From a766c174fed3508b6f694bb69972ab0943a784de Mon Sep 17 00:00:00 2001
From: Gytautas Zumaras <gytautaszumaras@Mac.localdomain>
Date: Fri, 20 Mar 2026 14:10:19 +0200
Subject: [PATCH 01/19] feat: add accessibility improvements for EAA compliance

---
 src/Service/SettingsTranslationService.php    |  1 +
 views/css/admin/logs_tab.css                  | 23 +++++++++++++-
 views/css/admin/payment_method.css            |  6 ++++
 views/js/admin/log.js                         | 31 +++++++++++++++++--
 .../components/settings/api-credentials.tsx   |  4 +--
 .../settings/email-notifications.tsx          |  2 +-
 .../components/settings/general-settings.tsx  |  2 +-
 .../components/settings/payment-methods.tsx   |  4 +--
 .../settings/payment-processing.tsx           |  2 +-
 views/templates/admin/logs/log_modal.tpl      | 12 ++++---
 views/templates/front/credit_card.tpl         |  5 +--
 views/templates/front/credit_cards.tpl        |  6 +++-
 .../hosted-templates/partials/all_errors.tpl  |  8 ++---
 .../partials/all_errors_16.tpl                |  8 ++---
 .../front/hosted-templates/template1.tpl      | 24 +++++++++-----
 .../front/hosted-templates/template3.tpl      | 26 ++++++++++------
 views/templates/front/loading.tpl             |  4 ++-
 views/templates/front/saferpay_iframe.tpl     |  4 +--
 views/templates/front/saferpay_wait.tpl       |  3 +-
 views/templates/hook/admin/saferpay_order.tpl |  3 ++
 .../hook/front/payment_with_cards.tpl         |  4 +--
 .../hook/front/saferpay_additional_info.tpl   | 26 ++++++++++------
 .../templates/hook/front/saferpay_payment.tpl |  2 +-
 23 files changed, 149 insertions(+), 61 deletions(-)

diff --git a/src/Service/SettingsTranslationService.php b/src/Service/SettingsTranslationService.php
index 58a315fbd..d657fdb0f 100644
--- a/src/Service/SettingsTranslationService.php
+++ b/src/Service/SettingsTranslationService.php
@@ -85,6 +85,7 @@ private function getCommonTranslations()
     {
         return [
             'saveChanges' => $this->module->l('Save Changes', self::FILE_NAME),
+            'saving' => $this->module->l('Saving...', self::FILE_NAME),
             'enable' => $this->module->l('Enable', self::FILE_NAME),
             'disable' => $this->module->l('Disable', self::FILE_NAME),
             'search' => $this->module->l('Search...', self::FILE_NAME),
diff --git a/views/css/admin/logs_tab.css b/views/css/admin/logs_tab.css
index 5bb36a92f..702cff1ec 100755
--- a/views/css/admin/logs_tab.css
+++ b/views/css/admin/logs_tab.css
@@ -73,10 +73,31 @@
     border-bottom: solid 1px grey;
     pointer-events: all;
     display: flex;
-    justify-content: center;
+    justify-content: space-between;
+    align-items: center;
     max-height: 10vh;
 }
 
+.log-modal-close {
+    background: none;
+    border: none;
+    font-size: 1.5rem;
+    cursor: pointer;
+    padding: 0.25rem 0.5rem;
+    line-height: 1;
+    color: #6b7280;
+    margin-right: 0.5rem;
+}
+
+.log-modal-close:hover {
+    color: #111827;
+}
+
+.log-modal-close:focus {
+    outline: 2px solid #2196F3;
+    outline-offset: 2px;
+}
+
 .log-modal-content {
     padding: 15px;
     height: 50vh;
diff --git a/views/css/admin/payment_method.css b/views/css/admin/payment_method.css
index 336eda6f0..9b0b08c91 100755
--- a/views/css/admin/payment_method.css
+++ b/views/css/admin/payment_method.css
@@ -43,6 +43,12 @@
     width: 0;
 }
 
+/* Visible focus indicator for keyboard navigation */
+.container-checkbox input:focus ~ .checkmark {
+    outline: 2px solid #2196F3;
+    outline-offset: 2px;
+}
+
 /* Create a custom checkbox */
 .checkmark {
     position: absolute;
diff --git a/views/js/admin/log.js b/views/js/admin/log.js
index 4a8eb769a..481b07f96 100644
--- a/views/js/admin/log.js
+++ b/views/js/admin/log.js
@@ -21,17 +21,44 @@
  */
 
 $(document).ready(function () {
+    function closeModal($modal) {
+        $modal.removeClass('open');
+        var triggerButton = $modal.data('triggerButton');
+        if (triggerButton) {
+            triggerButton.focus();
+        }
+    }
+
     $('.log-modal-overlay').on('click', function (event) {
-        $('.modal.open').removeClass('open');
+        closeModal($(this).closest('.modal'));
+        event.preventDefault();
+    });
+
+    $('.js-log-modal-close').on('click', function (event) {
+        closeModal($(this).closest('.modal'));
         event.preventDefault();
     });
 
+    $(document).on('keydown', function (event) {
+        if (event.key === 'Escape') {
+            var $openModal = $('.modal.open');
+            if ($openModal.length) {
+                closeModal($openModal);
+                event.preventDefault();
+            }
+        }
+    });
+
     $('.js-log-button').on('click', function (event) {
         var logId = $(this).data('log-id');
         var informationType = $(this).data('information-type');
+        var $modal = $('#' + $(this).data('target'));
+
+        $modal.data('triggerButton', $(this));
 
         // NOTE: opening modal
-        $('#' + $(this).data('target')).addClass('open');
+        $modal.addClass('open');
+        $modal.find('.js-log-modal-close').focus();
 
         // NOTE: if information has been set already we don't need to call ajax again.
         if (!$('#log-modal-' + logId + '-' + informationType + ' .log-modal-content-data').hasClass('hidden')) {
diff --git a/views/js/admin/settings-app/src/components/settings/api-credentials.tsx b/views/js/admin/settings-app/src/components/settings/api-credentials.tsx
index 5a3931901..15484be1e 100644
--- a/views/js/admin/settings-app/src/components/settings/api-credentials.tsx
+++ b/views/js/admin/settings-app/src/components/settings/api-credentials.tsx
@@ -168,7 +168,7 @@ export function ApiCredentials() {
                   <button
                     type="button"
                     onClick={() => setShowApiPassword(!showApiPassword)}
-                    className="sp-absolute sp-right-3 sp-top-1/2 sp--translate-y-1/2 sp-text-muted-foreground hover:sp-text-foreground sp-transition-colors"
+                    className="sp-absolute sp-right-3 sp-top-1/2 sp--translate-y-1/2 sp-text-muted-foreground hover:sp-text-foreground sp-transition-colors sp-p-1 sp-min-w-[24px] sp-min-h-[24px] sp-flex sp-items-center sp-justify-center"
                     aria-label={showApiPassword ? t('hidePassword') : t('showPassword')}
                   >
                     {showApiPassword ? <EyeOff className="sp-h-4 sp-w-4" /> : <Eye className="sp-h-4 sp-w-4" />}
@@ -330,7 +330,7 @@ export function ApiCredentials() {
       </Card>}
 
       <div className="sp-flex sp-justify-end">
-        <Button className="sp-min-w-[120px]" onClick={saveCredentials} disabled={saving}>
+        <Button className="sp-min-w-[120px]" onClick={saveCredentials} disabled={saving} aria-label={saving ? t('saving') : undefined}>
           {saving ? <Loader2 className="sp-h-4 sp-w-4 sp-animate-spin" /> : t('saveChanges')}
         </Button>
       </div>
diff --git a/views/js/admin/settings-app/src/components/settings/email-notifications.tsx b/views/js/admin/settings-app/src/components/settings/email-notifications.tsx
index 044239c82..d79d331ac 100644
--- a/views/js/admin/settings-app/src/components/settings/email-notifications.tsx
+++ b/views/js/admin/settings-app/src/components/settings/email-notifications.tsx
@@ -90,7 +90,7 @@ export function EmailNotifications() {
       </Card>
 
       <div className="sp-flex sp-justify-end">
-        <Button className="sp-min-w-[120px]" onClick={saveEmailSettings} disabled={saving}>
+        <Button className="sp-min-w-[120px]" onClick={saveEmailSettings} disabled={saving} aria-label={saving ? t('saving') : undefined}>
           {saving ? <Loader2 className="sp-h-4 sp-w-4 sp-animate-spin" /> : t('saveChanges')}
         </Button>
       </div>
diff --git a/views/js/admin/settings-app/src/components/settings/general-settings.tsx b/views/js/admin/settings-app/src/components/settings/general-settings.tsx
index fc077be4c..8a43d815f 100644
--- a/views/js/admin/settings-app/src/components/settings/general-settings.tsx
+++ b/views/js/admin/settings-app/src/components/settings/general-settings.tsx
@@ -221,7 +221,7 @@ export function GeneralSettings() {
       </Card>
 
       <div className="sp-flex sp-justify-end">
-        <Button className="sp-min-w-[120px]" onClick={saveGeneralSettings} disabled={saving}>
+        <Button className="sp-min-w-[120px]" onClick={saveGeneralSettings} disabled={saving} aria-label={saving ? t('saving') : undefined}>
           {saving ? <Loader2 className="sp-h-4 sp-w-4 sp-animate-spin" /> : t('saveChanges')}
         </Button>
       </div>
diff --git a/views/js/admin/settings-app/src/components/settings/payment-methods.tsx b/views/js/admin/settings-app/src/components/settings/payment-methods.tsx
index bc3fc449f..01149c2a1 100644
--- a/views/js/admin/settings-app/src/components/settings/payment-methods.tsx
+++ b/views/js/admin/settings-app/src/components/settings/payment-methods.tsx
@@ -48,7 +48,7 @@ function MultiSelect({
         <button
           type="button"
           className="sp-flex sp-min-h-[36px] sp-w-full sp-items-center sp-justify-between sp-rounded-md sp-border sp-border-border sp-bg-card sp-px-3 sp-py-1.5 sp-text-left sp-text-sm sp-transition-colors hover:sp-bg-secondary/50 focus-visible:sp-outline-none focus-visible:sp-ring-2 focus-visible:sp-ring-ring"
-          aria-label={label}
+          aria-label={selected.length === 0 ? `${label}: ${placeholder}` : `${label}: ${selected.length} ${t('selected')}`}
         >
           {selected.length === 0 ? (
             <span className="sp-text-muted-foreground">{placeholder}</span>
@@ -293,7 +293,7 @@ export function PaymentMethods() {
 
       {paymentMethods.length > 0 && (
         <div className="sp-flex sp-justify-end">
-          <Button className="sp-min-w-[120px]" onClick={savePaymentMethods} disabled={saving}>
+          <Button className="sp-min-w-[120px]" onClick={savePaymentMethods} disabled={saving} aria-label={saving ? t('saving') : undefined}>
             {saving ? <Loader2 className="sp-h-4 sp-w-4 sp-animate-spin" /> : t('saveChanges')}
           </Button>
         </div>
diff --git a/views/js/admin/settings-app/src/components/settings/payment-processing.tsx b/views/js/admin/settings-app/src/components/settings/payment-processing.tsx
index c19e98a45..3d26f72da 100644
--- a/views/js/admin/settings-app/src/components/settings/payment-processing.tsx
+++ b/views/js/admin/settings-app/src/components/settings/payment-processing.tsx
@@ -305,7 +305,7 @@ export function PaymentProcessing() {
       </Card>
 
