2.1.8

Fix: the callback rejected PENDING

PENDING is a live status on the wire, but the callback switch had no case for it, so it fell through to the unknown-status branch and answered HTTP 400. SpectroCoin records that as a failed delivery and retries it. The order is already sitting in the module's pending state when it arrives, so the right response is to acknowledge and change nothing — exactly what NEW already did.

WooCommerce and OpenCart both handle PENDING; PrestaShop was the outlier.

Adds a tier 2 end-to-end test

Configures the module in a real PrestaShop, places a real order, and delivers a callback for all 18 statuses, asserting the resulting order state each time — including the ten informational ones, which must leave the order alone. Also asserts the outbound create-order request describes the shop's order (currency, total, order id, callback URL, project id, User-Agent), and that the callback endpoint refuses a GET, an unknown order, an order paid through another module, and a settlement in the wrong currency.

The SpectroCoin API is stood in for by a stub answering as spectrocoin.com inside the compose network over TLS, so the module's shipped Config URLs are exercised unmodified — no credentials, nothing reaches the real API.

This test is what found the bug: it failed on PENDING only, and went green after the fix. The guard assertions were separately negative-tested by disabling the payment-method check, which then let a callback settle an order paid through another module.

Scope note recorded in the test: the order fixture is cloned from PrestaShop's own demo order rather than built by validateOrder(), and the redirect controller is not run — both need the Symfony container, which is null outside an HTTP request. The callback controller, which is the code under test, runs over real HTTP with the full framework.

2.1.7

Fixes installation on current PrestaShop 8.2.x.

The module declared a maximum compliant version of 8.2.0.0, so PrestaShop refused to install it on any shop running a later 8.2 patch. The upper bound is now the first unsupported version.

Also adds a smoke test that installs the packaged module into a real PrestaShop and verifies it registers on paymentOptions.

2.1.6

Maintenance release. The callback now recognises the TEST order statuses, which were previously rejected.

2.1.5

Maintenance release. API calls now identify the plugin and its version. Renames the standalone check scripts so they are no longer picked up by PHPUnit's test discovery.

2.1.4

Maintenance release. Updates guzzlehttp/guzzle to 7.15.3.

2.1.3

Maintenance release.

The callback now recognises every order status the API can report. Cancellations end the order. Statuses that only report on a payment in progress are recorded and leave the order untouched. A status outside the contract is still rejected.

Adds invariant tests for the status table; the test directory is excluded from the packaged release.

2.1.2

Maintenance pass over the payment callback controller.

• Load the order and confirm it exists and that $order->module is this module. The controller previously never loaded the Order object at all, it only built an OrderHistory.
• Check the settlement currency and amount reported for the order against total_paid and the order currency; only an underpayment is rejected, with a rounding tolerance.
• A payload that carries no settlement amount is logged and passes through unchanged.

Version bumped to 2.1.2 in composer.json; $this->version left at 2.0.0 as before.

Note for review: the legacy branch reads $_POST[$key] after testing Tools::getIsset($key), which also matches query-string keys, so a key present only in the query string reads as undefined. Harmless today because the signature check rejects such a payload, but worth tidying. Separately, Tools::file_get_contents is used to load the public certificate and its TLS behaviour varies by PrestaShop version - worth confirming against the versions we support.

Needs a store smoke test on both callback formats before release. Merging this fires the release workflow.

2.1.1

Security maintenance release.

• Update guzzlehttp/guzzle 7.9.2 → 7.15.1
• Update guzzlehttp/psr7 2.7.0 → 2.13.0

Resolves the open Dependabot advisories (moderate). Updates both composer.lock and the vendored sources so the shipped module is patched. Dependency-only change; no functional changes. composer.json version bumped to 2.1.1.

2.1.0

Added support for new JSON and old URL-encoded form data callbacks format. New callbacks will be automatically enabled with new SpectroCoin merchant projects created. With old projects, old callback format will be used. In the future versions old callback format will be removed.

2.0.1

Fixed: Issues with plugin settings rendering