CoolCMS API

GatewayCheckResult
in package

FinalYes

Result of verifying a payment at the gateway: status, identification and proofs.

  • amount + currencyCode: amount and currency confirmed by the gateway. The central guard (PaymentProcessorTrait::processPayment()) compares them with payment.total_price; a mismatch yields PaymentStatus::BAD_PRICE, never completed.
  • referenceId: our payment_id sent to the gateway when the transaction was created (GoPay order_number, Comgate refId, Stripe metadata.payment_id, PayU extOrderId, PayPal purchase_units[0].reference_id). A match proves the transaction is ours, which is stronger than the amount. A mismatch rejects the notification.
  • rejected + rejectReason: the notification failed origin verification (wrong or missing shared secret, foreign transaction, gatewayPaymentId conflict). A rejection is not an exception: the payment status stays unchanged (otherwise an attacker could force a downgrade of a legitimate payment) and it is only logged. The reply to the gateway is sent normally (fail-open callback rule).

Table of Contents

Properties

$amount  : float|null
$currencyCode  : string|null
$gatewayPaymentId  : string|null
$output  : string|null
$referenceId  : string|null
$rejected  : bool
$rejectReason  : string|null
$renderData  : array<string|int, mixed>
$returnMessage  : string|null
$state  : string|null
$status  : int
$subState  : string|null

Methods

__construct()  : mixed
reject()  : self
Builds a rejection for a notification that failed origin verification.
withStatus()  : self
Returns a copy with another status; the central guard uses it when the amount does not match (bad price). The other fields, including `output` for text/plain gateways, stay unchanged, except `rejected` and `rejectReason`, which are not copied: call it only on a check that was not rejected.

Properties

Methods

__construct()

public __construct(int $status[, string|null $gatewayPaymentId = null ][, string|null $state = null ][, string|null $subState = null ][, string|null $returnMessage = null ][, array<string|int, mixed> $renderData = [] ][, string|null $output = null ][, float|null $amount = null ][, string|null $currencyCode = null ][, string|null $referenceId = null ][, bool $rejected = false ][, string|null $rejectReason = null ]) : mixed
Parameters
$status : int
$gatewayPaymentId : string|null = null
$state : string|null = null
$subState : string|null = null
$returnMessage : string|null = null
$renderData : array<string|int, mixed> = []
$output : string|null = null
$amount : float|null = null
$currencyCode : string|null = null
$referenceId : string|null = null
$rejected : bool = false
$rejectReason : string|null = null

reject()

Builds a rejection for a notification that failed origin verification.

public static reject(string $reason[, string|null $output = null ]) : self

IMPORTANT: the payment status must not be touched. $output is kept for gateways without a redirect (mobilniplatby replies text/plain), but a rejected caller never receives anything that reveals the payment status.

Parameters
$reason : string
$output : string|null = null
Return values
self

withStatus()

Returns a copy with another status; the central guard uses it when the amount does not match (bad price). The other fields, including `output` for text/plain gateways, stay unchanged, except `rejected` and `rejectReason`, which are not copied: call it only on a check that was not rejected.

public withStatus(int $status[, string|null $returnMessage = null ]) : self
Parameters
$status : int
$returnMessage : string|null = null
Return values
self
On this page

Search results