       <div className="sp-flex sp-justify-end">
-        <Button className="sp-min-w-[120px]" onClick={savePaymentProcessing} disabled={saving}>
+        <Button className="sp-min-w-[120px]" onClick={savePaymentProcessing} disabled={saving} aria-label={saving ? t('saving') : undefined}>
           {saving ? <Loader2 className="sp-h-4 sp-w-4 sp-animate-spin" /> : t('saveChanges')}
         </Button>
       </div>
diff --git a/views/templates/admin/logs/log_modal.tpl b/views/templates/admin/logs/log_modal.tpl
index 62cb43dd4..eadfc7fcd 100644
--- a/views/templates/admin/logs/log_modal.tpl
+++ b/views/templates/admin/logs/log_modal.tpl
@@ -19,7 +19,8 @@
  *@copyright SIX Payment Services
  *@license   SIX Payment Services
  *}
-<div
+<button
+        type="button"
         class="btn btn-default button js-log-button"
         data-toggle="modal"
         data-log-id="{$log_id|escape:'htmlall':'UTF-8'}"
@@ -27,14 +28,14 @@
         data-target="log-modal-{$log_id|escape:'htmlall':'UTF-8'}-{$log_information_type|escape:'htmlall':'UTF-8'}"
 >
     {l s='View' mod='saferpayofficial'}
-</div>
+</button>
 
-<div id="log-modal-{$log_id|escape:'htmlall':'UTF-8'}-{$log_information_type|escape:'htmlall':'UTF-8'}" class="modal">
+<div id="log-modal-{$log_id|escape:'htmlall':'UTF-8'}-{$log_information_type|escape:'htmlall':'UTF-8'}" class="modal" role="dialog" aria-modal="true" aria-labelledby="log-modal-title-{$log_id|escape:'htmlall':'UTF-8'}-{$log_information_type|escape:'htmlall':'UTF-8'}">
     <div class="log-modal-overlay"></div>
 
     <div class="log-modal-window">
         <div class="log-modal-title">
-            <h4>
+            <h4 id="log-modal-title-{$log_id|escape:'htmlall':'UTF-8'}-{$log_information_type|escape:'htmlall':'UTF-8'}">
                 {if $log_information_type === 'request'}
                     {$log_id|escape:'htmlall':'UTF-8'}: {l s='Request data' mod='saferpayofficial'}
                 {elseif $log_information_type === 'response'}
@@ -43,10 +44,11 @@
                     {$log_id|escape:'htmlall':'UTF-8'}: {l s='Context data' mod='saferpayofficial'}
                 {/if}
             </h4>
+            <button type="button" class="log-modal-close js-log-modal-close" aria-label="{l s='Close' mod='saferpayofficial'}">&times;</button>
         </div>
 
         <div class="log-modal-content">
-            <div class="log-modal-content-spinner hidden"></div>
+            <div class="log-modal-content-spinner hidden" role="status" aria-label="{l s='Loading' mod='saferpayofficial'}"></div>
             <pre class="log-modal-content-data hidden"></pre>
         </div>
     </div>
diff --git a/views/templates/front/credit_card.tpl b/views/templates/front/credit_card.tpl
index f1e29053b..7f0f363fb 100755
--- a/views/templates/front/credit_card.tpl
+++ b/views/templates/front/credit_card.tpl
@@ -22,7 +22,7 @@
 
 <tr>
     <td>
-        <img src="{$card_img|escape:'htmlall':'UTF-8'}">
+        <img src="{$card_img|escape:'htmlall':'UTF-8'}" alt="{$payment_method|escape:'htmlall':'UTF-8'}">
     </td>
     <td>
         {$payment_method|escape:'htmlall':'UTF-8'}
@@ -38,7 +38,8 @@
     </td>
     <td>
         <a class="button lnk_view btn btn-default"
-           href="{$link->getModuleLink('saferpayofficial', {$controller|escape:'htmlall':'UTF-8'}, ['saved_card_id' => $saved_card_id|escape:'htmlall':'UTF-8'])|escape:'htmlall':'UTF-8' }">
+           href="{$link->getModuleLink('saferpayofficial', {$controller|escape:'htmlall':'UTF-8'}, ['saved_card_id' => $saved_card_id|escape:'htmlall':'UTF-8'])|escape:'htmlall':'UTF-8' }"
+           aria-label="{l s='Remove card' mod='saferpayofficial'} {$card_number|escape:'htmlall':'UTF-8'}">
             <span>
                 {l s='Remove' mod='saferpayofficial'}
             </span>
diff --git a/views/templates/front/credit_cards.tpl b/views/templates/front/credit_cards.tpl
index 16083a4b5..c31df2224 100755
--- a/views/templates/front/credit_cards.tpl
+++ b/views/templates/front/credit_cards.tpl
@@ -29,9 +29,11 @@
 {block name='page_content'}
     <div class="card">
         <table class="table">
+            <caption class="sr-only">{l s='Saved credit cards' mod='saferpayofficial'}</caption>
             <thead>
             <tr>
                 <th>
+                    <span class="sr-only">{l s='Card type' mod='saferpayofficial'}</span>
                 </th>
                 <th>
                     {l s='Credit card' mod='saferpayofficial'}
@@ -43,16 +45,18 @@
                     {l s='Valid till' mod='saferpayofficial'}
                 </th>
                 <th>
-                    {l s='Card' mod='saferpayofficial'}
+                    {l s='Card number' mod='saferpayofficial'}
                 </th>
                 <th>
                     {l s='Action' mod='saferpayofficial'}
                 </th>
             </tr>
             </thead>
+            <tbody>
             {foreach $rows as $row}
                 {$row|cleanHtml nofilter}
             {/foreach}
+            </tbody>
         </table>
     </div>
 {/block}
diff --git a/views/templates/front/hosted-templates/partials/all_errors.tpl b/views/templates/front/hosted-templates/partials/all_errors.tpl
index 4b99e0310..2fdddc0a7 100755
--- a/views/templates/front/hosted-templates/partials/all_errors.tpl
+++ b/views/templates/front/hosted-templates/partials/all_errors.tpl
@@ -19,18 +19,18 @@
  *@copyright SIX Payment Services
  *@license   SIX Payment Services
  *}
-<div style="display:none" class="alert alert-danger initialize-error" role="alert">
+<div style="display:none" class="alert alert-danger initialize-error" role="alert" aria-live="assertive">
     {include file="module:saferpayofficial/views/templates/front/hosted-templates/partials/initialize_error.tpl"}
 </div>
 
-<div style="display: none" class="alert alert-danger submission-error" role="alert">
+<div style="display: none" class="alert alert-danger submission-error" role="alert" aria-live="assertive">
     {include file="module:saferpayofficial/views/templates/front/hosted-templates/partials/submission_error.tpl"}
 </div>
 
-<div style="display:none" class="alert alert-danger internal-error" role="alert">
+<div style="display:none" class="alert alert-danger internal-error" role="alert" aria-live="assertive">
     {include file="module:saferpayofficial/views/templates/front/hosted-templates/partials/internal_error.tpl"}
 </div>
 
-<div style="display: none" class="alert alert-danger validation-error" role="alert">
+<div style="display: none" class="alert alert-danger validation-error" role="alert" aria-live="assertive">
     {include file="module:saferpayofficial/views/templates/front/hosted-templates/partials/validation_error.tpl"}
 </div>
\ No newline at end of file
diff --git a/views/templates/front/hosted-templates/partials/all_errors_16.tpl b/views/templates/front/hosted-templates/partials/all_errors_16.tpl
index cf5a5a1f7..40eab9865 100755
--- a/views/templates/front/hosted-templates/partials/all_errors_16.tpl
+++ b/views/templates/front/hosted-templates/partials/all_errors_16.tpl
@@ -19,18 +19,18 @@
  *@copyright SIX Payment Services
  *@license   SIX Payment Services
  *}
-<div style="display:none" class="alert alert-danger initialize-error" role="alert">
+<div style="display:none" class="alert alert-danger initialize-error" role="alert" aria-live="assertive">
     {include file="./initialize_error.tpl"}
 </div>
 
-<div style="display: none" class="alert alert-danger submission-error" role="alert">
+<div style="display: none" class="alert alert-danger submission-error" role="alert" aria-live="assertive">
     {include file="./submission_error.tpl"}
 </div>
 
-<div style="display:none" class="alert alert-danger internal-error" role="alert">
+<div style="display:none" class="alert alert-danger internal-error" role="alert" aria-live="assertive">
     {include file="./internal_error.tpl"}
 </div>
 
-<div style="display: none" class="alert alert-danger validation-error" role="alert">
+<div style="display: none" class="alert alert-danger validation-error" role="alert" aria-live="assertive">
     {include file="./validation_error.tpl"}
 </div>
\ No newline at end of file
diff --git a/views/templates/front/hosted-templates/template1.tpl b/views/templates/front/hosted-templates/template1.tpl
index 7e472882b..503132ae3 100755
--- a/views/templates/front/hosted-templates/template1.tpl
+++ b/views/templates/front/hosted-templates/template1.tpl
@@ -34,21 +34,25 @@
 
     <div class="container" id="main">
         <div class="form-group">
-            <input class="form-control" id="fields-holder-name" readonly placeholder="{l s='Holder name' mod='saferpayofficial'}">
+            <label for="fields-holder-name" class="sr-only">{l s='Holder name' mod='saferpayofficial'}</label>
+            <input class="form-control" id="fields-holder-name" readonly placeholder="{l s='Holder name' mod='saferpayofficial'}" aria-label="{l s='Holder name' mod='saferpayofficial'}">
         </div>
 
         <div class="form-group row">
             <div class="col-sm-12">
-                <input class="form-control" id="fields-card-number" readonly placeholder="{l s='0000 0000 0000 0000' mod='saferpayofficial'}">
+                <label for="fields-card-number" class="sr-only">{l s='Card number' mod='saferpayofficial'}</label>
+                <input class="form-control" id="fields-card-number" readonly placeholder="{l s='0000 0000 0000 0000' mod='saferpayofficial'}" aria-label="{l s='Card number' mod='saferpayofficial'}">
             </div>
         </div>
 
         <div class="row">
             <div class="col-sm-6 col-xs-12 form-group">
-                <input class="form-control" id="fields-expiration" readonly placeholder="{l s='MM/YYYY' mod='saferpayofficial'}">
+                <label for="fields-expiration" class="sr-only">{l s='Expiration date' mod='saferpayofficial'}</label>
+                <input class="form-control" id="fields-expiration" readonly placeholder="{l s='MM/YYYY' mod='saferpayofficial'}" aria-label="{l s='Expiration date' mod='saferpayofficial'}">
             </div>
             <div class="col-sm-6 col-xs-12 form-group">
-                <input class="form-control" id="fields-cvc" readonly placeholder="{l s='000' mod='saferpayofficial'}">
+                <label for="fields-cvc" class="sr-only">{l s='CVC code' mod='saferpayofficial'}</label>
+                <input class="form-control" id="fields-cvc" readonly placeholder="{l s='000' mod='saferpayofficial'}" aria-label="{l s='CVC code' mod='saferpayofficial'}">
             </div>
         </div>
 
@@ -67,21 +71,25 @@
 
     <div class="container" id="main">
         <div class="form-group">
-            <input class="form-control" id="fields-holder-name" readonly placeholder="{l s='Holder name' mod='saferpayofficial'}">
+            <label for="fields-holder-name" class="sr-only">{l s='Holder name' mod='saferpayofficial'}</label>
+            <input class="form-control" id="fields-holder-name" readonly placeholder="{l s='Holder name' mod='saferpayofficial'}" aria-label="{l s='Holder name' mod='saferpayofficial'}">
         </div>
 
         <div class="form-group row">
             <div class="col-sm-12">
-                <input class="form-control" id="fields-card-number" readonly placeholder="{l s='0000 0000 0000 0000' mod='saferpayofficial'}">
+                <label for="fields-card-number" class="sr-only">{l s='Card number' mod='saferpayofficial'}</label>
+                <input class="form-control" id="fields-card-number" readonly placeholder="{l s='0000 0000 0000 0000' mod='saferpayofficial'}" aria-label="{l s='Card number' mod='saferpayofficial'}">
             </div>
         </div>
 
