feature/INT-1667 - ChallengeIndicator/SessionChallengeIndicator enum alignment by david-ruiz-cko · Pull Request #357 · checkout/checkout-sdk-php

david-ruiz-cko · 2026-08-03T15:26:52Z

This pull request introduces several improvements and clarifications to the 3DS challenge indicator and related enums used in session and payment APIs. The main focus is on separating the values specific to session requests from those used in payment flows, improving documentation, and ensuring backwards compatibility. Additionally, related enums are updated for clarity and consistency, and comprehensive tests are added to verify correct serialization and deprecation handling.

Key changes:

3DS Challenge Indicator Improvements

Introduced a new SessionChallengeIndicatorType class with clear documentation and nine explicit values, including exemption values, for use only with session requests (POST /sessions). This separates session-specific values from those used in payments.
Updated ChallengeIndicatorType in Checkout\Common to clarify that five exemption values are deprecated and only accepted by sessions, not by payments or hosted payments. Documentation is improved and deprecation tags are added for these values.
Updated SessionRequest to use SessionChallengeIndicatorType for the challenge_indicator property, with improved docblocks and default value assignment. [1] [2] [3]

Related Enum and Property Updates

Updated Category, SessionScheme, and TransactionType enums with improved documentation, consistent naming, and added or corrected values (e.g., non_payment, quasi_card_transaction, new schemes like discover and upi). [1] [2] [3]

Test Improvements

Added a comprehensive test class, ChallengeIndicatorSerializationTest, to verify that all challenge indicator values are exposed, correctly serialized, and properly marked as deprecated where appropriate.
Updated integration tests to use the new SessionChallengeIndicatorType for session requests. [1] [2] [3] [4] [5]

These changes clarify the intended usage of challenge indicator values, improve maintainability, and ensure that the SDK aligns with API expectations and best practices.

agent-wall-e · 2026-08-03T15:26:55Z

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

security_sensitive_path:lib/Checkout/Sessions/SessionChallengeIndicatorType.php
security_sensitive_path:lib/Checkout/Sessions/SessionRequest.php
security_sensitive_path:test/Checkout/Tests/Sessions/AbstractSessionsIntegrationTest.php
security_sensitive_path:test/Checkout/Tests/Sessions/ChallengeIndicatorSerializationTest.php
security_sensitive_path:test/Checkout/Tests/Sessions/RequestAndGetSessionsIntegrationTest.php

Operational gates

✅ jira_ticket (INT-1667)
✅ independent_review

Files analysed: 6

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

agent-wall-e · 2026-08-03T15:26:56Z

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
`security_sensitive_path` — `lib/Checkout/Sessions/SessionChallengeIndicatorType.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `lib/Checkout/Sessions/SessionRequest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/AbstractSessionsIntegrationTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/ChallengeIndicatorSerializationTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/RequestAndGetSessionsIntegrationTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

classifying — this rule contributed to the chosen tier.
informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

agent-wall-e · 2026-08-03T15:50:38Z

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

security_sensitive_path:lib/Checkout/Sessions/Category.php
security_sensitive_path:lib/Checkout/Sessions/SessionChallengeIndicatorType.php
security_sensitive_path:lib/Checkout/Sessions/SessionRequest.php
security_sensitive_path:lib/Checkout/Sessions/SessionScheme.php
security_sensitive_path:lib/Checkout/Sessions/TransactionType.php

Operational gates

✅ jira_ticket (INT-1667)
✅ independent_review

Files analysed: 11

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

agent-wall-e · 2026-08-03T15:50:39Z

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
`security_sensitive_path` — `lib/Checkout/Sessions/Category.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `lib/Checkout/Sessions/SessionChallengeIndicatorType.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `lib/Checkout/Sessions/SessionRequest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `lib/Checkout/Sessions/SessionScheme.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `lib/Checkout/Sessions/TransactionType.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/AbstractSessionsIntegrationTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/ChallengeIndicatorSerializationTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/RequestAndGetSessionsIntegrationTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/SessionRequestSerializationTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/SessionsValueClassesTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

classifying — this rule contributed to the chosen tier.
informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

agent-wall-e · 2026-08-04T06:39:56Z

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

security_sensitive_path:lib/Checkout/Sessions/Category.php
security_sensitive_path:lib/Checkout/Sessions/SessionChallengeIndicatorType.php
security_sensitive_path:lib/Checkout/Sessions/SessionRequest.php
security_sensitive_path:lib/Checkout/Sessions/SessionScheme.php
security_sensitive_path:lib/Checkout/Sessions/TransactionType.php

