bluem-phpis a PHP 8.3 library for Bluem payment flows: Payments, eMandates, iDIN, and IBAN-name check.src/Bluem.phpis the main orchestration layer: it builds requests, validates XML, sends them throughTransport/, and turns responses intoResponses/*objects.src/Webhook.phphandles inbound webhook XML and is intentionally strict: HTTPS POST +text/xml; charset=UTF-8+ XML/signature validation.
src/Contexts/*defines service-specific bank/BIC sets and XSD schema paths (IdentityContext,PaymentsContext,MandatesContext).src/Requests/*owns XML/endpoint generation;src/Responses/*wrapsSimpleXMLElementparsing.src/Transport/isolates HTTP;CurlHttpTransportis the default and is injected intoBluemfor testability.src/Validators/*enforces XML and webhook constraints; do not bypass these checks in higher layers.
- Public API names are legacy-compatible and intentionally mixed-case in places (
CreateMandateRequest,PerformRequest,getConfig,Webhook::getPurchaseID()); avoid renaming unless you are ready to update downstream consumers. phpcs.xml.distuses PSR-12 with narrow exceptions for legacy method/property naming and file-header ordering.- Existing code mixes older style and newer strict typing; prefer small, behavior-preserving edits over broad refactors.
- Install deps with
composer install. - Lint with
make lint; auto-fix style withmake lint_fix. - Run unit tests with
make test_unitor./vendor/bin/phpunit tests/Unit. - Run live tests with
make test_integration/make test_acceptance; these require.env. - CI (
.github/workflows/ci.yml) runs on PHP 8.3, thenmake lint, then PHPUnit.
- Copy
.env.exampleto.envfor integration/acceptance tests. - Required env vars are enforced in
tests/Integration/BluemGenericTestCase.php:BLUEM_ENV,BLUEM_SENDER_ID,BLUEM_BRANDID,BLUEM_TEST_ACCESS_TOKEN,BLUEM_MERCHANTID,BLUEM_MERCHANTRETURNURLBASE. - Unit tests typically use a fake transport; integration tests extend the shared base case and hit live Bluem services.
- Update request/response/context pieces together so XML shape, endpoint URL, and validation stay aligned.
- Check
validation/*.xsdandexamples/when touching service-specific payloads. - Keep webhook validation strict; relaxing HTTPS, content-type, or signature checks is a security regression.