         <div class="row">
             <div class="col-sm-6 col-xs-12 form-group">
-                <input class="form-control" id="fields-expiration" readonly placeholder="{l s='MM/YYYY' mod='saferpayofficial'}">
+                <label for="fields-expiration" class="sr-only">{l s='Expiration date' mod='saferpayofficial'}</label>
+                <input class="form-control" id="fields-expiration" readonly placeholder="{l s='MM/YYYY' mod='saferpayofficial'}" aria-label="{l s='Expiration date' mod='saferpayofficial'}">
             </div>
             <div class="col-sm-6 col-xs-12 form-group">
-                <input class="form-control" id="fields-cvc" readonly placeholder="{l s='000' mod='saferpayofficial'}">
+                <label for="fields-cvc" class="sr-only">{l s='CVC code' mod='saferpayofficial'}</label>
+                <input class="form-control" id="fields-cvc" readonly placeholder="{l s='000' mod='saferpayofficial'}" aria-label="{l s='CVC code' mod='saferpayofficial'}">
             </div>
         </div>
 
diff --git a/views/templates/front/hosted-templates/template3.tpl b/views/templates/front/hosted-templates/template3.tpl
index 5dbc50b77..cfd9375b8 100755
--- a/views/templates/front/hosted-templates/template3.tpl
+++ b/views/templates/front/hosted-templates/template3.tpl
@@ -39,18 +39,21 @@
             <div class="input-container">
                 <div class="form-group row col-sm-7 input-box">
                     <div class="col col-sm-12 col-md-6">
-                        <input type="input" class="saferpay-input form-control" id="fields-card-number""
-                        placeholder="{l s='Card number' mod='saferpayofficial'}" readonly>
+                        <label for="fields-card-number" class="sr-only">{l s='Card number' mod='saferpayofficial'}</label>
+                        <input type="input" class="saferpay-input form-control" id="fields-card-number"
+                        placeholder="{l s='Card number' mod='saferpayofficial'}" aria-label="{l s='Card number' mod='saferpayofficial'}" readonly>
                     </div>
 
                     <div class="col col-sm-12 col-md-3">
+                        <label for="fields-expiration" class="sr-only">{l s='Expiration date' mod='saferpayofficial'}</label>
                         <input type="input" class="saferpay-input form-control" id="fields-expiration"
-                               placeholder="{l s='Exp' mod='saferpayofficial'}" readonly>
+                               placeholder="{l s='Exp' mod='saferpayofficial'}" aria-label="{l s='Expiration date' mod='saferpayofficial'}" readonly>
                     </div>
 
                     <div class="col col-sm-12 col-md-3">
+                        <label for="fields-cvc" class="sr-only">{l s='CVC code' mod='saferpayofficial'}</label>
                         <input type="input" class="saferpay-input form-control" id="fields-cvc"
-                               placeholder="{l s='Cvc' mod='saferpayofficial'}" readonly>
+                               placeholder="{l s='Cvc' mod='saferpayofficial'}" aria-label="{l s='CVC code' mod='saferpayofficial'}" readonly>
                     </div>
                 </div>
             </div>
@@ -64,7 +67,7 @@
 
             <div class="credit-card-container">
                 <div class="image-container">
-                    <div id="credit-card" class="credit-card-image img-fluid"></div>
+                    <div id="credit-card" class="credit-card-image img-fluid" role="img" aria-label="{l s='Credit card preview' mod='saferpayofficial'}"></div>
                 </div>
             </div>
 
@@ -85,18 +88,21 @@
             <div class="input-container">
                 <div class="form-group row col-sm-7 input-box">
                     <div class="col col-sm-12 col-md-6">
-                        <input type="input" class="saferpay-input form-control" id="fields-card-number""
-                        placeholder="{l s='Card number' mod='saferpayofficial'}" readonly>
+                        <label for="fields-card-number" class="sr-only">{l s='Card number' mod='saferpayofficial'}</label>
+                        <input type="input" class="saferpay-input form-control" id="fields-card-number"
+                        placeholder="{l s='Card number' mod='saferpayofficial'}" aria-label="{l s='Card number' mod='saferpayofficial'}" readonly>
                     </div>
 
                     <div class="col col-sm-12 col-md-3">
+                        <label for="fields-expiration" class="sr-only">{l s='Expiration date' mod='saferpayofficial'}</label>
                         <input type="input" class="saferpay-input form-control" id="fields-expiration"
-                               placeholder="{l s='Exp' mod='saferpayofficial'}" readonly>
+                               placeholder="{l s='Exp' mod='saferpayofficial'}" aria-label="{l s='Expiration date' mod='saferpayofficial'}" readonly>
                     </div>
 
                     <div class="col col-sm-12 col-md-3">
+                        <label for="fields-cvc" class="sr-only">{l s='CVC code' mod='saferpayofficial'}</label>
                         <input type="input" class="saferpay-input form-control" id="fields-cvc"
-                               placeholder="{l s='Cvc' mod='saferpayofficial'}" readonly>
+                               placeholder="{l s='Cvc' mod='saferpayofficial'}" aria-label="{l s='CVC code' mod='saferpayofficial'}" readonly>
                     </div>
                 </div>
             </div>
@@ -110,7 +116,7 @@
 
             <div class="credit-card-container">
                 <div class="image-container">
-                    <div id="credit-card" class="credit-card-image img-fluid"></div>
+                    <div id="credit-card" class="credit-card-image img-fluid" role="img" aria-label="{l s='Credit card preview' mod='saferpayofficial'}"></div>
                 </div>
             </div>
 
diff --git a/views/templates/front/loading.tpl b/views/templates/front/loading.tpl
index 07fbe8d47..242413ed0 100755
--- a/views/templates/front/loading.tpl
+++ b/views/templates/front/loading.tpl
@@ -26,7 +26,9 @@
 {/block}
 
 {block name='content'}
-    <div class="loader"></div>
+    <div class="loader" role="status" aria-live="polite">
+        <span class="sr-only">{l s='Loading payment, please wait' mod='saferpayofficial'}</span>
+    </div>
 {/block}
 
 {block name='footer'}
diff --git a/views/templates/front/saferpay_iframe.tpl b/views/templates/front/saferpay_iframe.tpl
index 6056c0345..7180a76c2 100755
--- a/views/templates/front/saferpay_iframe.tpl
+++ b/views/templates/front/saferpay_iframe.tpl
@@ -30,13 +30,13 @@
 
 {block name='content'}
     <div>
-        <iframe id="saferpay-iframe" src="{$redirect|escape:'htmlall':'UTF-8'}"></iframe>
+        <iframe id="saferpay-iframe" src="{$redirect|escape:'htmlall':'UTF-8'}" title="{l s='Saferpay payment form' mod='saferpayofficial'}"></iframe>
     </div>
 {/block}
 
 {block name='checkout_process'}
     <div>
-        <iframe id="saferpay-iframe" src="{$redirect|escape:'htmlall':'UTF-8'}"></iframe>
+        <iframe id="saferpay-iframe" src="{$redirect|escape:'htmlall':'UTF-8'}" title="{l s='Saferpay payment form' mod='saferpayofficial'}"></iframe>
     </div>
 {/block}
 
diff --git a/views/templates/front/saferpay_wait.tpl b/views/templates/front/saferpay_wait.tpl
index 28d372572..f99cab0a2 100644
--- a/views/templates/front/saferpay_wait.tpl
+++ b/views/templates/front/saferpay_wait.tpl
@@ -20,7 +20,8 @@
  *@license   SIX Payment Services
  *}
 <h2>{l s='Awaiting payment status' mod='saferpayofficial'}</h2>
-<div class="saferpay-spinner">
+<div class="saferpay-spinner" role="status" aria-live="polite">
+    <span class="sr-only">{l s='Loading, please wait' mod='saferpayofficial'}</span>
     <div class="rect1"></div>
     <div class="rect2"></div>
     <div class="rect3"></div>
diff --git a/views/templates/hook/admin/saferpay_order.tpl b/views/templates/hook/admin/saferpay_order.tpl
index fff4f2b2e..7ad4012ab 100755
--- a/views/templates/hook/admin/saferpay_order.tpl
+++ b/views/templates/hook/admin/saferpay_order.tpl
@@ -37,10 +37,13 @@
                     <div class="mb-2 form-inline">
                         <div class="input-group money-type row">
                             <div class="input-group">
+                                <label for="saferpay-refund-amount" class="sr-only">{l s='Refund amount' mod='saferpayofficial'}</label>
                                 <span class=" input-group-addon input-group-text"> {$currencySign|escape:'htmlall':'UTF-8'}</span>
                                 <input type="number"
+                                       id="saferpay-refund-amount"
                                        name="saferpay_refund_amount"
                                        class="form-control"
+                                       aria-label="{l s='Refund amount' mod='saferpayofficial'}"
                                        step=".01"
                                        min="0"
                                        max="{($authAmount|escape:'htmlall':'UTF-8' - $refund_amount|escape:'htmlall':'UTF-8' - $pending_refund_amount|escape:'htmlall':'UTF-8') / $amountMultiplier|escape:'htmlall':'UTF-8'}"
diff --git a/views/templates/hook/front/payment_with_cards.tpl b/views/templates/hook/front/payment_with_cards.tpl
index 5ec47b52b..d5dc48a9c 100755
--- a/views/templates/hook/front/payment_with_cards.tpl
+++ b/views/templates/hook/front/payment_with_cards.tpl
@@ -36,8 +36,8 @@
         <input type="hidden" class="saved_card_method" name="isBusinessLicence" value="1">
         <input type="hidden" name="saferpayPaymentType" value="{$saferpayPaymentType|escape:'htmlall':'UTF-8'}">
 
-        <a type="submit" class="btn btn-default button button-medium" onclick="$(this).closest('form').submit();">
+        <button type="submit" class="btn btn-default button button-medium">
             <span>{l s='Pay' mod='saferpayofficial'}<i class="icon-chevron-right right"></i></span>
-        </a>
+        </button>
     </form>
 </div>
diff --git a/views/templates/hook/front/saferpay_additional_info.tpl b/views/templates/hook/front/saferpay_additional_info.tpl
index 66b9b9e1d..ad441659c 100755
--- a/views/templates/hook/front/saferpay_additional_info.tpl
+++ b/views/templates/hook/front/saferpay_additional_info.tpl
@@ -25,20 +25,26 @@
     {$selected = 1}
     {foreach $savedCards as $savedCard}
         <div class="saved_credit_cards">
-            <input type="radio" name="saved_card_{$paymentMethod|escape:'htmlall':'UTF-8'}" value="{$savedCard['id_saferpay_card_alias']|escape:'htmlall':'UTF-8'}"
-                   {if $selected }checked="checked" {$selected = 0}{/if}
-            >
-            <span>{$savedCard['card_number']|escape:'htmlall':'UTF-8'}</span>
+            <label>
+                <input type="radio" name="saved_card_{$paymentMethod|escape:'htmlall':'UTF-8'}" value="{$savedCard['id_saferpay_card_alias']|escape:'htmlall':'UTF-8'}"
+                       {if $selected }checked="checked" {$selected = 0}{/if}
+                >
+                <span>{$savedCard['card_number']|escape:'htmlall':'UTF-8'}</span>
+            </label>
         </div>
     {/foreach}
     <div class="saved_credit_cards">
-        <input type="radio" name="saved_card_{$paymentMethod|escape:'htmlall':'UTF-8'}" value="0"
-               {if $selected }checked="checked"{/if}
-        >
-        <span>{l s='Use new card and save it' mod='saferpayofficial'}</span>
+        <label>
+            <input type="radio" name="saved_card_{$paymentMethod|escape:'htmlall':'UTF-8'}" value="0"
+                   {if $selected }checked="checked"{/if}
+            >
+            <span>{l s='Use new card and save it' mod='saferpayofficial'}</span>
+        </label>
     </div>
     <div class="saved_credit_cards">
-        <input type="radio" name="saved_card_{$paymentMethod|escape:'htmlall':'UTF-8'}" value="-1">
-        <span>{l s='Use new card once' mod='saferpayofficial'}</span>
+        <label>
+            <input type="radio" name="saved_card_{$paymentMethod|escape:'htmlall':'UTF-8'}" value="-1">
+            <span>{l s='Use new card once' mod='saferpayofficial'}</span>
+        </label>
     </div>
 </div>
\ No newline at end of file
diff --git a/views/templates/hook/front/saferpay_payment.tpl b/views/templates/hook/front/saferpay_payment.tpl
index 4151f6245..d0c7c2697 100755
--- a/views/templates/hook/front/saferpay_payment.tpl
+++ b/views/templates/hook/front/saferpay_payment.tpl
@@ -21,5 +21,5 @@
  *}
 
 <div>
-    <iframe id="test-frame" src=''></iframe>
+    <iframe id="saferpay-payment-frame" src='' title="{l s='Saferpay payment form' mod='saferpayofficial'}"></iframe>
 </div>
\ No newline at end of file

From 54c05a01ebd175c461f0898e7cdf097b9661bfcb Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@Tadas-Labutis.local>
Date: Fri, 8 May 2026 12:47:17 +0300
Subject: [PATCH 02/19] fix(a11y): add aria-label to mobile switches and tab
 triggers

Adds discernible accessible names to interactive controls that
were unlabelled at narrow viewports, resolving 33 of the 36 axe-core
violations found during SL-346 QA.

