +28,25 @@ final class SupportedMethodsProviderTest extends TestCase
private SupportedMethodsProvider $provider;
+ /** @var \SplObjectStorage */
+ private \SplObjectStorage $clientsByPaymentMethod;
+
protected function setUp(): void
{
$this->currencyContext = $this->createMock(CurrencyContextInterface::class);
$this->clientFactory = $this->createMock(PayPlugApiClientFactoryInterface::class);
$this->apiClient = $this->createMock(PayPlugApiClientInterface::class);
- $this->clientFactory->method('create')->willReturn($this->apiClient);
+ // Every payment method resolves to the shared client unless a test gives it one of its own
+ // through assignAccount(), which is how a second PayPlug account is modelled.
+ $this->clientsByPaymentMethod = new \SplObjectStorage();
+ $this->clientFactory->method('createForPaymentMethod')->willReturnCallback(
+ fn (object $paymentMethod): PayPlugApiClientInterface => $this->clientsByPaymentMethod->contains($paymentMethod)
+ ? $this->clientsByPaymentMethod[$paymentMethod]
+ : $this->apiClient,
+ );
- $this->provider = new SupportedMethodsProvider($this->currencyContext, $this->clientFactory);
+ $this->provider = new SupportedMethodsProvider($this->currencyContext, $this->clientFactory, new AccountAmountRangeResolver(), new NullLogger());
}
// -------------------------------------------------------------------------
@@ -67,6 +80,9 @@ public function testProvide_withDifferentFactory_doesNotFilter(): void
/**
* The current currency is USD but the method only authorizes EUR.
* Verifies the method is removed from the result list.
+ *
+ * No $paymentCurrencyCode is passed, so this also covers the documented fallback to
+ * CurrencyContextInterface for a payment carrying no currency of its own.
*/
public function testProvide_withUnauthorizedCurrency_removesMethod(): void
{
@@ -80,6 +96,91 @@ public function testProvide_withUnauthorizedCurrency_removesMethod(): void
self::assertEmpty($result);
}
+ /**
+ * The payment's own currency decides, not the one being displayed. Here the shopper browses in
+ * EUR (authorized) while the order was placed in USD (not authorized) — the amount is USD, so
+ * the method must go. Reading the display currency instead would keep a method whose limits
+ * were never checked against the amount's actual currency.
+ */
+ public function testProvide_withPaymentCurrencyUnauthorized_ignoresDisplayCurrency(): void
+ {
+ $this->currencyContext->method('getCurrencyCode')->willReturn('EUR');
+ $this->apiClient->method('getAccount')->willReturn($this->buildAccount(99, 2000000));
+
+ $method = $this->buildPaymentMethod(PayPlugGatewayFactory::FACTORY_NAME);
+
+ $result = $this->provider->provide(
+ [$method],
+ PayPlugGatewayFactory::FACTORY_NAME,
+ 1000,
+ paymentCurrencyCode: 'USD',
+ );
+
+ self::assertEmpty($result);
+ }
+
+ /**
+ * The mirror case, and the one that was mis-filtering before: the order is in EUR (authorized,
+ * amount within bounds) while the shopper has switched the display to USD. The method must be
+ * kept — previously the USD display currency was compared against a EUR-only account and hid a
+ * payment method that would have been charged in EUR.
+ */
+ public function testProvide_withPaymentCurrencyAuthorized_keepsMethodDespiteDisplayCurrency(): void
+ {
+ $this->currencyContext->method('getCurrencyCode')->willReturn('USD');
+ $this->apiClient->method('getAccount')->willReturn($this->buildAccount(99, 2000000));
+
+ $method = $this->buildPaymentMethod(PayPlugGatewayFactory::FACTORY_NAME);
+
+ $result = $this->provider->provide(
+ [$method],
+ PayPlugGatewayFactory::FACTORY_NAME,
+ 1000,
+ paymentCurrencyCode: 'EUR',
+ );
+
+ self::assertCount(1, $result);
+ }
+
+ /**
+ * Same unauthorized-currency setup, but the `payplug` method has Hosted Fields selected.
+ * UHF is exempt from the currency gate because the Retail `/account` payload does not know a
+ * UHF account's currencies (see the comment in SupportedMethodsProvider), so the method must
+ * survive — and, having no advertised limits for USD, must not be amount-filtered either
+ * despite 1000 sitting outside the EUR 99..2000000 range that the payload does advertise.
+ */
+ public function testProvide_withUnauthorizedCurrencyAndHostedFields_keepsMethod(): void
+ {
+ $this->currencyContext->method('getCurrencyCode')->willReturn('USD');
+ $this->apiClient->method('getAccount')->willReturn($this->buildAccount(99, 2000000));
+
+ $method = $this->buildPaymentMethod(PayPlugGatewayFactory::FACTORY_NAME, [
+ PayPlugGatewayFactory::HOSTED_FIELDS => true,
+ ]);
+
+ $result = $this->provider->provide([$method], PayPlugGatewayFactory::FACTORY_NAME, 1000);
+
+ self::assertCount(1, $result);
+ }
+
+ /**
+ * Hosted Fields is exempt from the currency gate, not from the amount limits: when the active
+ * currency *is* advertised, its min/max still apply.
+ */
+ public function testProvide_withAuthorizedCurrencyAndHostedFields_stillAppliesAmountLimits(): void
+ {
+ $this->currencyContext->method('getCurrencyCode')->willReturn('EUR');
+ $this->apiClient->method('getAccount')->willReturn($this->buildAccount(99, 2000000));
+
+ $method = $this->buildPaymentMethod(PayPlugGatewayFactory::FACTORY_NAME, [
+ PayPlugGatewayFactory::HOSTED_FIELDS => true,
+ ]);
+
+ $result = $this->provider->provide([$method], PayPlugGatewayFactory::FACTORY_NAME, 50);
+
+ self::assertEmpty($result);
+ }
+
// -------------------------------------------------------------------------
// provide() — amount below min_amount → method removed
// -------------------------------------------------------------------------
@@ -225,7 +326,7 @@ public function testProvide_withAllowedCountry_keepsMethod(): void
$this->apiClient->method('getAccount')->willReturn($account);
$method = $this->buildPaymentMethod('payplug_scalapay');
- $result = $this->provider->provide([$method], 'payplug_scalapay', 1000, 'FR');
+ $result = $this->provider->provide([$method], 'payplug_scalapay', 1000, billingCountryCode: 'FR');
self::assertCount(1, $result);
}
@@ -243,7 +344,7 @@ public function testProvide_withDisallowedCountry_removesMethod(): void
$this->apiClient->method('getAccount')->willReturn($account);
$method = $this->buildPaymentMethod('payplug_scalapay');
- $result = $this->provider->provide([$method], 'payplug_scalapay', 1000, 'US');
+ $result = $this->provider->provide([$method], 'payplug_scalapay', 1000, billingCountryCode: 'US');
self::assertEmpty($result);
}
@@ -261,7 +362,7 @@ public function testProvide_withAllowedCountriesAll_keepsMethod(): void
$this->apiClient->method('getAccount')->willReturn($account);
$method = $this->buildPaymentMethod('payplug_bancontact');
- $result = $this->provider->provide([$method], 'payplug_bancontact', 1000, 'US');
+ $result = $this->provider->provide([$method], 'payplug_bancontact', 1000, billingCountryCode: 'US');
self::assertCount(1, $result);
}
@@ -279,7 +380,7 @@ public function testProvide_withNullBillingCountry_keepsMethod(): void
$this->apiClient->method('getAccount')->willReturn($account);
$method = $this->buildPaymentMethod('payplug_scalapay');
- $result = $this->provider->provide([$method], 'payplug_scalapay', 1000, null);
+ $result = $this->provider->provide([$method], 'payplug_scalapay', 1000, billingCountryCode: null);
self::assertCount(1, $result);
}
@@ -359,6 +460,199 @@ public function testProvide_fallsBackToConfigurationAmounts(): void
self::assertEmpty($result2);
}
+ // -------------------------------------------------------------------------
+ // provide() — merchant-configured min/max override the API bounds
+ // -------------------------------------------------------------------------
+
+ /**
+ * The gateway config sets a min_amount (1000) tighter than the API min (99).
+ * Verifies amounts below the merchant's min are removed, and the merchant's own min boundary is kept.
+ */
+ public function testProvide_withMerchantConfiguredMinAmount_overridesApiMin(): void
+ {
+ $this->currencyContext->method('getCurrencyCode')->willReturn('EUR');
+ $this->apiClient->method('getAccount')->willReturn($this->buildAccount(99, 2000000));
+
+ $method = $this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME, ['min_amount' => 1000]);
+
+ $result = $this->provider->provide([$method], ScalapayGatewayFactory::FACTORY_NAME, 500);
+ self::assertEmpty($result);
+
+ $result2 = $this->provider->provide([$method], ScalapayGatewayFactory::FACTORY_NAME, 1000);
+ self::assertCount(1, $result2);
+ }
+
+ /**
+ * The gateway config sets a max_amount (100000) tighter than the API max (2000000).
+ * Verifies amounts above the merchant's max are removed, and the merchant's own max boundary is kept.
+ */
+ public function testProvide_withMerchantConfiguredMaxAmount_overridesApiMax(): void
+ {
+ $this->currencyContext->method('getCurrencyCode')->willReturn('EUR');
+ $this->apiClient->method('getAccount')->willReturn($this->buildAccount(99, 2000000));
+
+ $method = $this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME, ['max_amount' => 100000]);
+
+ $result = $this->provider->provide([$method], ScalapayGatewayFactory::FACTORY_NAME, 150000);
+ self::assertEmpty($result);
+
+ $result2 = $this->provider->provide([$method], ScalapayGatewayFactory::FACTORY_NAME, 100000);
+ self::assertCount(1, $result2);
+ }
+
+ /**
+ * No min_amount/max_amount set in the gateway config (merchant left the fields blank).
+ * Verifies the API bounds alone still apply, unchanged from today's behavior.
+ */
+ public function testProvide_withoutMerchantConfiguredAmounts_fallsBackToApiBoundsOnly(): void
+ {
+ $this->currencyContext->method('getCurrencyCode')->willReturn('EUR');
+ $this->apiClient->method('getAccount')->willReturn($this->buildAccount(99, 2000000));
+
+ $method = $this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME, []);
+
+ $result = $this->provider->provide([$method], ScalapayGatewayFactory::FACTORY_NAME, 50);
+ self::assertEmpty($result);
+
+ $result2 = $this->provider->provide([$method], ScalapayGatewayFactory::FACTORY_NAME, 99);
+ self::assertCount(1, $result2);
+ }
+
+ /**
+ * The merchant's min_amount/max_amount override is entered as EUR (MoneyType field), but
+ * checkout is happening in USD. The EUR-denominated override must not be applied to a
+ * USD amount — only the API's own per-currency bounds apply.
+ */
+ public function testProvide_merchantConfiguredAmountsIgnoredForNonEurCurrency(): void
+ {
+ $this->currencyContext->method('getCurrencyCode')->willReturn('USD');
+
+ $account = [
+ 'configuration' => [
+ 'min_amounts' => ['USD' => 100],
+ 'max_amounts' => ['USD' => 200000],
+ ],
+ 'payment_methods' => [],
+ ];
+ $this->apiClient->method('getAccount')->willReturn($account);
+
+ // If wrongly applied to USD, this EUR-denominated max_amount would exclude the payment.
+ $method = $this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME, ['max_amount' => 300]);
+
+ $result = $this->provider->provide([$method], ScalapayGatewayFactory::FACTORY_NAME, 150000);
+ self::assertCount(1, $result);
+ }
+
+ /**
+ * The min_amount/max_amount keys are Scalapay's own: only IsScalapayAmountRangeValidValidator
+ * keeps them inside the API-authorized range at save time, and it is wired for Scalapay only.
+ * Another gateway carrying the same keys must therefore be left on the raw API bounds rather
+ * than granted an unvalidated checkout override.
+ */
+ public function testProvide_merchantConfiguredAmountsIgnoredForNonScalapayGateway(): void
+ {
+ $this->currencyContext->method('getCurrencyCode')->willReturn('EUR');
+ $this->apiClient->method('getAccount')->willReturn($this->buildAccount(99, 2000000));
+
+ // If wrongly honored, this max_amount would exclude the payment below.
+ $method = $this->buildPaymentMethod(PayPlugGatewayFactory::FACTORY_NAME, ['min_amount' => 1000, 'max_amount' => 300]);
+
+ $result = $this->provider->provide([$method], PayPlugGatewayFactory::FACTORY_NAME, 150000);
+ self::assertCount(1, $result);
+ }
+
+ /**
+ * The gateway config is a plain serialized array, so a direct DB edit or an import script can
+ * leave a non-int in it. provide() runs on every checkout page with no surrounding try/catch:
+ * a malformed override must degrade to the API bounds, not throw and break payment-method
+ * resolution for the whole checkout.
+ */
+ public function testProvide_withMalformedMerchantConfiguredAmounts_fallsBackToApiBounds(): void
+ {
+ $this->currencyContext->method('getCurrencyCode')->willReturn('EUR');
+ $this->apiClient->method('getAccount')->willReturn($this->buildAccount(99, 2000000));
+
+ $method = $this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME, ['min_amount' => '1000', 'max_amount' => 'nonsense']);
+
+ // API bounds are 99–2000000: an in-range amount is kept, an out-of-range one still removed.
+ $result = $this->provider->provide([$method], ScalapayGatewayFactory::FACTORY_NAME, 150000);
+ self::assertCount(1, $result);
+
+ $result2 = $this->provider->provide([$method], ScalapayGatewayFactory::FACTORY_NAME, 50);
+ self::assertEmpty($result2);
+ }
+
+ // -------------------------------------------------------------------------
+ // provide() — one account per gateway config, not one per call
+ // -------------------------------------------------------------------------
+
+ /**
+ * Two enabled methods of the same factory sitting on different PayPlug accounts: the account
+ * resolved for the first must not decide the fate of the second. Here the first authorizes EUR
+ * and the second only USD, so an EUR checkout keeps the first and drops the second — sharing
+ * one lookup across the loop kept both.
+ */
+ public function testProvide_withMethodsOnDifferentAccounts_filtersEachAgainstItsOwnCurrencies(): void
+ {
+ $this->currencyContext->method('getCurrencyCode')->willReturn('EUR');
+
+ $eurMethod = $this->buildPaymentMethod(PayPlugGatewayFactory::FACTORY_NAME, configId: 1);
+ $usdMethod = $this->buildPaymentMethod(PayPlugGatewayFactory::FACTORY_NAME, configId: 2);
+
+ $this->assignAccount($eurMethod, $this->buildAccount(99, 2000000));
+ $this->assignAccount($usdMethod, [
+ 'configuration' => ['min_amounts' => ['USD' => 99], 'max_amounts' => ['USD' => 2000000]],
+ 'payment_methods' => [],
+ ]);
+
+ $result = $this->provider->provide([$eurMethod, $usdMethod], PayPlugGatewayFactory::FACTORY_NAME, 1000);
+
+ self::assertCount(1, $result);
+ self::assertSame($eurMethod, reset($result));
+ }
+
+ /**
+ * Same split, for the billing-country gate: each method is checked against its own account's
+ * allowed_countries.
+ */
+ public function testProvide_withMethodsOnDifferentAccounts_filtersEachAgainstItsOwnAllowedCountries(): void
+ {
+ $this->currencyContext->method('getCurrencyCode')->willReturn('EUR');
+
+ $frMethod = $this->buildPaymentMethod('payplug_scalapay', configId: 1);
+ $deMethod = $this->buildPaymentMethod('payplug_scalapay', configId: 2);
+
+ $this->assignAccount($frMethod, $this->buildScalapayAccount(['FR']));
+ $this->assignAccount($deMethod, $this->buildScalapayAccount(['DE']));
+
+ $result = $this->provider->provide([$frMethod, $deMethod], 'payplug_scalapay', 1000, billingCountryCode: 'FR');
+
+ self::assertCount(1, $result);
+ self::assertSame($frMethod, reset($result));
+ }
+
+ /**
+ * The per-account lookup must stay memoized: two methods sharing one gateway config hit the
+ * `/account` endpoint once between them, not once each.
+ */
+ public function testProvide_withMethodsSharingOneGatewayConfig_readsThatAccountOnce(): void
+ {
+ $this->currencyContext->method('getCurrencyCode')->willReturn('EUR');
+
+ $gatewayConfig = $this->buildGatewayConfig(PayPlugGatewayFactory::FACTORY_NAME, [], 1);
+ $first = $this->buildPaymentMethodFor($gatewayConfig);
+ $second = $this->buildPaymentMethodFor($gatewayConfig);
+
+ $client = $this->createMock(PayPlugApiClientInterface::class);
+ $client->expects(self::once())->method('getAccount')->willReturn($this->buildAccount(99, 2000000));
+ $this->clientsByPaymentMethod[$first] = $client;
+ $this->clientsByPaymentMethod[$second] = $client;
+
+ $result = $this->provider->provide([$first, $second], PayPlugGatewayFactory::FACTORY_NAME, 1000);
+
+ self::assertCount(2, $result);
+ }
+
// -------------------------------------------------------------------------
// Helpers
// -------------------------------------------------------------------------
@@ -374,14 +668,69 @@ private function buildAccount(int $minAmount, int $maxAmount): array
];
}
- private function buildPaymentMethod(string $factoryName): PaymentMethodInterface
+ /**
+ * @param list $allowedCountries
+ */
+ private function buildScalapayAccount(array $allowedCountries): array
+ {
+ return [
+ 'configuration' => ['min_amounts' => ['EUR' => 30], 'max_amounts' => ['EUR' => 2000000]],
+ 'payment_methods' => ['scalapay' => [
+ 'min_amounts' => ['EUR' => 500],
+ 'max_amounts' => ['EUR' => 200000],
+ 'allowed_countries' => $allowedCountries,
+ ]],
+ ];
+ }
+
+ /**
+ * @param array $config Persisted gateway config; defaults to empty, which is
+ * neither integrated_payment nor hosted_fields.
+ */
+ private function buildPaymentMethod(
+ string $factoryName,
+ array $config = [],
+ int|string|null $configId = null,
+ ): PaymentMethodInterface
+ {
+ return $this->buildPaymentMethodFor($this->buildGatewayConfig($factoryName, $config, $configId));
+ }
+
+ /**
+ * @param array $config
+ */
+ private function buildGatewayConfig(
+ string $factoryName,
+ array $config = [],
+ int|string|null $configId = null,
+ ): GatewayConfigInterface
{
$gatewayConfig = $this->createMock(GatewayConfigInterface::class);
$gatewayConfig->method('getFactoryName')->willReturn($factoryName);
+ $gatewayConfig->method('getConfig')->willReturn($config);
+ $gatewayConfig->method('getId')->willReturn($configId);
+ return $gatewayConfig;
+ }
+
+ private function buildPaymentMethodFor(GatewayConfigInterface $gatewayConfig): PaymentMethodInterface
+ {
$method = $this->createMock(PaymentMethodInterface::class);
$method->method('getGatewayConfig')->willReturn($gatewayConfig);
return $method;
}
+
+ /**
+ * Puts $paymentMethod on a PayPlug account of its own, as a second configured gateway would be.
+ *
+ * @param array $account
+ */
+ private function assignAccount(PaymentMethodInterface $paymentMethod, array $account): void
+ {
+ $client = $this->createMock(PayPlugApiClientInterface::class);
+ $client->method('getAccount')->willReturn($account);
+
+ $this->clientsByPaymentMethod[$paymentMethod] = $client;
+ }
}
diff --git a/tests/PHPUnit/Resolver/AccountAmountRangeResolverTest.php b/tests/PHPUnit/Resolver/AccountAmountRangeResolverTest.php
new file mode 100644
index 00000000..31dc7520
--- /dev/null
+++ b/tests/PHPUnit/Resolver/AccountAmountRangeResolverTest.php
@@ -0,0 +1,120 @@
+resolver = new AccountAmountRangeResolver();
+ }
+
+ public function testResolve_withoutPaymentMethodKey_usesConfigurationDefaults(): void
+ {
+ $account = [
+ 'configuration' => [
+ 'min_amounts' => ['EUR' => 100, 'USD' => 200],
+ 'max_amounts' => ['EUR' => 100000, 'USD' => 200000],
+ ],
+ ];
+
+ $result = $this->resolver->resolve($account, null);
+
+ self::assertSame([
+ 'EUR' => ['min_amount' => 100, 'max_amount' => 100000],
+ 'USD' => ['min_amount' => 200, 'max_amount' => 200000],
+ ], $result);
+ }
+
+ public function testResolve_withPaymentMethodOverride_usesOverrideInsteadOfDefaults(): void
+ {
+ $account = [
+ 'configuration' => [
+ 'min_amounts' => ['EUR' => 30],
+ 'max_amounts' => ['EUR' => 2000000],
+ ],
+ 'payment_methods' => [
+ 'scalapay' => [
+ 'min_amounts' => ['EUR' => 500],
+ 'max_amounts' => ['EUR' => 200000],
+ ],
+ ],
+ ];
+
+ $result = $this->resolver->resolve($account, 'scalapay');
+
+ self::assertSame(['EUR' => ['min_amount' => 500, 'max_amount' => 200000]], $result);
+ }
+
+ public function testResolve_withPaymentMethodKeyButNoOverride_fallsBackToConfigurationDefaults(): void
+ {
+ $account = [
+ 'configuration' => [
+ 'min_amounts' => ['EUR' => 30],
+ 'max_amounts' => ['EUR' => 2000000],
+ ],
+ 'payment_methods' => [
+ 'apple_pay' => [
+ 'enabled' => true,
+ // no min_amounts / max_amounts
+ ],
+ ],
+ ];
+
+ $result = $this->resolver->resolve($account, 'apple_pay');
+
+ self::assertSame(['EUR' => ['min_amount' => 30, 'max_amount' => 2000000]], $result);
+ }
+
+ /**
+ * The per-payment-method override is present but the wrong shape (a string, not an array).
+ * Verifies this degrades gracefully to the configuration defaults instead of blowing up on
+ * a malformed API response — this is the divergence the two original, independent
+ * implementations of this parsing logic used to disagree on.
