GravyWebhookProcessing-Authorization.puml
ActivePublic
Actions

Authored by jgleeson on Feb 24 2026, 6:56 PM.

Project Tags

None

Referenced Files

	F72475993: GravyWebhookProcessing-Authorization.puml
	Mar 2 2026, 7:30 PM

	F72317281: Gravy Webhook Processing Sequence.puml
	Feb 24 2026, 6:56 PM

Subscribers

None

	@startuml
	autonumber
	title
	<b>Gravy Webhook Processing - Authorization (SmashPig)</b>
	end title

	participant "Webhook" as API
	boundary "Core\\Http\\RequestHandler" as RH
	participant "GravyListener" as GL
	participant "ListenerValidator" as LV
	participant "TransactionMessage" as TM
	participant "TransactionAction" as TA
	participant "TransactionDetails\nNormalizer" as TDN
	participant "QueueWrapper" as QW

	== Webhook: transaction.authorized (authorization_succeeded) ==

	[-> RH: POST /index.php?p=gravy/listener\n(target.type=transaction,\nstatus=authorization_succeeded)
	activate RH

	RH -> GL: GravyListener::execute(request, response)
	activate GL

	GL -> LV: validateWebhookEventHeader(headers, config)
	activate LV
	note right of LV
	Checks AUTHORIZATION header matches
	Basic base64(webhook.username:password)
	end note
	LV --> GL: Validation OK
	deactivate LV

	GL -> GL: json_decode(rawBody)

	GL -> GL: mapFromWebhookMessage(parsed)\nnormalizeMessageType("transaction")\n-> "TransactionMessage"

	GL -> TM: GravyMessage::getInstanceFromNormalizedNotification()\n-> TransactionMessage::init()
	activate TM
	note right of TM
	Sets gateway_txn_id, date,
	payment_method, transaction_details
	(raw webhook target block)
	end note
	TM --> GL: TransactionMessage
	deactivate TM

	GL -> TA: GravyAction::getInstanceOf("TransactionAction")\n-> execute(message)
	activate TA

	TA -> TDN: getTransactionDetails(msg)
	activate TDN

	TDN -> TDN: getResponseMapperForPaymentMethod("card")\n-> ResponseMapper (via config mappers/cc-response)

	TDN -> TDN: ResponseMapper::mapFromPaymentResponse()\nnormalizeStatus("authorization_succeeded")\n-> PENDING_POKE

	TDN --> TA: PaymentProviderExtendedResponse\n(status=PENDING_POKE, isSuccessful=true)
	deactivate TDN

	TA -> TA: status == PENDING_POKE

	alt capture-from-ipn-listener == false (default)

	TA --> GL: return true (no job created)

	else capture-from-ipn-listener == true

	TA -> TA: ProcessCaptureRequestJob::factory(msg, details)

	TA -> QW: QueueWrapper::push("jobs-gravy",\nProcessCaptureRequestJob payload)
	activate QW
	QW --> TA: pushed
	deactivate QW

	note right of TA
	ProcessCaptureRequestJob will:
	- Look up pending record & fraud score
	- approvePayment() if PROCESS
	- cancelAuthorization() if REJECT/DUPLICATE
	- Leave auth pending if REVIEW
	end note

	TA --> GL: return true

	end
	deactivate TA

	GL --> RH: return true
	deactivate GL

	RH -->]: HTTP 200 OK
	deactivate RH

	@enduml

Event Timeline

jgleeson created this paste.Feb 24 2026, 6:56 PM

jgleeson mentioned this in T418251: Payments-wiki Gravy card donation & webhook processing UML sequence diagram (full picture).

jgleeson changed the title of this paste from Gravy Webhook Processing Sequence.puml to GravyWebhookProcessing-Authorization.puml.Mar 2 2026, 7:30 PM

jgleeson edited the content of this paste. (Show Details)

GravyWebhookProcessing-Authorization.pumlActivePublicActions

Event Timeline

GravyWebhookProcessing-Authorization.puml
ActivePublic
Actions