SL-346: add accessibility improvements for EAA compliance

changelog.md

@@ -196,4 +196,7 @@
 ## [2.0.2]
 - Remove WL Crypto payment method
 - Added setting to toggle order confirmation email sending
-- Added feature to group card payment methods into unified "Card" payment method
+- Added feature to group card payment methods into unified "Card" payment method
+- Fixed issue when newly enabled payment methods did not appear in checkout because default "all countries/currencies" restriction was not created on save
+- Fixed issue when payment method country/currency dropdowns showed "0" instead of indicating that all countries/currencies are allowed
+- BO : Added validation for Merchant Emails field (frontend + backend) to prevent saving invalid addresses

controllers/admin/AdminSaferPayOfficialSettingsController.php

@@ -179,6 +179,17 @@ public function ajaxProcessSaveCredentials()
             }
         }
 
+        $testMerchantEmails = $this->getStringValue($data, 'testMerchantEmails');
+        $liveMerchantEmails = $this->getStringValue($data, 'liveMerchantEmails');
+        $invalidEmail = $this->findInvalidEmail($testMerchantEmails) ?: $this->findInvalidEmail($liveMerchantEmails);
+        if ($invalidEmail !== null) {
+            $this->ajaxResponse(false, sprintf(
+                $this->module->l('Invalid merchant email address: %s', self::FILE_NAME),
+                $invalidEmail
+            ));
+            return;
+        }
+
         // Credentials validated — now save
         $configuration->set(SaferPayConfig::TEST_MODE, $isTestMode ? 1 : 0);
 
@@ -248,7 +259,8 @@ public function ajaxProcessSaveCredentials()
             true,
             $message,
             [
-                'hasBusinessLicense' => $hasBusinessLicense,
+                'testHasBusinessLicense' => (bool) $configuration->get(SaferPayConfig::BUSINESS_LICENSE . SaferPayConfig::TEST_SUFFIX),
+                'liveHasBusinessLicense' => (bool) $configuration->get(SaferPayConfig::BUSINESS_LICENSE),
                 'warning' => $licenseFetchFailed,
             ]
         );
@@ -389,6 +401,13 @@ public function ajaxProcessSavePaymentMethods()
                 $countries = isset($method['countries']) ? $method['countries'] : [];
                 $currencies = isset($method['currencies']) ? $method['currencies'] : [];
 
+                if (empty($countries)) {
+                    $countries = [SaferPayRestrictionCreator::RESTRICTION_ALL];
+                }
+                if (empty($currencies)) {
+                    $currencies = [SaferPayRestrictionCreator::RESTRICTION_ALL];
+                }
+
                 $success = $restrictionCreator->updateRestriction(
                     $paymentName,
                     SaferPayRestrictionCreator::RESTRICTION_COUNTRY,
@@ -545,8 +564,9 @@ private function collectSettingsData()
             'liveFieldAccessToken' => (string) $configuration->get(SaferPayConfig::FIELDS_ACCESS_TOKEN),
             'liveFieldJsUrl' => (string) $configuration->get(SaferPayConfig::FIELDS_LIBRARY),
 
-            // License (auto-detected)
-            'hasBusinessLicense' => (bool) $configuration->get(SaferPayConfig::BUSINESS_LICENSE . SaferPayConfig::getConfigSuffix()),
+            // License (auto-detected, per environment)
+            'testHasBusinessLicense' => (bool) $configuration->get(SaferPayConfig::BUSINESS_LICENSE . SaferPayConfig::TEST_SUFFIX),
+            'liveHasBusinessLicense' => (bool) $configuration->get(SaferPayConfig::BUSINESS_LICENSE),
 
