Merge pull request #28 from academe/protocol3

Support SagePay Protocol v3.00

Author: greydnls

README.md

@@ -33,6 +33,8 @@ The following gateways are provided by this package:
 
 * SagePay_Direct
 * SagePay_Server
+* SagePay_Direct3
+* SagePay_Server3
 
 For general usage instructions, please see the main [Omnipay](https://github.com/thephpleague/omnipay)
 repository.

src/DirectGateway.php

@@ -9,6 +9,8 @@
  */
 class DirectGateway extends AbstractGateway
 {
+    // Gateway identification.
+
     public function getName()
     {
         return 'Sage Pay Direct';
@@ -19,11 +21,12 @@ public function getDefaultParameters()
         return array(
             'vendor' => '',
             'testMode' => false,
-            'simulatorMode' => false,
             'referrerId' => '',
         );
     }
 
+    // Vendor identification.
+
     public function getVendor()
     {
         return $this->getParameter('vendor');
@@ -34,16 +37,16 @@ public function setVendor($value)
         return $this->setParameter('vendor', $value);
     }
 
-    public function getSimulatorMode()
-    {
-        return $this->getParameter('simulatorMode');
-    }
+    // Access to the HTTP client for debugging.
+    // NOTE: this is likely to be removed or replaced with something
+    // more appropriate.
 
-    public function setSimulatorMode($value)
+    public function getHttpClient()
     {
-        return $this->setParameter('simulatorMode', $value);
+        return $this->httpClient;
     }
 
+    // Available services.
     public function getReferrerId()
     {
         return $this->getParameter('referrerId');

src/Message/AbstractRequest.php

@@ -2,14 +2,15 @@
 
 namespace Omnipay\SagePay\Message;
 
+use Omnipay\Common\Exception\InvalidRequestException;
+
 /**
  * Sage Pay Abstract Request
  */
 abstract class AbstractRequest extends \Omnipay\Common\Message\AbstractRequest
 {
     protected $liveEndpoint = 'https://live.sagepay.com/gateway/service';
     protected $testEndpoint = 'https://test.sagepay.com/gateway/service';
-    protected $simulatorEndpoint = 'https://test.sagepay.com/Simulator';
 
     public function getVendor()
     {
@@ -21,16 +22,6 @@ public function setVendor($value)
         return $this->setParameter('vendor', $value);
     }
 
-    public function getSimulatorMode()
-    {
-        return $this->getParameter('simulatorMode');
-    }
-
-    public function setSimulatorMode($value)
-    {
-        return $this->setParameter('simulatorMode', $value);
-    }
-
     public function getService()
     {
         return $this->action;
@@ -115,7 +106,7 @@ public function setApply3DSecure($value)
     protected function getBaseData()
     {
         $data = array();
-        $data['VPSProtocol'] = '2.23';
+        $data['VPSProtocol'] = '3.00';
         $data['TxType'] = $this->action;
         $data['Vendor'] = $this->getVendor();
         $data['AccountType'] = $this->getAccountType() ?: 'E';
@@ -134,19 +125,6 @@ public function getEndpoint()
     {
         $service = strtolower($this->getService());
 
-        if ($this->getSimulatorMode()) {
-            // hooray for consistency
-            if ($service == 'vspdirect-register') {
-                return $this->simulatorEndpoint.'/VSPDirectGateway.asp';
-            } elseif ($service == 'vspserver-register') {
-                return $this->simulatorEndpoint.'/VSPServerGateway.asp?Service=VendorRegisterTx';
-            } elseif ($service == 'direct3dcallback') {
-                return $this->simulatorEndpoint.'/VSPDirectCallback.asp';
-            }
-
-            return $this->simulatorEndpoint.'/VSPServerGateway.asp?Service=Vendor'.ucfirst($service).'Tx';
-        }
-
         if ($this->getTestMode()) {
             return $this->testEndpoint."/$service.vsp";
         }

src/Message/ServerCompleteAuthorizeRequest.php

@@ -9,14 +9,25 @@
  */
 class ServerCompleteAuthorizeRequest extends AbstractRequest
 {
-    public function getData()
+    /**
+     * Get the signature calculated from the three pieces of saved local
+     * information:
+     * * VendorTxCode - merchant site ID (aka transactionId).
+     * * VPSTxId - SagePay ID (aka transactionReference)
+     * * SecurityKey - SagePay one-use token.
+     * and the POSTed transaction results.
+     * Note that the three items above are passed in as a single JSON structure
+     * as the transactionReference. Would be nice if that were just the fallback,
+     * if not passed in as three separate items to the relevant fields.
+     */
+    public function getSignature()
     {
         $this->validate('transactionId', 'transactionReference');
 