+ */
+ public function testResolve_withMalformedOverride_fallsBackToConfigurationDefaults(): void
+ {
+ $account = [
+ 'configuration' => [
+ 'min_amounts' => ['EUR' => 30],
+ 'max_amounts' => ['EUR' => 2000000],
+ ],
+ 'payment_methods' => [
+ 'scalapay' => [
+ 'min_amounts' => 'not-an-array',
+ 'max_amounts' => 'not-an-array',
+ ],
+ ],
+ ];
+
+ $result = $this->resolver->resolve($account, 'scalapay');
+
+ self::assertSame(['EUR' => ['min_amount' => 30, 'max_amount' => 2000000]], $result);
+ }
+
+ public function testResolve_currencyMissingFromMaxAmounts_isExcluded(): void
+ {
+ $account = [
+ 'configuration' => [
+ 'min_amounts' => ['EUR' => 100, 'USD' => 200],
+ 'max_amounts' => ['EUR' => 100000],
+ ],
+ ];
+
+ $result = $this->resolver->resolve($account, null);
+
+ self::assertSame(['EUR' => ['min_amount' => 100, 'max_amount' => 100000]], $result);
+ }
+
+ public function testResolve_missingConfiguration_returnsEmptyArray(): void
+ {
+ self::assertSame([], $this->resolver->resolve([], null));
+ }
+}
diff --git a/tests/PHPUnit/Resolver/SelectedCardResolverTest.php b/tests/PHPUnit/Resolver/SelectedCardResolverTest.php
new file mode 100644
index 00000000..b5e49250
--- /dev/null
+++ b/tests/PHPUnit/Resolver/SelectedCardResolverTest.php
@@ -0,0 +1,67 @@
+setSession(new Session(new MockArraySessionStorage()));
+
+ $this->requestStack = new RequestStack();
+ $this->requestStack->push($request);
+ $this->payplugCardRepository = $this->createMock(RepositoryInterface::class);
+
+ $this->resolver = new SelectedCardResolver($this->requestStack, $this->payplugCardRepository);
+ }
+
+ public function testResolve_withNoCardIdInSession_returnsNull(): void
+ {
+ self::assertNull($this->resolver->resolve());
+ }
+
+ public function testResolve_withOtherCardSentinelSelected_returnsNull(): void
+ {
+ $this->requestStack->getSession()->set('payplug_payment_method', 'other');
+
+ self::assertNull($this->resolver->resolve());
+ }
+
+ public function testResolve_withSelectedCardIdFound_returnsTheCard(): void
+ {
+ $card = new Card();
+ $this->requestStack->getSession()->set('payplug_payment_method', self::SELECTED_CARD_ID);
+ $this->payplugCardRepository->method('find')->with(self::SELECTED_CARD_ID)->willReturn($card);
+
+ self::assertSame($card, $this->resolver->resolve());
+ }
+
+ public function testResolve_withSelectedCardIdNoLongerFound_returnsNull(): void
+ {
+ $this->requestStack->getSession()->set('payplug_payment_method', self::SELECTED_CARD_ID);
+ $this->payplugCardRepository->method('find')->with(self::SELECTED_CARD_ID)->willReturn(null);
+
+ self::assertNull($this->resolver->resolve());
+ }
+}
diff --git a/tests/PHPUnit/Support/FakePayplugHttpRequest.php b/tests/PHPUnit/Support/FakePayplugHttpRequest.php
new file mode 100644
index 00000000..57e7d955
--- /dev/null
+++ b/tests/PHPUnit/Support/FakePayplugHttpRequest.php
@@ -0,0 +1,68 @@
+ */
+ private array $bodies;
+
+ private int $callCount = 0;
+
+ /**
+ * @param list $bodies raw response bodies, in the order the SDK will request them
+ */
+ public function __construct(array $bodies, private int $httpStatus = 200)
+ {
+ $this->bodies = [] === $bodies ? ['{}'] : $bodies;
+ }
+
+ public function setopt($option, $value)
+ {
+ return true;
+ }
+
+ public function exec()
+ {
+ $body = $this->bodies[$this->callCount] ?? $this->bodies[\count($this->bodies) - 1];
+ ++$this->callCount;
+
+ return $body;
+ }
+
+ public function getinfo($option)
+ {
+ return $this->httpStatus;
+ }
+
+ public function close()
+ {
+ }
+
+ public function error()
+ {
+ return '';
+ }
+
+ public function errno()
+ {
+ return 0;
+ }
+
+ public function callCount(): int
+ {
+ return $this->callCount;
+ }
+}
diff --git a/tests/PHPUnit/Twig/AuthorizationExtensionTest.php b/tests/PHPUnit/Twig/AuthorizationExtensionTest.php
new file mode 100644
index 00000000..fac0699a
--- /dev/null
+++ b/tests/PHPUnit/Twig/AuthorizationExtensionTest.php
@@ -0,0 +1,99 @@
+
+ */
+ public static function inputNotations(): iterable
+ {
+ yield 'EUR' => ['EUR', '1234.56'];
+ yield 'USD' => ['USD', '1234.56'];
+ // A typed amount would be refused in these currencies, so no placeholder suggests one.
+ yield 'zero-decimal JPY' => ['JPY', ''];
+ yield 'three-decimal KWD' => ['KWD', ''];
+ yield 'empty currency' => ['', ''];
+ yield 'malformed currency' => ['EU', ''];
+ }
+
+ /**
+ * @dataProvider inputNotations
+ */
+ public function testDescribe_exposesTheRemainingAmountInTheNotationTheAmountFieldsAccept(
+ string $currency,
+ string $expected,
+ ): void
+ {
+ $description = $this->extension()->describe($this->authorizedPayment(123456, $currency));
+
+ self::assertNotNull($description);
+ self::assertSame($expected, $description['remaining_amount_input']);
+ self::assertSame(123456, $description['remaining_amount']);
+ }
+
+ private function extension(): AuthorizationExtension
+ {
+ $clock = new MockClock('2026-09-24T10:00:00+00:00');
+
+ return new AuthorizationExtension(
+ new AuthorizedPaymentOperationProcessor(
+ $this->createMock(AuthorizationOperatorInterface::class),
+ $this->createMock(ILock::class),
+ $this->createMock(EntityManagerInterface::class),
+ $this->createMock(StateMachineInterface::class),
+ $clock,
+ $this->createMock(LoggerInterface::class),
+ ),
+ $clock,
+ );
+ }
+
+ private function authorizedPayment(int $amount, string $currency): Payment
+ {
+ $gatewayConfig = new GatewayConfig();
+ $gatewayConfig->setFactoryName(PayPlugGatewayFactory::FACTORY_NAME);
+ $gatewayConfig->setConfig([
+ PayPlugGatewayFactory::HOSTED_FIELDS => true,
+ PayPlugGatewayFactory::HF_IDENTIFIER => 'acct_1',
+ PayPlugGatewayFactory::DEFERRED_CAPTURE => true,
+ ]);
+ $method = new PaymentMethod();
+ $method->setGatewayConfig($gatewayConfig);
+
+ $payment = new Payment();
+ $payment->setOrder(new Order());
+ $payment->setMethod($method);
+ $payment->setAmount($amount);
+ $payment->setCurrencyCode($currency);
+ $payment->setState(PaymentInterface::STATE_AUTHORIZED);
+ $payment->setDetails(AuthorizationDetails::open(
+ ['hosted_fields_payment_id' => 'pay_1'],
+ new PaymentOutput(201, '{}', null, null, null, '2026-09-30T10:00:00+00:00', $amount),
+ $amount,
+ ));
+
+ return $payment;
+ }
+}
diff --git a/tests/PHPUnit/Twig/PayPlugExtensionTest.php b/tests/PHPUnit/Twig/PayPlugExtensionTest.php
new file mode 100644
index 00000000..703c5089
--- /dev/null
+++ b/tests/PHPUnit/Twig/PayPlugExtensionTest.php
@@ -0,0 +1,72 @@
+canSaveCardChecker = $this->createMock(CanSaveCardCheckerInterface::class);
+ $this->apiClientFactory = $this->createMock(PayPlugApiClientFactoryInterface::class);
+
+ $this->extension = new PayPlugExtension(
+ $this->canSaveCardChecker,
+ $this->apiClientFactory,
+ 'https://sdk.example.test/hosted-fields.min.js',
+ );
+ }
+
+ public function testHostedFieldsSdkUrl_returnsTheConfiguredUrl(): void
+ {
+ self::assertSame('https://sdk.example.test/hosted-fields.min.js', $this->extension->hostedFieldsSdkUrl());
+ }
+
+ public function testGetFunctions_registersThePayplugHostedFieldsSdkUrlFunction(): void
+ {
+ $functions = [];
+ foreach ($this->extension->getFunctions() as $function) {
+ $functions[$function->getName()] = $function;
+ }
+
+ self::assertArrayHasKey('payplug_hosted_fields_sdk_url', $functions);
+ $callable = $functions['payplug_hosted_fields_sdk_url']->getCallable();
+ self::assertIsCallable($callable);
+ self::assertSame('https://sdk.example.test/hosted-fields.min.js', $callable());
+ }
+
+ public function testHostedFieldsCompanyId_returnsCompanyIdFromAccount(): void
+ {
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $apiClient = $this->createMock(PayPlugApiClientInterface::class);
+ $apiClient->method('getAccount')->willReturn(['company_ref' => 'cmp_abc123']);
+ $this->apiClientFactory->method('createForPaymentMethod')->with($paymentMethod)->willReturn($apiClient);
+
+ self::assertSame('cmp_abc123', $this->extension->hostedFieldsCompanyId($paymentMethod));
+ }
+
+ public function testHostedFieldsCompanyId_missingCompanyIdKey_returnsEmptyString(): void
+ {
+ $paymentMethod = $this->createMock(PaymentMethodInterface::class);
+ $apiClient = $this->createMock(PayPlugApiClientInterface::class);
+ $apiClient->method('getAccount')->willReturn([]);
+ $this->apiClientFactory->method('createForPaymentMethod')->with($paymentMethod)->willReturn($apiClient);
+
+ self::assertSame('', $this->extension->hostedFieldsCompanyId($paymentMethod));
+ }
+}
diff --git a/tests/PHPUnit/Upc/AuthorizationDetailsTest.php b/tests/PHPUnit/Upc/AuthorizationDetailsTest.php
new file mode 100644
index 00000000..21371de9
--- /dev/null
+++ b/tests/PHPUnit/Upc/AuthorizationDetailsTest.php
@@ -0,0 +1,110 @@
+ 'pay_1'], $output, 1000);
+ $authorization = AuthorizationDetails::fromDetails($details);
+
+ self::assertSame('pay_1', $details['hosted_fields_payment_id']);
+ self::assertTrue($authorization->isDeferred());
+ // The response's amount wins over the Sylius one: the issuer may authorize less.
+ self::assertSame(900, $authorization->authorizedAmount());
+ self::assertSame(900, $authorization->remainingAmount());
+ self::assertEquals(new \DateTimeImmutable('2026-10-01T12:00:00+00:00'), $authorization->maxCaptureDate());
+ self::assertSame(0, $authorization->version());
+ }
+
+ public function testOpen_fallsBackToThePaymentAmountWhenTheResponseCarriesNone(): void
+ {
+ // A 3DS-pending response: the authorization isn't granted yet, so it carries no amount.
+ $output = new PaymentOutput(201, '{}', null, '', null);
+
+ $authorization = AuthorizationDetails::fromDetails(AuthorizationDetails::open([], $output, 1000));
+
+ self::assertSame(1000, $authorization->authorizedAmount());
+ self::assertNull($authorization->maxCaptureDate());
+ }
+
+ public function testRemainingAmount_subtractsCapturesAndCancellationsButNotFailedOnes(): void
+ {
+ $details = $this->openedDetails(1000);
+ $details = AuthorizationDetails::withOperation($details, AuthorizationDetails::OPERATION_CAPTURE, 'op_c1', 300);
+ $details = AuthorizationDetails::withOperation($details, AuthorizationDetails::OPERATION_CAPTURE, 'op_c2', 200);
+ $details = AuthorizationDetails::withOperation($details, AuthorizationDetails::OPERATION_CANCELLATION, 'op_v1', 100);
+ $details = AuthorizationDetails::withOperationFailed($details, AuthorizationDetails::OPERATION_CAPTURE, 'op_c2');
+
+ $authorization = AuthorizationDetails::fromDetails($details);
+
+ self::assertSame(300, $authorization->capturedAmount());
+ self::assertSame(100, $authorization->cancelledAmount());
+ self::assertSame(600, $authorization->remainingAmount());
+ self::assertTrue($authorization->hasCaptures());
+ // A failed operation still counts toward the version: it was attempted, and a form built
+ // before it is stale either way.
+ self::assertSame(3, $authorization->version());
+ }
+
+ public function testFindOperation_tellsCapturesAndCancellationsApart(): void
+ {
+ $details = $this->openedDetails(1000);
+ $details = AuthorizationDetails::withOperation($details, AuthorizationDetails::OPERATION_CAPTURE, 'op_c1', 300);
+ $details = AuthorizationDetails::withOperation($details, AuthorizationDetails::OPERATION_CANCELLATION, 'op_v1', 100);
+
+ $authorization = AuthorizationDetails::fromDetails($details);
+
+ self::assertSame(['operation' => 'capture', 'amount' => 300], $authorization->findOperation('op_c1'));
+ self::assertSame(['operation' => 'cancellation', 'amount' => 100], $authorization->findOperation('op_v1'));
+ self::assertNull($authorization->findOperation('op_unknown'));
+ }
+
+ public function testResolveCreationOutcome_readsSuccessAsAuthorizedOnlyForADeferredPayment(): void
+ {
+ $deferred = AuthorizationDetails::fromDetails($this->openedDetails(1000));
+ $immediate = AuthorizationDetails::fromDetails([]);
+
+ self::assertSame(PaymentOutcome::AUTHORIZED, $deferred->resolveCreationOutcome(PaymentOutcome::PAID));
+ self::assertSame(PaymentOutcome::FAILED, $deferred->resolveCreationOutcome(PaymentOutcome::FAILED));
+ self::assertSame(PaymentOutcome::PAID, $immediate->resolveCreationOutcome(PaymentOutcome::PAID));
+ }
+
+ public function testExpiry_isComputedAgainstTheDeadline(): void
+ {
+ $details = [...$this->openedDetails(1000), AuthorizationDetails::MAX_CAPTURE_DATE => '2026-10-01T12:00:00+00:00'];
+ $authorization = AuthorizationDetails::fromDetails($details);
+
+ self::assertFalse($authorization->isExpired(new \DateTimeImmutable('2026-09-25T12:00:00+00:00')));
+ self::assertFalse($authorization->isExpiringSoon(new \DateTimeImmutable('2026-09-25T12:00:00+00:00')));
+ self::assertTrue($authorization->isExpiringSoon(new \DateTimeImmutable('2026-09-30T13:00:00+00:00')));
+ self::assertTrue($authorization->isExpired(new \DateTimeImmutable('2026-10-01T12:00:00+00:00')));
+ self::assertFalse($authorization->isExpiringSoon(new \DateTimeImmutable('2026-10-02T00:00:00+00:00')));
+ }
+
+ public function testExpiry_isNeverAssumedWithoutAKnownDeadline(): void
+ {
+ $authorization = AuthorizationDetails::fromDetails($this->openedDetails(1000));
+
+ self::assertFalse($authorization->isExpired(new \DateTimeImmutable('2100-01-01')));
+ self::assertFalse($authorization->isExpiringSoon(new \DateTimeImmutable('2100-01-01')));
+ }
+
+ /**
+ * @return mixed[]
+ */
+ private function openedDetails(int $amount): array
+ {
+ return AuthorizationDetails::open([], new PaymentOutput(201, '{}', null, null, null, null, $amount), $amount);
+ }
+}
diff --git a/tests/PHPUnit/Upc/AuthorizationWebhookBodyTest.php b/tests/PHPUnit/Upc/AuthorizationWebhookBodyTest.php
new file mode 100644
index 00000000..ce6b9329
--- /dev/null
+++ b/tests/PHPUnit/Upc/AuthorizationWebhookBodyTest.php
@@ -0,0 +1,25 @@
+ 1], AuthorizationWebhookBody::withMaxCaptureDate(['a' => 1], 'not json'));
+ }
+}
diff --git a/tests/PHPUnit/Upc/CardDataFromPaymentMethodExtractorTest.php b/tests/PHPUnit/Upc/CardDataFromPaymentMethodExtractorTest.php
new file mode 100644
index 00000000..bb6208f2
--- /dev/null
+++ b/tests/PHPUnit/Upc/CardDataFromPaymentMethodExtractorTest.php
@@ -0,0 +1,182 @@
+ [
+ 'id' => 'card_xxx',
+ 'card' => [
+ 'network' => 'VISA',
+ 'code6x4' => '424242XXXXXX4242',
+ ],
+ 'details' => [
+ 'selectedBrand' => 'VISA',
+ 'validityDate' => '2027-12',
+ ],
+ ],
+ ]);
+
+ self::assertSame([
+ 'aliasId' => 'card_xxx',
+ 'brand' => 'VISA',
+ 'last4' => '4242',
+ 'expirationYear' => 2027,
+ 'expirationMonth' => 12,
+ ], CardDataFromPaymentMethodExtractor::extract($body));
+ }
+
+ public function testExtract_whenCardNetworkAndDetailsSelectedBrandDisagree_cardNetworkWins(): void
+ {
+ $body = json_encode([
+ 'paymentMethod' => [
+ 'card' => ['network' => 'VISA'],
+ 'details' => ['selectedBrand' => 'MASTERCARD'],
+ ],
+ ]);
+
+ self::assertSame(['brand' => 'VISA'], CardDataFromPaymentMethodExtractor::extract($body));
+ }
+
+ public function testExtract_withNoCardNetwork_fallsBackToDetailsSelectedBrand(): void
+ {
+ $body = json_encode([
+ 'paymentMethod' => [
+ 'card' => ['code6x4' => '424242XXXXXX4242'],
+ 'details' => ['selectedBrand' => 'MASTERCARD'],
+ ],
+ ]);
+
+ $result = CardDataFromPaymentMethodExtractor::extract($body);
+
+ self::assertSame('MASTERCARD', $result['brand']);
+ }
+
+ public function testExtract_withNonArrayBody_returnsEmptyArray(): void
+ {
+ self::assertSame([], CardDataFromPaymentMethodExtractor::extract('"just a string"'));
+ }
+
+ public function testExtract_withPaymentMethodKeyMissing_returnsEmptyArray(): void
+ {
+ self::assertSame([], CardDataFromPaymentMethodExtractor::extract(json_encode(['id' => 'op_1'])));
+ }
+
+ public function testExtract_withCardKeyMissing_returnsOnlyAliasId(): void
+ {
+ $body = json_encode(['paymentMethod' => ['id' => 'card_xxx', 'details' => ['selectedBrand' => 'VISA']]]);
+
+ self::assertSame(['aliasId' => 'card_xxx', 'brand' => 'VISA'], CardDataFromPaymentMethodExtractor::extract($body));
+ }
+
+ public function testExtract_withDetailsKeyMissing_returnsOnlyCardFields(): void
+ {
+ $body = json_encode(['paymentMethod' => ['card' => ['network' => 'VISA']]]);
+
+ self::assertSame(['brand' => 'VISA'], CardDataFromPaymentMethodExtractor::extract($body));
+ }
+
+ public function testExtract_withEmptyAliasId_omitsAliasId(): void
+ {
+ $body = json_encode(['paymentMethod' => ['id' => '']]);
+
+ self::assertSame([], CardDataFromPaymentMethodExtractor::extract($body));
+ }
+
+ public function testExtract_withCode6x4ShorterThanFourCharacters_omitsLast4(): void
+ {
+ $body = json_encode(['paymentMethod' => ['card' => ['code6x4' => '42']]]);
+
+ self::assertSame([], CardDataFromPaymentMethodExtractor::extract($body));
+ }
+
+ public function testExtract_withValidityDateNotMatchingTheExpectedFormat_omitsExpiration(): void
+ {
+ $body = json_encode(['paymentMethod' => ['details' => ['validityDate' => '1225']]]);
+
+ self::assertSame([], CardDataFromPaymentMethodExtractor::extract($body));
+ }
+
+ public function testExtract_withValidityDateOutOfRangeMonth_omitsExpiration(): void
+ {
+ $body = json_encode(['paymentMethod' => ['details' => ['validityDate' => '2027-13']]]);
+
+ self::assertSame([], CardDataFromPaymentMethodExtractor::extract($body));
+ }
+
+ public function testExtract_withStoredId_returnsItAsTheAliasId(): void
+ {
+ $body = json_encode(['paymentMethod' => ['storedId' => 'card_stored']]);
+
+ self::assertSame(['aliasId' => 'card_stored'], CardDataFromPaymentMethodExtractor::extract($body));
+ }
+
+ public function testExtract_withBothStoredIdAndId_prefersStoredId(): void
+ {
+ $body = json_encode(['paymentMethod' => ['storedId' => 'card_stored', 'id' => 'card_other']]);
+
+ self::assertSame(['aliasId' => 'card_stored'], CardDataFromPaymentMethodExtractor::extract($body));
+ }
+
+ /** @dataProvider unusableStoredIds */
+ public function testExtract_withAnUnusableStoredId_fallsBackToId(mixed $storedId): void
+ {
+ $body = json_encode(['paymentMethod' => ['storedId' => $storedId, 'id' => 'card_xxx']]);
+
+ self::assertSame(['aliasId' => 'card_xxx'], CardDataFromPaymentMethodExtractor::extract($body));
+ }
+
+ /** @return iterable */
+ public static function unusableStoredIds(): iterable
+ {
+ yield 'empty string' => [''];
+ yield 'null' => [null];
+ yield 'integer' => [123];
+ yield 'array' => [['card_stored']];
+ }
+
+ public function testExtract_withNeitherStoredIdNorId_returnsNoAliasId(): void
+ {
+ self::assertSame([], CardDataFromPaymentMethodExtractor::extract(json_encode(['paymentMethod' => ['card' => []]])));
+ }
+
+ public function testExtract_withTheRealWebhookShape_extractsTheAliasAndTheCardFields(): void
+ {
+ $body = json_encode([
+ 'operationType' => 'PAYMENT',
+ 'paymentMethod' => [
+ 'storedId' => 'card_new_1',
+ 'card' => ['network' => 'VISA', 'type' => 'VISA', 'code6x4' => '446421XXXXXX0000'],
+ 'details' => ['fullName' => 'John Doe', 'validityDate' => '2030-12', 'selectedBrand' => 'VISA'],
+ ],
+ 'orderId' => '42',
+ 'id' => '715ac841-1111-4111-8111-111111111111',
+ ]);
+
+ self::assertSame([
+ 'aliasId' => 'card_new_1',
+ 'brand' => 'VISA',
+ 'last4' => '0000',
+ 'expirationYear' => 2030,
+ 'expirationMonth' => 12,
+ ], CardDataFromPaymentMethodExtractor::extract($body));
+ }
+
+ public function testExtractFromDecoded_withAnAlreadyDecodedBody_behavesLikeExtract(): void
+ {
+ $decoded = ['paymentMethod' => ['id' => 'card_xxx', 'card' => ['network' => 'VISA']]];
+
+ self::assertSame(
+ ['aliasId' => 'card_xxx', 'brand' => 'VISA'],
+ CardDataFromPaymentMethodExtractor::extractFromDecoded($decoded),
+ );
+ }
+}
diff --git a/tests/PHPUnit/Upc/GatewayCredentialsResolverTest.php b/tests/PHPUnit/Upc/GatewayCredentialsResolverTest.php
new file mode 100644
index 00000000..03488faa
--- /dev/null
+++ b/tests/PHPUnit/Upc/GatewayCredentialsResolverTest.php
@@ -0,0 +1,84 @@
+createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getConfig')->willReturn([
+ PayPlugGatewayFactory::HF_IDENTIFIER => 'acct_123',
+ ]);
+
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $method->method('getGatewayConfig')->willReturn($gatewayConfig);
+
+ self::assertSame('acct_123', GatewayCredentialsResolver::resolve($method));
+ }
+
+ /**
+ * The submerchant is no longer configurable here — it belongs to the EUR MID configurations,
+ * not to the multi-currency ones this flow targets — so a config left over from before the
+ * field was removed must resolve exactly like one without it rather than throwing.