             // Payment Processing
             'paymentBehavior' => (int) $configuration->get(SaferPayConfig::PAYMENT_BEHAVIOR),
@@ -783,4 +803,24 @@ private function getIntValue($data, $key)
     {
         return isset($data[$key]) ? (int) $data[$key] : 0;
     }
+
+    /**
+     * Returns the first invalid email in a comma-separated list, or null if all are valid.
+     */
+    private function findInvalidEmail($emails)
+    {
+        if ($emails === '') {
+            return null;
+        }
+        foreach (explode(',', $emails) as $email) {
+            $email = trim($email);
+            if ($email === '') {
+                continue;
+            }
+            if (!\Validate::isEmail($email)) {
+                return $email;
+            }
+        }
+        return null;
+    }
 }

controllers/front/notify.php

@@ -158,7 +158,19 @@ public function postProcess()
                     ]);
 
                     die($this->module->l('Liability shift is false', self::FILE_NAME));
-                } elseif ($paymentBehaviorWithout3D === SaferPayConfig::PAYMENT_BEHAVIOR_WITHOUT_3D_CAPTURE
+                }
+
+                if ($paymentBehaviorWithout3D === SaferPayConfig::PAYMENT_BEHAVIOR_WITHOUT_3D_AUTHORIZE) {
+                    $logger->debug(sprintf('%s - Liability shift is false, order left authorized', self::FILE_NAME), [
+                        'context' => [
+                            'id_order' => $order->id,
+                        ],
+                    ]);
+
+                    die($this->module->l('Liability shift is false, order left authorized', self::FILE_NAME));
+                }
+
+                if ($paymentBehaviorWithout3D === SaferPayConfig::PAYMENT_BEHAVIOR_WITHOUT_3D_CAPTURE
                     && SaferPayConfig::supportsOrderCapture($order->payment)
                     && $transactionStatus !== TransactionStatus::CAPTURED
                 ) {
@@ -169,6 +181,8 @@ public function postProcess()
                             'id_order' => $order->id,
                         ],
                     ]);
+
+                    die($this->module->l('Liability shift is false, capturing order', self::FILE_NAME));
                 }
             }
 

controllers/front/return.php

@@ -274,15 +274,17 @@ private function executeTransaction($orderId, $selectedCard)
      */
     private function getRedirectionToControllerUrl($controllerName)
     {
-        $cartId = $this->context->cart->id ? $this->context->cart->id : Tools::getValue('cartId');
+        $cartId = (int) Tools::getValue('cartId') ?: (int) $this->context->cart->id;
+        $cart = new Cart($cartId);
+        $secureKey = Validate::isLoadedObject($cart) ? $cart->secure_key : $this->context->cart->secure_key;
 
         return $this->context->link->getModuleLink(
             $this->module->name,
             $controllerName,
             [
                 'cartId' => $cartId,
                 'orderId' => Order::getIdByCartId($cartId),
-                'secureKey' => $this->context->cart->secure_key,
+                'secureKey' => $secureKey,
                 'moduleId' => $this->module->id,
             ]
         );
@@ -339,7 +341,15 @@ private function createAndValidateOrder($assertResponseBody, $transactionStatus,
 
             if ($paymentBehaviorWithout3D === SaferPayConfig::PAYMENT_BEHAVIOR_WITHOUT_3D_CANCEL) {
                 $orderStatusService->cancel($order);
-            } elseif ($paymentBehaviorWithout3D === SaferPayConfig::PAYMENT_BEHAVIOR_WITHOUT_3D_CAPTURE
+
+                return;
+            }
+
+            if ($paymentBehaviorWithout3D === SaferPayConfig::PAYMENT_BEHAVIOR_WITHOUT_3D_AUTHORIZE) {
+                return;
+            }
+
+            if ($paymentBehaviorWithout3D === SaferPayConfig::PAYMENT_BEHAVIOR_WITHOUT_3D_CAPTURE
                 && SaferPayConfig::supportsOrderCapture($order->payment)
                 && $transactionStatus !== TransactionStatus::CAPTURED
             ) {

src/Api/ApiRequest.php

@@ -114,14 +114,16 @@ public function get($url, $params = [])
 
