v3.2.1 — euPago 2.0 Authorization: ApiKey header fix

Fix: euPago 2.0 (v1.02) endpoints (CreditCard, CreditCardRecurringPayment, CreditCardRecurrence, GooglePay, ApplePay) sent the API key as a bare ApiKey header, so euPago rejected every request with APIKEY_MISSING and no payment could be created. They now send Authorization: ApiKey <key> as documented. Classic 1.0 (MB/MBWay) was unaffected. Also released as v3.0.1 for the 3.0 line.

v3.0.1 — euPago 2.0 Authorization: ApiKey header fix

Backport onto the 3.0 line of the euPago 2.0 (v1.02) auth fix: CreditCard, CreditCardRecurringPayment, CreditCardRecurrence, GooglePay and ApplePay now send Authorization: ApiKey <key> instead of a bare ApiKey header (which euPago rejected with APIKEY_MISSING). No 3.1/3.2 callback-security changes and no migration — safe drop-in for apps pinned to ~3.0.0.

v3.2.0

Added

• Dispatch the InvalidCallbackReceived event when a callback fails validation (wrong API key/channel, unknown payment method, malformed data). The event carries the validation errors and a redacted callbackData (the API key and channel are excluded). The HTTP response remains a generic 422, so no field-level detail is leaked to the caller.

Builds on the callback security hardening introduced in v3.1.0.

Full changelog: https://github.com/digitaldev-lx/laravel-eupago/blob/master/CHANGELOG.md

v3.1.0

Security hardening of the payment callback (the trust boundary that confirms payments). The consumer-facing API (MB, MBWay, CreditCard classes, traits, events) is unchanged.

Upgrade note: this release adds a migration. After updating, run php artisan migrate (publish migrations first if you publish them).

Security

• Redact the API key and customer PII from logs (was logging the full URL + payload in clear text).
• Strip the API key from the CallbackReceived event payload.
• Confirm payments atomically (DB transaction + lockForUpdate) to prevent duplicate "paid" events under concurrent callbacks.
• Constant-time API key comparison (hash_equals) and per-IP rate limiting (throttle:60,1).
• Optional callback IP allowlist via EUPAGO_ALLOWED_IPS, off by default.

Changed

• Unknown payment methods now return HTTP 422 instead of raising a ValueError (500).
• Callback input is type-validated; validation failures return a generic 422 (previously a 302 redirect).
• Callback route no longer registered in the web middleware group.

Fixed

• Store MB Way amounts as decimal(10,2) instead of float (new migration).

Full changelog: https://github.com/digitaldev-lx/laravel-eupago/blob/master/CHANGELOG.md

v3.0.0

Release v3.0.0 - PHP 8.4, Laravel 13, Pint, PHPStan Level 6

Breaking Changes

• Minimum PHP version raised to 8.4 (dropped 8.3)
• Removed opcodesio/log-viewer production dependency
• Event properties are now readonly
• Unknown payment methods in callbacks now throw ValueError

Added

• Laravel 13 support
• PaymentMethod backed string enum
• Laravel Pint code style enforcement
• composer lint / composer lint:check scripts

Changed

• PHPStan raised from level 5 to level 6
• Constructor promotion with readonly in all payment classes and events
• Error handling extracted to EuPago base class (removed duplication from 9 classes)
• CallbackController refactored with match expression (~100 lines reduced to ~30)
• declare(strict_types=1) in all PHP files
• Typed return types throughout the codebase

Quality

• 165 tests passing (691 assertions)
• Pint code style: pass
• PHPStan level 6: 0 errors

See CHANGELOG.md for full details.

v2.3.0

Changelog

All notable changes to laravel-eupago will be documented in this file.

[2.3.0] - 2026-01-16

Added

Payment Methods

• Credit Card Single Payments: Full support for credit card payments with 3D Secure

  • Maximum transaction value: €3,999
  • Supports customer email and custom form timeout
  • Callback support with CC:PT payment method code
  • New CreditCard class, CreditCardReference model, and Creditcardable trait

• Credit Card Recurring Payments (Subscriptions): MIT (Merchant Initiated Transactions) support

  • Two-step process: Authorization + Recurring Payments
  • CreditCardRecurrence class for creating authorizations
  • CreditCardRecurringPayment class for executing recurring charges
  • New CreditCardRecurrenceAuthorization and CreditCardRecurringPayment models
  • Creditcardrecurrable trait for subscription management

• Google Pay: Digital wallet payment integration

  • Maximum transaction value: €99,999
  • Supports customer data (email, first name, last name, country code)
  • Callback support with GP:PT payment method code
  • New GooglePay class, GooglePayReference model, and Googlepayable trait

• Apple Pay: Apple digital wallet payment integration

  • Full customer data support (email, first name, last name, country code)
  • Callback support with AP:PT payment method code
  • New ApplePay class, ApplePayReference model, and Applepayable trait

• Payouts Management: OAuth-based payout consultation

  • Payout class for listing payouts by date range
  • PayoutTransaction class for listing settlement transactions
  • Bearer Token authentication support
  • Support for all payment methods (MB, MBWAY, CC, GP, AP)

Events System

• Credit Card Events:

  • CreditCardReferenceCreated / CreditCardReferenceCreationFailed
  • CreditCardReferencePaid
  • CreditCardRecurrenceAuthorizationCreated / CreditCardRecurrenceAuthorizationFailed
  • CreditCardRecurrenceAuthorizationAuthorized
  • CreditCardRecurringPaymentCreated / CreditCardRecurringPaymentFailed

• Google Pay Events:

  • GooglePayReferenceCreated / GooglePayReferenceCreationFailed
  • GooglePayReferencePaid

• Apple Pay Events:

  • ApplePayReferenceCreated / ApplePayReferenceCreationFailed
  • ApplePayReferencePaid

• Core Events:

  • MBReferenceCreated / MBReferenceCreationFailed
  • MBWayReferenceCreated / MBWayReferenceCreationFailed
  • MBReferencePaid
  • MBWayReferencePaid
  • MBReferenceExpired / MBWayReferenceExpired
  • CallbackReceived (dispatched for all payment callbacks)
  • InvalidCallbackReceived

Database & Models

• Migrations:

  • create_credit_card_references_table
  • create_credit_card_recurrence_authorizations_table
  • create_credit_card_recurring_payments_table
  • create_google_pay_references_table
  • create_apple_pay_references_table

• Models:

  • CreditCardReference with paid() scope
  • CreditCardRecurrenceAuthorization with authorized() and pending() scopes
  • CreditCardRecurringPayment with paid() scope and authorization relationship
  • GooglePayReference with paid() scope
  • ApplePayReference with paid() scope

• Factories:

  • CreditCardReferenceFactory with paid() state
  • CreditCardRecurrenceAuthorizationFactory with authorized() and pending() states
  • CreditCardRecurringPaymentFactory with paid() state
  • GooglePayReferenceFactory with paid() state
  • ApplePayReferenceFactory with paid() state
  • MbReferenceFactory with paid() and expired() states
  • MbwayReferenceFactory with paid() state

Infrastructure & Quality

• PHP 8.4 Support: Full support for PHP 8.4 alongside PHP 8.3
• Laravel 12 Support: Compatible with Laravel 12.x while maintaining Laravel 11.x support
• Pest Testing Framework: Comprehensive test suite with 165 tests and 691 assertions
• Larastan Static Analysis: Level 5 PHPStan/Larastan integration
• GitHub Actions CI/CD: Automated testing across PHP 8.3/8.4 and Laravel 11/12 matrix
• Composer Scripts:
  • composer test: Run Pest test suite
  • composer test:coverage: Run tests with 80% minimum coverage requirement
  • composer analyse: Run Larastan static analysis

Commands

• Artisan Command: eupago:check-expired to check and dispatch events for expired references
• Supports Laravel 11/12 scheduling via routes/console.php
• Backward compatible with Laravel 10 via app/Console/Kernel.php

Changed

• Callback Controller: Unified endpoint handling all payment methods (MB, MBWAY, CC, GP, AP)
• Backward Compatible: All new features maintain full backward compatibility
• Updated composer.json requirements:
  • PHP: ^8.3 || ^8.4 (was ^8.3)
  • Laravel: ^11.0 || ^12.0 (was ^11.0)
• Payment creation methods now dispatch events on both success and failure
• Callback controller dispatches CallbackReceived event for all incoming callbacks

Fixed

• Removed debug dd($data) statement in MB::getParams() (line 191)
• Fixed typo 'refrencia' → 'referencia' in CallbackRequest validation rules
• Added missing return statement in Mbable::createMbReference() method
• Removed unused MbCallbackRequest import in CallbackController

Documentation

• Comprehensive README Update:
  • Complete documentation for all 7 payment methods
  • Laravel 11/12 compatibility notes (event listeners, scheduling)
  • All 19 events documented with usage examples
  • Code examples for every payment method
  • Factory usage examples for testing
  • Updated "About DigitalDev" section
• Added CONTRIBUTING.md with contribution guidelines
• Created detailed CHANGELOG.md

Testing

• 165 Tests covering all payment methods and features
• 691 Assertions ensuring code reliability
• Unit tests for all classes (MB, MBWay, CreditCard, CreditCardRecurrence, CreditCardRecurringPayment, GooglePay, ApplePay, Payout, PayoutTransaction)
• Model tests for all payment reference models
• Trait tests for all polymorphic relationships
• Feature tests for callback handling across all payment methods
• Command tests for expired reference checking

[2.2.0] - Previous Release

Added

• PHP 8.3 and Laravel 11 support
• Support to MB and MBWay payment methods

[2.1.0] - Legacy Release

Added

• PHP 8.1+ and Laravel 10 support
• Initial implementation of EuPago payment integration

V2.2.0

[2.2.0] - 2024-07-20

Added

• Support for PHP 8.3
• Compatibility with Laravel 11

Changes

• The package has been updated to ensure full compatibility with the latest PHP version 8.3, providing improved performance and security features.
• Added support for Laravel 11, allowing developers to integrate digitaldev-lx/laravel-eupago seamlessly into their Laravel 11 projects.

Fixed

• Various minor bug fixes and performance improvements.

Notes

• For projects using Laravel 10, please use version 2.1.0 of this package.
• Ensure your environment is updated to PHP 8.3 to leverage the new features and improvements in this release.

v2.1.0

Change callback route to allow handle all payments methods in one single route

v2.0.202

Fix MB create reference types

v2.0.201

Fix Readme