+ */
+ public function testResolve_withALeftoverSubmerchantIdInConfig_ignoresIt(): void
+ {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getConfig')->willReturn([
+ PayPlugGatewayFactory::HF_IDENTIFIER => 'acct_123',
+ 'hfSubMerchantId' => 'submerchant_123',
+ ]);
+
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $method->method('getGatewayConfig')->willReturn($gatewayConfig);
+
+ self::assertSame('acct_123', GatewayCredentialsResolver::resolve($method));
+ }
+
+ public function testResolve_withNoGatewayConfig_throws(): void
+ {
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $method->method('getGatewayConfig')->willReturn(null);
+
+ $this->expectException(\LogicException::class);
+
+ GatewayCredentialsResolver::resolve($method);
+ }
+
+ public function testResolve_withMissingAccountId_throws(): void
+ {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getConfig')->willReturn([]);
+
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $method->method('getGatewayConfig')->willReturn($gatewayConfig);
+
+ $this->expectException(\LogicException::class);
+
+ GatewayCredentialsResolver::resolve($method);
+ }
+
+ public function testResolve_withBlankAccountId_throws(): void
+ {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getConfig')->willReturn([
+ PayPlugGatewayFactory::HF_IDENTIFIER => '',
+ ]);
+
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $method->method('getGatewayConfig')->willReturn($gatewayConfig);
+
+ $this->expectException(\LogicException::class);
+
+ GatewayCredentialsResolver::resolve($method);
+ }
+}
diff --git a/tests/PHPUnit/Upc/IntegrationDescriptionProviderTest.php b/tests/PHPUnit/Upc/IntegrationDescriptionProviderTest.php
new file mode 100644
index 00000000..2e3831b0
--- /dev/null
+++ b/tests/PHPUnit/Upc/IntegrationDescriptionProviderTest.php
@@ -0,0 +1,35 @@
+factory = new OrderAddressDtoCreator();
+ }
+
+ private function address(
+ ?string $phoneNumber = null,
+ string $countryCode = 'FR',
+ string $provinceCode = '75',
+ ): AddressInterface&MockObject {
+ $address = $this->createMock(AddressInterface::class);
+ $address->method('getFirstName')->willReturn('Jane');
+ $address->method('getLastName')->willReturn('Doe');
+ $address->method('getStreet')->willReturn('10 Rue de Rivoli');
+ $address->method('getCity')->willReturn('Paris');
+ $address->method('getCountryCode')->willReturn($countryCode);
+ $address->method('getProvinceCode')->willReturn($provinceCode);
+ $address->method('getPostcode')->willReturn('75001');
+ $address->method('getCompany')->willReturn('Acme Corp');
+ $address->method('getPhoneNumber')->willReturn($phoneNumber);
+
+ return $address;
+ }
+
+ private function orderWithAddresses(
+ ?AddressInterface $billing,
+ ?AddressInterface $shipping,
+ ?string $customerEmail = 'jane@example.com',
+ string $customerGender = '',
+ ): OrderInterface&MockObject {
+ $customer = $this->createMock(CustomerInterface::class);
+ $customer->method('getEmail')->willReturn($customerEmail);
+ $customer->method('getGender')->willReturn($customerGender);
+
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getCustomer')->willReturn($customer);
+ $order->method('getBillingAddress')->willReturn($billing);
+ $order->method('getShippingAddress')->willReturn($shipping);
+
+ return $order;
+ }
+
+ public function testCreateBilling_withNoBillingAddress_returnsNull(): void
+ {
+ $order = $this->orderWithAddresses(null, null);
+
+ self::assertNull($this->factory->createBilling($order));
+ }
+
+ public function testCreateShipping_withNoShippingAddress_returnsNull(): void
+ {
+ $order = $this->orderWithAddresses(null, null);
+
+ self::assertNull($this->factory->createShipping($order));
+ }
+
+ public function testCreateBilling_withAFullAddressAndMobilePhone_mapsEveryField(): void
+ {
+ $order = $this->orderWithAddresses($this->address('+33612345678'), null, customerGender: 'f');
+
+ $billing = $this->factory->createBilling($order);
+
+ self::assertNotNull($billing);
+ self::assertNotNull($billing->contact);
+ self::assertSame('Jane', $billing->contact->firstName);
+ self::assertSame('Doe', $billing->contact->lastName);
+ self::assertSame('MRS', $billing->title);
+ self::assertNull($billing->contact->phone);
+ self::assertSame('+33612345678', $billing->contact->mobilePhone);
+ self::assertNotNull($billing->address);
+ self::assertSame('10 Rue de Rivoli', $billing->address->line);
+ self::assertSame('Paris', $billing->address->city);
+ self::assertSame('FR', $billing->address->country);
+ self::assertSame('75', $billing->address->state);
+ self::assertSame('75001', $billing->address->zipCode);
+ }
+
+ public function testCreateBilling_withAProvinceCodeLongerThanThreeChars_omitsState(): void
+ {
+ $address = $this->address(provinceCode: 'US-CA');
+ $order = $this->orderWithAddresses($address, null);
+
+ $billing = $this->factory->createBilling($order);
+
+ self::assertNotNull($billing);
+ self::assertNotNull($billing->address);
+ self::assertNull($billing->address->state);
+ }
+
+ public function testCreateBilling_withALandlinePhone_setsPhoneNotMobilePhone(): void
+ {
+ $order = $this->orderWithAddresses($this->address('+33142345678'), null);
+
+ $billing = $this->factory->createBilling($order);
+
+ self::assertNotNull($billing);
+ self::assertNotNull($billing->contact);
+ self::assertSame('+33142345678', $billing->contact->phone);
+ self::assertNull($billing->contact->mobilePhone);
+ }
+
+ public function testCreateBilling_withNoPhoneNumber_leavesBothPhoneFieldsNull(): void
+ {
+ $order = $this->orderWithAddresses($this->address(null), null);
+
+ $billing = $this->factory->createBilling($order);
+
+ self::assertNotNull($billing);
+ self::assertNotNull($billing->contact);
+ self::assertNull($billing->contact->phone);
+ self::assertNull($billing->contact->mobilePhone);
+ }
+
+ public function testCreateBilling_withAnUnparseablePhoneNumber_leavesBothPhoneFieldsNullInsteadOfThrowing(): void
+ {
+ $order = $this->orderWithAddresses($this->address('not-a-phone-number'), null);
+
+ $billing = $this->factory->createBilling($order);
+
+ self::assertNotNull($billing);
+ self::assertNotNull($billing->contact);
+ self::assertNull($billing->contact->phone);
+ self::assertNull($billing->contact->mobilePhone);
+ }
+
+ public function testCreateBilling_withMaleGender_mapsTitleToMr(): void
+ {
+ $order = $this->orderWithAddresses($this->address(), null, customerGender: 'm');
+
+ $billing = $this->factory->createBilling($order);
+
+ self::assertNotNull($billing);
+ self::assertSame('MR', $billing->title);
+ }
+
+ public function testCreateBilling_withNoGender_leavesTitleNull(): void
+ {
+ $order = $this->orderWithAddresses($this->address(), null, customerGender: '');
+
+ $billing = $this->factory->createBilling($order);
+
+ self::assertNotNull($billing);
+ self::assertNull($billing->title);
+ }
+
+ public function testCreateShipping_withAFullAddress_mapsEveryFieldIncludingCustomerEmailAndCompany(): void
+ {
+ $order = $this->orderWithAddresses(null, $this->address('+33612345678'), customerEmail: 'jane@example.com');
+
+ $shipping = $this->factory->createShipping($order);
+
+ self::assertNotNull($shipping);
+ self::assertNotNull($shipping->contact);
+ self::assertSame('Jane', $shipping->contact->firstName);
+ self::assertSame('Doe', $shipping->contact->lastName);
+ self::assertSame('jane@example.com', $shipping->email);
+ self::assertSame('Acme Corp', $shipping->companyName);
+ self::assertNull($shipping->contact->phone);
+ self::assertSame('+33612345678', $shipping->contact->mobilePhone);
+ self::assertNotNull($shipping->address);
+ self::assertSame('75001', $shipping->address->zipCode);
+ }
+
+ public function testCreateBillingAndCreateShipping_areIndependentOfEachOther(): void
+ {
+ $order = $this->orderWithAddresses($this->address('+33612345678'), null);
+
+ self::assertNotNull($this->factory->createBilling($order));
+ self::assertNull($this->factory->createShipping($order));
+ }
+}
diff --git a/tests/PHPUnit/Upc/PaymentCaptureContextBuilderTest.php b/tests/PHPUnit/Upc/PaymentCaptureContextBuilderTest.php
new file mode 100644
index 00000000..8615f31e
--- /dev/null
+++ b/tests/PHPUnit/Upc/PaymentCaptureContextBuilderTest.php
@@ -0,0 +1,333 @@
+urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+ $this->afterPayUrlProvider = $this->createMock(UrlProviderInterface::class);
+ $this->afterPayUrlProvider->method('getUrl')->willReturn('https://shop.test/order/00000042/pay');
+ $this->requestStack = new RequestStack();
+
+ $this->builder = new PaymentCaptureContextBuilder(
+ $this->urlGenerator,
+ $this->afterPayUrlProvider,
+ new OrderAddressDtoCreator(),
+ $this->requestStack,
+ );
+ }
+
+ private function methodWithGatewayConfig(?array $config): PaymentMethodInterface&MockObject
+ {
+ $method = $this->createMock(PaymentMethodInterface::class);
+ if (null !== $config) {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getConfig')->willReturn($config);
+ $method->method('getGatewayConfig')->willReturn($gatewayConfig);
+ }
+
+ return $method;
+ }
+
+ public function testResolveGatewayCredentials_withCompleteConfig_returnsAccountId(): void
+ {
+ $method = $this->methodWithGatewayConfig(['hfIdentifier' => 'acct_123']);
+
+ self::assertSame('acct_123', $this->builder->resolveGatewayCredentials($method));
+ }
+
+ public function testResolveGatewayCredentials_withNoGatewayConfig_throws(): void
+ {
+ $this->expectException(\LogicException::class);
+
+ $this->builder->resolveGatewayCredentials($this->methodWithGatewayConfig(null));
+ }
+
+ public function testResolveGatewayCredentials_withBlankAccountId_throws(): void
+ {
+ $this->expectException(\LogicException::class);
+
+ $this->builder->resolveGatewayCredentials($this->methodWithGatewayConfig(['hfIdentifier' => '']));
+ }
+
+ public function testResolvePaymentMethod_withNoMethodOnThePayment_throws(): void
+ {
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getMethod')->willReturn(null);
+
+ $this->expectException(\LogicException::class);
+
+ $this->builder->resolvePaymentMethod($payment);
+ }
+
+ public function testResolvePaymentMethod_withAMethodOnThePayment_returnsIt(): void
+ {
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getMethod')->willReturn($method);
+
+ self::assertSame($method, $this->builder->resolvePaymentMethod($payment));
+ }
+
+ public function testResolveAmountAndCurrency_withAmountOrCurrencyMissing_throws(): void
+ {
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getAmount')->willReturn(null);
+ $payment->method('getCurrencyCode')->willReturn('EUR');
+
+ $this->expectException(\LogicException::class);
+
+ $this->builder->resolveAmountAndCurrency($payment);
+ }
+
+ public function testResolveAmountAndCurrency_withBothSet_returnsThem(): void
+ {
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getAmount')->willReturn(1000);
+ $payment->method('getCurrencyCode')->willReturn('EUR');
+
+ self::assertSame([1000, 'EUR'], $this->builder->resolveAmountAndCurrency($payment));
+ }
+
+ public function testBuildCustomerDto_withNoCustomerOnTheOrder_throws(): void
+ {
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getCustomer')->willReturn(null);
+
+ $this->expectException(\LogicException::class);
+
+ $this->builder->buildCustomerDto($order);
+ }
+
+ public function testBuildCustomerDto_withNoCustomerEmail_throws(): void
+ {
+ $customer = $this->createMock(CustomerInterface::class);
+ $customer->method('getEmail')->willReturn(null);
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getCustomer')->willReturn($customer);
+
+ $this->expectException(\LogicException::class);
+
+ $this->builder->buildCustomerDto($order);
+ }
+
+ public function testBuildCustomerDto_withCustomerAndEmail_returnsCustomerDto(): void
+ {
+ $customer = $this->createMock(CustomerInterface::class);
+ $customer->method('getId')->willReturn(7);
+ $customer->method('getEmail')->willReturn('customer@example.com');
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getCustomer')->willReturn($customer);
+
+ $dto = $this->builder->buildCustomerDto($order);
+
+ self::assertSame('7', $dto->id);
+ self::assertSame('customer@example.com', $dto->email);
+ }
+
+ public function testBuildBrowserDto_withNoCurrentRequest_returnsNull(): void
+ {
+ self::assertNull($this->builder->buildBrowserDto());
+ }
+
+ public function testBuildBrowserDto_withACurrentRequest_returnsItsClientDetails(): void
+ {
+ $request = new Request(server: ['REMOTE_ADDR' => '203.0.113.5']);
+ $request->headers->set('referer', 'https://shop.test/checkout');
+ $request->headers->set('User-Agent', 'TestAgent/1.0');
+ $this->requestStack->push($request);
+
+ $dto = $this->builder->buildBrowserDto();
+
+ self::assertNotNull($dto);
+ self::assertSame('203.0.113.5', $dto->ip);
+ self::assertSame('https://shop.test/checkout', $dto->referrer);
+ self::assertSame('TestAgent/1.0', $dto->userAgent);
+ }
+
+ public function testBuildCommonFields_setsSuccessCancelAndNotificationUrls(): void
+ {
+ $this->urlGenerator->method('generate')->willReturn('https://shop.test/payplug/notify/abc');
+
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getNumber')->willReturn('00000042');
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getId')->willReturn(42);
+
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $paymentRequest->method('getPayment')->willReturn($payment);
+ $paymentRequest->method('getHash')->willReturn(Uuid::v4());
+
+ $common = $this->builder->buildCommonFields('acct_123', 1000, 'eur', $paymentRequest, $order);
+
+ self::assertSame('acct_123', $common->accountId);
+ self::assertSame(1000, $common->amount);
+ self::assertSame('EUR', $common->currency);
+ self::assertSame('00000042', $common->orderId);
+ self::assertNull($common->submerchantExternalId);
+ self::assertSame('https://shop.test/payplug/notify/abc', $common->notificationUrl);
+ self::assertSame('https://shop.test/order/00000042/pay', $common->successUrl);
+ self::assertSame('https://shop.test/order/00000042/pay?status=canceled', $common->cancelUrl);
+ }
+
+ public function testBuildCommonFields_withNoOrder_fallsBackToPaymentIdAsOrderId(): void
+ {
+ $this->urlGenerator->method('generate')->willReturn('https://shop.test/payplug/notify/abc');
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getId')->willReturn(42);
+
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $paymentRequest->method('getPayment')->willReturn($payment);
+ $paymentRequest->method('getHash')->willReturn(Uuid::v4());
+
+ $common = $this->builder->buildCommonFields('acct_123', 1000, 'eur', $paymentRequest, null);
+
+ self::assertSame('42', $common->orderId);
+ self::assertNull($common->billing);
+ self::assertNull($common->shipping);
+ }
+
+ public function testBuildCommonFields_capturesImmediatelyUnlessDeferredCaptureIsEnabledOnHostedFields(): void
+ {
+ $this->urlGenerator->method('generate')->willReturn('https://shop.test/payplug/notify/abc');
+
+ self::assertTrue($this->commonFieldsForGatewayConfig([PayPlugGatewayFactory::HOSTED_FIELDS => true])->capture);
+ self::assertFalse($this->commonFieldsForGatewayConfig([
+ PayPlugGatewayFactory::HOSTED_FIELDS => true,
+ PayPlugGatewayFactory::DEFERRED_CAPTURE => true,
+ ])->capture);
+ }
+
+ /**
+ * @param array $config
+ */
+ private function commonFieldsForGatewayConfig(array $config): CommonFieldsDto
+ {
+ $gatewayConfig = new GatewayConfig();
+ $gatewayConfig->setFactoryName(PayPlugGatewayFactory::FACTORY_NAME);
+ $gatewayConfig->setConfig($config);
+ $method = new PaymentMethod();
+ $method->setGatewayConfig($gatewayConfig);
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getId')->willReturn(42);
+ $payment->method('getMethod')->willReturn($method);
+
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $paymentRequest->method('getPayment')->willReturn($payment);
+ $paymentRequest->method('getHash')->willReturn(Uuid::v4());
+
+ return $this->builder->buildCommonFields('acct_123', 1000, 'eur', $paymentRequest, null);
+ }
+
+ public function testBuildCommonFields_withAnOrderItem_usesItsProductNameAsDescription(): void
+ {
+ $this->urlGenerator->method('generate')->willReturn('https://shop.test/payplug/notify/abc');
+
+ $item = $this->createMock(OrderItemInterface::class);
+ $item->method('getProductName')->willReturn('Blue T-Shirt');
+
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getNumber')->willReturn('00000042');
+ $order->method('getItems')->willReturn(new ArrayCollection([$item]));
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getId')->willReturn(42);
+
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $paymentRequest->method('getPayment')->willReturn($payment);
+ $paymentRequest->method('getHash')->willReturn(Uuid::v4());
+
+ $common = $this->builder->buildCommonFields('acct_123', 1000, 'eur', $paymentRequest, $order);
+
+ self::assertSame('Blue T-Shirt', $common->description);
+ }
+
+ public function testBuildCommonFields_withNoOrderItem_fallsBackToTheIntegrationDescription(): void
+ {
+ $this->urlGenerator->method('generate')->willReturn('https://shop.test/payplug/notify/abc');
+
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getNumber')->willReturn('00000042');
+ $order->method('getItems')->willReturn(new ArrayCollection());
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getId')->willReturn(42);
+
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $paymentRequest->method('getPayment')->willReturn($payment);
+ $paymentRequest->method('getHash')->willReturn(Uuid::v4());
+
+ $common = $this->builder->buildCommonFields('acct_123', 1000, 'eur', $paymentRequest, $order);
+
+ self::assertNotNull($common->description);
+ self::assertNotSame('Blue T-Shirt', $common->description);
+ }
+
+ public function testResolveFullNameForCardDetails_withABillingAddressFullName_returnsIt(): void
+ {
+ $billingAddress = $this->createMock(AddressInterface::class);
+ $billingAddress->method('getFullName')->willReturn('Jane Doe');
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getBillingAddress')->willReturn($billingAddress);
+
+ self::assertSame('Jane Doe', $this->builder->resolveFullNameForCardDetails($order));
+ }
+
+ public function testResolveFullNameForCardDetails_withNoBillingAddressFullName_fallsBackToTheCustomerFullName(): void
+ {
+ $billingAddress = $this->createMock(AddressInterface::class);
+ $billingAddress->method('getFullName')->willReturn('');
+ $customer = $this->createMock(CustomerInterface::class);
+ $customer->method('getFullName')->willReturn('Jane Customer');
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getBillingAddress')->willReturn($billingAddress);
+ $order->method('getCustomer')->willReturn($customer);
+
+ self::assertSame('Jane Customer', $this->builder->resolveFullNameForCardDetails($order));
+ }
+
+ public function testResolveFullNameForCardDetails_withNoNameAvailableAnywhere_returnsNull(): void
+ {
+ $order = $this->createMock(OrderInterface::class);
+
+ self::assertNull($this->builder->resolveFullNameForCardDetails($order));
+ }
+}
diff --git a/tests/PHPUnit/Upc/PaymentCaptureOutcomeApplierTest.php b/tests/PHPUnit/Upc/PaymentCaptureOutcomeApplierTest.php
new file mode 100644
index 00000000..e940fb30
--- /dev/null
+++ b/tests/PHPUnit/Upc/PaymentCaptureOutcomeApplierTest.php
@@ -0,0 +1,250 @@
+logger = $this->createMock(LoggerInterface::class);
+ $this->stateMachine = $this->createMock(StateMachineInterface::class);
+ $this->orderStateMutator = $this->createMock(IOrderStateMutator::class);
+
+ // A real Session/FlashBag rather than a mock: the assertions below are about what the
+ // shopper actually ends up seeing, which is the flash bag's contents.
+ $this->session = new Session(new MockArraySessionStorage());
+ $request = new Request();
+ $request->setSession($this->session);
+ $this->requestStack = new RequestStack();
+ $this->requestStack->push($request);
+
+ $this->applier = $this->createApplier($this->requestStack);
+ }
+
+ private function createApplier(RequestStack $requestStack): PaymentCaptureOutcomeApplier
+ {
+ return new PaymentCaptureOutcomeApplier(
+ $this->logger,
+ $this->stateMachine,
+ $this->orderStateMutator,
+ $requestStack,
+ );
+ }
+
+ public function testFailPaymentRequest_tellsTheShopperTheTransactionDidNotGoThrough(): void
+ {
+ $this->applier->failPaymentRequest(
+ $this->createMock(PaymentRequestInterface::class),
+ $this->createMock(PaymentInterface::class),
+ new \LogicException('boom'),
+ PaymentCaptureFlow::Alias,
+ );
+
+ self::assertSame(
+ [self::SHOPPER_ERROR_FLASH_KEY],
+ $this->session->getFlashBag()->get('error'),
+ );
+ }
+
+ public function testFailPaymentRequest_neverLeaksTheExceptionMessageToTheShopper(): void
+ {
+ // Real example from a UPC 403: the raw message names internal infrastructure and the
+ // account's configuration, so it must stay in the log and out of the flash bag.
+ $leaky = 'The IP address "10.204.92.13" is not allowed to access this account.';
+
+ $this->applier->failPaymentRequest(
+ $this->createMock(PaymentRequestInterface::class),
+ $this->createMock(PaymentInterface::class),
+ new \RuntimeException($leaky),
+ PaymentCaptureFlow::Alias,
+ );
+
+ self::assertSame([self::SHOPPER_ERROR_FLASH_KEY], $this->session->getFlashBag()->get('error'));
+ }
+
+ public function testFailPaymentRequest_withoutASession_stillFailsThePaymentRequest(): void
+ {
+ // Reachable from the CLI (UpdatePaymentStateCommand) and from worker contexts, where
+ // Request::getSession() would throw — a failed payment must not become a 500 because
+ // there was nowhere to put a flash message.
