Mobile Payment Systems Testing: Complete Guide for QA Engineers

// Enable sandbox mode in iOS app
#if DEBUG
    let configuration = PKPaymentAuthorizationConfiguration()
    configuration.merchantIdentifier = "merchant.com.yourapp.sandbox"
    configuration.supportedNetworks = [.visa, .masterCard, .amex]
    configuration.merchantCapabilities = .capability3DS
#else
    // Production configuration
#endif

func testApplePayAuthorization() {
    let request = PKPaymentRequest()
    request.merchantIdentifier = "merchant.com.yourapp"
    request.supportedNetworks = [.visa, .masterCard, .amex]
    request.merchantCapabilities = .capability3DS
    request.countryCode = "US"
    request.currencyCode = "USD"

    let item = PKPaymentSummaryItem(label: "Test Product", amount: NSDecimalNumber(string: "9.99"))
    request.paymentSummaryItems = [item]

    // Verify authorization controller presentation
    let controller = PKPaymentAuthorizationController(paymentRequest: request)
    controller.delegate = self
    controller.present { presented in
        XCTAssertTrue(presented, "Payment controller should present")
    }
}

// Android Google Pay configuration
private fun createPaymentsClient(): PaymentsClient {
    val walletOptions = Wallet.WalletOptions.Builder()
        .setEnvironment(WalletConstants.ENVIRONMENT_TEST) // Use test environment
        .build()
    return Wallet.getPaymentsClient(this, walletOptions)
}

private fun createPaymentDataRequest(): PaymentDataRequest {
    val request = PaymentDataRequest.fromJson(
        """
        {
            "apiVersion": 2,
            "apiVersionMinor": 0,
            "allowedPaymentMethods": [
                {
                    "type": "CARD",
                    "parameters": {
                        "allowedAuthMethods": ["PAN_ONLY", "CRYPTOGRAM_3DS"],
                        "allowedCardNetworks": ["MASTERCARD", "VISA"]
                    },
                    "tokenizationSpecification": {
                        "type": "PAYMENT_GATEWAY",
                        "parameters": {
                            "gateway": "example",
                            "gatewayMerchantId": "exampleMerchantId"
                        }
                    }
                }
            ],
            "merchantInfo": {
                "merchantId": "TEST_MERCHANT_ID",
                "merchantName": "Test Merchant"
            },
            "transactionInfo": {
                "totalPriceStatus": "FINAL",
                "totalPrice": "12.34",
                "currencyCode": "USD"
            }
        }
        """.trimIndent()
    )
    return request
}

@Test
fun testGooglePayAvailability() {
    val isReadyToPayRequest = IsReadyToPayRequest.fromJson(
        """
        {
            "apiVersion": 2,
            "apiVersionMinor": 0,
            "allowedPaymentMethods": [
                {
                    "type": "CARD",
                    "parameters": {
                        "allowedAuthMethods": ["PAN_ONLY", "CRYPTOGRAM_3DS"],
                        "allowedCardNetworks": ["MASTERCARD", "VISA"]
                    }
                }
            ]
        }
        """.trimIndent()
    )

    paymentsClient.isReadyToPay(isReadyToPayRequest)
        .addOnCompleteListener { task ->
            assertTrue("Google Pay should be available", task.isSuccessful)
        }
}

fun validatePaymentToken(token: String) {
    val jsonToken = JSONObject(token)

    // Verify required fields
    assertTrue(jsonToken.has("signature"))
    assertTrue(jsonToken.has("protocolVersion"))
    assertTrue(jsonToken.has("signedMessage"))

    // Verify signature validity
    val signedMessage = jsonToken.getString("signedMessage")
    assertNotNull(signedMessage)
    assertFalse(signedMessage.isEmpty())
}

// iOS StoreKit testing
import StoreKit

class IAPManager: NSObject, SKPaymentTransactionObserver {
    func purchaseProduct(productId: String) {
        guard SKPaymentQueue.canMakePayments() else {
            print("User cannot make payments")
            return
        }

        let payment = SKPayment(product: product)
        SKPaymentQueue.default().add(payment)
    }

    func paymentQueue(_ queue: SKPaymentQueue,
                     updatedTransactions transactions: [SKPaymentTransaction]) {
        for transaction in transactions {
            switch transaction.transactionState {
            case .purchased:
                // Verify receipt and unlock content
                completeTransaction(transaction)
            case .failed:
                // Handle failure
                failedTransaction(transaction)
            case .restored:
                // Restore previous purchase
                restoreTransaction(transaction)
            case .deferred:
                // Payment pending approval
                print("Payment deferred")
            case .purchasing:
                print("Purchasing...")
            @unknown default:
                break
            }
        }
    }
}

class BillingManager(private val context: Context) : PurchasesUpdatedListener {
    private lateinit var billingClient: BillingClient

    fun initializeBilling() {
        billingClient = BillingClient.newBuilder(context)
            .setListener(this)
            .enablePendingPurchases()
            .build()

