Skip to content

Lesson 180: Sandbox Webhook Delivery Evidence

Choose a tag to compare

View all tags
@SplendidDigital SplendidDigital released this 09 Oct 13:16
· 1 commit to main since this release
Lesson180
7cb1a51
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Flipnzee Auctions — Lesson 180: Sandbox Webhook Delivery Evidence

Overview

Lesson 180 builds on the Lesson 153 stability baseline and subsequent development by strengthening Escrow Sandbox integration diagnostics, webhook auditability, and payment-lifecycle verification.

This release helps administrators distinguish webhook registration, endpoint reachability, request receipt, payload rejection, provider-side transaction verification, and successful local status synchronization.

What's New

Escrow Webhook Integration

  • Added read-only verification of the registered Sandbox webhook URL.
  • Checks that the expected Flipnzee webhook endpoint is registered in the current Sandbox account.
  • Verifies the linked Escrow transaction ID and external reference against the selected purchase intent.
  • Checks provider transaction state flags against the locally recorded payment status.

Webhook Receipt Audit

  • Records webhook processing stages, including request receipt and invalid-payload rejection.
  • Displays timestamps, environment, processing result, event information, transaction and intent identifiers, HTTP status, request ID, and diagnostic details.
  • Keeps the audit bounded to the latest 100 processing-stage entries.
  • Avoids storing raw payloads, request headers, API credentials, IP addresses, or buyer details.

Sandbox Delivery Evidence

  • Adds a read-only evidence summary for the linked Escrow transaction.
  • Excludes known synthetic probe events from genuine transaction-delivery evidence.
  • Distinguishes endpoint reachability from verified provider transaction data and local status synchronization.
  • Clearly indicates when genuine, non-probe delivery evidence has not been recorded.

Safe Endpoint Testing

  • Adds a controlled Sandbox-only endpoint probe using an intentionally invalid payload.
  • Verifies that the webhook handler rejects invalid requests with HTTP 400 before contacting Escrow or changing transaction status.
  • Keeps synthetic reliability tests separate from genuine provider-delivery evidence.

Payment Lifecycle Safety

  • Continues to verify transaction state independently through the Escrow API before processing supported payment-status transitions.
  • Preserves exact transaction and intent linkage checks.
  • Avoids treating webhook receipt alone as proof of sender identity or payment completion.
  • Does not automatically approve payments, mark funds as received, or initiate disbursements during read-only diagnostics.

Stability and Compatibility

  • Preserves the existing auction, bidding, Buy Now, purchase-intent, and transaction workflows.
  • Adds no database schema migration for these diagnostic improvements.
  • Keeps Production Buy Now gated while genuine Sandbox webhook delivery remains unverified.

Testing

The development checks include PHP syntax validation, ZIP integrity validation, Sandbox integration verification, safe endpoint rejection, and webhook audit inspection.

These checks validate local integration behavior and configuration. They do not, by themselves, establish successful delivery of a genuine Escrow webhook.

Important Notes

  • Use the matching Lesson 180 plugin ZIP attached to this release.
  • Keep Sandbox and Production credentials separate.
  • Do not use the endpoint probe as a substitute for a genuine provider event.
  • Before enabling production transactions, verify genuine webhook delivery and successful processing against independently retrieved Escrow transaction state.

Recommended baseline: Lesson 180 — Sandbox Webhook Delivery Evidence.

Assets 3
Loading