+ $requestStack = new RequestStack();
+ $requestStack->push(new Request());
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_FAIL);
+
+ $this->createApplier($requestStack)->failPaymentRequest(
+ $paymentRequest,
+ $this->createMock(PaymentInterface::class),
+ new \LogicException('boom'),
+ PaymentCaptureFlow::Alias,
+ );
+ }
+
+ public function testFailPaymentRequest_withNoRequestAtAll_stillFailsThePaymentRequest(): void
+ {
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_FAIL);
+
+ $this->createApplier(new RequestStack())->failPaymentRequest(
+ $paymentRequest,
+ $this->createMock(PaymentInterface::class),
+ new \LogicException('boom'),
+ PaymentCaptureFlow::Alias,
+ );
+ }
+
+ public function testFailPaymentRequest_logsSetsResponseDataAndAppliesFailTransition(): void
+ {
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getId')->willReturn(42);
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+
+ $this->logger->expects(self::once())->method('error')
+ ->with(self::stringContains('Hosted payment creation failed.'), self::anything());
+ $paymentRequest->expects(self::once())->method('setResponseData')->with(['error' => 'boom']);
+ $this->stateMachine->expects(self::once())->method('apply')
+ ->with($paymentRequest, PaymentRequestTransitions::GRAPH, PaymentRequestTransitions::TRANSITION_FAIL);
+
+ $this->applier->failPaymentRequest($paymentRequest, $payment, new \LogicException('boom'), PaymentCaptureFlow::Hosted);
+ }
+
+ public function testApplyOutcome_withRedirectHtml_storesItAndNeverAppliesOrderStateMutator(): void
+ {
+ $payment = $this->createMock(PaymentInterface::class);
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $output = new PaymentOutput(201, '{"id":"pay_1","execCode":"0001"}', null, '', null);
+
+ $paymentRequest->expects(self::once())->method('setResponseData')->with(['redirect_html' => '']);
+ $this->orderStateMutator->expects(self::never())->method('apply');
+
+ $this->applier->applyOutcome($paymentRequest, $payment, $output);
+ }
+
+ public function testApplyOutcome_withRedirectUrl_storesItAndNeverAppliesOrderStateMutator(): void
+ {
+ $payment = $this->createMock(PaymentInterface::class);
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $output = new PaymentOutput(201, '{"id":"pay_1"}', 'https://example.com/3ds', null, null);
+
+ $paymentRequest->expects(self::once())->method('setResponseData')->with(['redirect_url' => 'https://example.com/3ds']);
+ $this->orderStateMutator->expects(self::never())->method('apply');
+
+ $this->applier->applyOutcome($paymentRequest, $payment, $output);
+ }
+
+ public function testApplyOutcome_withDirectSuccessExecCode_appliesPaidOutcomeToOrderStateMutator(): void
+ {
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getId')->willReturn(42);
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $output = new PaymentOutput(201, '{"id":"pay_1","execCode":"0000"}', null, null, null);
+
+ $this->orderStateMutator->expects(self::once())->method('apply')->with('42', PaymentOutcome::PAID);
+
+ $this->applier->applyOutcome($paymentRequest, $payment, $output);
+ }
+
+ public function testApplyOutcome_withDirectSuccessOnADeferredCapturePayment_appliesAuthorizedNotPaid(): void
+ {
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getId')->willReturn(42);
+ $payment->method('getDetails')->willReturn([AuthorizationDetails::DEFERRED => true]);
+ $output = new PaymentOutput(201, '{"id":"pay_1","execCode":"0000"}', null, null, null);
+
+ $this->orderStateMutator->expects(self::once())->method('apply')->with('42', PaymentOutcome::AUTHORIZED);
+
+ $this->applier->applyOutcome($this->createMock(PaymentRequestInterface::class), $payment, $output);
+ }
+
+ public function testApplyOutcome_withNoExecCodeInResponseBody_neverAppliesOrderStateMutator(): void
+ {
+ $payment = $this->createMock(PaymentInterface::class);
+ $paymentRequest = $this->createMock(PaymentRequestInterface::class);
+ $output = new PaymentOutput(201, '{"id":"pay_1"}', null, null, null);
+
+ $this->orderStateMutator->expects(self::never())->method('apply');
+
+ $this->applier->applyOutcome($paymentRequest, $payment, $output);
+ }
+
+ public function testWarnWhenPaymentIdMissing_withNoPaymentId_logsAWarningWithIdsOnly(): void
+ {
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getId')->willReturn(42);
+
+ $this->logger->expects(self::once())->method('warning')->with(
+ '[PayPlug][UPC] Payment created but the response carried no payment id; it cannot be refunded from the back office until PayPlug returns a payment id.',
+ self::callback(static fn (array $context): bool => [
+ 'sylius_payment_id' => 42,
+ 'flow' => 'Hosted',
+ 'hosted_fields_operation_id' => 'op_1',
+ ] === $context),
+ );
+
+ $this->applier->warnWhenPaymentIdMissing($payment, PaymentCaptureFlow::Hosted, ['hosted_fields_operation_id' => 'op_1']);
+ }
+
+ public function testWarnWhenPaymentIdMissing_withNeitherId_logsANullOperationId(): void
+ {
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getId')->willReturn(42);
+
+ $this->logger->expects(self::once())->method('warning')->with(
+ self::anything(),
+ self::callback(static fn (array $context): bool => 'Alias' === $context['flow'] &&
+ \array_key_exists('hosted_fields_operation_id', $context) &&
+ null === $context['hosted_fields_operation_id']),
+ );
+
+ $this->applier->warnWhenPaymentIdMissing($payment, PaymentCaptureFlow::Alias, []);
+ }
+
+ public function testWarnWhenPaymentIdMissing_withAPaymentId_logsNothing(): void
+ {
+ $this->logger->expects(self::never())->method('warning');
+
+ $this->applier->warnWhenPaymentIdMissing(
+ $this->createMock(PaymentInterface::class),
+ PaymentCaptureFlow::Alias,
+ ['hosted_fields_payment_id' => 'pay_1', 'hosted_fields_operation_id' => 'op_1'],
+ );
+ }
+}
diff --git a/tests/PHPUnit/Upc/PayplugCardPersisterTest.php b/tests/PHPUnit/Upc/PayplugCardPersisterTest.php
new file mode 100644
index 00000000..7be544ce
--- /dev/null
+++ b/tests/PHPUnit/Upc/PayplugCardPersisterTest.php
@@ -0,0 +1,235 @@
+payplugCardFactory = $this->createMock(FactoryInterface::class);
+ $this->payplugCardRepository = $this->createMock(RepositoryInterface::class);
+ $this->managerRegistry = $this->createMock(ManagerRegistry::class);
+
+ $this->persister = new PayplugCardPersister($this->payplugCardFactory, $this->payplugCardRepository, $this->managerRegistry);
+ }
+
+ private function paymentWithOrder(?CustomerInterface $customer): PaymentInterface&MockObject
+ {
+ $order = $this->createMock(OrderInterface::class);
+ $order->method('getCustomer')->willReturn($customer);
+
+ $payment = $this->createMock(PaymentInterface::class);
+ $payment->method('getOrder')->willReturn($order);
+
+ return $payment;
+ }
+
+ private function corePaymentMethod(bool $live = false): CorePaymentMethodInterface&MockObject
+ {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getConfig')->willReturn(['live' => $live]);
+
+ $method = $this->createMock(CorePaymentMethodInterface::class);
+ $method->method('getGatewayConfig')->willReturn($gatewayConfig);
+
+ return $method;
+ }
+
+ public function testPersist_withNoCustomerOnTheOrder_doesNotPersistACard(): void
+ {
+ $payment = $this->paymentWithOrder(null);
+
+ $this->payplugCardRepository->expects(self::never())->method('add');
+
+ $this->persister->persist('alias_1', $payment, $this->corePaymentMethod(), [], []);
+ }
+
+ public function testPersist_withMethodNotACorePaymentMethod_doesNotPersistACard(): void
+ {
+ $payment = $this->paymentWithOrder($this->createMock(CustomerInterface::class));
+ $method = $this->createMock(PaymentMethodInterface::class);
+
+ $this->payplugCardRepository->expects(self::never())->method('add');
+
+ $this->persister->persist('alias_1', $payment, $method, [], []);
+ }
+
+ public function testPersist_withAliasAlreadyStored_doesNotPersistADuplicate(): void
+ {
+ $payment = $this->paymentWithOrder($this->createMock(CustomerInterface::class));
+
+ $this->payplugCardRepository->method('findOneBy')
+ ->with(['externalId' => 'alias_1', 'isLive' => false])
+ ->willReturn(new Card());
+ $this->payplugCardRepository->expects(self::never())->method('add');
+
+ $this->persister->persist('alias_1', $payment, $this->corePaymentMethod(), [], []);
+ }
+
+ public function testPersist_whenAddLosesARaceAgainstAConcurrentPersistCallForTheSameAlias_doesNotThrow(): void
+ {
+ $payment = $this->paymentWithOrder($this->createMock(CustomerInterface::class));
+
+ $card = new Card();
+ $this->payplugCardFactory->method('createNew')->willReturn($card);
+ $this->payplugCardRepository->method('add')->with($card)
+ ->willThrowException($this->createMock(UniqueConstraintViolationException::class));
+ $this->managerRegistry->expects(self::once())->method('resetManager');
+
+ $this->persister->persist('alias_1', $payment, $this->corePaymentMethod(), [], []);
+
+ $this->addToAssertionCount(1);
+ }
+
+ public function testPersist_withFetchedCardDataAvailable_takesPrecedenceOverDetailsFallback(): void
+ {
+ $customer = $this->createMock(CustomerInterface::class);
+ $payment = $this->paymentWithOrder($customer);
+ $method = $this->corePaymentMethod(live: true);
+
+ $card = new Card();
+ $this->payplugCardFactory->method('createNew')->willReturn($card);
+ $this->payplugCardRepository->expects(self::once())->method('add')->with($card);
+
+ $this->persister->persist(
+ 'alias_1',
+ $payment,
+ $method,
+ [
+ 'hosted_fields_selected_brand' => 'MASTERCARD',
+ 'hosted_fields_last4' => '0000',
+ 'hosted_fields_expiration_month' => 1,
+ 'hosted_fields_expiration_year' => 2020,
+ 'hosted_fields_country' => 'DE',
+ ],
+ [
+ 'brand' => 'VISA',
+ 'last4' => '4242',
+ 'expirationMonth' => 12,
+ 'expirationYear' => 2030,
+ ],
+ );
+
+ self::assertSame($customer, $card->getCustomer());
+ self::assertSame('alias_1', $card->getExternalId());
+ self::assertSame('VISA', $card->getBrand());
+ self::assertSame('4242', $card->getLast4());
+ self::assertSame(12, $card->getExpirationMonth());
+ self::assertSame(2030, $card->getExpirationYear());
+ // No card country field exists on the operation resource, so it always comes from $details.
+ self::assertSame('DE', $card->getCountryCode());
+ self::assertTrue($card->isLive());
+ self::assertSame($method, $card->getPaymentMethod());
+ }
+
+ public function testPersist_withNoFetchedCardDataAndNoDetails_usesEmptyDefaults(): void
+ {
+ $payment = $this->paymentWithOrder($this->createMock(CustomerInterface::class));
+
+ $card = new Card();
+ $this->payplugCardFactory->method('createNew')->willReturn($card);
+
+ $this->persister->persist('alias_1', $payment, $this->corePaymentMethod(), [], []);
+
+ self::assertSame('', $card->getBrand());
+ self::assertSame('', $card->getLast4());
+ self::assertSame(0, $card->getExpirationMonth());
+ self::assertSame(0, $card->getExpirationYear());
+ self::assertSame('', $card->getCountryCode());
+ }
+
+ public function testPersist_withValidDetailsFallbackOnly_usesTheSanitizedValues(): void
+ {
+ $payment = $this->paymentWithOrder($this->createMock(CustomerInterface::class));
+
+ $card = new Card();
+ $this->payplugCardFactory->method('createNew')->willReturn($card);
+
+ // Computed relative to today rather than hardcoded, since sanitizeExpirationYear() rejects
+ // anything before the wall-clock current year — a fixed literal would eventually become a
+ // past year and start failing this test for no code-regression reason.
+ $futureYear = (int) (new \DateTimeImmutable())->format('Y') + 1;
+
+ $this->persister->persist(
+ 'alias_1',
+ $payment,
+ $this->corePaymentMethod(),
+ [
+ 'hosted_fields_last4' => '4242',
+ 'hosted_fields_expiration_month' => 12,
+ 'hosted_fields_expiration_year' => $futureYear,
+ 'hosted_fields_country' => 'fr',
+ ],
+ [],
+ );
+
+ self::assertSame('4242', $card->getLast4());
+ self::assertSame(12, $card->getExpirationMonth());
+ self::assertSame($futureYear, $card->getExpirationYear());
+ // Uppercased regardless of the case the client submitted it in.
+ self::assertSame('FR', $card->getCountryCode());
+ }
+
+ /**
+ * @dataProvider malformedDetailsFallbackProvider
+ *
+ * @param mixed[] $details
+ */
+ public function testPersist_withMalformedDetailsFallbackValues_discardsThemAsIfAbsent(
+ array $details,
+ string $getter,
+ string|int $defaultValue,
+ ): void {
+ $payment = $this->paymentWithOrder($this->createMock(CustomerInterface::class));
+
+ $card = new Card();
+ $this->payplugCardFactory->method('createNew')->willReturn($card);
+
+ $this->persister->persist('alias_1', $payment, $this->corePaymentMethod(), $details, []);
+
+ self::assertSame($defaultValue, $card->$getter());
+ }
+
+ /** @return array */
+ public static function malformedDetailsFallbackProvider(): array
+ {
+ return [
+ 'brand not in the allowed list' => [['hosted_fields_selected_brand' => 'AMEX'], 'getBrand', ''],
+ 'last4 not 4 digits' => [['hosted_fields_last4' => '42'], 'getLast4', ''],
+ 'last4 not numeric' => [['hosted_fields_last4' => 'abcd'], 'getLast4', ''],
+ 'last4 with trailing newline' => [['hosted_fields_last4' => "4242\n"], 'getLast4', ''],
+ 'expiration month out of range' => [['hosted_fields_expiration_month' => 13], 'getExpirationMonth', 0],
+ 'expiration month zero' => [['hosted_fields_expiration_month' => 0], 'getExpirationMonth', 0],
+ 'expiration year in the past' => [['hosted_fields_expiration_year' => 2000], 'getExpirationYear', 0],
+ 'expiration year implausibly far ahead' => [['hosted_fields_expiration_year' => 9999], 'getExpirationYear', 0],
+ 'country not two letters' => [['hosted_fields_country' => 'FRA'], 'getCountryCode', ''],
+ 'country not alphabetic' => [['hosted_fields_country' => '12'], 'getCountryCode', ''],
+ 'country with trailing newline' => [['hosted_fields_country' => "fr\n"], 'getCountryCode', ''],
+ ];
+ }
+}
diff --git a/tests/PHPUnit/Upc/RefundDetailsLockKeyTest.php b/tests/PHPUnit/Upc/RefundDetailsLockKeyTest.php
new file mode 100644
index 00000000..f3c5f4ae
--- /dev/null
+++ b/tests/PHPUnit/Upc/RefundDetailsLockKeyTest.php
@@ -0,0 +1,38 @@
+expectException(\LogicException::class);
+
+ RefundDetailsLockKey::forPaymentId([42]);
+ }
+
+ /**
+ * The same payment id must always resolve to the same key regardless of caller — this is what
+ * lets RefundPaymentProcessor and HostedFieldsWebhookNotificationHandler actually serialize
+ * against each other.
+ */
+ public function testForPaymentId_isStableAcrossCalls(): void
+ {
+ self::assertSame(RefundDetailsLockKey::forPaymentId(42), RefundDetailsLockKey::forPaymentId(42));
+ }
+}
diff --git a/tests/PHPUnit/Upc/SyliusOrderStateMutatorTest.php b/tests/PHPUnit/Upc/SyliusOrderStateMutatorTest.php
new file mode 100644
index 00000000..7fdf0ebc
--- /dev/null
+++ b/tests/PHPUnit/Upc/SyliusOrderStateMutatorTest.php
@@ -0,0 +1,88 @@
+paymentRepository = $this->createMock(PaymentRepositoryInterface::class);
+ $this->stateMachine = $this->createMock(StateMachineInterface::class);
+ $this->logger = $this->createMock(LoggerInterface::class);
+ $this->mutator = new SyliusOrderStateMutator($this->paymentRepository, $this->stateMachine, $this->logger);
+ }
+
+ /**
+ * @dataProvider outcomeToTransitionProvider
+ */
+ public function testApply_mapsOutcomeToTheExpectedTransition(string $outcome, string $expectedTransition): void
+ {
+ $payment = $this->createMock(PaymentInterface::class);
+ $this->paymentRepository->method('find')->with(42)->willReturn($payment);
+ $this->stateMachine->method('can')->with($payment, PaymentTransitions::GRAPH, $expectedTransition)->willReturn(true);
+ $this->stateMachine->expects(self::once())->method('apply')->with($payment, PaymentTransitions::GRAPH, $expectedTransition);
+
+ $this->mutator->apply('42', $outcome);
+ }
+
+ /**
+ * @return iterable
+ */
+ public static function outcomeToTransitionProvider(): iterable
+ {
+ yield 'paid' => [PaymentOutcome::PAID, PaymentTransitions::TRANSITION_COMPLETE];
+ yield 'capture_required' => [PaymentOutcome::CAPTURE_REQUIRED, PaymentTransitions::TRANSITION_COMPLETE];
+ yield 'authorized' => [PaymentOutcome::AUTHORIZED, PaymentTransitions::TRANSITION_AUTHORIZE];
+ yield 'refunded' => [PaymentOutcome::REFUNDED, PaymentTransitions::TRANSITION_REFUND];
+ yield 'failed' => [PaymentOutcome::FAILED, PaymentTransitions::TRANSITION_FAIL];
+ }
+
+ public function testApply_forThreeDsPending_doesNothing(): void
+ {
+ $payment = $this->createMock(PaymentInterface::class);
+ $this->paymentRepository->method('find')->willReturn($payment);
+ $this->stateMachine->expects(self::never())->method('apply');
+
+ $this->mutator->apply('42', PaymentOutcome::THREE_DS_PENDING);
+ }
+
+ public function testApply_whenPaymentNotFound_logsAndDoesNothing(): void
+ {
+ $this->paymentRepository->method('find')->with(42)->willReturn(null);
+ $this->logger->expects(self::once())->method('error');
+ $this->stateMachine->expects(self::never())->method('apply');
+
+ $this->mutator->apply('42', PaymentOutcome::PAID);
+ }
+
+ public function testApply_whenTransitionNotAllowed_logsAndDoesNotApply(): void
+ {
+ $payment = $this->createMock(PaymentInterface::class);
+ $this->paymentRepository->method('find')->willReturn($payment);
+ $this->stateMachine->method('can')->willReturn(false);
+ $this->logger->expects(self::once())->method('warning');
+ $this->stateMachine->expects(self::never())->method('apply');
+
+ $this->mutator->apply('42', PaymentOutcome::PAID);
+ }
+}
diff --git a/tests/PHPUnit/Upc/SyliusPaymentOperationRepositoryTest.php b/tests/PHPUnit/Upc/SyliusPaymentOperationRepositoryTest.php
new file mode 100644
index 00000000..af3c17bd
--- /dev/null
+++ b/tests/PHPUnit/Upc/SyliusPaymentOperationRepositoryTest.php
@@ -0,0 +1,110 @@
+entityManager = $this->createMock(EntityManagerInterface::class);
+ $this->doctrineRepository = $this->createMock(EntityRepository::class);
+ $this->entityManager->method('getRepository')->with(PayPlugOperation::class)->willReturn($this->doctrineRepository);
+ $this->repository = new SyliusPaymentOperationRepository($this->entityManager);
+ }
+
+ public function testGetByOrderId_whenFound_returnsOperationData(): void
+ {
+ $entity = new PayPlugOperation('42', 'op_123', '0000', PaymentOutcome::PAID, 1000);
+ $this->doctrineRepository->method('findOneBy')->with(['orderId' => '42'])->willReturn($entity);
+
+ $result = $this->repository->getByOrderId('42');
+
+ self::assertSame('op_123', $result->operationId);
+ }
+
+ public function testGetByOrderId_whenMissing_throwsPaymentNotFoundException(): void
+ {
+ $this->doctrineRepository->method('findOneBy')->with(['orderId' => '42'])->willReturn(null);
+
+ $this->expectException(PaymentNotFoundException::class);
+
+ $this->repository->getByOrderId('42');
+ }
+
+ public function testGetByOperationId_whenFound_returnsOperationData(): void
+ {
+ $entity = new PayPlugOperation('42', 'op_123', '0000', PaymentOutcome::PAID, 1000);
+ $this->doctrineRepository->method('findOneBy')->with(['operationId' => 'op_123'])->willReturn($entity);
+
+ $result = $this->repository->getByOperationId('op_123');
+
+ self::assertSame('42', $result->orderId);
+ }
+
+ public function testGetByOperationId_whenMissing_throwsPaymentNotFoundException(): void
+ {
+ $this->doctrineRepository->method('findOneBy')->with(['operationId' => 'op_123'])->willReturn(null);
+
+ $this->expectException(PaymentNotFoundException::class);
+
+ $this->repository->getByOperationId('op_123');
+ }
+
+ public function testSave_persistsAndFlushesANewEntity(): void
+ {
+ $data = new OperationData('op_123', '0000', PaymentOutcome::PAID, 1000, '42');
+ $this->doctrineRepository->method('findOneBy')->with(['operationId' => 'op_123'])->willReturn(null);
+
+ $this->entityManager->expects(self::once())->method('persist')
+ ->with(self::isInstanceOf(PayPlugOperation::class));
+ $this->entityManager->expects(self::once())->method('flush');
+
+ $this->repository->save($data);
+ }
+
+ public function testIsTreated_delegatesToTheStoredEntity(): void
+ {
+ $entity = new PayPlugOperation('42', 'op_123', '0000', PaymentOutcome::PAID, 1000);
+ $entity->markTreated();
+ $this->doctrineRepository->method('findOneBy')->with(['operationId' => 'op_123'])->willReturn($entity);
+
+ self::assertTrue($this->repository->isTreated('op_123'));
+ }
+
+ public function testIsTreated_whenMissing_returnsFalse(): void
+ {
+ $this->doctrineRepository->method('findOneBy')->with(['operationId' => 'op_123'])->willReturn(null);
+
+ self::assertFalse($this->repository->isTreated('op_123'));
+ }
+
+ public function testMarkTreated_flagsTheStoredEntityAndFlushes(): void
+ {
+ $entity = new PayPlugOperation('42', 'op_123', '0000', PaymentOutcome::PAID, 1000);
+ $this->doctrineRepository->method('findOneBy')->with(['operationId' => 'op_123'])->willReturn($entity);
+
+ $this->entityManager->expects(self::once())->method('flush');
+
+ $this->repository->markTreated('op_123');
+
+ self::assertTrue($entity->isTreated());
+ }
+}
diff --git a/tests/PHPUnit/Upc/SyliusUnifiedApiHttpClientTest.php b/tests/PHPUnit/Upc/SyliusUnifiedApiHttpClientTest.php
new file mode 100644
index 00000000..d26d6393
--- /dev/null
+++ b/tests/PHPUnit/Upc/SyliusUnifiedApiHttpClientTest.php
@@ -0,0 +1,123 @@
+httpClient = $this->createMock(HttpClientInterface::class);
+ $this->logger = $this->createMock(LoggerInterface::class);
+ $this->adapter = new SyliusUnifiedApiHttpClient($this->httpClient, $this->logger, true);
+ }
+
+ public function testGet_sendsGetRequestWithHeaders(): void
+ {
+ $response = $this->createMock(ResponseInterface::class);
+ $response->method('getStatusCode')->willReturn(200);
+ $response->method('getContent')->with(false)->willReturn('{"id":"pay_123"}');
+
+ $this->httpClient->expects(self::once())->method('request')
+ ->with('GET', 'https://api.payplug.com/payments/pay_123', [
+ 'headers' => ['Authorization' => 'Bearer jwt'],
+ 'timeout' => 10,
+ ])
+ ->willReturn($response);
+
+ $result = $this->adapter->get('https://api.payplug.com/payments/pay_123', ['Authorization' => 'Bearer jwt']);
+
+ self::assertSame(['status' => 200, 'body' => '{"id":"pay_123"}'], $result);
+ }
+
+ public function testPostJson_sendsJsonEncodedBody(): void
+ {
+ $response = $this->createMock(ResponseInterface::class);
+ $response->method('getStatusCode')->willReturn(201);
+ $response->method('getContent')->with(false)->willReturn('{"id":"pay_123"}');
+
+ $this->httpClient->expects(self::once())->method('request')
+ ->with('POST', 'https://api.payplug.com/payments', [
+ 'json' => ['amount' => 1000],
+ 'headers' => ['Authorization' => 'Bearer jwt'],
+ 'timeout' => 10,
+ ])
+ ->willReturn($response);
+
+ $result = $this->adapter->postJson('https://api.payplug.com/payments', ['amount' => 1000], ['Authorization' => 'Bearer jwt']);
+
+ self::assertSame(['status' => 201, 'body' => '{"id":"pay_123"}'], $result);
+ }
+
+ public function testGet_onTransportFailure_returnsZeroStatusInsteadOfThrowing(): void
+ {
+ $response = $this->createMock(ResponseInterface::class);
+ $response->method('getStatusCode')->willThrowException(new TransportException('Could not resolve host'));
+ $this->httpClient->method('request')->willReturn($response);
+
+ $result = $this->adapter->get('https://api.payplug.com/payments/pay_123');
+
+ self::assertSame(0, $result['status']);
+ self::assertSame('Could not resolve host', $result['body']);
+ }
+
+ public function testPostJson_onTransportFailure_returnsZeroStatusInsteadOfThrowing(): void
+ {
+ $response = $this->createMock(ResponseInterface::class);
+ $response->method('getStatusCode')->willThrowException(new TransportException('Could not resolve host'));
+ $this->httpClient->method('request')->willReturn($response);
+
+ $result = $this->adapter->postJson('https://api.payplug.com/payments', []);
+
+ self::assertSame(0, $result['status']);
+ self::assertSame('Could not resolve host', $result['body']);
+ }
+
+ public function testGet_whenVerifyTlsDisabled_passesVerifyPeerAndVerifyHostFalse(): void
+ {
+ $adapter = new SyliusUnifiedApiHttpClient($this->httpClient, $this->logger, false);
+
+ $response = $this->createMock(ResponseInterface::class);
+ $response->method('getStatusCode')->willReturn(200);
+ $response->method('getContent')->with(false)->willReturn('{}');
+
+ $this->httpClient->expects(self::once())->method('request')
+ ->with('GET', 'https://staging-internal-payment.gcp.dlns.io/processing-operations/operations/op_1', [
+ 'headers' => [],
+ 'verify_peer' => false,
+ 'verify_host' => false,
+ 'timeout' => 10,
+ ])
+ ->willReturn($response);
+
+ $adapter->get('https://staging-internal-payment.gcp.dlns.io/processing-operations/operations/op_1');
+ }
+
+ public function testGet_whenVerifyTlsEnabled_neverPassesVerifyPeerOrVerifyHost(): void
+ {
+ $response = $this->createMock(ResponseInterface::class);
+ $response->method('getStatusCode')->willReturn(200);
+ $response->method('getContent')->with(false)->willReturn('{}');
+
+ $this->httpClient->expects(self::once())->method('request')
+ ->with('GET', 'https://api.payplug.com/payments/pay_123', ['headers' => [], 'timeout' => 10])
+ ->willReturn($response);
+
+ $this->adapter->get('https://api.payplug.com/payments/pay_123');
+ }
+}
diff --git a/tests/PHPUnit/Upc/SyliusUpcConfigurationRepositoryTest.php b/tests/PHPUnit/Upc/SyliusUpcConfigurationRepositoryTest.php
new file mode 100644
index 00000000..578738fe
--- /dev/null
+++ b/tests/PHPUnit/Upc/SyliusUpcConfigurationRepositoryTest.php
@@ -0,0 +1,194 @@
+entityManager = $this->createMock(EntityManagerInterface::class);
+ $this->configurationRepository = new SyliusUpcConfigurationRepository($this->entityManager);
+ }
+
+ private function gatewayConfig(array $config): GatewayConfigInterface&MockObject
+ {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getConfig')->willReturn($config);
+
+ return $gatewayConfig;
+ }
+
+ /** A repository scoped to a config carrying $config — the only supported way to read anything. */
+ private function scopedWith(array $config): ScopedConfigurationRepositoryInterface
+ {
+ return $this->configurationRepository->withGatewayConfig($this->gatewayConfig($config));
+ }
+
+ // -------------------------------------------------------------------------
+ // Explicit scoping — withGatewayConfig()
+ // -------------------------------------------------------------------------
+
+ /**
+ * Since PRE-3628 several enabled CB gateway configs may exist, one per channel. The scoped
+ * repository reads the config it was handed; the factory-name lookup that used to resolve an
+ * arbitrary channel's account is gone, along with the gateway config repository it needed.
