v1.2.0

Two follow-ups from putting 1.1 to work in setono/payum-quickpay — Quickpay knowledge every integration re-derives, now in the SDK (#22, #25). Additive; both verified against the live API.

composer require setono/quickpay-php-sdk:^1.2

Highlights

• Your callbacks for captures, refunds and cancels now actually arrive. Quickpay POSTs the callback of an API-issued operation to the account-wide callback URL (empty by default) — not to the callback_url on the payment link — so a shop that only set the link's URL never heard about them. Every operation now takes callbackUrl:, sent as the QuickPay-Callback-Url header (Client::CALLBACK_URL_HEADER) so that operation notifies the URL you name:

  $client->payments()->capture($id, new CaptureRequest(1000), callbackUrl: $notifyUrl);

  The low-level get()/post()/put()/patch()/delete() accept extra request headers too (renew, session, … can send it), and Link::$autoCapture / $autoCaptureAt are typed. (#26)
• Read a decline. A declined synchronized capture/refund/cancel is a 2xx with the decline on the operation. Operation::hasOutcome() / isDeclined() say it plainly, and Payment gained the views that decide an order's status: latestOperationOfType(), latestApprovedOperation() (where the money actually is — a trailing rejected or pending attempt no longer masks it), hasApprovedOperation(?type), and hasPendingOperation(?type). "Latest" is always the highest operation id, defined once. (#27)
• order_id fails fast, with the real rule. Live probing showed the API accepts 4–20 characters of letters, digits, space, ., _, - and rejects everything else (/ # : @ % + …, any non-ASCII) under the misleading "must have length between 4 and 20". CreatePaymentRequest now validates that at construction (ORDER_ID_PATTERN) and throws the new Setono\Quickpay\Exception\InvalidArgumentException — an SPL InvalidArgumentException that is also a QuickpayException. (#27)
• paymentMethods as a list. new CreateLinkRequest(..., paymentMethods: ['creditcard', '!amex']) is joined the way Quickpay expects (a (string) cast of a list used to send the literal Array and reject every payment). (#27)
• README — where operation callbacks go; state reads pending during any asynchronous operation (with the pre-operation balance); Quickpay does not retry a declined operation (a declined auto-capture leaves the payment new/authorized); synchronized declines are 2xx; the orderId rule; the new helpers with a decline-check snippet. The e2e operate.php now routes operation callbacks to the listener.

Changed

• CreatePaymentRequest validates orderId at construction (see above). Code that relied on the API's ValidationException for a bad order_id now fails earlier — locally, and with a message naming the actual rule.
• CollectionRequestOptions throws Setono\Quickpay\Exception\InvalidArgumentException — a subclass of the SPL exception it threw before, so existing catches keep working.

BC notes

• ClientInterface::get()/post()/put()/patch()/delete() and the protected ResourceEndpoint::postOperation() gained an optional $headers parameter. Callers are unaffected; only code that implements the mock-only interface (Client is its sole implementation) or subclasses the SDK's endpoint base (unsupported) needs to add the parameter. The Roave BC check reported these on #26 and it was knowingly merged red.

Quality

210 tests (1.1.0: 166), PHPStan level max, CI across PHP 8.1–8.5 × lowest/highest, plus the Roave backwards-compatibility check on every PR.

Full changelog: v1.1.0...v1.2.0 · CHANGELOG.md