        billingClient.startConnection(object : BillingClientStateListener {
            override fun onBillingSetupFinished(result: BillingResult) {
                if (result.responseCode == BillingClient.BillingResponseCode.OK) {
                    // Query available products
                    queryProducts()
                }
            }

            override fun onBillingServiceDisconnected() {
                // Retry connection
            }
        })
    }

    override fun onPurchasesUpdated(result: BillingResult, purchases: List<Purchase>?) {
        when (result.responseCode) {
            BillingClient.BillingResponseCode.OK -> {
                purchases?.forEach { purchase ->
                    if (purchase.purchaseState == Purchase.PurchaseState.PURCHASED) {
                        // Acknowledge purchase
                        acknowledgePurchase(purchase)
                    }
                }
            }
            BillingClient.BillingResponseCode.USER_CANCELED -> {
                // Handle user cancellation
            }
            else -> {
                // Handle other errors
            }
        }
    }
}

// Backend payment processing example (Node.js)
const stripe = require('stripe')(process.env.STRIPE_TEST_KEY);

async function processPayment(paymentData) {
    try {
        // Create payment intent
        const paymentIntent = await stripe.paymentIntents.create({
            amount: paymentData.amount,
            currency: 'usd',
            payment_method_types: ['card'],
            metadata: {
                orderId: paymentData.orderId,
                userId: paymentData.userId
            }
        });

        // Confirm payment
        const confirmedPayment = await stripe.paymentIntents.confirm(
            paymentIntent.id,
            {
                payment_method: paymentData.paymentMethodId
            }
        );

        return {
            success: true,
            transactionId: confirmedPayment.id,
            status: confirmedPayment.status
        };
    } catch (error) {
        return {
            success: false,
            error: error.message,
            code: error.code
        };
    }
}

# Python integration test example
import unittest
import requests

class PaymentGatewayTests(unittest.TestCase):
    def setUp(self):
        self.base_url = "https://api.payment-gateway.test"
        self.api_key = "test_api_key_12345"

    def test_successful_payment(self):
        """Test successful payment processing"""
        payload = {
            "amount": 1000,  # Amount in cents
            "currency": "USD",
            "card": {
                "number": "4242424242424242",
                "exp_month": 12,
                "exp_year": 2025,
                "cvc": "123"
            }
        }

        response = requests.post(
            f"{self.base_url}/charges",
            json=payload,
            headers={"Authorization": f"Bearer {self.api_key}"}
        )

        self.assertEqual(response.status_code, 200)
        self.assertTrue(response.json()["success"])

    def test_insufficient_funds(self):
        """Test payment declined due to insufficient funds"""
        payload = {
            "amount": 1000,
            "currency": "USD",
            "card": {
                "number": "4000000000009995",  # Declined card
                "exp_month": 12,
                "exp_year": 2025,
                "cvc": "123"
            }
        }

        response = requests.post(
            f"{self.base_url}/charges",
            json=payload,
            headers={"Authorization": f"Bearer {self.api_key}"}
        )

        self.assertEqual(response.status_code, 402)
        self.assertEqual(response.json()["error_code"], "insufficient_funds")

// iOS encryption example
import CryptoKit

func encryptCardData(_ cardNumber: String, publicKey: String) throws -> Data {
    let key = try P256.KeyAgreement.PublicKey(pemRepresentation: publicKey)
    let symmetricKey = SymmetricKey(size: .bits256)

    let sealedBox = try AES.GCM.seal(
        cardNumber.data(using: .utf8)!,
        using: symmetricKey
    )

    return sealedBox.combined!
}

# Check for sensitive data in logs
grep -r "4[0-9]{15}" ./logs/  # Search for potential credit card numbers
grep -r "cvv\|cvc" ./logs/    # Search for CVV references

# Analyze app traffic with proxy
mitmproxy -p 8080  # Intercept HTTPS traffic to verify encryption

# Configuration management
environments:
  development:
    payment_gateway: "sandbox"
    api_key: "${SANDBOX_API_KEY}"
    endpoint: "https://sandbox.payment-gateway.com"

  staging:
    payment_gateway: "sandbox"
    api_key: "${STAGING_API_KEY}"
    endpoint: "https://sandbox.payment-gateway.com"

  production:
    payment_gateway: "production"
    api_key: "${PRODUCTION_API_KEY}"
    endpoint: "https://api.payment-gateway.com"

// Feature flag implementation
const config = {
    useSandbox: process.env.NODE_ENV !== 'production',
    enableTestCards: process.env.ENABLE_TEST_CARDS === 'true',
    skipReceiptValidation: process.env.SKIP_RECEIPT_VALIDATION === 'true'
};

function getPaymentClient() {
    return config.useSandbox
        ? new SandboxPaymentClient(config.sandboxApiKey)
        : new ProductionPaymentClient(config.productionApiKey);
}