             return json_decode($response->raw_body);
         } catch (Exception $exception) {
-            $this->logger->error($exception->getMessage(), [
-                'context' => [
-                    'headers' => $this->getHeaders(),
-                ],
-                'request' => $params,
-                'response' => json_decode($response->raw_body),
-                'exceptions' => ExceptionUtility::getExceptions($exception),
-            ]);
+            if ($response === null) {
+                $this->logger->error($exception->getMessage(), [
+                    'context' => [
+                        'headers' => $this->getHeaders(),
+                    ],
+                    'request' => $params,
+                    'response' => null,
+                    'exceptions' => ExceptionUtility::getExceptions($exception),
+                ]);
+            }
 
             throw $exception;
         }
@@ -170,12 +172,14 @@ public function getWithCredentials($url, $username, $password, $baseUrl, $params
 
             return json_decode($response->raw_body);
         } catch (Exception $exception) {
-            $this->logger->error($exception->getMessage(), [
-                'context' => [],
-                'request' => $params,
-                'response' => $response ? json_decode($response->raw_body) : null,
-                'exceptions' => ExceptionUtility::getExceptions($exception),
-            ]);
+            if ($response === null) {
+                $this->logger->error($exception->getMessage(), [
+                    'context' => [],
+                    'request' => $params,
+                    'response' => null,
+                    'exceptions' => ExceptionUtility::getExceptions($exception),
+                ]);
+            }
 
             throw $exception;
         }
@@ -226,12 +230,14 @@ public function postWithCredentials($url, $username, $password, $baseUrl, $param
 
             return json_decode($response->raw_body);
         } catch (Exception $exception) {
-            $this->logger->error($exception->getMessage(), [
-                'context' => [],
-                'request' => $params,
-                'response' => $response ? json_decode($response->raw_body) : null,
-                'exceptions' => ExceptionUtility::getExceptions($exception),
-            ]);
+            if ($response === null) {
+                $this->logger->error($exception->getMessage(), [
+                    'context' => [],
+                    'request' => $params,
+                    'response' => null,
+                    'exceptions' => ExceptionUtility::getExceptions($exception),
+                ]);
+            }
 
             throw $exception;
         }

src/Service/SettingsTranslationService.php

@@ -85,6 +85,7 @@ private function getCommonTranslations()
     {
         return [
             'saveChanges' => $this->module->l('Save Changes', self::FILE_NAME),
+            'saving' => $this->module->l('Saving...', self::FILE_NAME),
             'enable' => $this->module->l('Enable', self::FILE_NAME),
             'disable' => $this->module->l('Disable', self::FILE_NAME),
             'search' => $this->module->l('Search...', self::FILE_NAME),
@@ -121,6 +122,7 @@ private function getApiCredentialsTranslations()
             'merchantEmails' => $this->module->l('Merchant Emails', self::FILE_NAME),
             'enterMerchantEmails' => $this->module->l('Enter merchant email addresses (comma-separated)', self::FILE_NAME),
             'separateEmails' => $this->module->l('These email addresses receive payment notification emails directly from SaferPay. Separate multiple email addresses with commas.', self::FILE_NAME),
+            'invalidMerchantEmails' => $this->module->l('Invalid email address', self::FILE_NAME),
             'saferpayFields' => $this->module->l('Saferpay Fields', self::FILE_NAME),
             'saferpayFieldsDescription' => $this->module->l('Configure Saferpay Fields for inline payment form integration.', self::FILE_NAME),
             'fieldAccessTokenInfo' => $this->module->l('Saferpay Field Access Token can be found in Saferpay Backoffice, navigate to', self::FILE_NAME),
@@ -228,7 +230,7 @@ private function getGeneralSettingsTranslations()
             'configName' => $this->module->l('Payment Page configurations name', self::FILE_NAME),
             'enterConfigName' => $this->module->l('Enter configuration name', self::FILE_NAME),
             'configNameDescription' => html_entity_decode($this->module->l('Name of the Payment Page Configuration created in Saferpay Backoffice (Settings > Payment Page Configuration). Max 20 characters. Allowed: letters, numbers, dots, colons, hyphens, underscores.', self::FILE_NAME), ENT_QUOTES, 'UTF-8'),
-            'hostedFieldInfo' => $this->module->l('Choose which hosted field will be displayed on payment option selection with supported payment methods.', self::FILE_NAME),
+            'hostedFieldInfo' => html_entity_decode($this->module->l('This style applies only to payment methods with "Custom form" enabled in the Payment Methods list. Methods without Custom form or paid with saved cards use the Saferpay-hosted payment page, whose appearance is controlled by "Payment Page configurations name".', self::FILE_NAME), ENT_QUOTES, 'UTF-8'),
             'hostedFieldStyle' => $this->module->l('Hosted field style', self::FILE_NAME),
             'hostedFieldStyleDescription' => $this->module->l('Select the card input form layout for the payment page.', self::FILE_NAME),
             'classicLayout' => $this->module->l('Classic Layout', self::FILE_NAME),