+ */
+ public function testWithGatewayConfig_readsCredentialsFromTheScopedConfig(): void
+ {
+ $scoped = $this->configurationRepository->withGatewayConfig($this->gatewayConfig([
+ 'live' => false,
+ 'test_client' => ['client_id' => 'de_id', 'client_secret' => 'de_secret'],
+ ]));
+
+ self::assertSame('de_id', $scoped->getClientId());
+ self::assertSame('de_secret', $scoped->getClientSecret());
+ }
+
+ /**
+ * The whole point of the ticket: two enabled CB configs on different channels, each resolving
+ * its own credentials. Also pins the wither as immutable — scoping for DE must not disturb the
+ * instance already scoped to FR, which is what makes the shared service safe to reuse.
+ */
+ public function testWithGatewayConfig_withTwoChannelsSharingTheCbFactory_keepsEachScopeIndependent(): void
+ {
+ $fr = $this->configurationRepository->withGatewayConfig($this->gatewayConfig([
+ 'live' => true,
+ 'live_client' => ['client_id' => 'fr_id', 'client_secret' => 'fr_secret'],
+ ]));
+ $de = $this->configurationRepository->withGatewayConfig($this->gatewayConfig([
+ 'live' => true,
+ 'live_client' => ['client_id' => 'de_id', 'client_secret' => 'de_secret'],
+ ]));
+
+ self::assertSame('fr_id', $fr->getClientId());
+ self::assertSame('de_id', $de->getClientId());
+ self::assertNotSame($fr, $de);
+ }
+
+ /**
+ * Every consumer holds a PaymentMethodInterface rather than a bare gateway config, so this is
+ * the form they actually use; it exists to keep the null-check in one place instead of five.
+ */
+ public function testForPaymentMethod_scopesToThatMethodsOwnGatewayConfig(): void
+ {
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $method->method('getGatewayConfig')->willReturn($this->gatewayConfig([
+ 'live' => false,
+ 'test_client' => ['client_id' => 'fr_id', 'client_secret' => 'fr_secret'],
+ ]));
+
+ self::assertSame('fr_id', $this->configurationRepository->forPaymentMethod($method)->getClientId());
+ }
+
+ public function testForPaymentMethod_whenTheMethodHasNoGatewayConfig_throws(): void
+ {
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $method->method('getGatewayConfig')->willReturn(null);
+
+ $this->expectException(\LogicException::class);
+
+ $this->configurationRepository->forPaymentMethod($method);
+ }
+
+ /**
+ * A loud failure at an unscoped call site beats the previous silent wrong-account behaviour:
+ * any path that forgot to scope reports itself at runtime instead of signing with whichever
+ * config Doctrine returned first.
+ */
+ public function testGetClientId_whenUnscoped_throwsInsteadOfResolvingAnArbitraryConfig(): void
+ {
+ $this->expectException(\LogicException::class);
+ $this->expectExceptionMessage('not been scoped');
+
+ $this->configurationRepository->getClientId();
+ }
+
+ public function testGet_whenUnscoped_throwsInsteadOfResolvingAnArbitraryConfig(): void
+ {
+ $this->expectException(\LogicException::class);
+ $this->expectExceptionMessage('not been scoped');
+
+ $this->configurationRepository->get('payplug_webhook_authorization_header');
+ }
+
+ public function testGetClientId_whenLive_readsFromLiveClient(): void
+ {
+ $scoped = $this->scopedWith(['live' => true, 'live_client' => ['client_id' => 'live_id', 'client_secret' => 'live_secret']]);
+
+ self::assertSame('live_id', $scoped->getClientId());
+ }
+
+ public function testGetClientId_whenNotLive_readsFromTestClient(): void
+ {
+ $scoped = $this->scopedWith(['live' => false, 'test_client' => ['client_id' => 'test_id', 'client_secret' => 'test_secret']]);
+
+ self::assertSame('test_id', $scoped->getClientId());
+ }
+
+ public function testGetClientSecret_whenLive_readsFromLiveClient(): void
+ {
+ $scoped = $this->scopedWith(['live' => true, 'live_client' => ['client_id' => 'live_id', 'client_secret' => 'live_secret']]);
+
+ self::assertSame('live_secret', $scoped->getClientSecret());
+ }
+
+ public function testGetClientId_whenNoClientConfigStored_returnsEmptyString(): void
+ {
+ $scoped = $this->scopedWith(['live' => false]);
+
+ self::assertSame('', $scoped->getClientId());
+ }
+
+ public function testGetPublicKeyId_readsHfIdentifier(): void
+ {
+ $scoped = $this->scopedWith([PayPlugGatewayFactory::HF_IDENTIFIER => 'hf_ident_123']);
+
+ self::assertSame('hf_ident_123', $scoped->getPublicKeyId());
+ }
+
+ public function testGetPublicKeyValue_returnsEmptyString(): void
+ {
+ $scoped = $this->scopedWith([]);
+
+ self::assertSame('', $scoped->getPublicKeyValue());
+ }
+
+ public function testGet_readsArbitraryKeyFromConfig(): void
+ {
+ $scoped = $this->scopedWith(['payplug_webhook_authorization_header' => 'Bearer shared-secret']);
+
+ self::assertSame('Bearer shared-secret', $scoped->get('payplug_webhook_authorization_header'));
+ }
+
+ public function testGet_whenKeyMissing_returnsNull(): void
+ {
+ $scoped = $this->scopedWith([]);
+
+ self::assertNull($scoped->get('missing_key'));
+ }
+
+ public function testSet_mergesTheKeyIntoConfigAndFlushesTheScopedConfig(): void
+ {
+ $gatewayConfig = $this->gatewayConfig(['existing' => 'value']);
+ $gatewayConfig->expects(self::once())->method('setConfig')
+ ->with(['existing' => 'value', 'new_key' => 'new_value']);
+ $this->entityManager->expects(self::once())->method('flush');
+
+ $this->configurationRepository->withGatewayConfig($gatewayConfig)->set('new_key', 'new_value');
+ }
+}
diff --git a/tests/PHPUnit/Upc/SyliusUpcLockTest.php b/tests/PHPUnit/Upc/SyliusUpcLockTest.php
new file mode 100644
index 00000000..51e52eec
--- /dev/null
+++ b/tests/PHPUnit/Upc/SyliusUpcLockTest.php
@@ -0,0 +1,60 @@
+lockFactory = $this->createMock(LockFactory::class);
+ $this->lock = new SyliusUpcLock($this->lockFactory);
+ }
+
+ public function testAcquire_whenLockIsFree_returnsTrue(): void
+ {
+ $lockInterface = $this->createMock(SharedLockInterface::class);
+ $lockInterface->method('acquire')->with(false)->willReturn(true);
+ $this->lockFactory->method('createLock')->with('key', 30)->willReturn($lockInterface);
+
+ self::assertTrue($this->lock->acquire('key', 30));
+ }
+
+ public function testAcquire_whenLockIsHeld_returnsFalse(): void
+ {
+ $lockInterface = $this->createMock(SharedLockInterface::class);
+ $lockInterface->method('acquire')->with(false)->willReturn(false);
+ $this->lockFactory->method('createLock')->willReturn($lockInterface);
+
+ self::assertFalse($this->lock->acquire('key', 30));
+ }
+
+ public function testRelease_releasesAPreviouslyAcquiredLock(): void
+ {
+ $lockInterface = $this->createMock(SharedLockInterface::class);
+ $lockInterface->method('acquire')->willReturn(true);
+ $lockInterface->expects(self::once())->method('release');
+ $this->lockFactory->method('createLock')->willReturn($lockInterface);
+
+ $this->lock->acquire('key', 30);
+ $this->lock->release('key');
+ }
+
+ public function testRelease_whenNothingWasAcquired_doesNothing(): void
+ {
+ $this->expectNotToPerformAssertions();
+
+ $this->lock->release('never-acquired');
+ }
+}
diff --git a/tests/PHPUnit/Upc/SyliusUpcLoggerTest.php b/tests/PHPUnit/Upc/SyliusUpcLoggerTest.php
new file mode 100644
index 00000000..ceb653b6
--- /dev/null
+++ b/tests/PHPUnit/Upc/SyliusUpcLoggerTest.php
@@ -0,0 +1,44 @@
+psrLogger = $this->createMock(LoggerInterface::class);
+ $this->logger = new SyliusUpcLogger($this->psrLogger);
+ }
+
+ public function testDebug_delegatesToThePsrLogger(): void
+ {
+ $this->psrLogger->expects(self::once())->method('debug')->with('a message', ['key' => 'value']);
+
+ $this->logger->debug('a message', ['key' => 'value']);
+ }
+
+ public function testInfo_delegatesToThePsrLogger(): void
+ {
+ $this->psrLogger->expects(self::once())->method('info')->with('a message', []);
+
+ $this->logger->info('a message');
+ }
+
+ public function testError_delegatesToThePsrLogger(): void
+ {
+ $this->psrLogger->expects(self::once())->method('error')->with('a message', ['key' => 'value']);
+
+ $this->logger->error('a message', ['key' => 'value']);
+ }
+}
diff --git a/tests/PHPUnit/Upc/UnifiedApiAuthorizationOperatorTest.php b/tests/PHPUnit/Upc/UnifiedApiAuthorizationOperatorTest.php
new file mode 100644
index 00000000..bce512d0
--- /dev/null
+++ b/tests/PHPUnit/Upc/UnifiedApiAuthorizationOperatorTest.php
@@ -0,0 +1,155 @@
+ 'Bearer cached-jwt', 'Content-Type' => 'application/json'];
+
+ private IUnifiedApiHttpClient&MockObject $unifiedApiHttpClient;
+
+ private ScopedConfigurationRepositoryInterface&MockObject $configurationRepository;
+
+ private UnifiedApiAuthorizationOperator $operator;
+
+ protected function setUp(): void
+ {
+ $this->unifiedApiHttpClient = $this->createMock(IUnifiedApiHttpClient::class);
+ $tokenCache = $this->createMock(ITokenCache::class);
+ $tokenCache->method('get')->willReturn('cached-jwt');
+
+ $scoped = $this->createMock(ScopedConfigurationRepositoryInterface::class);
+ $scoped->method('getClientId')->willReturn('client_abc');
+ $scoped->method('getClientSecret')->willReturn('secret_xyz');
+ $this->configurationRepository = $this->createMock(ScopedConfigurationRepositoryInterface::class);
+ $this->configurationRepository->method('forPaymentMethod')->willReturn($scoped);
+
+ $oauth2Client = new OAuth2Client($this->createMock(IOAuthHttpClient::class), 'https://api.payplug.com', '', '', 'https://www.payplug.com');
+
+ $this->operator = new UnifiedApiAuthorizationOperator(
+ $this->unifiedApiHttpClient,
+ new TokenManager($tokenCache, $oauth2Client),
+ $this->configurationRepository,
+ 'https://api.payplug.com',
+ );
+ }
+
+ public function testCapture_partial_postsTheAmountToTheCaptureEndpointOfTheMethodsOwnAccount(): void
+ {
+ $method = $this->hostedFieldsPaymentMethod('acct_123');
+ $this->configurationRepository->expects(self::once())->method('forPaymentMethod')->with($method);
+
+ $this->unifiedApiHttpClient->expects(self::once())
+ ->method('postJson')
+ ->with(
+ 'https://api.payplug.com/api/payment-gateway/payments/pay_123/capture',
+ [
+ 'account' => ['id' => 'acct_123'],
+ 'orderId' => 'order_1',
+ 'description' => 'Capture #1 for order order_1',
+ 'amount' => 300,
+ 'currency' => 'USD',
+ ],
+ self::AUTH_HEADERS,
+ )
+ ->willReturn(['status' => 200, 'body' => '{"amount":300,"requestedAmount":1000,"operationIds":["op_c1"]}']);
+
+ $output = $this->operator->capture($method, 'pay_123', 'order_1', 300, 'USD');
+
+ self::assertSame(700, $output->remainingCapturableAmount);
+ }
+
+ public function testCancel_full_postsAVoidWithoutAmount(): void
+ {
+ $this->unifiedApiHttpClient->expects(self::once())
+ ->method('postJson')
+ ->with(
+ 'https://api.payplug.com/api/payment-gateway/payments/pay_123/void',
+ [
+ 'account' => ['id' => 'acct_123'],
+ 'orderId' => 'order_1',
+ 'description' => 'Cancellation #1 for order order_1',
+ ],
+ self::AUTH_HEADERS,
+ )
+ ->willReturn(['status' => 200, 'body' => '{"operationIds":["op_v1"]}']);
+
+ $this->operator->cancel($this->hostedFieldsPaymentMethod('acct_123'), 'pay_123', 'order_1', null);
+ }
+
+ public function testCancel_partialRefusedByTheContract_surfacesUpcsOwnException(): void
+ {
+ // The real staging answer (2026-09-24) to a partial void on an account without the option.
+ $this->unifiedApiHttpClient->method('postJson')->willReturn([
+ 'status' => 403,
+ 'body' => '{"status":403,"error":"Forbidden","errorCategory":"INVALID_REQUEST","message":"The operation is not allowed."}',
+ ]);
+
+ $this->expectException(PartialCancellationNotAllowedException::class);
+
+ $this->operator->cancel($this->hostedFieldsPaymentMethod('acct_123'), 'pay_123', 'order_1', 400, 'USD', 1);
+ }
+
+ /**
+ * Staging, 2026-09-24: a second capture on the same authorization comes back as HTTP 200 with
+ * a failure execCode. UPC must not let that through as a successful CaptureOutput.
+ */
+ public function testCapture_secondCaptureRefusedWithA200_surfacesMultipleCaptureNotAllowed(): void
+ {
+ $this->unifiedApiHttpClient->method('postJson')->willReturn([
+ 'status' => 200,
+ 'body' => '{"descriptor":"Plug","execCode":"4011","message":"Duplicate request.","operationIds":["op_dup"]}',
+ ]);
+
+ $this->expectException(MultipleCaptureNotAllowedException::class);
+
+ $this->operator->capture($this->hostedFieldsPaymentMethod('acct_123'), 'pay_123', 'order_1', 6201, 'USD', 2);
+ }
+
+ public function testCancel_partial_sendsTheCurrencyUpcRequiresAlongsideAnAmount(): void
+ {
+ $this->unifiedApiHttpClient->expects(self::once())
+ ->method('postJson')
+ ->with(self::anything(), self::callback(
+ static fn (array $body): bool => 1000 === $body['amount'] && 'USD' === $body['currency'],
+ ))
+ ->willReturn(['status' => 200, 'body' => '{"execCode":"0000","operationIds":["op_v1"]}']);
+
+ $this->operator->cancel($this->hostedFieldsPaymentMethod('acct_123'), 'pay_123', 'order_1', 1000, 'USD', 1);
+ }
+
+ private function hostedFieldsPaymentMethod(string $accountId): PaymentMethodInterface&MockObject
+ {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getConfig')->willReturn([
+ PayPlugGatewayFactory::HOSTED_FIELDS => true,
+ PayPlugGatewayFactory::HF_IDENTIFIER => $accountId,
+ ]);
+
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $method->method('getGatewayConfig')->willReturn($gatewayConfig);
+
+ return $method;
+ }
+}
diff --git a/tests/PHPUnit/Upc/UnifiedApiContractTest.php b/tests/PHPUnit/Upc/UnifiedApiContractTest.php
new file mode 100644
index 00000000..43655e14
--- /dev/null
+++ b/tests/PHPUnit/Upc/UnifiedApiContractTest.php
@@ -0,0 +1,45 @@
+ ['fullName' => 'John Doe'], 'saveFutureUsage' => true],
+ );
+
+ $body = $dto->createPayloadBody();
+
+ self::assertSame('hf_token_abc', $body['paymentMethod']['hfToken'] ?? null);
+ self::assertSame('John Doe', $body['paymentMethod']['details']['fullName'] ?? null);
+ self::assertTrue($body['paymentMethod']['saveFutureUsage'] ?? false);
+ }
+
+ public function testPaymentDto_sendsTheAliasInPaymentMethodStoredId(): void
+ {
+ $dto = new PaymentDto(
+ new CommonFieldsDto('acct_123', 1000, 'EUR', '000000042'),
+ 'card_alias_1',
+ 'ONE_CLICK',
+ );
+
+ $body = $dto->createPayloadBody();
+
+ self::assertSame('card_alias_1', $body['paymentMethod']['storedId'] ?? null);
+ }
+}
diff --git a/tests/PHPUnit/Upc/UnifiedApiOperationStatusFetcherTest.php b/tests/PHPUnit/Upc/UnifiedApiOperationStatusFetcherTest.php
new file mode 100644
index 00000000..a43a66c3
--- /dev/null
+++ b/tests/PHPUnit/Upc/UnifiedApiOperationStatusFetcherTest.php
@@ -0,0 +1,147 @@
+unifiedApiHttpClient = $this->createMock(IUnifiedApiHttpClient::class);
+ $this->oauthHttpClient = $this->createMock(IOAuthHttpClient::class);
+ $this->tokenCache = $this->createMock(ITokenCache::class);
+ $this->scopedConfiguration = $this->scopedConfigurationWith('client_abc', 'secret_xyz');
+ $this->configurationRepository = $this->createMock(ScopedConfigurationRepositoryInterface::class);
+ $this->configurationRepository->method('forPaymentMethod')
+ ->willReturnCallback(fn (): ScopedConfigurationRepositoryInterface => $this->scopedConfiguration);
+
+ $oauth2Client = new OAuth2Client($this->oauthHttpClient, 'https://api.payplug.com', '', '', 'https://www.payplug.com');
+ $tokenManager = new TokenManager($this->tokenCache, $oauth2Client);
+
+ $this->fetcher = new UnifiedApiOperationStatusFetcher(
+ $this->unifiedApiHttpClient,
+ $tokenManager,
+ $this->configurationRepository,
+ 'https://api.payplug.com',
+ );
+ }
+
+ private function scopedConfigurationWith(
+ string $clientId,
+ string $clientSecret,
+ ): ScopedConfigurationRepositoryInterface&MockObject
+ {
+ $scoped = $this->createMock(ScopedConfigurationRepositoryInterface::class);
+ $scoped->method('getClientId')->willReturn($clientId);
+ $scoped->method('getClientSecret')->willReturn($clientSecret);
+
+ return $scoped;
+ }
+
+ /**
+ * An operation id alone does not identify an account. Both call sites poll for a specific
+ * payment, so they pass that payment's method and the fetch is authenticated against the
+ * account the operation actually lives on.
