SL-350: fixing styles and credentials saving logic - #315
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly refactors the handling of Saferpay API credentials and business license information. It transitions from a manual checkbox for business license declaration to an automated detection system that queries the Saferpay API. This change, coupled with real-time credential validation and an improved user interface, aims to streamline the setup process, reduce configuration errors, and provide a more intuitive experience for managing Saferpay settings. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a significant improvement by refactoring the credential saving logic to auto-detect the Saferpay business license, removing the need for manual configuration. The frontend React application has been updated to reflect this, featuring a much-improved user experience for credential validation and terminal fetching. The overall code quality is high, particularly the refactoring within the React context provider. However, I've identified a critical issue where a necessary validation check was removed, which could lead to a fatal error. Additionally, there's a non-functional UI element and an opportunity to simplify some backend logic for better maintainability.
| $data = $this->getJsonInput(); | ||
| if (!$data) { | ||
| $this->ajaxResponse(false, $this->module->l('Invalid request data', self::FILE_NAME)); | ||
| return; | ||
| } | ||
| $isTestMode = isset($data['env']) && $data['env'] === 'test'; | ||
| $suffix = $isTestMode ? SaferPayConfig::TEST_SUFFIX : ''; |
There was a problem hiding this comment.
The check for invalid request data (if (!$data)) was removed. The getJsonInput() method can return null if the JSON body is invalid or empty. The subsequent code at line 396 ($isTestMode = isset($data['env']) ...) will then attempt to access an array offset on a null value, which will cause a warning in PHP < 8 and a fatal error in PHP 8+. This check should be restored to ensure the application handles invalid requests gracefully.
$data = $this->getJsonInput();
if (!$data) {
$this->ajaxResponse(false, $this->module->l('Invalid request data', self::FILE_NAME));
return;
}
$isTestMode = isset($data['env']) && $data['env'] === 'test';
$suffix = $isTestMode ? SaferPayConfig::TEST_SUFFIX : '';| if (!empty($activeUsername) && !empty($activePassword) && !empty($activeCustomerId)) { | ||
| try { | ||
| /** @var SaferPayGetLicense $getLicense */ | ||
| $getLicense = $this->module->getService(SaferPayGetLicense::class); | ||
| $licenseInfo = $getLicense->fetchLicenseWithCredentials( | ||
| $activeUsername, | ||
| $activePassword, | ||
| $activeCustomerId, | ||
| $isTestMode | ||
| ); | ||
|
|
||
| $hasBusinessLicense = $licenseInfo['hasBusinessLicense']; | ||
| $configuration->set(SaferPayConfig::BUSINESS_LICENSE . $suffix, $hasBusinessLicense ? 1 : 0); | ||
| } catch (\Exception $e) { | ||
| $configuration->set(SaferPayConfig::BUSINESS_LICENSE . $suffix, 0); | ||
| $licenseMessage = ' ' . $this->module->l('Could not retrieve license information. Please verify your credentials.', self::FILE_NAME); | ||
| } | ||
| } else { | ||
| $configuration->set(SaferPayConfig::BUSINESS_LICENSE . $suffix, 0); | ||
| $businessLicenseDisabled = true; | ||
| } | ||
|
|
||
| if ($businessLicenseDisabled) { | ||
| $this->ajaxResponse( | ||
| true, | ||
| $this->module->l('Credentials saved. Field Access Token is required for business license — it has been disabled.', self::FILE_NAME) | ||
| ); | ||
| return; | ||
| } |
There was a problem hiding this comment.
The logic for setting the SaferPayConfig::BUSINESS_LICENSE configuration value is currently duplicated across the try, catch, and else blocks. This can be simplified to improve readability and maintainability. Consider determining the value of $hasBusinessLicense within the conditional logic and then calling $configuration->set() only once at the end.
if (!empty($activeUsername) && !empty($activePassword) && !empty($activeCustomerId)) {
try {
/** @var SaferPayGetLicense $getLicense */
$getLicense = $this->module->getService(SaferPayGetLicense::class);
$licenseInfo = $getLicense->fetchLicenseWithCredentials(
$activeUsername,
$activePassword,
$activeCustomerId,
$isTestMode
);
$hasBusinessLicense = $licenseInfo['hasBusinessLicense'];
} catch (\Exception $e) {
$licenseMessage = ' ' . $this->module->l('Could not retrieve license information. Please verify your credentials.', self::FILE_NAME);
}
}
$configuration->set(SaferPayConfig::BUSINESS_LICENSE . $suffix, $hasBusinessLicense ? 1 : 0);| <Button | ||
| variant="outline" | ||
| disabled={!settings.hasBusinessLicense || !hasCredentials} | ||
| className="sp-shrink-0" | ||
| > | ||
| <Wand2 className="sp-h-4 sp-w-4 sp-mr-1.5" /> | ||
| {t('generate')} | ||
| </Button> |
There was a problem hiding this comment.
The "Generate" button for the Field Access Token is visible in the UI but currently lacks an onClick handler, rendering it non-functional. This could be confusing for users who expect it to perform an action. If the token generation functionality is not yet implemented, consider either removing the button for now or disabling it with a tooltip explaining that it's a future feature.
Adds discernible accessible names to interactive controls that were unlabelled at narrow viewports, resolving 33 of the 36 axe-core violations found during SL-346 QA. - Payment Methods mobile cards: add aria-label to "Logos" and "Custom form" switches (28 violations). Desktop layout was already labelled; only the md:sp-hidden mobile block was missing labels. - Settings tab triggers: add aria-label to all five TabsTrigger buttons (5 violations). Visible text labels are wrapped in sp-hidden sm:sp-inline so on mobile only the icon shows; without aria-label the buttons had no accessible name.
