redsys_button 2.0.0

Redsys payment 2.0.0 is a major release for Drupal 10.3 and Drupal 11. It rebuilds the standalone, Webform, and Drupal Commerce payment flows around authenticated Redsys notifications, persistent payment records, and safer secret management.

Highlights

• Adds standalone off-site payments for card, Bizum, PayPal, and xPay (Apple Pay or Google Pay).
• Adds HMAC SHA-512 V2 signing while retaining HMAC SHA-256 V1 for legacy terminals.
• Stores merchant secrets through the Key module instead of Drupal configuration.
• Stores standalone and Webform payment attempts as auditable Drupal entities.
• Adds permission-protected payment administration and payment detail pages.
• Verifies callback signatures and immutable transaction values, including amount, currency, merchant, terminal, transaction type, and order number.
• Makes repeated Redsys notifications idempotent.
• Sends confirmation email only after an authenticated successful notification.
• Adds token-protected payment result pages.
• Adds a configurable Webform payment handler that keeps submissions as drafts until payment is confirmed.
• Rebuilds the Drupal Commerce integration with separate card, Bizum, PayPal, and xPay gateways.
• Adds gateway-specific credentials and authenticated Commerce payment notifications.
• Adds update hooks, configuration schema, Composer metadata, and PHPUnit coverage.

Requirements

• Drupal 10.3 or Drupal 11.
• PHP 8.1 or newer.
• Key 1.22 or newer.
• Webform 6.3 for the optional Webform integration.

Important changes from 1.x

• Drupal 9 is no longer supported.
• The Key module is now required.
• New installations use HMAC SHA-512 V2 by default. Updated installations remain on HMAC SHA-256 V1 until explicitly changed and tested.
• Payment confirmation emails are no longer sent when the customer starts a payment. They are sent only after Redsys confirms the payment with a valid signed notification.
• Drupal Commerce credentials are now configured per payment gateway.
• Existing Commerce gateways receive the previous global credentials automatically during the update, but each gateway should be reviewed and saved afterwards.
• PayPal, Bizum, Apple Pay, and Google Pay must be enabled for the merchant terminal by the bank or Redsys.
• This release implements one-time off-site authorization payments. It does not provide refunds, recurring payments, or tokenization.

Updating from 1.x

1. Back up the database and exported configuration.
2. Make sure the site is running Drupal 10.3 or later, or Drupal 11. Drupal 9 sites must update Drupal core first.
3. Update the module with Composer:

composer require 'drupal/redsys_button:^2.0' --with-all-dependencies

4. Run the database updates and rebuild caches:

drush updb
drush cr

5. The former plaintext merchant secret is migrated to a Key entity named redsys_button_legacy. Review it under /admin/config/system/keys and move it to an environment, file, or external secret provider
before using the module in production.
6. Review and save each existing Redsys Commerce payment gateway.
7. Test payments in the Redsys test environment and confirm that asynchronous HTTP notifications are enabled for the terminal.

See the README for complete installation, configuration, integration, and security guidance.