- Payment Methods mobile cards: add aria-label to "Logos" and
  "Custom form" switches (28 violations). Desktop layout was already
  labelled; only the md:sp-hidden mobile block was missing labels.
- Settings tab triggers: add aria-label to all five TabsTrigger
  buttons (5 violations). Visible text labels are wrapped in
  sp-hidden sm:sp-inline so on mobile only the icon shows; without
  aria-label the buttons had no accessible name.
---
 .../settings-app/src/components/settings/payment-methods.tsx | 2 ++
 .../src/components/settings/saferpay-settings.tsx            | 5 +++++
 2 files changed, 7 insertions(+)

diff --git a/views/js/admin/settings-app/src/components/settings/payment-methods.tsx b/views/js/admin/settings-app/src/components/settings/payment-methods.tsx
index 01149c2a1..5daddcd97 100644
--- a/views/js/admin/settings-app/src/components/settings/payment-methods.tsx
+++ b/views/js/admin/settings-app/src/components/settings/payment-methods.tsx
@@ -243,6 +243,7 @@ export function PaymentMethods() {
                       <Switch
                         checked={method.showLogos}
                         onCheckedChange={(checked) => updatePaymentMethod(method.name, { showLogos: checked })}
+                        aria-label={`${t('logos')} ${method.displayName}`}
                       />
                     </div>
                     {method.hasCustomForm && (
@@ -251,6 +252,7 @@ export function PaymentMethods() {
                         <Switch
                           checked={method.showCustomForm}
                           onCheckedChange={(checked) => updatePaymentMethod(method.name, { showCustomForm: checked })}
+                          aria-label={`${t('customForm')} ${method.displayName}`}
                         />
                       </div>
                     )}
diff --git a/views/js/admin/settings-app/src/components/settings/saferpay-settings.tsx b/views/js/admin/settings-app/src/components/settings/saferpay-settings.tsx
index 0d8649911..93b02197c 100644
--- a/views/js/admin/settings-app/src/components/settings/saferpay-settings.tsx
+++ b/views/js/admin/settings-app/src/components/settings/saferpay-settings.tsx
@@ -24,6 +24,7 @@ export function SaferpaySettings() {
         <TabsList className="sp-h-auto sp-w-full sp-justify-start sp-gap-1 sp-rounded-lg sp-bg-white sp-border sp-border-border sp-p-1">
           <TabsTrigger
             value="credentials"
+            aria-label={t('tabApiCredentials')}
             className="sp-flex sp-items-center sp-gap-2 sp-rounded-md sp-px-2.5 sp-py-2.5 sm:sp-px-4 sp-text-sm sp-font-normal sp-bg-transparent data-[state=active]:sp-bg-primary data-[state=active]:sp-text-primary-foreground data-[state=active]:sp-shadow-none"
           >
             <Key className="sp-h-4 sp-w-4 sp-shrink-0" />
@@ -31,6 +32,7 @@ export function SaferpaySettings() {
           </TabsTrigger>
           <TabsTrigger
             value="methods"
+            aria-label={t('tabPaymentMethods')}
             className="sp-flex sp-items-center sp-gap-2 sp-rounded-md sp-px-2.5 sp-py-2.5 sm:sp-px-4 sp-text-sm sp-font-normal sp-bg-transparent data-[state=active]:sp-bg-primary data-[state=active]:sp-text-primary-foreground data-[state=active]:sp-shadow-none"
           >
             <Wallet className="sp-h-4 sp-w-4 sp-shrink-0" />
@@ -38,6 +40,7 @@ export function SaferpaySettings() {
           </TabsTrigger>
           <TabsTrigger
             value="payment"
+            aria-label={t('tabPaymentProcessing')}
             className="sp-flex sp-items-center sp-gap-2 sp-rounded-md sp-px-2.5 sp-py-2.5 sm:sp-px-4 sp-text-sm sp-font-normal sp-bg-transparent data-[state=active]:sp-bg-primary data-[state=active]:sp-text-primary-foreground data-[state=active]:sp-shadow-none"
           >
             <CreditCard className="sp-h-4 sp-w-4 sp-shrink-0" />
@@ -45,6 +48,7 @@ export function SaferpaySettings() {
           </TabsTrigger>
           <TabsTrigger
             value="email"
+            aria-label={t('tabEmailNotifications')}
             className="sp-flex sp-items-center sp-gap-2 sp-rounded-md sp-px-2.5 sp-py-2.5 sm:sp-px-4 sp-text-sm sp-font-normal sp-bg-transparent data-[state=active]:sp-bg-primary data-[state=active]:sp-text-primary-foreground data-[state=active]:sp-shadow-none"
           >
             <Mail className="sp-h-4 sp-w-4 sp-shrink-0" />
@@ -52,6 +56,7 @@ export function SaferpaySettings() {
           </TabsTrigger>
           <TabsTrigger
             value="general"
+            aria-label={t('tabGeneralSettings')}
             className="sp-flex sp-items-center sp-gap-2 sp-rounded-md sp-px-2.5 sp-py-2.5 sm:sp-px-4 sp-text-sm sp-font-normal sp-bg-transparent data-[state=active]:sp-bg-primary data-[state=active]:sp-text-primary-foreground data-[state=active]:sp-shadow-none"
           >
             <Settings2 className="sp-h-4 sp-w-4 sp-shrink-0" />

From 04934a5a57d916a50213b0203fa284bb0552e5b9 Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@Tadas-Labutis.local>
Date: Fri, 8 May 2026 13:06:00 +0300
Subject: [PATCH 03/19] fix(a11y): improve color contrast for WCAG 2.1 AA
 compliance

- Darken --sp-muted-foreground from 46% to 38% lightness (4.31:1 -> ~6.4:1)
- Replace sp-text-emerald-600 with sp-text-emerald-700 in API Credentials
  (3.76:1 -> 5.27:1 on white, 3.57:1 -> ~5:1 on emerald-50)

Resolves 3 axe-core color-contrast violations across all 5 settings tabs.
Verified: 0 contrast issues remain inside #saferpay-settings-root.
---
 .../src/components/settings/api-credentials.tsx             | 6 +++---
 views/js/admin/settings-app/src/globals.css                 | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/views/js/admin/settings-app/src/components/settings/api-credentials.tsx b/views/js/admin/settings-app/src/components/settings/api-credentials.tsx
index 15484be1e..be169a505 100644
--- a/views/js/admin/settings-app/src/components/settings/api-credentials.tsx
+++ b/views/js/admin/settings-app/src/components/settings/api-credentials.tsx
@@ -185,7 +185,7 @@ export function ApiCredentials() {
               </div>
             )}
             {credentialStatus === 'valid' && (
-              <div className="sp-flex sp-items-center sp-gap-2 sp-text-sm sp-text-emerald-600">
+              <div className="sp-flex sp-items-center sp-gap-2 sp-text-sm sp-text-emerald-700">
                 <CheckCircle2 className="sp-h-4 sp-w-4" />
                 {t('credentialsValid')}
               </div>
@@ -250,12 +250,12 @@ export function ApiCredentials() {
         <CardContent>
           <div className="sp-grid sp-gap-5">
             <div className="sp-flex sp-items-center sp-gap-3 sp-rounded-lg sp-bg-emerald-50 sp-border sp-border-emerald-200 sp-px-4 sp-py-3">
-              <CheckCircle2 className="sp-h-5 sp-w-5 sp-shrink-0 sp-text-emerald-600" />
+              <CheckCircle2 className="sp-h-5 sp-w-5 sp-shrink-0 sp-text-emerald-700" />
               <div className="sp-flex sp-flex-col sp-gap-0.5">
                 <p className="sp-mb-0 sp-text-sm sp-font-medium sp-text-emerald-800">
                   {t('saferpayFieldsIncluded')}
                 </p>
-                <p className="sp-mb-0 sp-text-xs sp-text-emerald-600">
+                <p className="sp-mb-0 sp-text-xs sp-text-emerald-700">
                   {t('saferpayFieldsIncludedDescription')}
                 </p>
               </div>
diff --git a/views/js/admin/settings-app/src/globals.css b/views/js/admin/settings-app/src/globals.css
index 084c1fe3b..b222286c7 100644
--- a/views/js/admin/settings-app/src/globals.css
+++ b/views/js/admin/settings-app/src/globals.css
@@ -14,7 +14,7 @@
   --sp-secondary: 180 15% 95%;
   --sp-secondary-foreground: 220 20% 10%;
   --sp-muted: 180 12% 95%;
-  --sp-muted-foreground: 220 10% 46%;
+  --sp-muted-foreground: 220 12% 38%;
   --sp-accent: 180 25% 92%;
   --sp-accent-foreground: 180 51% 22%;
   --sp-destructive: 0 72% 51%;

From 2da0b7dc0f9b9569d4e0e39553a1288821f67a3b Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@Tadas-Labutis.local>
Date: Fri, 8 May 2026 13:11:16 +0300
Subject: [PATCH 04/19] fix(a11y): add aria-label to hosted field style
 combobox

Radix Label component does not auto-wire to SelectTrigger; without
an explicit aria-label, screen readers announced only the selected
value. Resolves last open finding in TC-346.1.
---
 .../settings-app/src/components/settings/general-settings.tsx   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/views/js/admin/settings-app/src/components/settings/general-settings.tsx b/views/js/admin/settings-app/src/components/settings/general-settings.tsx
index 8a43d815f..52b795687 100644
--- a/views/js/admin/settings-app/src/components/settings/general-settings.tsx
+++ b/views/js/admin/settings-app/src/components/settings/general-settings.tsx
@@ -101,7 +101,7 @@ export function GeneralSettings() {
                 value={String(settings.hostedFieldsTemplate)}
                 onValueChange={(val) => updateSettings({ hostedFieldsTemplate: Number(val) })}
               >
-                <SelectTrigger className="sp-w-[220px]">
+                <SelectTrigger className="sp-w-[220px]" aria-label={t('hostedFieldStyle')}>
                   <SelectValue />
                 </SelectTrigger>
                 <SelectContent>

From baca7a3a4f65820d1a757be305bf795c74308187 Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@Tadas-Labutis.local>
Date: Fri, 8 May 2026 13:19:21 +0300
Subject: [PATCH 05/19] fix(a11y): add focus trap to log details modal

Previously Tab could escape the modal into background page content
violating WCAG 2.1.2 (Focus Order) for modal dialogs. Tab/Shift+Tab
now cycle within the modal's focusable elements.

