Payment Sips Bundle Laravel Package

Product Decisions This Supports

• Scoping a legacy payments workstream — not a roadmap feature. This package addresses exactly one narrow need: wiring an Atos Worldline SIPS payment method into a Symfony application already running JMSPaymentCoreBundle. It informs a migration/decommissioning decision, not a growth bet. There is no product surface here, only plumbing.
• Correcting an assumed framework fit. Despite being catalogued as a "Laravel/PHP package," this is a Symfony bundle with a hard dependency on JMSPaymentCoreBundle. Any Laravel-side evaluation can be closed on day one — it is incompatible by construction, not merely unmaintained.
• Reframing build vs. buy as "copy vs. depend." MIT licensing means the code is free to reuse. With 1 star and 0 dependents, the honest call is to vendor or fork the small request/response logic rather than adopt it as a tracked dependency that implies a maintenance contract nobody is honouring.
• Triaging payment-gateway use cases. Relevant only to French/EU card payments (Carte Bleue, and bank-branded SIPS variants like Mercanet, Scellius, Elys, Cyberplus) under an existing SIPS merchant contract. Irrelevant for wallets, subscriptions, marketplaces, multi-PSP routing, or tokenisation — none of which this bundle models.
• Surfacing technical debt as roadmap input. Finding this in a codebase is itself a signal: it marks a payment stack that predates SCA/PSD2, 3-D Secure 2, and SIPS 2.0. That belongs in a "retire legacy payment integrations" epic with a dated exit, not in an enhancement backlog.

When to Consider This Package

Consider it only when all of the following hold:

• You operate a Symfony 2/3 application with JMSPaymentCoreBundle already in production.
• You hold an active SIPS (v1) merchant contract with Atos Worldline/Worldline — verified against the endpoint generation the target bank actually provisions, not assumed from the repo.
• Payment volume is low, migration budget is effectively zero, and you need a payment method wired up in days rather than quarters.
• You want a working reference implementation of SIPS request signing, callback handling, and response codes to crib from — treated as documentation of a protocol, not a library.

Look elsewhere when:

• The stack is Laravel or anything non-Symfony — the bundle will not install or function.
• You are greenfield, or your acquirer has moved you to SIPS 2.0, Worldline SIPS Paypage, PayZen, or Systempay, all of which have current, supported SDKs.
• You carry PCI DSS scope, SCA/PSD2, or 3DS2 obligations — this code predates them and will not satisfy an auditor.
• You need vendor support, security patching, or an SLA. With zero dependents, you are the maintainer the moment you install it.
• You need multi-gateway abstraction, subscriptions, refunds/partial captures, or tokenisation — use a modern PSP SDK or an abstraction layer instead.

How to Pitch It (Stakeholders)

To executives: This is a free, MIT-licensed connector that lets an existing legacy Symfony storefront accept French card payments through a SIPS contract we may already hold. It is cheap to try and cheap to abandon — which is precisely its ceiling; it is not a platform investment. The decision it surfaces is a genuine cost-avoidance vs. risk trade-off: a near-zero-cost stopgap today, against an unmaintained, single-star dependency sitting inside our payment path that predates current card-security regulation. Recommendation: permit it only as an explicitly time-boxed bridge inside an existing migration, and fund the exit at the same time. If Worldline offers a current REST API for the account, prefer it and skip this entirely.

To engineering: It is a thin Symfony bundle, not a Laravel package. One star, zero dependents, no active upstream — treat the repository as source material, not a dependency. If used: pin the exact commit, vendor the code into our tree, wrap it behind our own payment interface so the gateway is swappable, and log an owner plus a removal date. Expect to modernise type hints for PHP 8.x and add strict signature comparison (hash_equals). Do not extend it — every feature request against it is a signal to migrate to a current Worldline or alternative PSP SDK instead. Budget for the bank sandbox credential wait (often weeks) as the critical path, not the port.