Verify Paystack Payments in Symfony

// In PaystackService
public function verifyAndFulfill(string $reference, EntityManagerInterface $em): array
{
    $order = $em->getRepository(Order::class)->findOneBy(['reference' => $reference]);

    if (!$order) {
        return ['success' => false, 'error' => 'Order not found'];
    }

    if ($order->isPaid()) {
        return ['success' => true, 'already_fulfilled' => true];
    }

    $result = $this->verifyTransaction($reference);

    if (!($result['status'] ?? false) || $result['data']['status'] !== 'success') {
        return ['success' => false, 'error' => 'Payment not successful'];
    }

    if ($result['data']['amount'] !== $order->getAmount()) {
        return ['success' => false, 'error' => 'Amount mismatch'];
    }

    // Atomic update
    $updated = $em->createQueryBuilder()
        ->update(Order::class, 'o')
        ->set('o.paid', true)
        ->set('o.paidAt', ':now')
        ->where('o.reference = :ref')
        ->andWhere('o.paid = false')
        ->setParameter('ref', $reference)
        ->setParameter('now', new \DateTime())
        ->getQuery()
        ->execute();

    return [
        'success' => true,
        'already_fulfilled' => $updated === 0,
    ];
}

#[Route('/payment/callback')]
public function callback(Request $request, PaystackService $paystack, EntityManagerInterface $em): Response
{
    $reference = $request->query->get('reference') ?? $request->query->get('trxref');

    if (!$reference) {
        return new Response('Missing reference', 400);
    }

    $result = $paystack->verifyAndFulfill($reference, $em);

    if ($result['success']) {
        return $this->render('payment/success.html.twig', ['reference' => $reference]);
    }

    return $this->render('payment/failed.html.twig', ['error' => $result['error']]);
}

• Using $em->flush() without atomic conditions. Use DQL UPDATE with a WHERE clause instead.
• Not checking currency. Always verify the currency matches your entity.
• Trusting request parameters. Verify against your database, not URL params.

This guide is part of the Paystack integration guides by language and framework series.

Sign up for the McTaba newsletter