Resolves TC-346.7.
---
 views/js/admin/log.js | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/views/js/admin/log.js b/views/js/admin/log.js
index 481b07f96..a16cecc4b 100644
--- a/views/js/admin/log.js
+++ b/views/js/admin/log.js
@@ -40,10 +40,31 @@ $(document).ready(function () {
     });
 
     $(document).on('keydown', function (event) {
+        var $openModal = $('.modal.open');
+        if (!$openModal.length) {
+            return;
+        }
         if (event.key === 'Escape') {
-            var $openModal = $('.modal.open');
-            if ($openModal.length) {
-                closeModal($openModal);
+            closeModal($openModal);
+            event.preventDefault();
+            return;
+        }
+        if (event.key === 'Tab') {
+            var focusables = $openModal.find('button, [href], input, select, textarea, [tabindex]:not([tabindex="-1"])').filter(':visible');
+            if (!focusables.length) {
+                event.preventDefault();
+                return;
+            }
+            var first = focusables.first()[0];
+            var last = focusables.last()[0];
+            if (event.shiftKey && document.activeElement === first) {
+                last.focus();
+                event.preventDefault();
+            } else if (!event.shiftKey && document.activeElement === last) {
+                first.focus();
+                event.preventDefault();
+            } else if (!$openModal[0].contains(document.activeElement)) {
+                first.focus();
                 event.preventDefault();
             }
         }

From 3456d459e4e326dbbee1e5d0715c8c18d1ab2ecd Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@Tadas-Labutis.local>
Date: Fri, 8 May 2026 13:24:13 +0300
Subject: [PATCH 06/19] fix(a11y): improve contrast on SaferpayOfficial admin
 order buttons
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PrestaShop core .btn-primary teal (#25b9d7) on white was 2.6:1 — fails
WCAG 2.1 AA (requires 4.5:1). Scoped override on #saferpay-admin-form
only, so other admin pages keep their PS theme. Refund/Capture buttons
now use the module brand teal #1c7c80 (5.27:1).
---
 views/css/admin/saferpay_admin_order.css | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/views/css/admin/saferpay_admin_order.css b/views/css/admin/saferpay_admin_order.css
index 548c95357..0d4e16797 100755
--- a/views/css/admin/saferpay_admin_order.css
+++ b/views/css/admin/saferpay_admin_order.css
@@ -22,4 +22,14 @@
 .saferpay-refund-button{
     display: inline-block;
     margin-left: 10px;
+}
+
+/* WCAG 2.1 AA contrast (white on PS .btn-primary teal is 2.6:1 — fails 4.5:1).
+   Scope override only to our admin form so global PS buttons are untouched. */
+#saferpay-admin-form .btn-primary,
+#saferpay-admin-form .btn-primary:focus,
+#saferpay-admin-form .btn-primary:hover{
+    background-color: #1c7c80;
+    border-color: #1c7c80;
+    color: #fff;
 }
\ No newline at end of file

From a78459d1e7cf2bef2596ff88d65917f5bc20402d Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@Tadas-Labutis.local>
Date: Fri, 8 May 2026 13:28:02 +0300
Subject: [PATCH 07/19] fix(a11y): add scope=col to saved cards table headers

Without scope, screen readers cannot reliably associate header cells
with their data column. Resolves TC-346.10 (FO saved credit cards).
---
 views/templates/front/credit_cards.tpl | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/views/templates/front/credit_cards.tpl b/views/templates/front/credit_cards.tpl
index c31df2224..66e0c76d6 100755
--- a/views/templates/front/credit_cards.tpl
+++ b/views/templates/front/credit_cards.tpl
@@ -32,22 +32,22 @@
             <caption class="sr-only">{l s='Saved credit cards' mod='saferpayofficial'}</caption>
             <thead>
             <tr>
-                <th>
+                <th scope="col">
                     <span class="sr-only">{l s='Card type' mod='saferpayofficial'}</span>
                 </th>
-                <th>
+                <th scope="col">
                     {l s='Credit card' mod='saferpayofficial'}
                 </th>
-                <th>
+                <th scope="col">
                     {l s='Added date' mod='saferpayofficial'}
                 </th>
-                <th>
+                <th scope="col">
                     {l s='Valid till' mod='saferpayofficial'}
                 </th>
-                <th>
+                <th scope="col">
                     {l s='Card number' mod='saferpayofficial'}
                 </th>
-                <th>
+                <th scope="col">
                     {l s='Action' mod='saferpayofficial'}
                 </th>
             </tr>

From ce8d69f118ef9075dba80b8bb3ceb94353ec93d5 Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@Tadas-Labutis.local>
Date: Fri, 8 May 2026 13:42:50 +0300
Subject: [PATCH 08/19] fix(a11y): improve Remove link contrast on saved cards
 table

The PS Classic theme rendered the Remove link in teal #24b9d7 on white
(2.6:1) which fails WCAG 2.1 AA. Use brand teal #1c7c80 (5.27:1) via
inline color so the override does not bleed to other theme buttons.
---
 views/templates/front/credit_card.tpl | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/views/templates/front/credit_card.tpl b/views/templates/front/credit_card.tpl
index 7f0f363fb..08bd4f997 100755
--- a/views/templates/front/credit_card.tpl
+++ b/views/templates/front/credit_card.tpl
@@ -39,8 +39,9 @@
     <td>
         <a class="button lnk_view btn btn-default"
            href="{$link->getModuleLink('saferpayofficial', {$controller|escape:'htmlall':'UTF-8'}, ['saved_card_id' => $saved_card_id|escape:'htmlall':'UTF-8'])|escape:'htmlall':'UTF-8' }"
-           aria-label="{l s='Remove card' mod='saferpayofficial'} {$card_number|escape:'htmlall':'UTF-8'}">
-            <span>
+           aria-label="{l s='Remove card' mod='saferpayofficial'} {$card_number|escape:'htmlall':'UTF-8'}"
+           style="color:#1c7c80">
+            <span style="color:inherit">
                 {l s='Remove' mod='saferpayofficial'}
             </span>
         </a>

From 634beca0228eded391eb9b8f39ab2aa4d66aecc2 Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@Tadas-Labutis.local>
Date: Fri, 8 May 2026 13:52:39 +0300
Subject: [PATCH 09/19] revert(a11y): drop PS theme contrast overrides

The .btn-primary (BO admin order) and .btn-default (FO saved cards)
contrast issues originate in PrestaShop core/theme CSS, not in our
module. Overriding them at module level was the wrong layer:
- fragile against theme updates
- could clash with merchant theme customizations
- inconsistent with our decision to scope SL-346 to module-owned UI

These now match the same out-of-scope category as the BO breadcrumb,
help button, and submenu tabs. Module-owned a11y fixes (React Settings
app contrast, aria-labels, scope=col, focus trap, etc.) remain in PR.
---
 views/css/admin/saferpay_admin_order.css | 10 ----------
 views/templates/front/credit_card.tpl    |  5 ++---
 2 files changed, 2 insertions(+), 13 deletions(-)

diff --git a/views/css/admin/saferpay_admin_order.css b/views/css/admin/saferpay_admin_order.css
index 0d4e16797..548c95357 100755
--- a/views/css/admin/saferpay_admin_order.css
+++ b/views/css/admin/saferpay_admin_order.css
@@ -22,14 +22,4 @@
 .saferpay-refund-button{
     display: inline-block;
     margin-left: 10px;
-}
-
-/* WCAG 2.1 AA contrast (white on PS .btn-primary teal is 2.6:1 — fails 4.5:1).
-   Scope override only to our admin form so global PS buttons are untouched. */
-#saferpay-admin-form .btn-primary,
-#saferpay-admin-form .btn-primary:focus,
-#saferpay-admin-form .btn-primary:hover{
-    background-color: #1c7c80;
-    border-color: #1c7c80;
-    color: #fff;
 }
\ No newline at end of file
diff --git a/views/templates/front/credit_card.tpl b/views/templates/front/credit_card.tpl
index 08bd4f997..7f0f363fb 100755
--- a/views/templates/front/credit_card.tpl
+++ b/views/templates/front/credit_card.tpl
@@ -39,9 +39,8 @@
     <td>
         <a class="button lnk_view btn btn-default"
            href="{$link->getModuleLink('saferpayofficial', {$controller|escape:'htmlall':'UTF-8'}, ['saved_card_id' => $saved_card_id|escape:'htmlall':'UTF-8'])|escape:'htmlall':'UTF-8' }"
-           aria-label="{l s='Remove card' mod='saferpayofficial'} {$card_number|escape:'htmlall':'UTF-8'}"
-           style="color:#1c7c80">
-            <span style="color:inherit">
+           aria-label="{l s='Remove card' mod='saferpayofficial'} {$card_number|escape:'htmlall':'UTF-8'}">
+            <span>
                 {l s='Remove' mod='saferpayofficial'}
             </span>
         </a>

From 34769493bc5fd88f67fc9078ad24f5faa0f7bc33 Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@Tadas-Labutis.local>
Date: Fri, 8 May 2026 14:58:49 +0300
Subject: [PATCH 10/19] fix: prevent silent save with empty or invalid API
 credentials

- Disable Save Changes button when username/password empty, credential
  check is in flight, or inline credential error is shown
- Mark JSON API Username and Password as required (visual asterisk +
  aria-required) to surface the requirement before user clicks Save
---
 .../components/settings/api-credentials.tsx   | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/views/js/admin/settings-app/src/components/settings/api-credentials.tsx b/views/js/admin/settings-app/src/components/settings/api-credentials.tsx
index be169a505..37d6af2d6 100644
--- a/views/js/admin/settings-app/src/components/settings/api-credentials.tsx
+++ b/views/js/admin/settings-app/src/components/settings/api-credentials.tsx
@@ -145,17 +145,23 @@ export function ApiCredentials() {
             {/* Username & Password */}
             <div className="sp-grid sp-gap-5 md:sp-grid-cols-2">
               <div className="sp-flex sp-flex-col sp-gap-2">
-                <Label htmlFor="api-username">{t('jsonApiUsername')}</Label>
+                <Label htmlFor="api-username">
+                  {t('jsonApiUsername')} <span className="sp-text-destructive" aria-hidden="true">*</span>
+                </Label>
                 <Input
                   id="api-username"
                   type="text"
                   placeholder={t('enterApiUsername', envLabel.toLowerCase())}
                   value={username}
                   onChange={(e) => setField('username', e.target.value)}
+                  required
+                  aria-required="true"
                 />
               </div>
               <div className="sp-flex sp-flex-col sp-gap-2">
-                <Label htmlFor="api-password">{t('jsonApiPassword')}</Label>
+                <Label htmlFor="api-password">
+                  {t('jsonApiPassword')} <span className="sp-text-destructive" aria-hidden="true">*</span>
+                </Label>
                 <div className="sp-relative">
                   <Input
                     id="api-password"
@@ -164,6 +170,8 @@ export function ApiCredentials() {
                     value={password}
                     onChange={(e) => setField('password', e.target.value)}
                     className="sp-pr-10"
+                    required
+                    aria-required="true"
                   />
                   <button
                     type="button"
@@ -330,7 +338,12 @@ export function ApiCredentials() {
       </Card>}
 
       <div className="sp-flex sp-justify-end">
-        <Button className="sp-min-w-[120px]" onClick={saveCredentials} disabled={saving} aria-label={saving ? t('saving') : undefined}>
+        <Button
+          className="sp-min-w-[120px]"
+          onClick={saveCredentials}
+          disabled={saving || !hasCredentials || credentialStatus === 'invalid' || credentialStatus === 'checking'}
+          aria-label={saving ? t('saving') : undefined}
+        >
           {saving ? <Loader2 className="sp-h-4 sp-w-4 sp-animate-spin" /> : t('saveChanges')}
         </Button>
       </div>

From 07ba05da97388b70d82c51836b4553e68d997b84 Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@Tadas-Labutis.local>
Date: Fri, 8 May 2026 16:24:03 +0300
Subject: [PATCH 11/19] fix: hide Saferpay Fields section per active
 environment license

The Saferpay Fields section was driven by a single hasBusinessLicense
flag derived from the active environment's stored license at page load.
Switching environments client-side did not re-evaluate it, so the
section stayed visible after switching to an environment with no
validated business license.

