Netopia Mobilpay Laravel Package

Technical Evaluation

Architecture Fit

• Laravel-Native Compatibility: The package’s PSR-4 autoloading aligns seamlessly with Laravel’s dependency injection and service container. It can be integrated as a custom payment gateway driver (e.g., extending Spatie\Payment\Payment or Laravel Cashier) or as a standalone service.
• Modular Design: Encourages decoupling of payment logic from business logic via:
  • Service Layer: Abstract MobilePay-specific calls (e.g., MobilpayPaymentService).
  • Repositories: Persist transactions via MobilpayTransactionRepository.
  • Events: Emit MobilpayPaid, MobilpayFailed events for async processing (e.g., inventory updates, notifications).
• PCI Compliance: Handles encryption/decryption (OpenSSL 3.0+ compatible) and HMAC validation, reducing custom PCI audit scope. Risk: Ensure your Laravel environment meets PCI DSS requirements (e.g., tokenization, access controls).

Integration Feasibility

• Low Friction: No Laravel-specific dependencies; integrates via Composer and service container.
• Webhook Handling: Requires HMAC validation (MobilePay’s hmac signature) and idempotency (prevent replay attacks). Laravel’s middleware (VerifyMobilpaySignature) or queue listeners can handle this.
• Database Schema: Flexible but requires:
  • mobilpay_transactions (status, amount, metadata, webhook_data).
  • mobilpay_webhook_logs (for replay safety).
  • Recommendation: Use Eloquent models with soft deletes and Laravel Migrations.
• Testing Complexity:
  • Unit Tests: Mock Mobilpay\Payment\Request and Mobilpay\Payment\Invoice.
  • Integration Tests: Use MobilePay’s sandbox (e.g., https://sandbox.mobilepay.dk) with Guzzle HTTP interceptors.
  • Webhook Tests: Validate HMAC signatures and payload schemas.

Technical Risk

Key Questions

1. API Versioning Strategy:
   • How will the team handle MobilePay API deprecations (e.g., v1 → v2)?
   • Solution: Use feature flags or strategy pattern to switch implementations.
2. Retry Logic:
   • Should failed payments use exponential backoff (via Laravel Queues) or immediate retries?
   • Solution: Implement MobilpayRetryJob with jitter (e.g., sleep(rand(1, 5))).
3. Compliance:
   • Does the package support PCI DSS tokenization? If not, will you use Laravel Cashier or a custom solution?
   • Solution: Audit MobilePay’s tokenization endpoints or use 3D Secure via their API.
4. Monitoring:
   • How will transaction statuses (pending, failed, refunded) be tracked in dashboards (e.g., Grafana, Laravel Nova)?
   • Solution: Publish MobilpayTransaction events to a message broker (e.g., Laravel Echo + Pusher).
5. Multi-Currency:
   • Does the package support DKK/EUR/SEK natively, or require custom logic for currency conversion?
   • Solution: Extend Invoice class or use Laravel’s Money package.
6. Fallback Mechanisms:
   • What happens if MobilePay’s API is down? Should orders fail gracefully or redirect to a backup gateway (e.g., Stripe)?
   • Solution: Implement a circuit breaker (e.g., Spatie\CircuitBreaker) with fallback logic.

Integration Approach

Stack Fit

• PHP/Laravel:
  • PSR-4 Autoloading: Compatible with Laravel’s Composer autoloader (no PSR-0 conflicts).
  • Service Container: Register MobilpayService as a singleton or context-bound instance.
  • Queue System: Use Laravel Queues (Redis/Database) for async webhook processing.
• Dependencies:
  • Guzzle HTTP Client: Already bundled with Laravel; no additional setup.
  • OpenSSL Extension: Required for encryption (ext-openssl must be enabled).
  • Optional: monolog/monolog for structured logging.
• Database:
  • PostgreSQL/MySQL: Agnostic; use Eloquent or Query Builder.
  • Schema: Minimal requirements (see Operational Impact).
• Third-Party Tools:
  • Laravel Cashier: Can coexist if using multi-gateway setup (e.g., Cashier::addGateway('mobilpay')).
  • Spatie Payment Gateways: Integrate as a custom driver (e.g., MobilpayGateway).

Migration Path

Compatibility

• Laravel Versions:
  • Tested: Laravel 8+ (PHP 7.4+).
  • PHP 8.3+: Required for OpenSSL 3.0+ support (aes-256-cbc + IV).
  • Polyfills: May need ramsey/uuid or symfony/polyfill for older Laravel versions.
• MobilePay API:
  • Validate against MobilePay’s latest API spec.
  • Breaking Changes: Watch for deprecated endpoints (e.g., /v1/payments → /v2/payments).
• Third-Party Integrations:
  • Stripe/Laravel Cashier: Use multi-gateway setup (e.g., Cashier::addGateway('mobilpay')).
  • Queue Workers: Requires Supervisor or Forge for background processing of webhooks.

Sequencing

1. Prerequisites:
   • Obtain MobilePay merchant credentials (sandbox + production).
   • Generate public/private key pairs (e.g., sandbox.YOUR-SIGNATURE.public.cer).
2. Development:
   • Install package: composer require birkof/netopia-mobilpay.
   • Configure .env:

     MOBILPAY_MERCHANT_ID=your_merchant_id
     MOBILPAY_SECRET=your_secret_key
     MOBILPAY_PUBLIC_CERT=/path/to/sandbox.YOUR-SIGNATURE.public.cer
     MOBILPAY_PRIVATE_KEY=/path/to/sandbox