Complete Payment module: initiate/webhook/confirm/refund actions, Filament resources (T5.8-T5.13)

- InitiatePaymentAction + POST /api/v1/payments/{booking}/initiate - Generic KBZ webhook (POST /api/v1/webhooks/{method}/{encryptBookingId?}), signature verification per KBZ's real callback spec, PaymentGatewayInterface::handleWebhook() - ConfirmPaymentAction: idempotent confirmation, PaymentCompleted/PaymentFailed events, MarkBookingPaid listener - RefundBookingAction + POST /api/v1/bookings/{booking}/refund: partial refunds validated against remaining balance, RefundProcessed event, MarkBookingRefunded listener - CancelBookingAction now refunds confirmed bookings instead of rejecting; BookingPolicy::cancel requires process_refunds for confirmed bookings - PaymentPlugin + PaymentResource/RefundResource Filament admin UI (read-only payments, refund list + Process action) - Booking detail page now shows related payments - Fix CACHE_STORE mismatch (database -> redis) so tagged route caching works - CLAUDE.md: never run migrate:fresh/migrate:refresh/db:wipe on dev without being asked
2026-08-09 16:20:21 +07:00
parent 4737838021
commit d19a14a45e
55 changed files with 2547 additions and 29 deletions
@@ -0,0 +1,89 @@
+<?php
+
+use Modules\Booking\Enums\BookingStatus;
+use Modules\Booking\Models\Booking;
+use Modules\Payment\Data\PaymentResultData;
+use Modules\Payment\Enums\PaymentMethod;
+use Modules\Payment\Enums\PaymentStatus;
+use Modules\Payment\Factories\PaymentGatewayFactory;
+use Modules\Payment\Gateways\KbzMiniAppGateway;
+use Modules\Payment\Models\Payment;
+use Modules\Payment\Support\KbzSignature;
+
+/**
+ * Keeps KbzMiniAppGateway's real handleWebhook() (so the inbound signature
+ * check in the webhook route stays genuine end-to-end) but stubs verify()
+ * so the double-delivery/idempotency test never hits the real KBZ API and
+ * can count re-verification calls.
+ */
+class FakeVerifyingKbzGateway extends KbzMiniAppGateway
+{
+    public static int $verifyCallCount = 0;
+
+    public function verify(string $gatewayTransactionId): PaymentResultData
+    {
+        self::$verifyCallCount++;
+
+        return new PaymentResultData(
+            status: PaymentStatus::Completed,
+            gatewayTransactionId: $gatewayTransactionId,
+            gatewayPayload: ['trade_status' => 'PAY_SUCCESS'],
+        );
+    }
+}
+
+beforeEach(function () {
+    FakeVerifyingKbzGateway::$verifyCallCount = 0;
+
+    config(['services.kbz.merchant_key' => 'test-merchant-key']);
+    app(PaymentGatewayFactory::class)->register(PaymentMethod::KbzMiniApp, FakeVerifyingKbzGateway::class);
+});
+
+/**
+ * @return array<string, mixed>
+ */
+function signedKbzConfirmationBody(string $merchOrderId): array
+{
+    $notification = [
+        'appid' => 'APPID123',
+        'notify_time' => '1576842150',
+        'merch_code' => 'MERCH001',
+        'merch_order_id' => $merchOrderId,
+        'mm_order_id' => '01001814070006560257',
+        'trans_currency' => 'MMK',
+        'total_amount' => '15000',
+        'trade_status' => 'PAY_SUCCESS',
+        'trans_end_time' => '1576834704',
+        'nonce_str' => '513ba55344ad44c8b69465aae66f7703',
+        'sign_type' => 'SHA256',
+    ];
+
+    $notification['sign'] = KbzSignature::sign($notification, 'test-merchant-key');
+
+    return ['Request' => $notification];
+}
+
+test('a double-delivered kbz webhook only confirms the payment and its booking once', function () {
+    $booking = Booking::factory()->create(['status' => BookingStatus::PendingPayment]);
+    $payment = Payment::factory()->create([
+        'booking_id' => $booking->id,
+        'status' => PaymentStatus::Pending,
+        'gateway' => PaymentMethod::KbzMiniApp,
+        'gateway_transaction_id' => 'EVB-DUPTEST-1',
+    ]);
+
+    $body = signedKbzConfirmationBody('EVB-DUPTEST-1');
+
+    $this->postJson('/api/v1/webhooks/kbz_mini_app', $body)->assertOk();
+
+    expect($payment->refresh()->status)->toBe(PaymentStatus::Completed)
+        ->and($booking->refresh()->status)->toBe(BookingStatus::Confirmed)
+        ->and(FakeVerifyingKbzGateway::$verifyCallCount)->toBe(1);
+
+    // KBZ redelivers the same notification — must not re-verify or re-confirm.
+    $this->postJson('/api/v1/webhooks/kbz_mini_app', $body)->assertOk();
+
+    expect($payment->refresh()->status)->toBe(PaymentStatus::Completed)
+        ->and($booking->refresh()->status)->toBe(BookingStatus::Confirmed)
+        ->and(FakeVerifyingKbzGateway::$verifyCallCount)->toBe(1);
+});