2.0.1 - league/oauth2-client, PSR-18, PSR-3, PHP 8.2

First release of this fork, and a substantial modernization of the OnPay PHP SDK.

Install with:

composer require tomsommer/onpay-php-sdk:^2.0

The package replaces onpayio/php-sdk, so it drops into a project that depends on the upstream SDK without a conflict.

Why this fork exists

Upstream carried a bundled copy of fkooman/oauth2-client — a PHP 5.4-era library whose own README recommends using something else — and then spent years working around it: a fake sessionless Session, an OAuth state built with crypt(), and a PKCE challenge generated but sent with an empty verifier. Every HTTP call was hard-wired to cURL, failures went to error_log(), and PRs to fix the latter two sat unreviewed for nine months (onpayio#98, onpayio#99).

What changed

• OAuth 2.0 now runs on league/oauth2-client. The whole vendored OnPay\OAuth\Client\* tree is gone, along with InternalTokenStorage, Session and CurlHttpClientLogger. Authorization, code exchange and token refresh go through a maintained library via OnPayProvider, exposed as getProvider() if you want to drive the flow yourself.
• HTTP goes through any PSR-18 client, with PSR-17 factories. Pass your own (Symfony HttpClient, Guzzle, Buzz) or let php-http/discovery find one. Also settable at runtime with setHttpClient().
• Failed responses are reported to a PSR-3 logger. OnPayAPI implements LoggerAwareInterface; without a logger it still falls back to error_log(), so nothing is dropped silently.
• PKCE is opt-in and actually works. Set the pkce_method option and carry the verifier across the redirect with getPkceCode() / setPkceCode().
• Malformed JSON and transport errors raise typed exceptions (ApiException, ConnectionException, TokenException) instead of yielding null.
• getLastHttpRequest() / getLastHttpResponse() return the PSR-7 messages, not a partial hand-rolled copy — so you get the real headers, status and reason phrase. The response body stream is rewound for you.
• PHP 8.2+, native types on the core classes, and CI running PHPUnit on PHP 8.2/8.3/8.4 (plus a lowest-dependencies job) and PHPStan level 5.

Upgrading from onpayio/php-sdk 1.x

OnPay\OnPayAPI, OnPay\StaticToken, everything under OnPay\API\* and the constructor signature new OnPayAPI($tokenStorage, $options) are unchanged, so for most integrations only the Composer package name changes.

Breaking changes:

• OnPay\OAuth\Client\*, OnPay\InternalTokenStorage, OnPay\Session and OnPay\CurlHttpClientLogger were removed. Nothing in the public API referenced them.
• OnPay\API\Http\Request and OnPay\API\Http\Response were removed. The last-exchange accessors return PSR-7 messages instead; getUri() now returns a UriInterface, so cast it to string.
• TokenStorageInterface declares getToken(): ?string and saveToken(string $token): void. Add the types to your own implementation.
• Tokens are stored in league/oauth2-client format. Tokens written by 1.x are still read, so existing installations keep working without re-authorizing.
• A PSR-18 client must be installable. composer require pulls in php-http/discovery, which finds any client you already have; install one (for example symfony/http-client with nyholm/psr7, or guzzlehttp/guzzle) if you have none.
• The SDK no longer sets a cURL timeout of its own, because it no longer owns the transport. Configure the timeout on the HTTP client you inject.

Known issues

• If OnPay's token endpoint ever omits refresh_token from a refresh response (permitted by RFC 6749 §6), the stored token loses its refresh token and the next expiry is unrecoverable. Not observed in practice; fix queued.
• 2.0.0 was tagged the same day and is superseded by this release. Use ^2.0.

Upstream project: https://github.com/onpayio/php-sdk — the commits behind onpayio#98 and onpayio#99 remain in this fork's history if OnPay ever wants to pick them up.