# Changelog

## [Unreleased]

## [v1.0.6] - 2026-03-16
### Added
- Hosted Payment Page support with Redsys form payload generation and dedicated HPP endpoint routing.
- Integration mode configuration in the admin settings UI for choosing REST or HPP flows.

### Changed
- `PaymentsController` can now hydrate payment requests from a posted `Cartsbe` ID, using `amountout` as the collected total and merchant defaults from `redsys` or legacy `paygate` settings.
- Added explicit API routes for return, cancel, webhook, HPP, app redirect, and legacy compatibility endpoints.

### Fixed
- Runtime signing now uses the configured merchant secret for REST requests and webhook verification instead of relying on the demo fallback key.
- Added backward-compatible Redsys constants and a legacy `/v3/payments/redsys` alias so older integrations continue to resolve.

## [v1.0.5] - 2025-07-14
### Fixed
- URL rules in Module.php corrected to use `redsys/api/payments/*` routes matching the `controllers/api/` sub-namespace
- Added missing `redsys-notify` URL rule for server-to-server webhook (`actionWebhook`)
- `SettingsController::actionTestConnection()` now uses `Redsys::SANDBOX_URL` / `Redsys::PRODUCTION_URL` constants instead of deprecated `sandboxUrl` / `productionUrl` aliases
- `PaymentsController::actionRequest()` now converts amount from decimal to integer cents (×100) as required by Redsys API

### Removed
- Unused `use yii\helpers\Json` import from `SettingsForm`
- Duplicate `saveToParams()` method in `SettingsForm` (alias of `save()`)
- Dead `response.details` block from `settings.js` success handler (data was already removed server-side)

## [v1.0.4] - 2025-07-13
### Fixed
- Completely rewrote `PaymentsController` — removed 384 lines of injected foreign content (wrong namespace, second `<?php` mid-file, references to non-existent Paygate class)
- Removed data leak in `SettingsController::actionTestConnection()` (merchant_code and api_url stripped from JSON response)
- `Module.php`: replaced hardcoded demo `HMAC_KEY` with `Redsys::getSecretKey()` and `Redsys::PRODUCTION_URL`

## [v1.0.3] - 2025-07-12
### Fixed
- `Redsys.php`: fixed 9 missing commas in `localAttributes()` array, implemented `getDs_Signature()`, resolved undefined variables in `getDs_MerchantParameters()`, replaced `Utils::` reference with `self::`, removed hardcoded `HMAC_KEY` constant

## [v1.0.0] - 2025-07-01
### Added
- Initial release with Redsys HMAC-SHA-512 gateway integration
