Download the PHP package wizcodepl/lunar-tpay without Composer
On this page you can find all versions of the php package wizcodepl/lunar-tpay. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package lunar-tpay
lunar-tpay
Tpay (OpenAPI) payment driver for Lunar PHP.
Authorize → redirect customer to tpay → JWS-verified webhook updates the order.
Installation
Get sandbox credentials at register.sandbox.tpay.com and generate Open API keys in Merchant Panel → Integration → API.
In your Lunar config/lunar.php, register the driver:
The webhook route POST /tpay/notify is registered automatically. Set this URL in your tpay merchant panel.
Usage
The PaymentAuthorize.message field carries the redirect URL — that's a Lunar API quirk (the DTO doesn't have a dedicated redirectUrl field).
You can preselect a payment method (BLIK, card, specific bank) via withData():
When omitted, tpay shows its own payment-method picker on the redirect page.
Webhook authentication — JWS x509
Tpay signs every notification with its private key (RFC 7515 detached JWS, RS256). We verify against the publicly-fetched Tpay signing certificate, chained up to the Tpay root CA. Both certificates live at:
| Production | Sandbox | |
|---|---|---|
| Signing cert | https://secure.tpay.com/x509/notifications-jws.pem |
https://secure.sandbox.tpay.com/x509/notifications-jws.pem |
| Root CA | https://secure.tpay.com/x509/tpay-jws-root.pem |
https://secure.sandbox.tpay.com/x509/tpay-jws-root.pem |
Certs are fetched once and cached for 24h. Notifications without a valid
X-JWS-Signature header are rejected with 403 SIGNATURE_INVALID. Legacy
md5sum verification is intentionally not supported — JWS is the modern,
asymmetric path with no shared secret to leak.
Testing
This package uses real sandbox tests rather than mocks. The philosophy
mirrors how Stripe, PayPal, and AWS PHP SDKs do it: real OAuth, real POST /transactions, real GET /transactions/{id} against the sandbox.
Run locally
Without these env vars the e2e sandbox tests skip cleanly with a clear message — CI without secrets stays green.
What's covered
| Test | Tests |
|---|---|
TpayClientTest |
sandbox OAuth + create/get transaction round-trip + error handling |
TpayPaymentDriverTest |
driver registration in Lunar PaymentManager + sandbox-backed authorize() flow + meta persistence |
TpayJwsVerifierTest |
JWS verifier negative paths (empty/malformed/wrong-alg/SSRF guard) |
TpayWebhookControllerTest |
controller logic (status mapping, order lookup, response codes) — verifier swapped with a deterministic stub via the container so we don't need a real tpay signature for controller-level tests |
The full positive-path JWS verification needs a real tpay-signed payload, which only happens after a real sandbox transaction fires its webhook against a publicly-reachable URL. Validate that scenario manually after deploying to a staging URL.
Why no MockClient / VCR cassettes
For payment flows the temptation is to record API responses (à la VCR) and replay them. We chose against this because:
- Sandbox is free and reliable. tpay's OpenAPI sandbox is stable.
- Recorded fixtures drift silently when the API changes — and payment schemas change more often than people expect.
- Real sandbox calls catch credential / cert / DNS issues that mocks can't.
The downside is that running tests requires creds — solved by skip-on-empty.
What's intentionally not in v1.0
- Refunds —
refund()returnsPaymentRefund(false, …). Use the tpay merchant panel for now. - Retry queue — single attempt; failure is logged and dispatched as a
Lunar
PaymentAttemptEvent. Wrap with your own retry policy if needed. - Filament admin UI —
Order.meta.tpayis the source of truth; surface it in your panel however you prefer.
License
MIT — see LICENSE.