Expose testHasBusinessLicense and liveHasBusinessLicense separately
from the controller (initial payload and save response), and pick the
active one in api-credentials.tsx based on testMode.
---
 ...dminSaferPayOfficialSettingsController.php | 25 ++++++++++++++-----
 .../components/settings/api-credentials.tsx   | 22 +++++++++++++---
 .../src/context/settings-context.tsx          | 15 +++++++----
 .../js/admin/settings-app/src/types/index.ts  |  5 ++--
 4 files changed, 50 insertions(+), 17 deletions(-)

diff --git a/controllers/admin/AdminSaferPayOfficialSettingsController.php b/controllers/admin/AdminSaferPayOfficialSettingsController.php
index 71ffd95ec..da7e57e41 100755
--- a/controllers/admin/AdminSaferPayOfficialSettingsController.php
+++ b/controllers/admin/AdminSaferPayOfficialSettingsController.php
@@ -40,6 +40,7 @@
 use Invertus\SaferPay\Service\SaferPayRestrictionCreator;
 use Invertus\SaferPay\Exception\Api\SaferPayApiException;
 use Invertus\SaferPay\Exception\Restriction\RestrictionException;
+use Invertus\SaferPay\Logger\LoggerInterface;
 
 require_once dirname(__FILE__) . '/../../vendor/autoload.php';
 
@@ -209,8 +210,8 @@ public function ajaxProcessSaveCredentials()
 
         // Auto-detect license features from Saferpay Management API
         $suffix = $isTestMode ? SaferPayConfig::TEST_SUFFIX : '';
-        $licenseMessage = '';
         $hasBusinessLicense = false;
+        $licenseFetchFailed = false;
 
         if (!empty($activeUsername) && !empty($activePassword) && !empty($activeCustomerId)) {
             try {
@@ -227,18 +228,29 @@ public function ajaxProcessSaveCredentials()
                 $configuration->set(SaferPayConfig::BUSINESS_LICENSE . $suffix, $hasBusinessLicense ? 1 : 0);
             } catch (\Exception $e) {
                 $configuration->set(SaferPayConfig::BUSINESS_LICENSE . $suffix, 0);
+                $licenseFetchFailed = true;
 
-                $licenseMessage = ' ' . $this->module->l('Could not retrieve license information. Please verify your credentials.', self::FILE_NAME);
+                /** @var LoggerInterface $logger */
+                $logger = $this->module->getService(LoggerInterface::class);
+                $logger->error('License fetch failed on credentials save: ' . $e->getMessage(), [
+                    'context' => ['exception_class' => get_class($e)],
+                ]);
             }
         } else {
             $configuration->set(SaferPayConfig::BUSINESS_LICENSE . $suffix, 0);
         }
 
+        $message = $licenseFetchFailed
+            ? $this->module->l('Settings saved, but Saferpay Fields availability could not be confirmed. Please try again later or check the module Logs for details.', self::FILE_NAME)
+            : $this->module->l('Settings saved successfully.', self::FILE_NAME);
+
         $this->ajaxResponse(
             true,
-            $this->module->l('Settings saved successfully.', self::FILE_NAME) . $licenseMessage,
+            $message,
             [
-                'hasBusinessLicense' => $hasBusinessLicense,
+                'testHasBusinessLicense' => (bool) $configuration->get(SaferPayConfig::BUSINESS_LICENSE . SaferPayConfig::TEST_SUFFIX),
+                'liveHasBusinessLicense' => (bool) $configuration->get(SaferPayConfig::BUSINESS_LICENSE),
+                'warning' => $licenseFetchFailed,
             ]
         );
     }
@@ -534,8 +546,9 @@ private function collectSettingsData()
             'liveFieldAccessToken' => (string) $configuration->get(SaferPayConfig::FIELDS_ACCESS_TOKEN),
             'liveFieldJsUrl' => (string) $configuration->get(SaferPayConfig::FIELDS_LIBRARY),
 
-            // License (auto-detected)
-            'hasBusinessLicense' => (bool) $configuration->get(SaferPayConfig::BUSINESS_LICENSE . SaferPayConfig::getConfigSuffix()),
+            // License (auto-detected, per environment)
+            'testHasBusinessLicense' => (bool) $configuration->get(SaferPayConfig::BUSINESS_LICENSE . SaferPayConfig::TEST_SUFFIX),
+            'liveHasBusinessLicense' => (bool) $configuration->get(SaferPayConfig::BUSINESS_LICENSE),
 
             // Payment Processing
             'paymentBehavior' => (int) $configuration->get(SaferPayConfig::PAYMENT_BEHAVIOR),
diff --git a/views/js/admin/settings-app/src/components/settings/api-credentials.tsx b/views/js/admin/settings-app/src/components/settings/api-credentials.tsx
index be169a505..20a6380b9 100644
--- a/views/js/admin/settings-app/src/components/settings/api-credentials.tsx
+++ b/views/js/admin/settings-app/src/components/settings/api-credentials.tsx
@@ -35,6 +35,7 @@ export function ApiCredentials() {
   const fieldJsUrl = isTest ? settings.testFieldJsUrl : settings.liveFieldJsUrl
 
   const hasCredentials = username.length > 0 && password.length > 0
+  const hasBusinessLicense = isTest ? settings.testHasBusinessLicense : settings.liveHasBusinessLicense
 
   const setField = (field: string, value: string | boolean) => {
     updateSettings({ [`${prefix}${field.charAt(0).toUpperCase() + field.slice(1)}`]: value } as Record<string, string | boolean>)
@@ -145,17 +146,23 @@ export function ApiCredentials() {
             {/* Username & Password */}
             <div className="sp-grid sp-gap-5 md:sp-grid-cols-2">
               <div className="sp-flex sp-flex-col sp-gap-2">
-                <Label htmlFor="api-username">{t('jsonApiUsername')}</Label>
+                <Label htmlFor="api-username">
+                  {t('jsonApiUsername')} <span className="sp-text-destructive" aria-hidden="true">*</span>
+                </Label>
                 <Input
                   id="api-username"
                   type="text"
                   placeholder={t('enterApiUsername', envLabel.toLowerCase())}
                   value={username}
                   onChange={(e) => setField('username', e.target.value)}
+                  required
+                  aria-required="true"
                 />
               </div>
               <div className="sp-flex sp-flex-col sp-gap-2">
-                <Label htmlFor="api-password">{t('jsonApiPassword')}</Label>
+                <Label htmlFor="api-password">
+                  {t('jsonApiPassword')} <span className="sp-text-destructive" aria-hidden="true">*</span>
+                </Label>
                 <div className="sp-relative">
                   <Input
                     id="api-password"
@@ -164,6 +171,8 @@ export function ApiCredentials() {
                     value={password}
                     onChange={(e) => setField('password', e.target.value)}
                     className="sp-pr-10"
+                    required
+                    aria-required="true"
                   />
                   <button
                     type="button"
@@ -242,7 +251,7 @@ export function ApiCredentials() {
         </CardContent>
       </Card>
 
-      {settings.hasBusinessLicense && <Card>
+      {hasBusinessLicense && <Card>
         <CardHeader>
           <CardTitle className="sp-text-base sp-font-semibold">{t('saferpayFields')}</CardTitle>
           <CardDescription>{t('saferpayFieldsDescription')}</CardDescription>
@@ -330,7 +339,12 @@ export function ApiCredentials() {
       </Card>}
 
       <div className="sp-flex sp-justify-end">
-        <Button className="sp-min-w-[120px]" onClick={saveCredentials} disabled={saving} aria-label={saving ? t('saving') : undefined}>
+        <Button
+          className="sp-min-w-[120px]"
+          onClick={saveCredentials}
+          disabled={saving || !hasCredentials || credentialStatus === 'invalid' || credentialStatus === 'checking'}
+          aria-label={saving ? t('saving') : undefined}
+        >
           {saving ? <Loader2 className="sp-h-4 sp-w-4 sp-animate-spin" /> : t('saveChanges')}
         </Button>
       </div>
diff --git a/views/js/admin/settings-app/src/context/settings-context.tsx b/views/js/admin/settings-app/src/context/settings-context.tsx
index c4ce8f6c3..784cf7fb1 100644
--- a/views/js/admin/settings-app/src/context/settings-context.tsx
+++ b/views/js/admin/settings-app/src/context/settings-context.tsx
@@ -48,7 +48,7 @@ export function SettingsProvider({ children }: { children: React.ReactNode }) {
   }, [])
 
   const handleSave = useCallback(async (
-    saveFn: () => Promise<{ success: boolean; message?: string }>,
+    saveFn: () => Promise<{ success: boolean; message?: string; warning?: boolean }>,
     label: string,
     section: SavingSection,
   ) => {
@@ -56,7 +56,8 @@ export function SettingsProvider({ children }: { children: React.ReactNode }) {
     try {
       const result = await saveFn()
       if (result.success) {
-        toast({ title: result.message || t('savedSuccessfully', label), variant: 'default' })
+        const variant = result.warning ? 'warning' : 'default'
+        toast({ title: result.message || t('savedSuccessfully', label), variant })
       } else {
         toast({ title: result.message || t('failedToSave', label), variant: 'destructive' })
       }
@@ -91,10 +92,14 @@ export function SettingsProvider({ children }: { children: React.ReactNode }) {
         liveFieldJsUrl: currentSettings.liveFieldJsUrl,
       })
       const data = result as unknown as Record<string, unknown>
-      if (result.success && typeof data.hasBusinessLicense === 'boolean') {
-        setSettings((prev) => ({ ...prev, hasBusinessLicense: data.hasBusinessLicense as boolean }))
+      if (result.success) {
+        setSettings((prev) => ({
+          ...prev,
+          ...(typeof data.testHasBusinessLicense === 'boolean' ? { testHasBusinessLicense: data.testHasBusinessLicense as boolean } : {}),
+          ...(typeof data.liveHasBusinessLicense === 'boolean' ? { liveHasBusinessLicense: data.liveHasBusinessLicense as boolean } : {}),
+        }))
       }
-      return result
+      return { ...result, warning: data.warning === true }
     }, 'API Credentials', 'credentials')
   }, [handleSave])
 
diff --git a/views/js/admin/settings-app/src/types/index.ts b/views/js/admin/settings-app/src/types/index.ts
index 436600c17..79bf8e2ae 100644
--- a/views/js/admin/settings-app/src/types/index.ts
+++ b/views/js/admin/settings-app/src/types/index.ts
@@ -33,8 +33,9 @@ export interface SaferpaySettingsData {
   liveFieldAccessToken: string
   liveFieldJsUrl: string
 
-  // License (read-only, auto-detected from API)
-  hasBusinessLicense: boolean
+  // License (read-only, auto-detected from API, per environment)
+  testHasBusinessLicense: boolean
+  liveHasBusinessLicense: boolean
 
   // Payment Processing
   paymentBehavior: number

From 5338eea61f4e3ee7846091e866b84975fc44d665 Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@Tadas-Labutis.local>
Date: Fri, 15 May 2026 12:59:04 +0300
Subject: [PATCH 12/19] fix: break out of SaferPay iframe on payment status
 redirect

The polling script in saferpay_wait.tpl navigated the iframe itself via
window.location.href, leaving the parent window stuck on the SaferPay
iframe controller URL while the cart or order-confirmation page rendered
nested inside the iframe.