+ */
+ public function testGetOperation_signsWithTheCredentialsOfThePaymentMethodsOwnAccount(): void
+ {
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $this->scopedConfiguration = $this->scopedConfigurationWith('de_id', 'de_secret');
+
+ $scopedFor = null;
+ $this->configurationRepository->expects(self::once())
+ ->method('forPaymentMethod')
+ ->willReturnCallback(function (PaymentMethodInterface $m) use (&$scopedFor): ScopedConfigurationRepositoryInterface {
+ $scopedFor = $m;
+
+ return $this->scopedConfiguration;
+ });
+
+ $sentCredentials = null;
+ $this->oauthHttpClient->method('post')->willReturnCallback(
+ function (string $url, array $formParams, array $headers = []) use (&$sentCredentials): array {
+ $sentCredentials = $headers['Authorization'];
+
+ return ['status' => 200, 'body' => json_encode(['access_token' => 'jwt', 'expires_in' => 300, 'token_type' => 'Bearer'])];
+ },
+ );
+ $this->unifiedApiHttpClient->method('get')->willReturn(['status' => 200, 'body' => '{}']);
+
+ $this->fetcher->getOperation('op_1', $method);
+
+ self::assertSame($method, $scopedFor);
+ self::assertSame('Basic ' . base64_encode('de_id:de_secret'), $sentCredentials);
+ }
+
+ public function testGetOperation_withValidCredentials_returnsTheRawResponse(): void
+ {
+ $this->tokenCache->method('get')->willReturn('cached-jwt');
+ $body = '{"id":"op_1","execCode":"0000","orderId":"000000072","amount":7400}';
+ $this->unifiedApiHttpClient->method('get')
+ ->with('https://api.payplug.com/processing-operations/operations/public/op_1', ['Authorization' => 'Bearer cached-jwt'])
+ ->willReturn(['status' => 200, 'body' => $body]);
+
+ $response = $this->fetcher->getOperation('op_1', $this->createMock(PaymentMethodInterface::class));
+
+ self::assertSame(['status' => 200, 'body' => $body], $response);
+ }
+
+ /**
+ * Unlike the old (deleted) UnifiedApiOperationService, an unknown operation id is not given
+ * its own exception type here — getOperation() folds a 404 into the same generic ApiException
+ * as any other non-2xx status, since no caller currently needs to tell them apart.
+ */
+ public function testGetOperation_onMissingOperation_throwsApiException(): void
+ {
+ $this->tokenCache->method('get')->willReturn('cached-jwt');
+ $this->unifiedApiHttpClient->method('get')->willReturn(['status' => 404, 'body' => '{}']);
+
+ $this->expectException(ApiException::class);
+ $this->expectExceptionCode(404);
+
+ $this->fetcher->getOperation('op_1', $this->createMock(PaymentMethodInterface::class));
+ }
+
+ public function testGetOperation_onNon2xxResponse_throwsApiException(): void
+ {
+ $this->tokenCache->method('get')->willReturn('cached-jwt');
+ $this->unifiedApiHttpClient->method('get')->willReturn(['status' => 500, 'body' => '{}']);
+
+ $this->expectException(ApiException::class);
+
+ $this->fetcher->getOperation('op_1', $this->createMock(PaymentMethodInterface::class));
+ }
+}
diff --git a/tests/PHPUnit/Upc/UnifiedApiPaymentCreatorTest.php b/tests/PHPUnit/Upc/UnifiedApiPaymentCreatorTest.php
new file mode 100644
index 00000000..97570ebd
--- /dev/null
+++ b/tests/PHPUnit/Upc/UnifiedApiPaymentCreatorTest.php
@@ -0,0 +1,155 @@
+unifiedApiHttpClient = $this->createMock(IUnifiedApiHttpClient::class);
+ $this->oauthHttpClient = $this->createMock(IOAuthHttpClient::class);
+ $this->tokenCache = $this->createMock(ITokenCache::class);
+
+ $this->scopedConfiguration = $this->scopedConfigurationWith('client_abc', 'secret_xyz');
+ $this->configurationRepository = $this->createMock(ScopedConfigurationRepositoryInterface::class);
+ $this->configurationRepository->method('forPaymentMethod')
+ ->willReturnCallback(fn (): ScopedConfigurationRepositoryInterface => $this->scopedConfiguration);
+
+ $oauth2Client = new OAuth2Client($this->oauthHttpClient, 'https://api.payplug.com', '', '', 'https://www.payplug.com');
+ $tokenManager = new TokenManager($this->tokenCache, $oauth2Client);
+
+ $this->creator = new UnifiedApiPaymentCreator(
+ $this->unifiedApiHttpClient,
+ $tokenManager,
+ $this->configurationRepository,
+ 'https://api.payplug.com',
+ );
+ }
+
+ private function dto(): HostedFieldDto
+ {
+ return new HostedFieldDto(new CommonFieldsDto('acct_123', 1000, 'eur', '42'), 'hf_token_abc');
+ }
+
+ private function scopedConfigurationWith(
+ string $clientId,
+ string $clientSecret,
+ ): ScopedConfigurationRepositoryInterface&MockObject
+ {
+ $scoped = $this->createMock(ScopedConfigurationRepositoryInterface::class);
+ $scoped->method('getClientId')->willReturn($clientId);
+ $scoped->method('getClientSecret')->willReturn($clientSecret);
+
+ return $scoped;
+ }
+
+ /**
+ * The payload DTO carries no account context, so the payment method is what tells the creator
+ * which PayPlug account to sign with. Since PRE-3628 two CB payment methods on different
+ * channels can hold different credentials, so reading them off an unscoped repository would
+ * create the payment on whichever account Doctrine happened to return.
+ */
+ public function testCreatePayment_signsWithTheCredentialsOfThePaymentMethodsOwnAccount(): void
+ {
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $this->scopedConfiguration = $this->scopedConfigurationWith('de_id', 'de_secret');
+
+ $scopedFor = null;
+ $this->configurationRepository->expects(self::once())
+ ->method('forPaymentMethod')
+ ->willReturnCallback(function (PaymentMethodInterface $m) use (&$scopedFor): ScopedConfigurationRepositoryInterface {
+ $scopedFor = $m;
+
+ return $this->scopedConfiguration;
+ });
+
+ $this->tokenCache->method('get')->willReturn(null); // force a token request
+ $sentCredentials = null;
+ $this->oauthHttpClient->method('post')->willReturnCallback(
+ function (string $url, array $formParams, array $headers = []) use (&$sentCredentials): array {
+ $sentCredentials = $headers['Authorization'];
+
+ return ['status' => 200, 'body' => json_encode(['access_token' => 'jwt', 'expires_in' => 300, 'token_type' => 'Bearer'])];
+ },
+ );
+ $this->unifiedApiHttpClient->method('postJson')->willReturn(['status' => 201, 'body' => '{"id":"pay_1"}']);
+
+ $this->creator->createPayment($this->dto(), $method);
+
+ self::assertSame($method, $scopedFor);
+ self::assertSame('Basic ' . base64_encode('de_id:de_secret'), $sentCredentials);
+ }
+
+ public function testCreateHostedPayment_withValidCredentials_returnsTheOutput(): void
+ {
+ $this->tokenCache->method('get')->willReturn(null);
+ $this->oauthHttpClient->method('post')->willReturn([
+ 'status' => 200,
+ 'body' => json_encode(['access_token' => 'fresh-jwt', 'expires_in' => 300, 'token_type' => 'Bearer']),
+ ]);
+ $this->unifiedApiHttpClient->method('postJson')->willReturn(['status' => 201, 'body' => '{"id":"pay_1"}']);
+
+ $output = $this->creator->createPayment($this->dto(), $this->createMock(PaymentMethodInterface::class));
+
+ self::assertSame(201, $output->status);
+ self::assertNull($output->redirectUrl);
+ }
+
+ public function testCreateHostedPayment_withPending3ds_extractsTheRedirectUrl(): void
+ {
+ $this->tokenCache->method('get')->willReturn('cached-jwt');
+ $this->unifiedApiHttpClient->method('postJson')->willReturn([
+ 'status' => 200,
+ 'body' => json_encode(['id' => 'pay_1', 'redirect' => ['url' => 'https://3ds.payplug.com/challenge']]),
+ ]);
+
+ $output = $this->creator->createPayment($this->dto(), $this->createMock(PaymentMethodInterface::class));
+
+ self::assertSame('https://3ds.payplug.com/challenge', $output->redirectUrl);
+ }
+
+ public function testCreateHostedPayment_onNon2xxResponse_throwsApiException(): void
+ {
+ $this->tokenCache->method('get')->willReturn('cached-jwt');
+ $this->unifiedApiHttpClient->method('postJson')->willReturn(['status' => 500, 'body' => '{}']);
+
+ $this->expectException(ApiException::class);
+
+ $this->creator->createPayment($this->dto(), $this->createMock(PaymentMethodInterface::class));
+ }
+}
diff --git a/tests/PHPUnit/Upc/UnifiedApiRefundCreatorTest.php b/tests/PHPUnit/Upc/UnifiedApiRefundCreatorTest.php
new file mode 100644
index 00000000..5019db3d
--- /dev/null
+++ b/tests/PHPUnit/Upc/UnifiedApiRefundCreatorTest.php
@@ -0,0 +1,251 @@
+unifiedApiHttpClient = $this->createMock(IUnifiedApiHttpClient::class);
+ $this->oauthHttpClient = $this->createMock(IOAuthHttpClient::class);
+ $this->tokenCache = $this->createMock(ITokenCache::class);
+
+ $this->scopedConfiguration = $this->scopedConfigurationWith('client_abc', 'secret_xyz');
+ $this->configurationRepository = $this->createMock(ScopedConfigurationRepositoryInterface::class);
+ $this->configurationRepository->method('forPaymentMethod')
+ ->willReturnCallback(fn (): ScopedConfigurationRepositoryInterface => $this->scopedConfiguration);
+
+ $oauth2Client = new OAuth2Client($this->oauthHttpClient, 'https://api.payplug.com', '', '', 'https://www.payplug.com');
+ $tokenManager = new TokenManager($this->tokenCache, $oauth2Client);
+
+ $this->creator = new UnifiedApiRefundCreator(
+ $this->unifiedApiHttpClient,
+ $tokenManager,
+ $this->configurationRepository,
+ 'https://api.payplug.com',
+ );
+
+ // Swappable so a test that needs to observe the token request itself can force a cache miss.
+ $this->tokenCache->method('get')->willReturnCallback(fn (): ?string => $this->cachedToken);
+ }
+
+ private function scopedConfigurationWith(
+ string $clientId,
+ string $clientSecret,
+ ): ScopedConfigurationRepositoryInterface&MockObject
+ {
+ $scoped = $this->createMock(ScopedConfigurationRepositoryInterface::class);
+ $scoped->method('getClientId')->willReturn($clientId);
+ $scoped->method('getClientSecret')->willReturn($clientSecret);
+
+ return $scoped;
+ }
+
+ /**
+ * createRefund() already routes the *account id* per payment method; the OAuth credentials it
+ * signs with have to follow the same method, or a refund on channel B is authenticated as
+ * channel A and rejected — or worse, accepted against the wrong merchant.
+ */
+ public function testCreateRefund_signsWithTheCredentialsOfThePaymentMethodsOwnAccount(): void
+ {
+ $method = $this->buildHostedFieldsPaymentMethod('acct_de');
+ $this->scopedConfiguration = $this->scopedConfigurationWith('de_id', 'de_secret');
+ $this->cachedToken = null; // force a real token request, so its credentials are observable
+
+ $scopedFor = null;
+ $this->configurationRepository->expects(self::once())
+ ->method('forPaymentMethod')
+ ->willReturnCallback(function (PaymentMethodInterface $m) use (&$scopedFor): ScopedConfigurationRepositoryInterface {
+ $scopedFor = $m;
+
+ return $this->scopedConfiguration;
+ });
+
+ $sentCredentials = null;
+ $this->oauthHttpClient->method('post')->willReturnCallback(
+ function (string $url, array $formParams, array $headers = []) use (&$sentCredentials): array {
+ $sentCredentials = $headers['Authorization'];
+
+ return ['status' => 200, 'body' => json_encode(['access_token' => 'jwt', 'expires_in' => 300, 'token_type' => 'Bearer'])];
+ },
+ );
+ $this->unifiedApiHttpClient->method('postJson')->willReturn(['status' => 200, 'body' => '{}']);
+
+ $this->creator->createRefund($method, 'pay_123', 'order_1');
+
+ self::assertSame($method, $scopedFor);
+ self::assertSame('Basic ' . base64_encode('de_id:de_secret'), $sentCredentials);
+ }
+
+ public function testCreateRefund_withoutAmount_sendsAFullRefundUsingTheMethodsOwnAccountId(): void
+ {
+ $method = $this->buildHostedFieldsPaymentMethod('acct_123');
+
+ $this->unifiedApiHttpClient->expects(self::once())
+ ->method('postJson')
+ ->with(
+ 'https://api.payplug.com/api/payment-gateway/payments/pay_123/refund',
+ [
+ 'account' => ['id' => 'acct_123'],
+ 'orderId' => 'order_1',
+ 'description' => 'Refund for order order_1',
+ ],
+ ['Authorization' => 'Bearer cached-jwt', 'Content-Type' => 'application/json'],
+ )
+ ->willReturn(['status' => 200, 'body' => '{"execCode":"0000"}']);
+
+ $result = $this->creator->createRefund($method, 'pay_123', 'order_1');
+
+ self::assertSame(['status' => 200, 'body' => '{"execCode":"0000"}'], $result);
+ }
+
+ public function testCreateRefund_withAmount_sendsAPartialRefund(): void
+ {
+ $method = $this->buildHostedFieldsPaymentMethod('acct_123');
+
+ $this->unifiedApiHttpClient->expects(self::once())
+ ->method('postJson')
+ ->with(
+ 'https://api.payplug.com/api/payment-gateway/payments/pay_123/refund',
+ [
+ 'account' => ['id' => 'acct_123'],
+ 'orderId' => 'order_1',
+ 'description' => 'Refund for order order_1',
+ 'amount' => 500,
+ ],
+ ['Authorization' => 'Bearer cached-jwt', 'Content-Type' => 'application/json'],
+ )
+ ->willReturn(['status' => 200, 'body' => '{}']);
+
+ $this->creator->createRefund($method, 'pay_123', 'order_1', 500);
+ }
+
+ public function testCreateRefund_onA404Response_throwsPaymentNotFoundException(): void
+ {
+ $method = $this->buildHostedFieldsPaymentMethod('acct_123');
+ $this->unifiedApiHttpClient->method('postJson')->willReturn(['status' => 404, 'body' => '{}']);
+
+ $this->expectException(PaymentNotFoundException::class);
+
+ $this->creator->createRefund($method, 'pay_123', 'order_1');
+ }
+
+ public function testCreateRefund_onNon2xxResponse_throwsApiException(): void
+ {
+ $method = $this->buildHostedFieldsPaymentMethod('acct_123');
+ $this->unifiedApiHttpClient->method('postJson')->willReturn(['status' => 500, 'body' => '{}']);
+
+ $this->expectException(ApiException::class);
+
+ $this->creator->createRefund($method, 'pay_123', 'order_1');
+ }
+
+ public function testCreateRefund_withANonPositiveAmount_throwsRefundAmountExceptionBeforeAnyNetworkCall(): void
+ {
+ $method = $this->buildHostedFieldsPaymentMethod('acct_123');
+ $this->unifiedApiHttpClient->expects(self::never())->method('postJson');
+
+ $this->expectException(RefundAmountException::class);
+
+ $this->creator->createRefund($method, 'pay_123', 'order_1', 0);
+ }
+
+ /**
+ * The refund body must state what $amount's minor units are: without it the Unified API infers
+ * the currency from the account, which silently means the wrong thing for a multi-currency
+ * merchant.
+ */
+ public function testCreateRefund_withCurrency_sendsItAlongsideTheAmount(): void
+ {
+ $method = $this->buildHostedFieldsPaymentMethod('acct_123');
+
+ $this->unifiedApiHttpClient->expects(self::once())
+ ->method('postJson')
+ ->with(
+ 'https://api.payplug.com/api/payment-gateway/payments/pay_123/refund',
+ [
+ 'account' => ['id' => 'acct_123'],
+ 'orderId' => 'order_1',
+ 'description' => 'Refund for order order_1',
+ 'amount' => 6800,
+ 'currency' => 'USD',
+ ],
+ ['Authorization' => 'Bearer cached-jwt', 'Content-Type' => 'application/json'],
+ )
+ ->willReturn(['status' => 200, 'body' => '{}']);
+
+ $this->creator->createRefund($method, 'pay_123', 'order_1', 6800, 'USD');
+ }
+
+ /**
+ * Credentials must come from $method's own gateway config, not from whichever
+ * Hosted-Fields-configured payment method IConfigurationRepository's backing store happens to
+ * resolve first — otherwise a merchant with more than one such payment method could have a
+ * refund routed to the wrong account.
+ */
+ public function testCreateRefund_withNoConfiguredAccountId_throwsLogicExceptionBeforeAnyNetworkCall(): void
+ {
+ $method = $this->buildHostedFieldsPaymentMethod('');
+
+ $this->unifiedApiHttpClient->expects(self::never())->method('postJson');
+
+ $this->expectException(\LogicException::class);
+ $this->expectExceptionMessage('Hosted Fields account id is not configured for this payment method.');
+
+ $this->creator->createRefund($method, 'pay_123', 'order_1');
+ }
+
+ private function buildHostedFieldsPaymentMethod(
+ string $accountId,
+ ): PaymentMethodInterface&MockObject
+ {
+ $gatewayConfig = $this->createMock(GatewayConfigInterface::class);
+ $gatewayConfig->method('getConfig')->willReturn([
+ PayPlugGatewayFactory::HOSTED_FIELDS => true,
+ PayPlugGatewayFactory::HF_IDENTIFIER => $accountId,
+ ]);
+
+ $method = $this->createMock(PaymentMethodInterface::class);
+ $method->method('getGatewayConfig')->willReturn($gatewayConfig);
+
+ return $method;
+ }
+}
diff --git a/tests/PHPUnit/Validator/PaymentMethodValidatorTest.php b/tests/PHPUnit/Validator/PaymentMethodValidatorTest.php
index f8fb7b70..5a97dd24 100644
--- a/tests/PHPUnit/Validator/PaymentMethodValidatorTest.php
+++ b/tests/PHPUnit/Validator/PaymentMethodValidatorTest.php
@@ -8,6 +8,11 @@
use PayPlug\SyliusPayPlugPlugin\Gateway\BancontactGatewayFactory;
use PayPlug\SyliusPayPlugPlugin\Gateway\OneyGatewayFactory;
use PayPlug\SyliusPayPlugPlugin\Gateway\PayPlugGatewayFactory;
+use PayPlug\SyliusPayPlugPlugin\Gateway\ScalapayGatewayFactory;
+use PayPlug\SyliusPayPlugPlugin\Gateway\Validator\Constraints\HasNoGatewayChannelConflict;
+use PayPlug\SyliusPayPlugPlugin\Gateway\Validator\Constraints\IsCanSavePaymentMethod;
+use PayPlug\SyliusPayPlugPlugin\Gateway\Validator\Constraints\IsScalapayAmountRangeValid;
+use PayPlug\SyliusPayPlugPlugin\Gateway\Validator\Constraints\PayplugPermission;
use PayPlug\SyliusPayPlugPlugin\Validator\PaymentMethodValidator;
use PHPUnit\Framework\MockObject\MockObject;
use PHPUnit\Framework\TestCase;
@@ -137,12 +142,13 @@ public function testProcess_withViolations_disablesMethodAndFlashesErrors(): voi
}
// -------------------------------------------------------------------------
- // process() — PayPlug factory, no special flags → only IsCanSavePaymentMethod constraint
+ // process() — PayPlug factory, no special flags → base constraints only
// -------------------------------------------------------------------------
/**
* PayPlug gateway with ONE_CLICK, DEFERRED_CAPTURE and INTEGRATED_PAYMENT all false.
- * Verifies only the base IsCanSavePaymentMethod constraint (1 total) is passed to the validator.
+ * Verifies only the always-present constraint (1 total) is passed to the validator:
+ * IsCanSavePaymentMethod.
*/
public function testProcess_payplugFactory_noFlags_validatesWithBaseConstraintOnly(): void
{
@@ -157,8 +163,8 @@ public function testProcess_payplugFactory_noFlags_validatesWithBaseConstraintOn
->expects(self::once())
->method('validate')
->willReturnCallback(function ($subject, array $constraints) {
- // Only the base IsCanSavePaymentMethod constraint (no permission constraints)
- self::assertCount(1, $constraints);
+ self::assertCount(2, $constraints);
+ self::assertInstanceOf(HasNoGatewayChannelConflict::class, $constraints[1]);
return new ConstraintViolationList();
})
@@ -173,12 +179,13 @@ public function testProcess_payplugFactory_noFlags_validatesWithBaseConstraintOn
}
// -------------------------------------------------------------------------
- // process() — PayPlug factory, all flags enabled → 4 constraints (base + 3 permissions)
+ // process() — PayPlug factory, all permission flags enabled → 4 constraints (1 base + 3 permissions)
// -------------------------------------------------------------------------
/**
* PayPlug gateway with ONE_CLICK, DEFERRED_CAPTURE and INTEGRATED_PAYMENT all true.
- * Verifies 4 constraints are passed to the validator (base + one per enabled feature flag).
+ * Verifies 4 constraints are passed to the validator: the always-present
+ * IsCanSavePaymentMethod plus one per enabled feature flag.