- Darken --sp-muted-foreground from 46% to 38% lightness (4.31:1 -> ~6.4:1) - Replace sp-text-emerald-600 with sp-text-emerald-700 in API Credentials (3.76:1 -> 5.27:1 on white, 3.57:1 -> ~5:1 on emerald-50) Resolves 3 axe-core color-contrast violations across all 5 settings tabs. Verified: 0 contrast issues remain inside #saferpay-settings-root.
Radix Label component does not auto-wire to SelectTrigger; without an explicit aria-label, screen readers announced only the selected value. Resolves last open finding in TC-346.1.
Previously Tab could escape the modal into background page content violating WCAG 2.1.2 (Focus Order) for modal dialogs. Tab/Shift+Tab now cycle within the modal's focusable elements. Resolves TC-346.7.
PrestaShop core .btn-primary teal (#25b9d7) on white was 2.6:1 — fails WCAG 2.1 AA (requires 4.5:1). Scoped override on #saferpay-admin-form only, so other admin pages keep their PS theme. Refund/Capture buttons now use the module brand teal #1c7c80 (5.27:1).
Without scope, screen readers cannot reliably associate header cells with their data column. Resolves TC-346.10 (FO saved credit cards).
The PS Classic theme rendered the Remove link in teal #24b9d7 on white (2.6:1) which fails WCAG 2.1 AA. Use brand teal #1c7c80 (5.27:1) via inline color so the override does not bleed to other theme buttons.
The .btn-primary (BO admin order) and .btn-default (FO saved cards) contrast issues originate in PrestaShop core/theme CSS, not in our module. Overriding them at module level was the wrong layer: - fragile against theme updates - could clash with merchant theme customizations - inconsistent with our decision to scope SL-346 to module-owned UI These now match the same out-of-scope category as the BO breadcrumb, help button, and submenu tabs. Module-owned a11y fixes (React Settings app contrast, aria-labels, scope=col, focus trap, etc.) remain in PR.
- Disable Save Changes button when username/password empty, credential check is in flight, or inline credential error is shown - Mark JSON API Username and Password as required (visual asterisk + aria-required) to surface the requirement before user clicks Save
The Saferpay Fields section was driven by a single hasBusinessLicense flag derived from the active environment's stored license at page load. Switching environments client-side did not re-evaluate it, so the section stayed visible after switching to an environment with no validated business license. Expose testHasBusinessLicense and liveHasBusinessLicense separately from the controller (initial payload and save response), and pick the active one in api-credentials.tsx based on testMode.
When the Saferpay Management API license lookup fails during credentials save, the previous flow showed a misleading green success toast that asked merchants to verify credentials they had just successfully validated. - Log the underlying error to the SaferPay module Logs tab via LoggerInterface - Return a 'warning' flag in the save credentials response - Render an amber warning toast with a clearer message that points to the Logs
…ntials Disable Save Changes when API credentials empty or invalid
…nse-visibility Fix Saferpay Fields visibility per active environment license
…toast Log license fetch failures and surface honest warning toast on save
The polling script in saferpay_wait.tpl navigated the iframe itself via window.location.href, leaving the parent window stuck on the SaferPay iframe controller URL while the cart or order-confirmation page rendered nested inside the iframe. Use window.top so the redirect targets the parent window and the user lands at /cart or /order-confirmation with the proper top-level chrome.
Address review feedback on PR #325: - Use location.replace() so the polling page is not stored in history (Back from order-confirmation should not return to the spinner). - Wrap window.top access in try/catch with an in-iframe fallback in case sandboxing or browser policy blocks the breakout.
…owns show All instead of 0
…rictions-default BUGFIX: payment methods default to all countries/currencies and dropdowns show All instead of 0
fix: break out of SaferPay iframe on payment status redirect
…rpay transaction abort
…redirect-secure-key
BUGFIX: redirect customer to cart instead of order history after Saferpay transaction abort
…le-info BUGFIX: clarify Hosted field style info banner to mention Custom form requirement
Frontend (api-credentials.tsx): show inline error and disable Save when any comma-separated entry fails an email regex. Backend (AdminSaferPayOfficialSettingsController): reject save when testMerchantEmails or liveMerchantEmails contains a value that fails Validate::isEmail() — guards against curl/devtools bypass.
BUGFIX: validate Merchant Emails field on save
When 'Behavior when 3D Secure Payer Authentication was not successful' was set to Authorize, the order was still being captured because the AUTHORIZE branch was missing and the CANCEL branch did not return early, so control fell through to the default-payment-behavior Capture block. Each 3DS-fail branch now returns/dies explicitly, so the configured 3DS-fail behavior is always honored.
isValidResponse() already logs API errors before throwing SaferPayApiException, so the surrounding catch in get(), getWithCredentials(), and postWithCredentials() produced a redundant error row for every failed call. Guard the catch-block logger->error with if ($response === null) so it only fires on transport-level failures, where isValidResponse() never ran.
…6/accessibility-eaa-compliance # Conflicts: # controllers/admin/AdminSaferPayOfficialSettingsController.php
…ance SL-346: add accessibility improvements for EAA compliance
SL-358: add ConfigSet field validation, move hosted field style to general settings
…cription SL-356: add Order reference on payment page toggle to control Descripton
SL-355: add Capture option to 3D Secure failure behavior setting
SL-353/SL-354: fields settings block logic
3 participants
Self-Checks
JIRA task link
Summary
QA Checklist Labels
QA Checklist
Additional Context
Frontend Changes