- Is royalpunk/paybox-bundle a Laravel package or a Symfony bundle?
- The provided overview describes it as a Symfony bundle, not a Laravel package. That matters because Symfony bundle registration and DependencyInjection conventions differ from Laravel service providers and package auto-discovery. Inspect the repository for Bundle.php and DependencyInjection files versus a Laravel ServiceProvider before planning integration. Treat Laravel support as unconfirmed until that check is done.
- How do I install royalpunk/paybox-bundle with Composer?
- Because it is hosted on a self-managed forge rather than Packagist, a normal composer require may not work without extra repository configuration. Plan to add a Composer vcs repository entry and inject forge credentials into local and CI environments. The overview does not include exact install commands or version constraints, so confirm those from the repository before scheduling the work.
- Does royalpunk/paybox-bundle support Laravel auto-discovery?
- The package is described as a Symfony bundle, so Laravel package auto-discovery should not be assumed. Laravel auto-discovery depends on a composer.json extra.laravel providers entry and a service provider class. Check those files first. If they are absent, you would need a custom wrapper or manual service registration, which changes the integration estimate.
- How do I configure Paybox credentials and payment parameters?
- The overview says setup is through bundle registration and configuration, but it does not list config keys or environment variable names. Expect to provide Paybox site, rank, identifier, and signing parameters through Symfony configuration, then confirm the exact names from the repo. Keep secrets out of source control and inject them through environment-specific configuration or CI secrets.
- What Paybox payment flows does this package handle?
- The described surface is payment request preparation, redirect or gateway response handling, and return and callback flows. That covers initiating a Paybox payment and receiving the gateway response. The overview does not describe refunds, capture-later authorization, recurring billing, tokenization, multi-currency, or 3-D Secure 2 challenge handling. Scope those as separate work unless the repository documents them.
- Can royalpunk/paybox-bundle handle refunds, capture, recurring payments, or 3DS2?
- No refunds, capture, recurring billing, tokenization, multi-currency, or 3DS2 support is mentioned in the provided overview. A thin legacy-style Paybox wrapper is unlikely to cover SCA and challenge flows without additional work. If 3DS2 or refunds are launch requirements, validate them against the code before relying on the build-versus-wrap estimate.
- How should I test Paybox callbacks and signature verification?
- Signature verification is the top risk, so give it a dedicated review and written tests rather than folding it into a general integration task. Test field ordering, constant-time comparison, callback verification, and failure paths with known-good and tampered Paybox payloads. Also test idempotency and replay protection because gateway retries can otherwise create duplicate charges. With no public dependents or bug corpus, your test plan is the main safety net.
- Is royalpunk/paybox-bundle production-ready for payment processing?
- Treat it as a reference implementation and integration checklist, not an inherited dependency. Adoption evidence is effectively absent: no stars, no dependents, no public issue tracker, and no CI badge in the provided assessment. Production readiness also depends on unresolved concerns such as callback signature verification, idempotency, amount handling in integer minor units, PCI scope, and 3DS2. Put any vendor code behind an internal PaymentGateway interface before using it in production.
- How do I integrate it behind a PaymentGateway abstraction?
- Define an internal PaymentGateway interface with initiate, capture, refund, and webhook methods, then adapt the bundle's services to that interface. That keeps Paybox-specific field ordering, signing, and callback handling isolated from domain code. The abstraction is the durable deliverable, and the vendor code remains replaceable if the bundle is abandoned or fails review. This is the safer framing for a single-sprint spike.
- What are the alternatives or maintenance concerns for royalpunk/paybox-bundle?
- The strategic alternative is to write the narrow Paybox request, redirect, callback, and signature-verification flow yourself, using this package as a reference for PBX field ordering and callback shape. Maintenance risk is high because hosting is on a self-managed forge with no public issue tracker, Packagist metadata, fork graph, or visible CI. License and provenance are unknown from the metadata, which is a procurement gate for payment code. Confirm licensing and long-term ownership before making it a dependency.