Use window.top so the redirect targets the parent window and the user
lands at /cart or /order-confirmation with the proper top-level chrome.
---
 views/templates/front/saferpay_wait.tpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/views/templates/front/saferpay_wait.tpl b/views/templates/front/saferpay_wait.tpl
index f99cab0a2..2378c1ee1 100644
--- a/views/templates/front/saferpay_wait.tpl
+++ b/views/templates/front/saferpay_wait.tpl
@@ -99,7 +99,7 @@
                 try {
                     var data = JSON.parse(request.responseText);
                     if (data.isFinished && data.href) {
-                        window.location.href = data.href;
+                        (window.top || window).location.href = data.href;
                         return;
                     }
                 } catch (e) {

From b558f031ed1361112a51e99414c5109da32d1798 Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@Tadas-Labutis.local>
Date: Fri, 15 May 2026 13:03:17 +0300
Subject: [PATCH 13/19] fix: use location.replace and guard window.top access

Address review feedback on PR #325:
- Use location.replace() so the polling page is not stored in history
  (Back from order-confirmation should not return to the spinner).
- Wrap window.top access in try/catch with an in-iframe fallback in
  case sandboxing or browser policy blocks the breakout.
---
 views/templates/front/saferpay_wait.tpl | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/views/templates/front/saferpay_wait.tpl b/views/templates/front/saferpay_wait.tpl
index 2378c1ee1..37f75b5d0 100644
--- a/views/templates/front/saferpay_wait.tpl
+++ b/views/templates/front/saferpay_wait.tpl
@@ -99,7 +99,11 @@
                 try {
                     var data = JSON.parse(request.responseText);
                     if (data.isFinished && data.href) {
-                        (window.top || window).location.href = data.href;
+                        try {
+                            (window.top || window).location.replace(data.href);
+                        } catch (e) {
+                            window.location.replace(data.href);
+                        }
                         return;
                     }
                 } catch (e) {

From b94589a6b0d2aa0431d77eb98e2891562a13e6d4 Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@Tadas-Labutis.local>
Date: Fri, 15 May 2026 13:15:02 +0300
Subject: [PATCH 14/19] BUGFIX: payment methods default to all
 countries/currencies and dropdowns show All instead of 0

---
 changelog.md                                  |  4 +-
 ...dminSaferPayOfficialSettingsController.php |  7 +++
 .../components/settings/payment-methods.tsx   | 45 +++++++++++++------
 3 files changed, 41 insertions(+), 15 deletions(-)

diff --git a/changelog.md b/changelog.md
index 4dc83f73a..e7188c6f5 100755
--- a/changelog.md
+++ b/changelog.md
@@ -196,4 +196,6 @@
 ## [2.0.2]
 - Remove WL Crypto payment method
 - Added setting to toggle order confirmation email sending
-- Added feature to group card payment methods into unified "Card" payment method
\ No newline at end of file
+- Added feature to group card payment methods into unified "Card" payment method
+- Fixed issue when newly enabled payment methods did not appear in checkout because default "all countries/currencies" restriction was not created on save
+- Fixed issue when payment method country/currency dropdowns showed "0" instead of indicating that all countries/currencies are allowed
\ No newline at end of file
diff --git a/controllers/admin/AdminSaferPayOfficialSettingsController.php b/controllers/admin/AdminSaferPayOfficialSettingsController.php
index da7e57e41..00d04986f 100755
--- a/controllers/admin/AdminSaferPayOfficialSettingsController.php
+++ b/controllers/admin/AdminSaferPayOfficialSettingsController.php
@@ -390,6 +390,13 @@ public function ajaxProcessSavePaymentMethods()
                 $countries = isset($method['countries']) ? $method['countries'] : [];
                 $currencies = isset($method['currencies']) ? $method['currencies'] : [];
 
+                if (empty($countries)) {
+                    $countries = [SaferPayRestrictionCreator::RESTRICTION_ALL];
+                }
+                if (empty($currencies)) {
+                    $currencies = [SaferPayRestrictionCreator::RESTRICTION_ALL];
+                }
+
                 $success = $restrictionCreator->updateRestriction(
                     $paymentName,
                     SaferPayRestrictionCreator::RESTRICTION_COUNTRY,
diff --git a/views/js/admin/settings-app/src/components/settings/payment-methods.tsx b/views/js/admin/settings-app/src/components/settings/payment-methods.tsx
index 5daddcd97..99dfd735a 100644
--- a/views/js/admin/settings-app/src/components/settings/payment-methods.tsx
+++ b/views/js/admin/settings-app/src/components/settings/payment-methods.tsx
@@ -31,15 +31,28 @@ function MultiSelect({
     [options, search],
   )
 
+  const ALL_VALUE = 0
+
+  const validSelected = useMemo(
+    () => selected.filter((s) => s !== ALL_VALUE && options.some((o) => o.id === s)),
+    [selected, options],
+  )
+
+  const isAll = selected.includes(ALL_VALUE) || validSelected.length === 0
+
   const toggle = useCallback(
     (value: number) => {
-      onChange(
-        selected.includes(value)
-          ? selected.filter((s) => s !== value)
-          : [...selected, value],
-      )
+      if (value === ALL_VALUE) {
+        onChange([ALL_VALUE])
+        return
+      }
+      const base = isAll ? [] : validSelected
+      const next = base.includes(value)
+        ? base.filter((s) => s !== value)
+        : [...base, value]
+      onChange(next.length === 0 ? [ALL_VALUE] : next)
     },
-    [selected, onChange],
+    [validSelected, isAll, onChange],
   )
 
   return (
@@ -48,14 +61,18 @@ function MultiSelect({
         <button
           type="button"
           className="sp-flex sp-min-h-[36px] sp-w-full sp-items-center sp-justify-between sp-rounded-md sp-border sp-border-border sp-bg-card sp-px-3 sp-py-1.5 sp-text-left sp-text-sm sp-transition-colors hover:sp-bg-secondary/50 focus-visible:sp-outline-none focus-visible:sp-ring-2 focus-visible:sp-ring-ring"
-          aria-label={selected.length === 0 ? `${label}: ${placeholder}` : `${label}: ${selected.length} ${t('selected')}`}
+          aria-label={isAll ? `${label}: ${placeholder.replace(/^Select\s+/i, 'All ')}` : validSelected.length === 0 ? `${label}: ${placeholder}` : `${label}: ${validSelected.length} ${t('selected')}`}
         >
-          {selected.length === 0 ? (
+          {isAll ? (
+            <Badge variant="secondary" className="sp-text-xs sp-font-normal">
+              {placeholder.replace(/^Select\s+/i, 'All ')}
+            </Badge>
+          ) : validSelected.length === 0 ? (
             <span className="sp-text-muted-foreground">{placeholder}</span>
           ) : (
             <span className="sp-flex sp-flex-wrap sp-gap-1">
-              {selected.length <= 2 ? (
-                selected.map((s) => {
+              {validSelected.length <= 2 ? (
+                validSelected.map((s) => {
                   const opt = options.find((o) => o.id === s)
                   return (
                     <Badge key={s} variant="secondary" className="sp-text-xs sp-font-normal">
@@ -65,7 +82,7 @@ function MultiSelect({
                 })
               ) : (
                 <Badge variant="secondary" className="sp-text-xs sp-font-normal">
-                  {selected.length} {t('selected')}
+                  {validSelected.length} {t('selected')}
                 </Badge>
               )}
             </span>
@@ -92,7 +109,7 @@ function MultiSelect({
               className="sp-flex sp-cursor-pointer sp-items-center sp-gap-2 sp-rounded-sm sp-px-2 sp-py-1.5 sp-text-sm hover:sp-bg-accent"
             >
               <Checkbox
-                checked={selected.includes(option.id)}
+                checked={option.id === ALL_VALUE ? isAll : validSelected.includes(option.id)}
                 onCheckedChange={() => toggle(option.id)}
               />
               <span className="sp-text-sm">{option.name}</span>
@@ -104,11 +121,11 @@ function MultiSelect({
             </p>
           )}
         </div>
-        {selected.length > 0 && (
+        {validSelected.length > 0 && (
           <div className="sp-border-t sp-p-2">
             <button
               type="button"
-              onClick={() => onChange([])}
+              onClick={() => onChange([ALL_VALUE])}
               className="sp-w-full sp-rounded-sm sp-px-2 sp-py-1 sp-text-xs sp-text-muted-foreground hover:sp-text-foreground sp-transition-colors"
             >
               {t('clearAll')}

From 20263c302d0298c3845806ad3099e1800d3b5672 Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@Tadas-Labutis.local>
Date: Fri, 15 May 2026 13:57:15 +0300
Subject: [PATCH 15/19] BUGFIX: redirect customer to cart instead of order
 history after Saferpay transaction abort

---
 changelog.md                 | 3 ++-
 controllers/front/return.php | 6 ++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/changelog.md b/changelog.md
index 4dc83f73a..ccb490a3f 100755
--- a/changelog.md
+++ b/changelog.md
@@ -196,4 +196,5 @@
 ## [2.0.2]
 - Remove WL Crypto payment method
 - Added setting to toggle order confirmation email sending
-- Added feature to group card payment methods into unified "Card" payment method
\ No newline at end of file
+- Added feature to group card payment methods into unified "Card" payment method
+- Fixed issue when customer was redirected to order history instead of cart after aborting a Saferpay transaction
\ No newline at end of file
diff --git a/controllers/front/return.php b/controllers/front/return.php
index b5fc37c69..2934e6f88 100755
--- a/controllers/front/return.php
+++ b/controllers/front/return.php
@@ -274,7 +274,9 @@ private function executeTransaction($orderId, $selectedCard)
      */
     private function getRedirectionToControllerUrl($controllerName)
     {
-        $cartId = $this->context->cart->id ? $this->context->cart->id : Tools::getValue('cartId');
+        $cartId = (int) Tools::getValue('cartId') ?: (int) $this->context->cart->id;
+        $cart = new Cart($cartId);
+        $secureKey = Validate::isLoadedObject($cart) ? $cart->secure_key : $this->context->cart->secure_key;
 
         return $this->context->link->getModuleLink(
             $this->module->name,
@@ -282,7 +284,7 @@ private function getRedirectionToControllerUrl($controllerName)
             [
                 'cartId' => $cartId,
                 'orderId' => Order::getIdByCartId($cartId),
-                'secureKey' => $this->context->cart->secure_key,
+                'secureKey' => $secureKey,
                 'moduleId' => $this->module->id,
             ]
         );

From bb3e081af986701ff83262ac69629fdbb23d4493 Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@Tadas-Labutis.local>
Date: Fri, 15 May 2026 14:30:30 +0300
Subject: [PATCH 16/19] BUGFIX: clarify Hosted field style info banner to
 mention Custom form requirement

---
 src/Service/SettingsTranslationService.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Service/SettingsTranslationService.php b/src/Service/SettingsTranslationService.php
index d657fdb0f..f574ad93f 100644
--- a/src/Service/SettingsTranslationService.php
+++ b/src/Service/SettingsTranslationService.php
@@ -229,7 +229,7 @@ private function getGeneralSettingsTranslations()
             'configName' => $this->module->l('Payment Page configurations name', self::FILE_NAME),
             'enterConfigName' => $this->module->l('Enter configuration name', self::FILE_NAME),
             'configNameDescription' => html_entity_decode($this->module->l('Name of the Payment Page Configuration created in Saferpay Backoffice (Settings > Payment Page Configuration). Max 20 characters. Allowed: letters, numbers, dots, colons, hyphens, underscores.', self::FILE_NAME), ENT_QUOTES, 'UTF-8'),
-            'hostedFieldInfo' => $this->module->l('Choose which hosted field will be displayed on payment option selection with supported payment methods.', self::FILE_NAME),
+            'hostedFieldInfo' => html_entity_decode($this->module->l('This style applies only to payment methods with "Custom form" enabled in the Payment Methods list. Methods without Custom form or paid with saved cards use the Saferpay-hosted payment page, whose appearance is controlled by "Payment Page configurations name".', self::FILE_NAME), ENT_QUOTES, 'UTF-8'),
             'hostedFieldStyle' => $this->module->l('Hosted field style', self::FILE_NAME),
             'hostedFieldStyleDescription' => $this->module->l('Select the card input form layout for the payment page.', self::FILE_NAME),
             'classicLayout' => $this->module->l('Classic Layout', self::FILE_NAME),

From 7743a2db0ae647235c38fd590f4c97bfb606e4df Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@Tadas-Labutis.local>
Date: Fri, 15 May 2026 16:43:05 +0300
Subject: [PATCH 17/19] BUGFIX: validate Merchant Emails field on save
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Frontend (api-credentials.tsx): show inline error and disable Save when
any comma-separated entry fails an email regex.