*/
public function testProcess_payplugFactory_allFlagsEnabled_validatesWithAllConstraints(): void
{
@@ -194,7 +201,116 @@ public function testProcess_payplugFactory_allFlagsEnabled_validatesWithAllConst
->method('validate')
->willReturnCallback(function ($subject, array $constraints) {
// Base + CAN_SAVE_CARD + CAN_CREATE_DEFERRED_PAYMENT + CAN_USE_INTEGRATED_PAYMENTS
- self::assertCount(4, $constraints);
+ self::assertCount(5, $constraints);
+ self::assertInstanceOf(HasNoGatewayChannelConflict::class, $constraints[4]);
+
+ return new ConstraintViolationList();
+ })
+ ;
+
+ $flashBag = $this->createMock(FlashBagInterface::class);
+ $session = $this->createMock(Session::class);
+ $session->method('getFlashBag')->willReturn($flashBag);
+ $this->requestStack->method('getSession')->willReturn($session);
+
+ $this->paymentMethodValidator->process($paymentMethod);
+ }
+
+ // -------------------------------------------------------------------------
+ // process() — PayPlug factory, hostedFields true, oneClick false → base constraint only
+ // -------------------------------------------------------------------------
+
+ /**
+ * PayPlug gateway in hosted_fields mode with oneClick absent/false. Verifies
+ * processPayplug() validates with the base IsCanSavePaymentMethod constraint only (1 total) —
+ * hosted_fields adds no permission constraint of its own, matching the redirected mode.
+ */
+ public function testProcess_payplugFactory_hostedFieldsTrueOneClickFalse_validatesWithBaseConstraintOnly(): void
+ {
+ $config = [
+ PayPlugGatewayFactory::HOSTED_FIELDS => true,
+ PayPlugGatewayFactory::ONE_CLICK => false,
+ ];
+ $paymentMethod = $this->buildPaymentMethod(PayPlugGatewayFactory::FACTORY_NAME, $config);
+
+ $this->validator
+ ->expects(self::once())
+ ->method('validate')
+ ->willReturnCallback(function ($subject, array $constraints) {
+ self::assertCount(2, $constraints);
+ self::assertInstanceOf(HasNoGatewayChannelConflict::class, $constraints[1]);
+ self::assertInstanceOf(IsCanSavePaymentMethod::class, $constraints[0]);
+
+ return new ConstraintViolationList();
+ })
+ ;
+
+ $flashBag = $this->createMock(FlashBagInterface::class);
+ $session = $this->createMock(Session::class);
+ $session->method('getFlashBag')->willReturn($flashBag);
+ $this->requestStack->method('getSession')->willReturn($session);
+
+ $this->paymentMethodValidator->process($paymentMethod);
+ }
+
+ // -------------------------------------------------------------------------
+ // process() — PayPlug factory, hostedFields true, oneClick true → base + CAN_SAVE_CARD
+ // -------------------------------------------------------------------------
+
+ /**
+ * PayPlug gateway in hosted_fields mode with oneClick=true. Verifies processPayplug() adds a
+ * PayplugPermission (CAN_SAVE_CARD) constraint alongside the base one (2 total) — the same
+ * behavior as oneClick in redirected/integrated_payment mode.
+ */
+ public function testProcess_payplugFactory_hostedFieldsTrueOneClickTrue_validatesWithPermissionConstraint(): void
+ {
+ $config = [
+ PayPlugGatewayFactory::HOSTED_FIELDS => true,
+ PayPlugGatewayFactory::ONE_CLICK => true,
+ ];
+ $paymentMethod = $this->buildPaymentMethod(PayPlugGatewayFactory::FACTORY_NAME, $config);
+
+ $this->validator
+ ->expects(self::once())
+ ->method('validate')
+ ->willReturnCallback(function ($subject, array $constraints) {
+ self::assertCount(3, $constraints);
+ self::assertInstanceOf(HasNoGatewayChannelConflict::class, $constraints[2]);
+ self::assertInstanceOf(IsCanSavePaymentMethod::class, $constraints[0]);
+ self::assertInstanceOf(PayplugPermission::class, $constraints[1]);
+
+ return new ConstraintViolationList();
+ })
+ ;
+
+ $flashBag = $this->createMock(FlashBagInterface::class);
+ $session = $this->createMock(Session::class);
+ $session->method('getFlashBag')->willReturn($flashBag);
+ $this->requestStack->method('getSession')->willReturn($session);
+
+ $this->paymentMethodValidator->process($paymentMethod);
+ }
+
+ // -------------------------------------------------------------------------
+ // process() — Scalapay factory → base constraint + amount range constraint
+ // -------------------------------------------------------------------------
+
+ /**
+ * Scalapay gateway config. Verifies both IsCanSavePaymentMethod and
+ * IsScalapayAmountRangeValid are passed to the validator (2 total).
+ */
+ public function testProcess_scalapayFactory_validatesWithBaseAndAmountRangeConstraints(): void
+ {
+ $paymentMethod = $this->buildPaymentMethod(ScalapayGatewayFactory::FACTORY_NAME, []);
+
+ $this->validator
+ ->expects(self::once())
+ ->method('validate')
+ ->willReturnCallback(function ($subject, array $constraints) {
+ self::assertCount(3, $constraints);
+ self::assertInstanceOf(HasNoGatewayChannelConflict::class, $constraints[2]);
+ self::assertInstanceOf(IsCanSavePaymentMethod::class, $constraints[0]);
+ self::assertInstanceOf(IsScalapayAmountRangeValid::class, $constraints[1]);
return new ConstraintViolationList();
})
diff --git a/translations/flashes.en.yml b/translations/flashes.en.yml
index 1faaa11a..b05df556 100644
--- a/translations/flashes.en.yml
+++ b/translations/flashes.en.yml
@@ -3,9 +3,36 @@ payplug_sylius_payplug_plugin:
oney_not_enabled: Oney is not (or is no longer) activated on your account.
api_unknow_error: An error occurred. Please retry in few seconds.
transaction_failed_1click: The transaction was not completed and your card was not charged.
+ transaction_failed: The transaction was not completed and your card was not charged.
warning:
payment_success_no_card_saved: The payment was successful but we were unable to save your credit card details.
admin:
oauth_callback_success: The OAuth connection was established successfully.
payment_method_disabled: ⚠️ The payment method has been disabled because some validation criteria are not met.
oauth_setup_error: An error occurred while setting up the OAuth connection. Please try again.
+ logout_success: The PayPlug account has been disconnected and this payment method has been disabled.
+ logout_error: An error occurred while disconnecting the PayPlug account. Please try again.
+ authorization:
+ capture_success: The capture has been performed.
+ cancel_success: The cancellation has been performed.
+ error:
+ not_authorized: This payment is not (or no longer) an authorization awaiting capture. Reload the page to see its current state.
+ stale: The order changed since this page was displayed (operation already performed?). Reload the page and check the remaining amount before trying again.
+ in_progress: Another operation is already in progress on this payment. Wait a few seconds, then reload the page.
+ expired: The authorization has expired and the funds have been released. No capture is possible any more; ask the customer for a new payment if needed.
+ cancel_after_capture: This payment has already been partly captured, so it can no longer be cancelled. Use a refund to return all or part of the captured amount.
+ nothing_remaining: Nothing is left to capture or cancel on this authorization.
+ invalid_amount: "Invalid amount. Enter a positive amount, e.g. 12.50, or leave the field blank for the remaining amount."
+ unsupported_currency: "An amount cannot be entered for a payment in this currency (%currency%). Leave the field blank to use the whole remaining amount. The payment was not changed."
+ amount_exceeds_remaining: "The amount exceeds what is still available (%remaining%). Enter a lower or equal amount."
+ amount_refused: PayPlug refused this amount (above the available amount, or invalid). Reload the page and check the remaining amount.
+ already_captured: PayPlug reports this payment as already captured. Reload the page; if the displayed state does not match, contact PayPlug support.
+ already_cancelled: PayPlug reports this payment as already cancelled. Reload the page; if the displayed state does not match, contact PayPlug support.
+ not_operable: PayPlug reports this payment is no longer in a state that allows this operation (already captured or cancelled). Reload the page; if the displayed state does not match, contact PayPlug support.
+ partial_cancellation_not_allowed: Partial cancellation is not enabled on your PayPlug contract. Cancel the whole amount (blank amount field) or contact PayPlug to enable the option.
+ conflict: Another operation is being processed by PayPlug for this payment. Try again in a moment.
+ refused_by_issuer: The customer's bank refused the operation. The payment was not changed.
+ multiple_capture_not_allowed: Only one capture is possible on this authorization with your PayPlug account, and it has already been performed. The remaining amount cannot be captured. For future orders, capture the final amount in one go, or contact PayPlug to enable multiple captures.
+ payment_not_found: This payment could not be found at PayPlug. Check that the payment method is connected to the right PayPlug account.
+ api_error: The operation could not be performed because of a PayPlug error. The payment was not changed; try again in a moment.
+ unexpected_error: The operation may have been performed by PayPlug, but it could not be recorded here. Check the payment in your PayPlug portal before trying again, to avoid capturing or cancelling twice.
diff --git a/translations/flashes.fr.yml b/translations/flashes.fr.yml
index b05b5110..fc9fa375 100644
--- a/translations/flashes.fr.yml
+++ b/translations/flashes.fr.yml
@@ -3,9 +3,36 @@ payplug_sylius_payplug_plugin:
oney_not_enabled: Oney n'est pas ou plus activé sur votre compte.
api_unknow_error: Une erreur s'est produite. Veuillez réessayer dans quelques secondes.
transaction_failed_1click: La transaction a échoué, votre carte de paiement ne sera pas débitée.
+ transaction_failed: La transaction a échoué, votre carte de paiement ne sera pas débitée.
warning:
payment_success_no_card_saved: Le paiement a été effectué avec succès, mais nous n'avons pas pu enregistrer votre carte bancaire.
admin:
oauth_callback_success: La connexion OAuth a été établie avec succès.
payment_method_disabled: ⚠️ La méthode de paiement a été désactivée car certains critères de validation ne sont pas remplis.
oauth_setup_error: Une erreur s'est produite lors de la configuration de la connexion OAuth. Veuillez réessayer.
+ logout_success: Le compte PayPlug a été déconnecté et ce moyen de paiement a été désactivé.
+ logout_error: Une erreur s’est produite lors de la déconnexion du compte PayPlug. Veuillez réessayer.
+ authorization:
+ capture_success: La capture a été effectuée.
+ cancel_success: L'annulation a été effectuée.
+ error:
+ not_authorized: Ce paiement n'est pas (ou plus) une autorisation en attente de capture. Rechargez la page pour voir son état actuel.
+ stale: La commande a changé depuis l'affichage de la page (opération déjà effectuée ?). Rechargez la page et vérifiez le montant restant avant de réessayer.
+ in_progress: Une opération est déjà en cours sur ce paiement. Patientez quelques secondes puis rechargez la page.
+ expired: L'autorisation a expiré, les fonds ont été libérés. Aucune capture n'est plus possible ; demandez un nouveau paiement au client si nécessaire.
+ cancel_after_capture: Une capture a déjà été effectuée sur ce paiement, il ne peut plus être annulé. Utilisez le remboursement pour rendre tout ou partie du montant capturé.
+ nothing_remaining: Il ne reste aucun montant à capturer ou annuler sur cette autorisation.
+ invalid_amount: "Montant invalide. Saisissez un montant positif, par exemple 12,50, ou laissez le champ vide pour le montant restant."
+ unsupported_currency: "Impossible de saisir un montant pour un paiement dans cette devise (%currency%). Laissez le champ vide pour utiliser tout le montant restant. Le paiement n'a pas été modifié."
+ amount_exceeds_remaining: "Le montant dépasse le restant disponible (%remaining%). Saisissez un montant inférieur ou égal."
+ amount_refused: PayPlug a refusé ce montant (supérieur au montant disponible ou invalide). Rechargez la page et vérifiez le montant restant.
+ already_captured: PayPlug indique que ce paiement a déjà été capturé. Rechargez la page ; si l'état affiché ne correspond pas, contactez le support PayPlug.
+ already_cancelled: PayPlug indique que ce paiement a déjà été annulé. Rechargez la page ; si l'état affiché ne correspond pas, contactez le support PayPlug.
+ not_operable: PayPlug indique que ce paiement n'est plus dans un état permettant cette opération (déjà capturé ou annulé). Rechargez la page ; si l'état affiché ne correspond pas, contactez le support PayPlug.
+ partial_cancellation_not_allowed: L'annulation partielle n'est pas activée sur votre contrat PayPlug. Annulez la totalité (champ montant vide) ou contactez PayPlug pour activer l'option.
+ conflict: Une autre opération est en cours de traitement chez PayPlug pour ce paiement. Réessayez dans quelques instants.
+ refused_by_issuer: La banque du client a refusé l'opération. Le paiement n'a pas été modifié.
+ multiple_capture_not_allowed: Une seule capture est possible sur cette autorisation avec votre compte PayPlug ; la capture précédente a déjà été effectuée. Le montant restant ne peut pas être capturé. Pour les prochaines commandes, capturez le montant final en une seule fois, ou contactez PayPlug pour activer la capture multiple.
+ payment_not_found: Ce paiement est introuvable chez PayPlug. Vérifiez que le moyen de paiement est connecté au bon compte PayPlug.
+ api_error: L'opération n'a pas pu être effectuée à cause d'une erreur PayPlug. Le paiement n'a pas été modifié ; réessayez dans quelques instants.
+ unexpected_error: L'opération a peut-être été effectuée par PayPlug, mais elle n'a pas pu être enregistrée ici. Vérifiez le paiement dans votre portail PayPlug avant de réessayer, pour ne pas capturer ou annuler deux fois.
diff --git a/translations/flashes.it.yml b/translations/flashes.it.yml
index 10cd5113..764f2bbe 100644
--- a/translations/flashes.it.yml
+++ b/translations/flashes.it.yml
@@ -3,9 +3,36 @@ payplug_sylius_payplug_plugin:
oney_not_enabled: Oney non è o non è più attivato per il tuo account.
api_unknow_error: C'è stato un errore. Per favore riprova tra qualche secondo.
transaction_failed_1click: La transazione non è stata conclusa e non è stato effettuato alcun addebito sulla tua carta.
+ transaction_failed: La transazione non è stata conclusa e non è stato effettuato alcun addebito sulla tua carta.
warning:
payment_success_no_card_saved: Il pagamento è andato a buon fine ma non è stato possibile salvare la tua carta di credito.
admin:
oauth_callback_success: La connessione OAuth è stata stabilita con successo.
payment_method_disabled: ⚠️ Il metodo di pagamento è stato disattivato perché alcuni criteri di validazione non sono soddisfatti.
oauth_setup_error: Si è verificato un errore durante la configurazione della connessione OAuth. Per favore riprova.
+ logout_success: L’account PayPlug è stato disconnesso e questo metodo di pagamento è stato disattivato.
+ logout_error: Si è verificato un errore durante la disconnessione dell’account PayPlug. Per favore riprova.
+ authorization:
+ capture_success: L'incasso è stato effettuato.
+ cancel_success: L'annullamento è stato effettuato.
+ error:
+ not_authorized: Questo pagamento non è (o non è più) un'autorizzazione in attesa di incasso. Ricarica la pagina per vederne lo stato attuale.
+ stale: L'ordine è cambiato dalla visualizzazione della pagina (operazione già eseguita?). Ricarica la pagina e verifica l'importo residuo prima di riprovare.
+ in_progress: Un'altra operazione è già in corso su questo pagamento. Attendi qualche secondo, poi ricarica la pagina.
+ expired: L'autorizzazione è scaduta e i fondi sono stati rilasciati. Non è più possibile alcun incasso; se necessario, chiedi al cliente un nuovo pagamento.
+ cancel_after_capture: Su questo pagamento è già stato effettuato un incasso, quindi non può più essere annullato. Usa un rimborso per restituire tutto o parte dell'importo incassato.
+ nothing_remaining: Non resta alcun importo da incassare o annullare su questa autorizzazione.
+ invalid_amount: "Importo non valido. Inserisci un importo positivo, ad es. 12,50, oppure lascia il campo vuoto per l'importo residuo."
+ unsupported_currency: "Non è possibile inserire un importo per un pagamento in questa valuta (%currency%). Lascia il campo vuoto per usare l'intero importo residuo. Il pagamento non è stato modificato."
+ amount_exceeds_remaining: "L'importo supera quello ancora disponibile (%remaining%). Inserisci un importo inferiore o uguale."
+ amount_refused: PayPlug ha rifiutato questo importo (superiore a quello disponibile o non valido). Ricarica la pagina e verifica l'importo residuo.
+ already_captured: PayPlug indica che questo pagamento è già stato incassato. Ricarica la pagina; se lo stato mostrato non corrisponde, contatta il supporto PayPlug.
+ already_cancelled: PayPlug indica che questo pagamento è già stato annullato. Ricarica la pagina; se lo stato mostrato non corrisponde, contatta il supporto PayPlug.
+ not_operable: PayPlug indica che questo pagamento non è più in uno stato che consente questa operazione (già incassato o annullato). Ricarica la pagina; se lo stato mostrato non corrisponde, contatta il supporto PayPlug.
+ partial_cancellation_not_allowed: L'annullamento parziale non è attivo sul tuo contratto PayPlug. Annulla l'intero importo (campo importo vuoto) o contatta PayPlug per attivare l'opzione.
+ conflict: Un'altra operazione è in corso di elaborazione presso PayPlug per questo pagamento. Riprova tra qualche istante.
+ refused_by_issuer: La banca del cliente ha rifiutato l'operazione. Il pagamento non è stato modificato.
+ multiple_capture_not_allowed: Con il tuo account PayPlug è possibile un solo incasso su questa autorizzazione, ed è già stato effettuato. L'importo residuo non può essere incassato. Per i prossimi ordini, incassa l'importo finale in una sola volta, oppure contatta PayPlug per attivare l'incasso multiplo.
+ payment_not_found: Questo pagamento non è stato trovato presso PayPlug. Verifica che il metodo di pagamento sia collegato all'account PayPlug corretto.
+ api_error: L'operazione non è stata eseguita a causa di un errore PayPlug. Il pagamento non è stato modificato; riprova tra qualche istante.
+ unexpected_error: L'operazione potrebbe essere stata eseguita da PayPlug, ma non è stato possibile registrarla qui. Verifica il pagamento nel tuo portale PayPlug prima di riprovare, per non catturare o annullare due volte.
diff --git a/translations/messages.en.yml b/translations/messages.en.yml
index 9ffa6acb..c968ddb0 100644
--- a/translations/messages.en.yml
+++ b/translations/messages.en.yml
@@ -5,6 +5,25 @@ payplug_sylius_payplug_plugin:
oney_x4_with_fees_payment: Oney 4x
oney_x3_without_fees_payment: Oney 3x Without Fees
oney_x4_without_fees_payment: Oney 4x Without Fees
+ authorization:
+ title: PayPlug — Deferred capture
+ authorized_amount: Authorized amount
+ captured_amount: Already captured
+ cancelled_amount: Cancelled
+ remaining_amount: Remaining capturable
+ max_capture_date: Capture deadline
+ max_capture_date_unknown: Not provided
+ expired: The authorization has expired and the funds have been released. No capture is possible any more.
+ expiring_soon: The authorization expires soon. Capture the amount you need before the deadline, or the funds will be released.
+ capture_amount: Amount to capture
+ capture: Capture
+ capture_help: Leave blank to capture the whole remaining amount. You may capture several times as long as the total stays within the authorized amount.
+ cancel_amount: Amount to cancel
+ cancel: Cancel authorization
+ cancel_help: Leave blank to cancel everything. Partial cancellation must be enabled on your PayPlug contract. Not possible after a first capture.
+ cancel_confirm: Confirm the cancellation? The cancelled funds will be released and can no longer be captured.
+ nothing_remaining: Nothing left to capture on this authorization.
+ not_authorized: No action available in the payment's current state.
ui:
account:
saved_cards:
@@ -34,6 +53,7 @@ payplug_sylius_payplug_plugin:
shipping.postcode: The postal code %postalCode% entered for the delivery address is invalid
payplug_gateway_label: Payplug
payment_refund_locally: The payment refund was made locally only.
+ payment_refund_missing_payment_id: 'This payment cannot be refunded from the back office: Payplug did not return its payment reference. Contact Payplug support mentioning order %order%.'
test_mode: TEST Mode
payplug_id: |
Payplug ID: %paymentId%
@@ -93,6 +113,10 @@ payplug_sylius_payplug_plugin:
title: 'The fees are:'
client: Split between you and your customers
merchant: For you
+ scalapay_gateway_config:
+ min_amount: Minimum amount
+ max_amount: Maximum amount
+ amount_help: Leave empty to use the limits authorized by PayPlug.
integrated_payment:
card_holder.title: 'Cardholder name'
card_holder.error: 'Invalid Name and/or Last Name.'
@@ -107,6 +131,13 @@ payplug_sylius_payplug_plugin:
place_order.label: 'Place order'
transaction_secure.label: 'Transaction secured by'
privacy_policy.label: 'Privacy Policy'
+ hosted_fields:
+ error.tokenization_failed: 'Your card details could not be validated. Please check them and try again.'
+ error.unsupported_brand: 'This card brand is not supported for this payment method. Please use a different card.'
+ save_card.label: 'Save my card'
+ place_order.label: 'Place order'
+ network_selection.label: 'Select your network'
+ network_selection.tooltip: 'Your card supports two networks and you can choose the one you want for this payment. If you do not, the network selected by default by the merchant will be used.'
deferred_capture:
process_order_info: |
You will be charged when your order is processed.
@@ -117,6 +148,13 @@ payplug_sylius_payplug_plugin:
renew_oauth: Force OAuth reconnection
renew_oauth_help: |
If this option is checked, a new authentication flow will be started when clicking the "Update" button.
+ hf_identifier_label: 'Account ID'
+ hosted_fields_option: 'Advanced (beta) Hosted Fields'
+ connected_account: Connected PayPlug account
+ connected_account_unknown: Re-authenticate to display the connected account
+ not_connected: No PayPlug account connected yet
+ logout: Disconnect this account
+ logout_help: Removes the PayPlug credentials stored for this payment method and disables it. The other payment methods keep their own connection.
form:
oney_error: Some missing information is required to pay using Oney by Payplug
complete_info:
@@ -130,13 +168,16 @@ payplug_sylius_payplug_plugin:
submit: Confirm and continue
base_currency_not_euro: |
Channel #channel_code#: #payment_method# is only available on channels with EURO as a currency
- only_one_gateway_allowed: |
- Please note that the %gateway_title% payment method has already been set. To change it, go to your payment methods.
+ gateway_channel_conflict: >-
+ Channel %channel% is already linked to the enabled payment method "%payment_method%". Disable it, or remove that channel from one of the two.
one_click_enable: Enable One click
one_click_help: |
Allow your customers to save their credit card details for later
integrated_payment_enable: Enable payment integrated
+ redirected_payment_enable: Enable redirected payment
+ account_id_required: 'Advanced features require an Account ID, please contact your Account Manager.'
