Complete Payment module: initiate/webhook/confirm/refund actions, Filament resources (T5.8-T5.13)

- InitiatePaymentAction + POST /api/v1/payments/{booking}/initiate - Generic KBZ webhook (POST /api/v1/webhooks/{method}/{encryptBookingId?}), signature verification per KBZ's real callback spec, PaymentGatewayInterface::handleWebhook() - ConfirmPaymentAction: idempotent confirmation, PaymentCompleted/PaymentFailed events, MarkBookingPaid listener - RefundBookingAction + POST /api/v1/bookings/{booking}/refund: partial refunds validated against remaining balance, RefundProcessed event, MarkBookingRefunded listener - CancelBookingAction now refunds confirmed bookings instead of rejecting; BookingPolicy::cancel requires process_refunds for confirmed bookings - PaymentPlugin + PaymentResource/RefundResource Filament admin UI (read-only payments, refund list + Process action) - Booking detail page now shows related payments - Fix CACHE_STORE mismatch (database -> redis) so tagged route caching works - CLAUDE.md: never run migrate:fresh/migrate:refresh/db:wipe on dev without being asked
2026-08-09 16:20:21 +07:00
parent 4737838021
commit d19a14a45e
55 changed files with 2547 additions and 29 deletions
@@ -0,0 +1,62 @@
+<?php
+
+namespace Modules\Payment\Actions;
+
+use Illuminate\Support\Facades\DB;
+use Modules\Payment\Enums\PaymentMethod;
+use Modules\Payment\Enums\PaymentStatus;
+use Modules\Payment\Events\PaymentCompleted;
+use Modules\Payment\Events\PaymentFailed;
+use Modules\Payment\Models\Payment;
+use Modules\Payment\Services\PaymentService;
+
+/**
+ * Confirms a Payment following an inbound webhook notification — never
+ * trusts the webhook's own trade_status directly, re-verifies with the
+ * gateway first (domain.md §6, bnf_event's client-driven-confirmation
+ * fallback pattern).
+ *
+ * Idempotent: KBZ may redeliver the same notification (or this may run more
+ * than once for the same transaction for other reasons), so a Payment only
+ * ever transitions out of `pending` once — a redelivery after that is a
+ * no-op that doesn't re-call the gateway or re-dispatch events.
+ */
+class ConfirmPaymentAction
+{
+    public function __construct(
+        private PaymentService $paymentService,
+    ) {}
+
+    public function handle(PaymentMethod $method, string $gatewayTransactionId): ?Payment
+    {
+        $payment = Payment::where('gateway', $method)
+            ->where('gateway_transaction_id', $gatewayTransactionId)
+            ->first();
+
+        if ($payment === null || $payment->status !== PaymentStatus::Pending) {
+            return $payment;
+        }
+
+        $verified = $this->paymentService->verify($method, $gatewayTransactionId);
+
+        if ($verified->status === PaymentStatus::Pending) {
+            return $payment;
+        }
+
+        return DB::transaction(function () use ($payment, $verified) {
+            $payment->update([
+                'status' => $verified->status,
+                'gateway_payload' => $verified->gatewayPayload,
+                'completed_at' => now(),
+            ]);
+
+            match ($verified->status) {
+                PaymentStatus::Completed => PaymentCompleted::dispatch($payment),
+                PaymentStatus::Failed => PaymentFailed::dispatch($payment),
+                PaymentStatus::Pending => null,
+            };
+
+            return $payment;
+        });
+    }
+}