Operational gates

✅ jira_ticket (INT-1667)
✅ independent_review

Files analysed: 11

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

agent-wall-e · 2026-08-04T06:39:56Z

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
`security_sensitive_path` — `lib/Checkout/Sessions/Category.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `lib/Checkout/Sessions/SessionChallengeIndicatorType.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `lib/Checkout/Sessions/SessionRequest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `lib/Checkout/Sessions/SessionScheme.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `lib/Checkout/Sessions/TransactionType.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/AbstractSessionsIntegrationTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/ChallengeIndicatorSerializationTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/RequestAndGetSessionsIntegrationTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/SessionRequestSerializationTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/SessionsValueClassesTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

classifying — this rule contributed to the chosen tier.
informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

agent-wall-e · 2026-08-04T07:15:03Z

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

security_sensitive_path:lib/Checkout/Sessions/Category.php
security_sensitive_path:lib/Checkout/Sessions/SessionChallengeIndicatorType.php
security_sensitive_path:lib/Checkout/Sessions/SessionRequest.php
security_sensitive_path:lib/Checkout/Sessions/SessionScheme.php
security_sensitive_path:lib/Checkout/Sessions/TransactionType.php

Operational gates

✅ jira_ticket (INT-1667)
✅ independent_review

Files analysed: 11

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

agent-wall-e · 2026-08-04T07:15:04Z

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
`security_sensitive_path` — `lib/Checkout/Sessions/Category.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `lib/Checkout/Sessions/SessionChallengeIndicatorType.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `lib/Checkout/Sessions/SessionRequest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `lib/Checkout/Sessions/SessionScheme.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `lib/Checkout/Sessions/TransactionType.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/AbstractSessionsIntegrationTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/ChallengeIndicatorSerializationTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/RequestAndGetSessionsIntegrationTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/SessionRequestSerializationTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
`security_sensitive_path` — `test/Checkout/Tests/Sessions/SessionsValueClassesTest.php`	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

classifying — this rule contributed to the chosen tier.
informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

sonarqubecloud · 2026-08-04T07:15:32Z

Quality Gate passed

Issues
11 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

ChallengeIndicator/SessionChallengeIndicator enum alignment

9925832

david-ruiz-cko requested a review from a team August 3, 2026 15:26

Some fixes and tests

b5149f0

test fix

7356418

Comment fixed

bf7cc69

armando-rodriguez-cko approved these changes Aug 5, 2026

View reviewed changes

david-ruiz-cko merged commit 2ccc6e6 into master Aug 6, 2026
4 checks passed

david-ruiz-cko deleted the feature/INT-1667 branch August 6, 2026 08:13

armando-rodriguez-cko mentioned this pull request Aug 6, 2026

Release 5.3.0 - Address Document Verification endpoints + ChallengeIndicator/SessionChallengeIndicator alignment #358

Merged

Navigation Menu

Uh oh!

feature/INT-1667 - ChallengeIndicator/SessionChallengeIndicator enum alignment - #357

feature/INT-1667 - ChallengeIndicator/SessionChallengeIndicator enum alignment#357
david-ruiz-cko merged 4 commits into
masterfrom
feature/INT-1667

david-ruiz-cko commented Aug 3, 2026 •

edited

Loading

Uh oh!

agent-wall-e Bot commented Aug 3, 2026

Uh oh!

agent-wall-e Bot commented Aug 3, 2026

Uh oh!

agent-wall-e Bot commented Aug 3, 2026

Uh oh!

agent-wall-e Bot commented Aug 3, 2026

Uh oh!

agent-wall-e Bot commented Aug 4, 2026

Uh oh!

agent-wall-e Bot commented Aug 4, 2026

Uh oh!

agent-wall-e Bot commented Aug 4, 2026

Uh oh!

agent-wall-e Bot commented Aug 4, 2026

Uh oh!

sonarqubecloud Bot commented Aug 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

david-ruiz-cko commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

3DS Challenge Indicator Improvements

Related Enum and Property Updates

Test Improvements

Uh oh!

agent-wall-e Bot commented Aug 3, 2026

🔴 Risk Classification: MAJOR

Classification reasons

Operational gates

Uh oh!

agent-wall-e Bot commented Aug 3, 2026

Uh oh!

agent-wall-e Bot commented Aug 3, 2026

🔴 Risk Classification: MAJOR

Classification reasons

Operational gates

Uh oh!

agent-wall-e Bot commented Aug 3, 2026

Uh oh!

agent-wall-e Bot commented Aug 4, 2026

🔴 Risk Classification: MAJOR

Classification reasons

Operational gates

Uh oh!

agent-wall-e Bot commented Aug 4, 2026

Uh oh!

agent-wall-e Bot commented Aug 4, 2026

🔴 Risk Classification: MAJOR

Classification reasons

Operational gates

Uh oh!

agent-wall-e Bot commented Aug 4, 2026

Uh oh!

sonarqubecloud Bot commented Aug 4, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

david-ruiz-cko commented Aug 3, 2026 •

edited

Loading