Files
e-ticket/templates/order/payment.html.twig
Serreau Jovann 04927ec988 Complete TASK_CHECKUP: security, UX, tests, coverage, accessibility, config externalization
Billetterie:
- Partial refund support (STATUS_PARTIALLY_REFUNDED, refundedAmount field, migration)
- Race condition fix: PESSIMISTIC_WRITE lock on stock decrement in transaction
- Idempotency key on PaymentIntent::create, reuse existing PI if stripeSessionId set
- Disable checkout when event ended (server 400 + template hide)
- Webhook deduplication via cache (24h TTL on stripe event.id)
- Email validation (filter_var) in OrderController guest flow
- JSON cart validation (structure check before processing)
- Invitation expiration after 7 days (isExpired method + landing page message)
- Stripe Checkout fallback when JS fails to load (noscript + redirect)

Config externalization:
- Move Stripe fees (STRIPE_FEE_RATE, STRIPE_FEE_FIXED) and admin email (ADMIN_EMAIL) to .env/services.yaml
- Replace all hardcoded contact@e-cosplay.fr across 13 files
- MailerService: getAdminEmail()/getAdminFrom(), default $from=null resolves to admin

UX & Accessibility:
- ARIA tabs: role=tablist/tab/tabpanel, aria-selected, keyboard nav (arrows, Home, End)
- aria-label on cart +/- buttons and editor toolbar buttons
- tabindex=0 on editor toolbar buttons for keyboard access
- data-confirm handler in app.js (was only in admin.js)
- Cart error feedback on checkout failure
- Billet designer save feedback (loading/success/error states)
- Stock polling every 30s with rupture/low stock badges
- Back to event link on payment page

Security:
- HTML sanitizer: BLOCKED_TAGS list (script, style, iframe, svg, etc.) - content fully removed
- Stripe polling timeout (15s max) with fallback redirect
- Rate limiting on public order access (20/5min)
- .catch() on all fetch() calls (sortable, billet-designer)

Tests (92% PHP, 100% JS lines):
- PCOV added to dev Dockerfile
- Test DB setup: .env.test with DATABASE_URL, Redis auth, Meilisearch key
- Rate limiter disabled in test env
- Makefile: test_db_setup, test_db_reset, run_test_php, run_test_coverage_php/js
- New tests: InvitationFlowTest (21), AuditServiceTest (4), ExportServiceTest (9), InvoiceServiceTest (4)
- New tests: SuspendedUserSubscriberTest, RateLimiterSubscriberTest, MeilisearchServiceTest
- New tests: Stripe webhook payment_failed (6) + charge.refunded (6)
- New tests: BilletBuyer refund, User suspended, OrganizerInvitation expiration
- JS tests: stock polling (6), data-confirm (2), copy-url restore (1), editor ARIA (2), XSS (9), tabs keyboard (9)
- ESLint + PHP CS Fixer: 0 errors
- SonarQube exclusions aligned with vitest coverage config

Infra:
- Meilisearch consistency command (app:meilisearch:check-consistency --fix) + cron daily 3am
- MeilisearchService: getAllDocumentIds(), listIndexes()

