Complete Payment module: initiate/webhook/confirm/refund actions, Filament resources (T5.8-T5.13)

- InitiatePaymentAction + POST /api/v1/payments/{booking}/initiate - Generic KBZ webhook (POST /api/v1/webhooks/{method}/{encryptBookingId?}), signature verification per KBZ's real callback spec, PaymentGatewayInterface::handleWebhook() - ConfirmPaymentAction: idempotent confirmation, PaymentCompleted/PaymentFailed events, MarkBookingPaid listener - RefundBookingAction + POST /api/v1/bookings/{booking}/refund: partial refunds validated against remaining balance, RefundProcessed event, MarkBookingRefunded listener - CancelBookingAction now refunds confirmed bookings instead of rejecting; BookingPolicy::cancel requires process_refunds for confirmed bookings - PaymentPlugin + PaymentResource/RefundResource Filament admin UI (read-only payments, refund list + Process action) - Booking detail page now shows related payments - Fix CACHE_STORE mismatch (database -> redis) so tagged route caching works - CLAUDE.md: never run migrate:fresh/migrate:refresh/db:wipe on dev without being asked
2026-08-09 16:20:21 +07:00
parent 4737838021
commit d19a14a45e
55 changed files with 2547 additions and 29 deletions
@@ -0,0 +1,93 @@
+<?php
+
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\Log;
+use Modules\Booking\Models\Booking;
+use Modules\Payment\Support\KbzSignature;
+
+/**
+ * @param  array<string, mixed>  $overrides
+ * @return array<string, mixed>
+ */
+function signedKbzWebhookBody(array $overrides = []): array
+{
+    $merchantKey = 'test-merchant-key';
+
+    $notification = array_merge([
+        'appid' => 'APPID123',
+        'notify_time' => '1576842150',
+        'merch_code' => 'MERCH001',
+        'merch_order_id' => 'EVB-FIXTURE-001-1',
+        'mm_order_id' => '01001814070006560257',
+        'trans_currency' => 'MMK',
+        'total_amount' => '15000',
+        'trade_status' => 'PAY_SUCCESS',
+        'trans_end_time' => '1576834704',
+        'nonce_str' => '513ba55344ad44c8b69465aae66f7703',
+        'sign_type' => 'SHA256',
+    ], $overrides);
+
+    $notification['sign'] = KbzSignature::sign($notification, $merchantKey);
+
+    return ['Request' => $notification];
+}
+
+beforeEach(function () {
+    config(['services.kbz.merchant_key' => 'test-merchant-key']);
+});
+
+test('a validly signed kbz webhook is acknowledged with the literal success body', function () {
+    Log::spy();
+
+    $this->postJson('/api/v1/webhooks/kbz_mini_app', signedKbzWebhookBody())
+        ->assertOk()
+        ->assertSee('success');
+
+    Log::shouldHaveReceived('info')->once();
+});
+
+test('an invalidly signed kbz webhook is rejected with 400, never 500', function () {
+    Log::spy();
+
+    $body = signedKbzWebhookBody();
+    $body['Request']['sign'] = 'tampered';
+
+    $this->postJson('/api/v1/webhooks/kbz_mini_app', $body)
+        ->assertStatus(400);
+
+    Log::shouldHaveReceived('warning')->once();
+});
+
+test('an unknown gateway in the route segment 404s rather than reaching a controller', function () {
+    $this->postJson('/api/v1/webhooks/not_a_real_gateway', signedKbzWebhookBody())
+        ->assertNotFound();
+});
+
+test('a missing signature is rejected with 400', function () {
+    $this->postJson('/api/v1/webhooks/kbz_mini_app', ['Request' => ['trade_status' => 'PAY_SUCCESS']])
+        ->assertStatus(400);
+});
+
+test('the optional encrypted booking id segment is accepted and decrypted for logging', function () {
+    Log::spy();
+
+    $booking = Booking::factory()->create();
+    $encrypted = Crypt::encryptString((string) $booking->id);
+
+    $this->postJson("/api/v1/webhooks/kbz_mini_app/{$encrypted}", signedKbzWebhookBody())
+        ->assertOk();
+
+    Log::shouldHaveReceived('info')->withArgs(
+        fn (string $message, array $context): bool => $context['booking_id'] === $booking->id
+    )->once();
+});
+
+test('a garbage encrypted booking id segment does not fail the webhook', function () {
+    $this->postJson('/api/v1/webhooks/kbz_mini_app/not-a-real-ciphertext', signedKbzWebhookBody())
+        ->assertOk();
+});
+
+test('no auth:sanctum is required to reach the webhook', function () {
+    $this->postJson('/api/v1/webhooks/kbz_mini_app', signedKbzWebhookBody())
+        ->assertOk();
+});