Backend (AdminSaferPayOfficialSettingsController): reject save when
testMerchantEmails or liveMerchantEmails contains a value that fails
Validate::isEmail() — guards against curl/devtools bypass.
---
 changelog.md                                  |  1 +
 ...dminSaferPayOfficialSettingsController.php | 31 +++++++++++++++++++
 src/Service/SettingsTranslationService.php    |  1 +
 .../components/settings/api-credentials.tsx   | 16 +++++++++-
 4 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/changelog.md b/changelog.md
index 4f070a716..3fe31cd34 100755
--- a/changelog.md
+++ b/changelog.md
@@ -199,3 +199,4 @@
 - Added feature to group card payment methods into unified "Card" payment method
 - Fixed issue when newly enabled payment methods did not appear in checkout because default "all countries/currencies" restriction was not created on save
 - Fixed issue when payment method country/currency dropdowns showed "0" instead of indicating that all countries/currencies are allowed
+- BO : Added validation for Merchant Emails field (frontend + backend) to prevent saving invalid addresses
diff --git a/controllers/admin/AdminSaferPayOfficialSettingsController.php b/controllers/admin/AdminSaferPayOfficialSettingsController.php
index 00d04986f..0d4f5ffcf 100755
--- a/controllers/admin/AdminSaferPayOfficialSettingsController.php
+++ b/controllers/admin/AdminSaferPayOfficialSettingsController.php
@@ -179,6 +179,17 @@ public function ajaxProcessSaveCredentials()
             }
         }
 
+        $testMerchantEmails = $this->getStringValue($data, 'testMerchantEmails');
+        $liveMerchantEmails = $this->getStringValue($data, 'liveMerchantEmails');
+        $invalidEmail = $this->findInvalidEmail($testMerchantEmails) ?: $this->findInvalidEmail($liveMerchantEmails);
+        if ($invalidEmail !== null) {
+            $this->ajaxResponse(false, sprintf(
+                $this->module->l('Invalid merchant email address: %s', self::FILE_NAME),
+                $invalidEmail
+            ));
+            return;
+        }
+
         // Credentials validated — now save
         $configuration->set(SaferPayConfig::TEST_MODE, $isTestMode ? 1 : 0);
 
@@ -792,4 +803,24 @@ private function getIntValue($data, $key)
     {
         return isset($data[$key]) ? (int) $data[$key] : 0;
     }
+
+    /**
+     * Returns the first invalid email in a comma-separated list, or null if all are valid.
+     */
+    private function findInvalidEmail($emails)
+    {
+        if ($emails === '') {
+            return null;
+        }
+        foreach (explode(',', $emails) as $email) {
+            $email = trim($email);
+            if ($email === '') {
+                continue;
+            }
+            if (!\Validate::isEmail($email)) {
+                return $email;
+            }
+        }
+        return null;
+    }
 }
diff --git a/src/Service/SettingsTranslationService.php b/src/Service/SettingsTranslationService.php
index f574ad93f..ae2de9990 100644
--- a/src/Service/SettingsTranslationService.php
+++ b/src/Service/SettingsTranslationService.php
@@ -122,6 +122,7 @@ private function getApiCredentialsTranslations()
             'merchantEmails' => $this->module->l('Merchant Emails', self::FILE_NAME),
             'enterMerchantEmails' => $this->module->l('Enter merchant email addresses (comma-separated)', self::FILE_NAME),
             'separateEmails' => $this->module->l('These email addresses receive payment notification emails directly from SaferPay. Separate multiple email addresses with commas.', self::FILE_NAME),
+            'invalidMerchantEmails' => $this->module->l('Invalid email address', self::FILE_NAME),
             'saferpayFields' => $this->module->l('Saferpay Fields', self::FILE_NAME),
             'saferpayFieldsDescription' => $this->module->l('Configure Saferpay Fields for inline payment form integration.', self::FILE_NAME),
             'fieldAccessTokenInfo' => $this->module->l('Saferpay Field Access Token can be found in Saferpay Backoffice, navigate to', self::FILE_NAME),
diff --git a/views/js/admin/settings-app/src/components/settings/api-credentials.tsx b/views/js/admin/settings-app/src/components/settings/api-credentials.tsx
index 20a6380b9..d806211bc 100644
--- a/views/js/admin/settings-app/src/components/settings/api-credentials.tsx
+++ b/views/js/admin/settings-app/src/components/settings/api-credentials.tsx
@@ -37,6 +37,13 @@ export function ApiCredentials() {
   const hasCredentials = username.length > 0 && password.length > 0
   const hasBusinessLicense = isTest ? settings.testHasBusinessLicense : settings.liveHasBusinessLicense
 
+  const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
+  const invalidEmails = merchantEmails
+    .split(',')
+    .map(e => e.trim())
+    .filter(e => e.length > 0 && !EMAIL_RE.test(e))
+  const merchantEmailsInvalid = invalidEmails.length > 0
+
   const setField = (field: string, value: string | boolean) => {
     updateSettings({ [`${prefix}${field.charAt(0).toUpperCase() + field.slice(1)}`]: value } as Record<string, string | boolean>)
   }
@@ -242,7 +249,14 @@ export function ApiCredentials() {
                 placeholder={t('enterMerchantEmails')}
                 value={merchantEmails}
                 onChange={(e) => setField('merchantEmails', e.target.value)}
+                aria-invalid={merchantEmailsInvalid}
+                className={merchantEmailsInvalid ? 'sp-border-destructive focus-visible:sp-ring-destructive' : ''}
               />
+              {merchantEmailsInvalid && (
+                <p className="sp-text-xs sp-text-destructive">
+                  {t('invalidMerchantEmails')}: {invalidEmails.join(', ')}
+                </p>
+              )}
               <p className="sp-text-xs sp-text-muted-foreground">
                 {t('separateEmails')}
               </p>
@@ -342,7 +356,7 @@ export function ApiCredentials() {
         <Button
           className="sp-min-w-[120px]"
           onClick={saveCredentials}
-          disabled={saving || !hasCredentials || credentialStatus === 'invalid' || credentialStatus === 'checking'}
+          disabled={saving || !hasCredentials || credentialStatus === 'invalid' || credentialStatus === 'checking' || merchantEmailsInvalid}
           aria-label={saving ? t('saving') : undefined}
         >
           {saving ? <Loader2 className="sp-h-4 sp-w-4 sp-animate-spin" /> : t('saveChanges')}

From 15841deb746a5cb20365183e53ec0193fcaeeb20 Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@MacBookAir.localdomain>
Date: Tue, 26 May 2026 15:08:11 +0300
Subject: [PATCH 18/19] BUGFIX: ensure 3DS-fail behavior overrides default
 payment behavior

When 'Behavior when 3D Secure Payer Authentication was not successful'
was set to Authorize, the order was still being captured because the
AUTHORIZE branch was missing and the CANCEL branch did not return early,
so control fell through to the default-payment-behavior Capture block.

Each 3DS-fail branch now returns/dies explicitly, so the configured
3DS-fail behavior is always honored.
---
 controllers/front/notify.php | 16 +++++++++++++++-
 controllers/front/return.php | 10 +++++++++-
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/controllers/front/notify.php b/controllers/front/notify.php
index 35bb7d25f..667a1fd4d 100755
--- a/controllers/front/notify.php
+++ b/controllers/front/notify.php
@@ -158,7 +158,19 @@ public function postProcess()
                     ]);
 
                     die($this->module->l('Liability shift is false', self::FILE_NAME));
-                } elseif ($paymentBehaviorWithout3D === SaferPayConfig::PAYMENT_BEHAVIOR_WITHOUT_3D_CAPTURE
+                }
+
+                if ($paymentBehaviorWithout3D === SaferPayConfig::PAYMENT_BEHAVIOR_WITHOUT_3D_AUTHORIZE) {
+                    $logger->debug(sprintf('%s - Liability shift is false, order left authorized', self::FILE_NAME), [
+                        'context' => [
+                            'id_order' => $order->id,
+                        ],
+                    ]);
+
+                    die($this->module->l('Liability shift is false, order left authorized', self::FILE_NAME));
+                }
+
+                if ($paymentBehaviorWithout3D === SaferPayConfig::PAYMENT_BEHAVIOR_WITHOUT_3D_CAPTURE
                     && SaferPayConfig::supportsOrderCapture($order->payment)
                     && $transactionStatus !== TransactionStatus::CAPTURED
                 ) {
@@ -169,6 +181,8 @@ public function postProcess()
                             'id_order' => $order->id,
                         ],
                     ]);
+
+                    die($this->module->l('Liability shift is false, capturing order', self::FILE_NAME));
                 }
             }
 
diff --git a/controllers/front/return.php b/controllers/front/return.php
index 7bb84cade..a65984b32 100755
--- a/controllers/front/return.php
+++ b/controllers/front/return.php
@@ -341,7 +341,15 @@ private function createAndValidateOrder($assertResponseBody, $transactionStatus,
 
             if ($paymentBehaviorWithout3D === SaferPayConfig::PAYMENT_BEHAVIOR_WITHOUT_3D_CANCEL) {
                 $orderStatusService->cancel($order);
-            } elseif ($paymentBehaviorWithout3D === SaferPayConfig::PAYMENT_BEHAVIOR_WITHOUT_3D_CAPTURE
+
+                return;
+            }
+
+            if ($paymentBehaviorWithout3D === SaferPayConfig::PAYMENT_BEHAVIOR_WITHOUT_3D_AUTHORIZE) {
+                return;
+            }
+
+            if ($paymentBehaviorWithout3D === SaferPayConfig::PAYMENT_BEHAVIOR_WITHOUT_3D_CAPTURE
                 && SaferPayConfig::supportsOrderCapture($order->payment)
                 && $transactionStatus !== TransactionStatus::CAPTURED
             ) {

From 60d1e5a75a9f3c4f7ddbeb469d0286dc223ca3c2 Mon Sep 17 00:00:00 2001
From: Tadas Labutis <tadaslabutis@MacBookAir.localdomain>
Date: Tue, 26 May 2026 16:25:52 +0300
Subject: [PATCH 19/19] BUGFIX: de-duplicate ApiRequest error logs

isValidResponse() already logs API errors before throwing
SaferPayApiException, so the surrounding catch in get(),
getWithCredentials(), and postWithCredentials() produced a redundant
error row for every failed call. Guard the catch-block logger->error
with if ($response === null) so it only fires on transport-level
failures, where isValidResponse() never ran.
---
 src/Api/ApiRequest.php | 46 ++++++++++++++++++++++++------------------
 1 file changed, 26 insertions(+), 20 deletions(-)

diff --git a/src/Api/ApiRequest.php b/src/Api/ApiRequest.php
index 72ebc144a..5df54cd59 100755
--- a/src/Api/ApiRequest.php
+++ b/src/Api/ApiRequest.php
@@ -114,14 +114,16 @@ public function get($url, $params = [])
 
             return json_decode($response->raw_body);
         } catch (Exception $exception) {
-            $this->logger->error($exception->getMessage(), [
-                'context' => [
-                    'headers' => $this->getHeaders(),
-                ],
-                'request' => $params,
-                'response' => json_decode($response->raw_body),
-                'exceptions' => ExceptionUtility::getExceptions($exception),
-            ]);
+            if ($response === null) {
+                $this->logger->error($exception->getMessage(), [
+                    'context' => [
+                        'headers' => $this->getHeaders(),
+                    ],
+                    'request' => $params,
+                    'response' => null,
+                    'exceptions' => ExceptionUtility::getExceptions($exception),
+                ]);
+            }
 
             throw $exception;
         }
@@ -170,12 +172,14 @@ public function getWithCredentials($url, $username, $password, $baseUrl, $params
 
             return json_decode($response->raw_body);
         } catch (Exception $exception) {
-            $this->logger->error($exception->getMessage(), [
-                'context' => [],
-                'request' => $params,
-                'response' => $response ? json_decode($response->raw_body) : null,
-                'exceptions' => ExceptionUtility::getExceptions($exception),
-            ]);
+            if ($response === null) {
+                $this->logger->error($exception->getMessage(), [
+                    'context' => [],
+                    'request' => $params,
+                    'response' => null,
+                    'exceptions' => ExceptionUtility::getExceptions($exception),
+                ]);
+            }
 
             throw $exception;
         }
@@ -226,12 +230,14 @@ public function postWithCredentials($url, $username, $password, $baseUrl, $param
 
             return json_decode($response->raw_body);
         } catch (Exception $exception) {
-            $this->logger->error($exception->getMessage(), [
-                'context' => [],
-                'request' => $params,
-                'response' => $response ? json_decode($response->raw_body) : null,
-                'exceptions' => ExceptionUtility::getExceptions($exception),
-            ]);
+            if ($response === null) {
+                $this->logger->error($exception->getMessage(), [
+                    'context' => [],
+                    'request' => $params,
+                    'response' => null,
+                    'exceptions' => ExceptionUtility::getExceptions($exception),
+                ]);
+            }
 
             throw $exception;
         }