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 11:14:06 +01:00

105 lines
6.1 KiB
Twig

{% extends 'base.html.twig' %}
{% block title %}Paiement - {{ order.event.title }} - E-Ticket{% endblock %}
{% block head %}
<script src="https://js.stripe.com/v3/" defer crossorigin="anonymous"></script>
{% endblock %}
{% block body %}
<div class="w-full md:w-[80%] lg:w-[60%] mx-auto py-12 px-4">
<div class="card-brutal overflow-hidden mb-6">
<div class="section-header">
<h2 class="text-[10px] font-black uppercase tracking-widest text-white">Evenement</h2>
</div>
<div class="p-6">
<h1 class="text-2xl font-black uppercase tracking-tighter mb-2">{{ order.event.title }}</h1>
<p class="text-sm font-bold text-gray-600 mb-1">{{ order.event.startAt|date('d/m/Y') }}{{ order.event.startAt|date('H:i') }} a {{ order.event.endAt|date('H:i') }}</p>
<p class="text-sm font-bold text-gray-600 mb-1">{{ order.event.address }}, {{ order.event.zipcode }} {{ order.event.city }}</p>
<p class="text-sm font-bold text-gray-400">Par {{ order.event.account.companyName ?? (order.event.account.firstName ~ ' ' ~ order.event.account.lastName) }}</p>
<p class="text-xs font-mono text-gray-400 mt-3">Commande {{ order.orderNumber }}</p>
</div>
</div>
<div class="card-brutal overflow-hidden mb-6">
<div class="section-header">
<h2 class="text-[10px] font-black uppercase tracking-widest text-white">Acheteur</h2>
</div>
<div class="p-6 flex flex-wrap gap-6">
<div>
<p class="text-[10px] font-black uppercase tracking-widest text-gray-400 mb-1">Nom</p>
<p class="text-sm font-bold">{{ order.lastName }}</p>
</div>
<div>
<p class="text-[10px] font-black uppercase tracking-widest text-gray-400 mb-1">Prenom</p>
<p class="text-sm font-bold">{{ order.firstName }}</p>
</div>
<div>
<p class="text-[10px] font-black uppercase tracking-widest text-gray-400 mb-1">Email</p>
<p class="text-sm font-bold">{{ order.email }}</p>
</div>
</div>
</div>
<div class="card-brutal overflow-hidden mb-6">
<div class="section-header">
<h2 class="text-[10px] font-black uppercase tracking-widest text-white">Billets</h2>
</div>
<div class="p-6">
{% for item in order.items %}
<div class="border-2 border-gray-900 bg-white p-4 {{ not loop.last ? 'mb-3' : '' }}">
<div class="flex flex-col md:flex-row md:items-center gap-4">
<div class="flex items-center gap-4 flex-1 min-w-0">
{% if item.billet and item.billet.pictureName %}
<img src="{{ ('/uploads/billets/' ~ item.billet.pictureName) | imagine_filter('thumbnail') }}" alt="{{ item.billetName }}" class="w-16 h-16 object-cover border border-gray-300 flex-shrink-0">
{% endif %}
<div class="min-w-0">
<p class="font-black uppercase text-sm">{{ item.billetName }}</p>
{% if item.billet and item.billet.description %}
<p class="text-xs text-gray-500 font-bold mt-1">{{ item.billet.description }}</p>
{% endif %}
</div>
</div>
<div class="flex items-center gap-6 flex-shrink-0">
<span class="text-sm font-bold text-gray-400">x{{ item.quantity }}</span>
<span class="font-black text-sm">{{ item.unitPriceHTDecimal|number_format(2, ',', ' ') }} &euro;/u</span>
<span class="font-black text-lg text-indigo-600">{{ item.lineTotalHTDecimal|number_format(2, ',', ' ') }} &euro;</span>
</div>
</div>
</div>
{% endfor %}
<div class="flex justify-between pt-4 mt-4 border-t-3 border-gray-900">
<span class="font-black uppercase tracking-widest">Total</span>
<span class="font-black text-2xl text-indigo-600">{{ order.totalHTDecimal|number_format(2, ',', ' ') }} &euro;</span>
</div>
</div>
</div>
<div class="card-brutal overflow-hidden" id="payment-card" data-stripe-key="{{ stripe_public_key }}" data-stripe-account="{{ stripe_account }}" data-intent-url="{{ path('app_order_create_intent', {id: order.id}) }}" data-return-url="{{ url('app_order_success', {id: order.id}) }}" data-fallback-url="{{ path('app_order_checkout_fallback', {id: order.id}) }}" data-amount="{{ order.totalHTDecimal|number_format(2, ',', ' ') }}">
<div class="section-header">
<h2 class="text-[10px] font-black uppercase tracking-widest text-white">Paiement securise</h2>
</div>
<div class="p-6">
<noscript>
<a href="{{ path('app_order_checkout_fallback', {id: order.id}) }}" class="w-full btn-brutal font-black uppercase text-sm tracking-widest bg-indigo-600 text-white hover:bg-indigo-800 transition-all block text-center">
Payer {{ order.totalHTDecimal|number_format(2, ',', ' ') }} &euro; via Stripe
</a>
</noscript>
<div id="payment-element" class="mb-6"></div>
<div id="payment-message" class="hidden flash-error mb-4">
<p class="font-black text-sm" id="payment-message-text"></p>
</div>
<button type="button" id="payment-submit" class="w-full btn-brutal font-black uppercase text-sm tracking-widest bg-indigo-600 text-white hover:bg-indigo-800 transition-all">
Payer {{ order.totalHTDecimal|number_format(2, ',', ' ') }} &euro;
</button>
<p class="text-[10px] font-bold text-gray-400 mt-4 text-center">Paiement securise par Stripe</p>
</div>
</div>
<a href="{{ path('app_event_detail', {orgaSlug: order.event.account.slug, id: order.event.id, eventSlug: order.event.slug}) }}" class="block text-center mt-6 text-sm font-bold text-gray-500 hover:text-gray-900 transition-colors">&larr; Retour a l'evenement</a>
</div>
{% endblock %}