handle iframeAllowed parameter from order request response

[konradkozaczenko]

https://developers.payu.com/europe/docs/card-payments/threeds/auth-page/#iframe-handling

[Copilot]

Pull request overview

This PR adds handling for the iframeAllowed parameter returned in the PayU order creation response, which is used for 3DS authentication iframe handling. The new Continue3DsHttpRedirect reply class extends HttpRedirect to carry the iframeAllowed flag so consumers can determine whether to render the 3DS redirect in an iframe.

Changes:

• Added iframeAllowed field to OrderCreatedResponse value object to capture the API response parameter.
• Introduced Continue3DsHttpRedirect reply class that wraps HttpRedirect with an iframeAllowed boolean property.
• Updated CaptureAction to throw Continue3DsHttpRedirect instead of HttpRedirect for 3DS redirects, passing the iframe-allowed state.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
src/ValueObject/Response/OrderCreatedResponse.php	Added iframeAllowed property and included it in fromResponse and toArray
src/Core/Reply/Continue3DsHttpRedirect.php	New reply class extending HttpRedirect with iframeAllowed flag
src/Action/CaptureAction.php	Changed 3DS redirect to use Continue3DsHttpRedirect with iframeAllowed
tests/Integration/Action/CaptureActionTest.php	Added iframeAllowed to expected response arrays in test assertions

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[lukasz-falda]

Why you need this specific redirect?

Handle the iframeAllowed flag in the set/get methods of the \Answear\Payum\PayU\Model\Model class, such as setOrderId(), and simply retrieve this flag where needed using

$model = Model::ensureArrayObject($payment->getDetails());
$model->iframeAllowed

[konradkozaczenko]

iframeAllowed is strictly related to the redirect. You handle the redirect by catching the exception. When the exception is an instance of Continue3DsHttpRedirect, you can check the iframeAllowed parameter. It's part of the redirect process, not a model object that holds data about the payment, buyer, etc

[lukasz-falda]

iframeAllowed is strictly related to the redirect

agree

So maybe IframeHttpRedirect extends HttpRedirect and here

return match($orderCreatedResponse->iframeAllowed)
  true => new IframeHttpRedirect($orderCreatedResponse->redirectUri),
  false => new HttpRedirect($orderCreatedResponse->redirectUri)

You will have generic exception for iframe without any flags.

[lukasz-falda]

keep here default false, will be match better for handling

[mglowala]

już zapomniałem, że tu się steruje exceptionami :)