         $reference = json_decode($this->getTransactionReference(), true);
 
-        // validate VPSSignature
-        $signature = md5(
+        // Re-create the VPSSignature
+        $signature_string =
             $reference['VPSTxId'].
             $reference['VendorTxCode'].
             $this->httpRequest->request->get('Status').
@@ -33,8 +44,24 @@ public function getData()
             $this->httpRequest->request->get('AddressStatus').
             $this->httpRequest->request->get('PayerStatus').
             $this->httpRequest->request->get('CardType').
-            $this->httpRequest->request->get('Last4Digits')
-        );
+            $this->httpRequest->request->get('Last4Digits').
+            // New for protocol v3.00
+            // Described in the docs as "mandatory" but not supplied when PayPal is used,
+            // so provide the defaults.
+            $this->httpRequest->request->get('DeclineCode', '').
+            $this->httpRequest->request->get('ExpiryDate', '').
+            $this->httpRequest->request->get('FraudResponse', '').
+            $this->httpRequest->request->get('BankAuthCode', '');
+
+        return md5($signature_string);
+    }
+
+    /**
+     * Get the POSTed data, checking that the signature is valid.
+     */
+    public function getData()
+    {
+        $signature = $this->getSignature();
 
         if (strtolower($this->httpRequest->request->get('VPSSignature')) !== $signature) {
             throw new InvalidResponseException;

tests/Message/ServerAuthorizeResponseTest.php

@@ -42,6 +42,6 @@ public function testServerPurchaseFailure()
         $this->assertFalse($response->isSuccessful());
         $this->assertFalse($response->isRedirect());
         $this->assertSame('{"VendorTxCode":"123456"}', $response->getTransactionReference());
-        $this->assertSame('The Description field should be between 1 and 100 characters long.', $response->getMessage());
+        $this->assertSame('3082 : The Description value is too long.', $response->getMessage());
     }
 }

tests/Message/ServerCompleteAuthorizeResponseTest.php

@@ -25,6 +25,9 @@ public function testServerCompleteAuthorizeResponseSuccess()
                 'PayerStatus' => 'k',
                 'CardType' => 'l',
                 'Last4Digits' => 'm',
+                'DeclineCode' => '00',
+                'ExpiryDate' => '0722',
+                'BankAuthCode' => '999777',
             )
         );
 

tests/Mock/CaptureFailure.txt

@@ -8,6 +8,6 @@ Content-Type: Text/Plain
 Set-Cookie: ASPSESSIONIDSEHSCTTR=NNBHGPBDLOMKKPGPNDDJFBAB; secure; path=/
 Cache-control: private
 
-VPSProtocol=2.23
+VPSProtocol=3.00
 Status=INVALID
 StatusDetail=You are trying to RELEASE a transaction that has already been RELEASEd or ABORTed.

tests/Mock/CaptureSuccess.txt

@@ -8,6 +8,6 @@ Content-Type: Text/Plain
 Set-Cookie: ASPSESSIONIDSEHSCTTR=FNBHGPBDMGDJCNLCDCDPGKCA; secure; path=/
 Cache-control: private
 
-VPSProtocol=2.23
+VPSProtocol=3.00
 Status=OK
 StatusDetail=The transaction was RELEASEed successfully.

tests/Mock/DirectPurchase3dSecure.txt

@@ -8,7 +8,7 @@ Content-Type: Text/Plain
 Set-Cookie: ASPSESSIONIDSEHSCTTR=FDNGGPBDBPAHLBIMINACENLN; secure; path=/
 Cache-control: private
 
-VPSProtocol=2.23
+VPSProtocol=3.00
 Status=3DAUTH
 3DSecureStatus=OK
 MD=065379457749061954

tests/Mock/DirectPurchaseFailure.txt

@@ -8,6 +8,6 @@ Content-Type: Text/Plain
 Set-Cookie: ASPSESSIONIDSEHSCTTR=PIMGGPBDEAHAGKNHFGMICIAM; secure; path=/
 Cache-control: private
 
-VPSProtocol=2.23
+VPSProtocol=3.00
 Status=INVALID
 StatusDetail=The VendorTxCode '984297' has been used before.  Each transaction you send should have a unique VendorTxCode.