views/css/admin/logs_tab.css

@@ -73,10 +73,31 @@
     border-bottom: solid 1px grey;
     pointer-events: all;
     display: flex;
-    justify-content: center;
+    justify-content: space-between;
+    align-items: center;
     max-height: 10vh;
 }
 
+.log-modal-close {
+    background: none;
+    border: none;
+    font-size: 1.5rem;
+    cursor: pointer;
+    padding: 0.25rem 0.5rem;
+    line-height: 1;
+    color: #6b7280;
+    margin-right: 0.5rem;
+}
+
+.log-modal-close:hover {
+    color: #111827;
+}
+
+.log-modal-close:focus {
+    outline: 2px solid #2196F3;
+    outline-offset: 2px;
+}
+
 .log-modal-content {
     padding: 15px;
     height: 50vh;

views/css/admin/payment_method.css

@@ -43,6 +43,12 @@
     width: 0;
 }
 
+/* Visible focus indicator for keyboard navigation */
+.container-checkbox input:focus ~ .checkmark {
+    outline: 2px solid #2196F3;
+    outline-offset: 2px;
+}
+
 /* Create a custom checkbox */
 .checkmark {
     position: absolute;

views/js/admin/log.js

@@ -21,17 +21,65 @@
  */
 
 $(document).ready(function () {
+    function closeModal($modal) {
+        $modal.removeClass('open');
+        var triggerButton = $modal.data('triggerButton');
+        if (triggerButton) {
+            triggerButton.focus();
+        }
+    }
+
     $('.log-modal-overlay').on('click', function (event) {
-        $('.modal.open').removeClass('open');
+        closeModal($(this).closest('.modal'));
+        event.preventDefault();
+    });
+
+    $('.js-log-modal-close').on('click', function (event) {
+        closeModal($(this).closest('.modal'));
         event.preventDefault();
     });
 
+    $(document).on('keydown', function (event) {
+        var $openModal = $('.modal.open');
+        if (!$openModal.length) {
+            return;
+        }
+        if (event.key === 'Escape') {
+            closeModal($openModal);
+            event.preventDefault();
+            return;
+        }
+        if (event.key === 'Tab') {
+            var focusables = $openModal.find('button, [href], input, select, textarea, [tabindex]:not([tabindex="-1"])').filter(':visible');
+            if (!focusables.length) {
+                event.preventDefault();
+                return;
+            }
+            var first = focusables.first()[0];
+            var last = focusables.last()[0];
+            if (event.shiftKey && document.activeElement === first) {
+                last.focus();
+                event.preventDefault();
+            } else if (!event.shiftKey && document.activeElement === last) {
+                first.focus();
+                event.preventDefault();
+            } else if (!$openModal[0].contains(document.activeElement)) {
+                first.focus();
+                event.preventDefault();
+            }
+        }
+    });
+
     $('.js-log-button').on('click', function (event) {
         var logId = $(this).data('log-id');
         var informationType = $(this).data('information-type');
+        var $modal = $('#' + $(this).data('target'));
+
+        $modal.data('triggerButton', $(this));
 
         // NOTE: opening modal
-        $('#' + $(this).data('target')).addClass('open');
+        $modal.addClass('open');
+        $modal.find('.js-log-modal-close').focus();
 
         // NOTE: if information has been set already we don't need to call ajax again.
         if (!$('#log-modal-' + logId + '-' + informationType + ' .log-modal-content-data').hasClass('hidden')) {