+ integrated_payment_currency_incompatible: 'The selected channel is not compatible with Integrated Payment.'
deferred_capture_enable: Enable deferred capture
deferred_capture_help: |
diff --git a/translations/messages.fr.yml b/translations/messages.fr.yml
index 068fba68..0050815b 100644
--- a/translations/messages.fr.yml
+++ b/translations/messages.fr.yml
@@ -5,6 +5,25 @@ payplug_sylius_payplug_plugin:
oney_x4_with_fees_payment: Oney 4x
oney_x3_without_fees_payment: Oney 3x Sans Frais
oney_x4_without_fees_payment: Oney 4x Sans Frais
+ authorization:
+ title: PayPlug — Capture différée
+ authorized_amount: Montant autorisé
+ captured_amount: Déjà capturé
+ cancelled_amount: Annulé
+ remaining_amount: Restant capturable
+ max_capture_date: Date limite de capture
+ max_capture_date_unknown: Non communiquée
+ expired: L'autorisation a expiré, les fonds ont été libérés. Aucune capture n'est plus possible.
+ expiring_soon: L'autorisation expire bientôt. Capturez le montant souhaité avant la date limite, sinon les fonds seront libérés.
+ capture_amount: Montant à capturer
+ capture: Capturer
+ capture_help: Laissez vide pour capturer tout le restant. Vous pouvez capturer en plusieurs fois tant que le cumul reste dans le montant autorisé.
+ cancel_amount: Montant à annuler
+ cancel: Annuler l'autorisation
+ cancel_help: Laissez vide pour tout annuler. L'annulation partielle doit être activée sur votre contrat PayPlug. Impossible après une première capture.
+ cancel_confirm: Confirmer l'annulation ? Les fonds annulés seront libérés et ne pourront plus être capturés.
+ nothing_remaining: Plus rien à capturer sur cette autorisation.
+ not_authorized: Aucune action disponible dans l'état actuel du paiement.
ui:
account:
saved_cards:
@@ -34,6 +53,7 @@ payplug_sylius_payplug_plugin:
shipping.postcode: Le code postal %postalCode% renseigné pour l'adresse de livraison est invalide
payplug_gateway_label: Payplug
payment_refund_locally: Le remboursement du paiement a été effectué uniquement localement.
+ payment_refund_missing_payment_id: "Ce paiement ne peut pas être remboursé depuis le back-office : Payplug n'a pas renvoyé sa référence de paiement. Contactez le support Payplug en indiquant la commande %order%."
test_mode: Mode TEST
payplug_id: |
ID Payplug : %paymentId%
@@ -111,6 +131,10 @@ payplug_sylius_payplug_plugin:
title: 'Les frais sont :'
client: Répartis entre vous et vos clients
merchant: À votre charge
+ scalapay_gateway_config:
+ min_amount: Montant minimum
+ max_amount: Montant maximum
+ amount_help: Laissez vide pour utiliser les limites autorisées par PayPlug.
integrated_payment:
card_holder.title: 'Nom du titulaire de la carte'
card_holder.error: 'Nom et/ou prénom invalide(s).'
@@ -126,6 +150,13 @@ payplug_sylius_payplug_plugin:
place_order.label: 'Confirmer le paiement'
transaction_secure.label: 'Transaction sécurisée par'
privacy_policy.label: 'Politique de confidentialité'
+ hosted_fields:
+ error.tokenization_failed: 'Les informations de votre carte n’ont pas pu être validées. Veuillez les vérifier et réessayer.'
+ error.unsupported_brand: 'Cette marque de carte n’est pas prise en charge pour ce moyen de paiement. Merci d’utiliser une autre carte.'
+ save_card.label: 'Enregistrer ma carte bancaire'
+ place_order.label: 'Confirmer le paiement'
+ network_selection.label: 'Sélectionnez votre réseau'
+ network_selection.tooltip: 'Votre carte supporte deux réseaux et vous pouvez choisir celui que vous voulez pour ce paiement. Si vous ne le faites pas, alors le réseau sera celui sélectionné par défaut par le marchand.'
deferred_capture:
process_order_info: |
Vous serez prélevé(é) lors du traitement de votre commande.
@@ -137,6 +168,13 @@ payplug_sylius_payplug_plugin:
renew_oauth: Forcer la reconnexion OAuth
renew_oauth_help: |
Si cette option est cochée, un nouveau flux d’authentification sera lancé lors du clic sur le bouton "Mise à jour".
+ hf_identifier_label: 'Identifiant de compte'
+ hosted_fields_option: 'Hosted Fields avancé (beta)'
+ connected_account: Compte PayPlug connecté
+ connected_account_unknown: Reconnectez-vous pour afficher le compte connecté
+ not_connected: Aucun compte PayPlug connecté pour le moment
+ logout: Déconnecter ce compte
+ logout_help: Supprime les identifiants PayPlug enregistrés pour ce moyen de paiement et le désactive. Les autres moyens de paiement conservent leur propre connexion.
form:
oney_error: Il y a des informations manquantes pour pouvoir payer en utilisant Oney by Payplug
complete_info:
@@ -150,14 +188,17 @@ payplug_sylius_payplug_plugin:
submit: Valider et continuer
base_currency_not_euro: |
Canal #channel_code# : #payment_method# n’est disponible que sur des canaux dont la devise est l’EURO
- only_one_gateway_allowed: |
- Attention, le moyen de paiement %gateway_title% existe déjà. Pour le modifier, rendez-vous sur vos moyens de paiement.
+ gateway_channel_conflict: >-
+ Le canal %channel% est déjà rattaché au moyen de paiement actif « %payment_method% ». Désactivez-le, ou retirez ce canal de l'un des deux.
one_click_enable: Activer le One click
one_click_help: |
Permettez à vos clients d'enregistrer leurs coordonnées de carte de paiement pour effectuer ultérieurement
d'autres transactions
integrated_payment_enable: Activer le Paiement Integré
+ redirected_payment_enable: Activer le Paiement redirigé
+ account_id_required: 'Les fonctionnalités avancées nécessitent un Account ID, veuillez contacter votre Account Manager.'
+ integrated_payment_currency_incompatible: 'Le canal sélectionné n''est pas compatible avec le Paiement intégré'
deferred_capture_enable: Activer la capture différée
deferred_capture_help: |
Attention, assurez vous qu'un déclencheur de la capture différée a bien été ajouté dans le code source du projet
diff --git a/translations/messages.it.yml b/translations/messages.it.yml
index 10459f42..086dab6e 100644
--- a/translations/messages.it.yml
+++ b/translations/messages.it.yml
@@ -5,6 +5,25 @@ payplug_sylius_payplug_plugin:
oney_x4_with_fees_payment: Oney 4x
oney_x3_without_fees_payment: Oney 3x Nessuna Commissione
oney_x4_without_fees_payment: Oney 4x Nessuna Commissione
+ authorization:
+ title: PayPlug — Incasso differito
+ authorized_amount: Importo autorizzato
+ captured_amount: Già incassato
+ cancelled_amount: Annullato
+ remaining_amount: Residuo incassabile
+ max_capture_date: Scadenza per l'incasso
+ max_capture_date_unknown: Non comunicata
+ expired: L'autorizzazione è scaduta e i fondi sono stati rilasciati. Non è più possibile alcun incasso.
+ expiring_soon: L'autorizzazione scade a breve. Incassa l'importo desiderato prima della scadenza, altrimenti i fondi verranno rilasciati.
+ capture_amount: Importo da incassare
+ capture: Incassa
+ capture_help: Lascia vuoto per incassare tutto il residuo. Puoi incassare più volte finché il totale resta entro l'importo autorizzato.
+ cancel_amount: Importo da annullare
+ cancel: Annulla autorizzazione
+ cancel_help: Lascia vuoto per annullare tutto. L'annullamento parziale deve essere attivo sul tuo contratto PayPlug. Non possibile dopo un primo incasso.
+ cancel_confirm: Confermare l'annullamento? I fondi annullati verranno rilasciati e non potranno più essere incassati.
+ nothing_remaining: Non resta nulla da incassare su questa autorizzazione.
+ not_authorized: Nessuna azione disponibile nello stato attuale del pagamento.
ui:
account:
saved_cards:
@@ -34,6 +53,7 @@ payplug_sylius_payplug_plugin:
shipping.postcode: Il codice postale %postalCode% inserito per l’indirizzo di consegna non è valido
payplug_gateway_label: Payplug
payment_refund_locally: Il rimborso del pagamento è stato effettuato solo a livello locale (interno).
+ payment_refund_missing_payment_id: 'Questo pagamento non può essere rimborsato dal back office: Payplug non ha restituito il suo riferimento di pagamento. Contatta il supporto Payplug indicando l''ordine %order%.'
test_mode: Modalità TEST
payplug_id: |
ID Payplug : %paymentId%
@@ -93,6 +113,10 @@ payplug_sylius_payplug_plugin:
title: 'Le spese sono:'
client: Ripartite tra te e i tuoi clienti
merchant: A tuo carico
+ scalapay_gateway_config:
+ min_amount: Importo minimo
+ max_amount: Importo massimo
+ amount_help: Lascia vuoto per usare i limiti autorizzati da PayPlug.
integrated_payment:
card_holder.title: 'Titolare della carta'
card_holder.error: 'Nome e/o Cognome non valido(i).'
@@ -107,6 +131,13 @@ payplug_sylius_payplug_plugin:
place_order.label: 'Ordine'
transaction_secure.label: 'Transazione protetta da'
privacy_policy.label: 'Politica di confidenzialità'
+ hosted_fields:
+ error.tokenization_failed: 'Non è stato possibile verificare i dati della tua carta. Controllali e riprova.'
+ error.unsupported_brand: 'Questo marchio di carta non è supportato per questo metodo di pagamento. Utilizza un’altra carta.'
+ save_card.label: 'Salva la mia carta'
+ place_order.label: 'Ordine'
+ network_selection.label: 'Seleziona il tuo circuito'
+ network_selection.tooltip: 'La tua carta supporta due circuiti e puoi scegliere quello che preferisci per questo pagamento. Se non lo fai, verrà utilizzato il circuito selezionato di default dal commerciante.'
deferred_capture:
process_order_info: |
L'addebito avverrà al momento dell'elaborazione dell'ordine.
@@ -117,6 +148,13 @@ payplug_sylius_payplug_plugin:
renew_oauth: Forza la riconnessione OAuth
renew_oauth_help: |
Se questa opzione è selezionata, un nuovo flusso di autenticazione verrà avviato quando si fa clic sul pulsante "Aggiorna".
+ hf_identifier_label: 'ID Account'
+ hosted_fields_option: 'Hosted Fields avanzato (beta)'
+ connected_account: Account PayPlug collegato
+ connected_account_unknown: Autenticati di nuovo per visualizzare l'account collegato
+ not_connected: Nessun account PayPlug ancora collegato
+ logout: Disconnetti questo account
+ logout_help: Rimuove le credenziali PayPlug salvate per questo metodo di pagamento e lo disattiva. Gli altri metodi di pagamento mantengono la propria connessione.
form:
oney_error: Mancano alcune informazioni per poter pagare con “Oney by Payplug”
complete_info:
@@ -130,13 +168,16 @@ payplug_sylius_payplug_plugin:
submit: Convalida e continua
base_currency_not_euro: |
Il canale #channel_code# : #payment_method# è disponibile solo per i canali la cui valuta è in EURO
- only_one_gateway_allowed: |
- Attenzione: il metodo di pagamento %gateway_title% è già definito. Per modificarlo, vai ai tuoi metodi di pagamento.
+ gateway_channel_conflict: >-
+ Il canale %channel% è già collegato al metodo di pagamento attivo "%payment_method%". Disattivalo oppure rimuovi quel canale da uno dei due.
one_click_enable: Attiva un clic
one_click_help: |
Consenti ai tuoi clienti di salvare i dettagli della loro carta di credito per dopo
integrated_payment_enable: Abilita il pagamento integrato
+ redirected_payment_enable: Abilita il pagamento reindirizzato
+ account_id_required: 'Le funzionalità avanzate richiedono un Account ID, si prega di contattare il vostro Account Manager.'
+ integrated_payment_currency_incompatible: 'Il canale selezionato non è compatibile con il Pagamento integrato.'
deferred_capture_enable: Abilita la cattura differita
deferred_capture_help: |
Assicurarsi che nel codice sorgente del progetto sia stato aggiunto un trigger di acquisizione ritardata
diff --git a/translations/validators.en.yml b/translations/validators.en.yml
index 78c1c1fe..cf4141c2 100644
--- a/translations/validators.en.yml
+++ b/translations/validators.en.yml
@@ -33,6 +33,8 @@ payplug_sylius_payplug_plugin:
You don't have access to this feature yet.
To activate Scalapay, please contact us at support@payplug.com
and activate the LIVE mode.
+ min_amount_greater_than_max: The minimum amount must be lower than or equal to the maximum amount.
+ amount_out_of_authorized_range: The amount limits must be between %min_amount% and %max_amount%.
payplug_wero:
can_not_save_method_with_test_key: |
The Wero payment method is not available for the TEST mode.
diff --git a/translations/validators.fr.yml b/translations/validators.fr.yml
index 6031253d..5f4baffc 100644
--- a/translations/validators.fr.yml
+++ b/translations/validators.fr.yml
@@ -32,6 +32,8 @@ payplug_sylius_payplug_plugin:
Vous n'avez pas accès à cette fonctionnalité.
Pour activer Scalapay, contactez-nous à support@payplug.com
et activez le mode LIVE.
+ min_amount_greater_than_max: Le montant minimum doit être inférieur ou égal au montant maximum.
+ amount_out_of_authorized_range: Les limites de montant doivent être comprises entre %min_amount% et %max_amount%.
payplug_wero:
can_not_save_method_with_test_key: |
Le paiement par Wero n'est pas disponible en mode TEST.
diff --git a/translations/validators.it.yml b/translations/validators.it.yml
index 7dcf67b4..7ebaea99 100644
--- a/translations/validators.it.yml
+++ b/translations/validators.it.yml
@@ -32,6 +32,8 @@ payplug_sylius_payplug_plugin:
Non puoi ancora accedere a questa funzionalità.
Per attivare Scalapay, contattaci a support@payplug.com
e attiva la modalità LIVE.
+ min_amount_greater_than_max: L'importo minimo deve essere inferiore o uguale all'importo massimo.
+ amount_out_of_authorized_range: I limiti di importo devono essere compresi tra %min_amount% e %max_amount%.
payplug_wero:
can_not_save_method_with_test_key: |
Il metodo di pagamento Wero non è disponibile in modalità TEST.
{{ form_row(form.parent.parent.payplug_card_choice) }}
{% endif %}
- {% if integratedPayment %}
+ {% if is_hosted_fields %}
+ {% include '@PayPlugSyliusPayPlugPlugin/shop/hosted_fields/index.html.twig' with {
+ 'paymentMethod': method,
+ 'hasSavedCards': has_saved_cards,
+ } %}
+ {% elseif is_integrated_payment %}
{% include '@PayPlugSyliusPayPlugPlugin/shop/integrated/index.html.twig' with {
'paymentMethod': method,
'payment': order.getLastPayment('cart'),
- 'hasSavedCards': hasSavedCards,
+ 'hasSavedCards': has_saved_cards,
'paymentInputId': form.vars.id,
} %}
{% endif %}
diff --git a/tests/Behat/Context/Setup/PayPlugContext.php b/tests/Behat/Context/Setup/PayPlugContext.php
index 493e38b6..879059da 100644
--- a/tests/Behat/Context/Setup/PayPlugContext.php
+++ b/tests/Behat/Context/Setup/PayPlugContext.php
@@ -67,6 +67,30 @@ public function theStoreHasAPaymentMethodWithACodeAndPayPlugPaymentGateway(
$this->paymentMethodManager->flush();
}
+ /**
+ * @Given the store has a payment method :paymentMethodName with a code :paymentMethodCode and PayPlug Hosted Fields payment gateway
+ */
+ public function theStoreHasAPaymentMethodWithACodeAndPayPlugHostedFieldsPaymentGateway(
+ string $paymentMethodName,
+ string $paymentMethodCode,
+ ): void {
+ $paymentMethod = $this->createPaymentMethodPayPlug(
+ $paymentMethodName,
+ $paymentMethodCode,
+ PayPlugGatewayFactory::FACTORY_NAME,
+ PayPlugGatewayFactory::FACTORY_TITLE,
+ );
+
+ $paymentMethod->getGatewayConfig()->setConfig([
+ 'secretKey' => 'test',
+ 'payum.http_client' => '@payplug_sylius_payplug_plugin.api_client.payplug',
+ PayPlugGatewayFactory::HOSTED_FIELDS => true,
+ PayPlugGatewayFactory::HF_IDENTIFIER => 'test-company-id',
+ ]);
+
+ $this->paymentMethodManager->flush();
+ }
+
/**
* @Given the store has a payment method :paymentMethodName with a code :paymentMethodCode and Oney payment gateway
*/
diff --git a/tests/Behat/Context/Ui/Shop/CheckoutContext.php b/tests/Behat/Context/Ui/Shop/CheckoutContext.php
index ae35eef1..85b10294 100644
--- a/tests/Behat/Context/Ui/Shop/CheckoutContext.php
+++ b/tests/Behat/Context/Ui/Shop/CheckoutContext.php
@@ -4,7 +4,7 @@
namespace Tests\PayPlug\SyliusPayPlugPlugin\Behat\Context\Ui\Shop;
-use Behat\Behat\Context\Context;
+use Behat\MinkExtension\Context\RawMinkContext;
use PayPlug\SyliusPayPlugPlugin\ApiClient\PayPlugApiClientInterface;
use Sylius\Behat\Page\Shop\Checkout\CompletePageInterface;
use Sylius\Behat\Page\Shop\Order\ShowPageInterface;
@@ -13,7 +13,7 @@
use Tests\PayPlug\SyliusPayPlugPlugin\Behat\Page\Shop\Payum\PaymentPageInterface;
use Webmozart\Assert\Assert;
-final class CheckoutContext implements Context
+final class CheckoutContext extends RawMinkContext
{
/** @var CompletePageInterface */
private $summaryPage;
@@ -157,4 +157,15 @@ public function oneyIsDisabled(): void
{
$this->payPlugApiMocker->disableOney();
}
+
+ /**
+ * @Then I should see the :selector element on the page
+ */
+ public function iShouldSeeTheElementOnThePage(string $selector): void
+ {
+ Assert::notNull(
+ $this->getSession()->getPage()->find('css', $selector),
+ sprintf('Element matching selector "%s" was not found on the page.', $selector),
+ );
+ }
}
diff --git a/tests/Behat/Mocker/PayPlugApiClientFactory.php b/tests/Behat/Mocker/PayPlugApiClientFactory.php
index a143f64d..913e7313 100644
--- a/tests/Behat/Mocker/PayPlugApiClientFactory.php
+++ b/tests/Behat/Mocker/PayPlugApiClientFactory.php
@@ -6,6 +6,7 @@
use PayPlug\SyliusPayPlugPlugin\ApiClient\PayPlugApiClientFactoryInterface;
use PayPlug\SyliusPayPlugPlugin\ApiClient\PayPlugApiClientInterface;
+use Sylius\Component\Payment\Model\PaymentMethodInterface;
use Symfony\Component\DependencyInjection\ContainerInterface;
class PayPlugApiClientFactory implements PayPlugApiClientFactoryInterface
@@ -22,7 +23,11 @@ public function __construct(ContainerInterface $container, string $serviceName)
$this->serviceName = $serviceName;
}
- public function create(string $factoryName, ?string $key = null): PayPlugApiClientInterface
+ /**
+ * The Behat suites stub one PayPlug account for the whole scenario, so the payment method is
+ * ignored here — the mocked client is the same whichever one is passed.
+ */
+ public function createForPaymentMethod(PaymentMethodInterface $paymentMethod): PayPlugApiClientInterface
{
return new PayPlugApiClient($this->container, $this->serviceName);
}
diff --git a/tests/Behat/Resources/suites/ui/paying_with_payplug_for_order.yml b/tests/Behat/Resources/suites/ui/paying_with_payplug_for_order.yml
index 659d5003..df97f112 100644
--- a/tests/Behat/Resources/suites/ui/paying_with_payplug_for_order.yml
+++ b/tests/Behat/Resources/suites/ui/paying_with_payplug_for_order.yml
@@ -30,6 +30,9 @@ default:
- sylius.behat.context.setup.user
- payplug_sylius_payplug_plugin.behat.context.setup.payplug
+ # Provides "This secret Key is valid", which installs the static Payplug\Core\HttpClient
+ # mock for the whole test process (needed by templates calling is_payplug_test_mode_enabled).
+ - payplug_sylius_payplug_plugin.behat.context.ui.admin.managing_payment_method_payplug
# - sylius.behat.context.ui.paypal
- sylius.behat.context.ui.shop.cart
diff --git a/tests/PHPUnit/Action/Admin/Auth/UnifiedAuthenticationControllerTest.php b/tests/PHPUnit/Action/Admin/Auth/UnifiedAuthenticationControllerTest.php
new file mode 100644
index 00000000..4d534bb0
--- /dev/null
+++ b/tests/PHPUnit/Action/Admin/Auth/UnifiedAuthenticationControllerTest.php
@@ -0,0 +1,425 @@
+router = $this->createMock(RouterInterface::class);
+ $this->paymentMethodRepository = $this->createMock(RepositoryInterface::class);
+ $this->entityManager = $this->createMock(EntityManagerInterface::class);
+ $this->validator = $this->createMock(ValidatorInterface::class);
+ // final class — cannot be mocked by PHPUnit, so a real instance wired with mocked
+ // collaborators is built instead. Most scenarios here stop before process() is reached;
+ // the happy-path ones do reach it, hence the stubbed validator returning no violations.
+ $this->paymentMethodValidator = new PaymentMethodValidator(
+ $this->createMock(RequestStack::class),
+ $this->validator,
+ $this->entityManager,
+ );
+ $this->logger = $this->createMock(LoggerInterface::class);
+ $this->oauthHttpClient = $this->createMock(IOAuthHttpClient::class);
+
+ $this->controller = new UnifiedAuthenticationController(
+ $this->router,
+ $this->paymentMethodRepository,
+ $this->entityManager,
+ $this->paymentMethodValidator,
+ $this->logger,
+ $this->oauthHttpClient,
+ new IdTokenEmailExtractor(),
+ 'https://api-qa.payplug.com',
+ 'https://www.payplug.com',
+ );
+
+ $this->controller->setContainer(new ServiceLocator([
+ 'router' => fn () => $this->router,
+ ]));
+ }
+
+ protected function tearDown(): void
+ {
+ HttpClient::$REQUEST_HANDLER = null;
+ }
+
+ private function buildRequest(array $query = []): Request
+ {
+ $request = new Request($query);
+ $request->setSession(new Session(new MockArraySessionStorage()));
+
+ return $request;
+ }
+
+ /**
+ * PHPUnit resolves multiple `method('generate')->with(...)` stubs by registration order, not
+ * by which constraint actually matches a given call — a single callback branching on the
+ * route name is the only way to give different routes different return values reliably.
+ *
+ * @param array