# Certificate pinning test
import ssl
import socket

def test_certificate_pinning(hostname, port, expected_cert_hash):
    """Verify app implements certificate pinning"""
    context = ssl.create_default_context()

    with socket.create_connection((hostname, port)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
            cert_der = ssock.getpeercert(binary_form=True)
            cert_hash = hashlib.sha256(cert_der).hexdigest()

            assert cert_hash == expected_cert_hash, \
                "Certificate hash mismatch - possible MITM attack"

# iOS Keychain inspection
security dump-keychain ~/Library/Keychains/login.keychain-db

# Android SharedPreferences check
adb shell run-as com.yourapp.package cat /data/data/com.yourapp.package/shared_prefs/preferences.xml

# Memory dump analysis
fridump -U com.yourapp.package -s
grep -r "4[0-9]{15}" dump/  # Search for card numbers in memory

// Session management test
describe('Payment Session Security', () => {
    it('should expire session after 15 minutes of inactivity', async () => {
        const session = await createPaymentSession();

        // Wait for timeout period
        await sleep(15 * 60 * 1000);

        // Attempt to use expired session
        const result = await processPayment(session.id);

        expect(result.error).toBe('session_expired');
    });

    it('should prevent replay attacks', async () => {
        const payment = await capturePaymentRequest();

        // Process payment
        await processPayment(payment);

        // Attempt to replay same payment
        const replayResult = await processPayment(payment);

        expect(replayResult.error).toBe('duplicate_transaction');
    });
});

// Simulate network timeout
@Test
fun testPaymentNetworkTimeout() {
    // Mock network layer to simulate timeout
    mockWebServer.enqueue(MockResponse().setSocketPolicy(SocketPolicy.NO_RESPONSE))

    val result = paymentService.processPayment(testPaymentData)

    assertTrue(result is PaymentResult.NetworkError)
    assertEquals("Request timeout", result.message)
}

func testInsufficientFunds() {
    let testCard = TestCard(number: "4000000000009995") // Declined card

    let expectation = XCTestExpectation(description: "Payment declined")

    paymentProcessor.process(card: testCard, amount: 100.00) { result in
        switch result {
        case .failure(let error):
            XCTAssertEqual(error, .insufficientFunds)
            expectation.fulfill()
        case .success:
            XCTFail("Payment should have been declined")
        }
    }

    wait(for: [expectation], timeout: 10.0)
}

// Test automatic retry logic
async function testPaymentRetry() {
    let attempts = 0;
    const maxRetries = 3;

    // Mock payment service to fail twice, succeed on third attempt
    paymentService.process = jest.fn()
        .mockRejectedValueOnce(new Error('Temporary failure'))
        .mockRejectedValueOnce(new Error('Temporary failure'))
        .mockResolvedValueOnce({ success: true, transactionId: '12345' });

    const result = await paymentWithRetry(paymentData, maxRetries);

    expect(paymentService.process).toHaveBeenCalledTimes(3);
    expect(result.success).toBe(true);
}

func testSubscriptionCreation() {
    let subscription = Subscription(
        productId: "monthly_premium",
        period: .monthly,
        price: 9.99
    )

    subscriptionManager.subscribe(to: subscription) { result in
        XCTAssertTrue(result.isSuccess)
        XCTAssertNotNil(result.receiptData)
        XCTAssertEqual(result.expirationDate, expectedDate)
    }
}

@Test
fun testAutoRenewal() = runTest {
    // Create subscription expiring soon
    val subscription = createTestSubscription(
        expiresAt = now().plusMinutes(5)
    )

    // Wait for auto-renewal window
    advanceTimeBy(6.minutes)

    // Verify subscription renewed
    val renewed = subscriptionRepository.getSubscription(subscription.id)
    assertTrue(renewed.isActive)
    assertEquals(now().plusMonths(1), renewed.expiresAt)
}

def test_billing_cycle():
    """Test subscription billing across multiple cycles"""
    subscription = create_subscription(
        user_id="test_user",
        plan="monthly",
        start_date=datetime(2025, 1, 1)
    )

    # Test first billing
    first_charge = process_billing_cycle(subscription, datetime(2025, 1, 1))
    assert first_charge.amount == 9.99
    assert first_charge.status == "succeeded"

    # Test second billing
    second_charge = process_billing_cycle(subscription, datetime(2025, 2, 1))
    assert second_charge.amount == 9.99
    assert second_charge.status == "succeeded"

    # Test failed payment
    set_payment_method_invalid(subscription)
    third_charge = process_billing_cycle(subscription, datetime(2025, 3, 1))
    assert third_charge.status == "failed"
    assert subscription.status == "past_due"

describe('Subscription Grace Period', () => {
    it('should retry failed payments during grace period', async () => {
        const subscription = await createSubscription({
            gracePeriodDays: 7,
            retryAttempts: 3
        });

        // Simulate failed payment
        await simulateFailedPayment(subscription);

        // Verify subscription status
        expect(subscription.status).toBe('past_due');
        expect(subscription.gracePeriodEnds).toBe(addDays(now(), 7));

        // Simulate retry attempts
        for (let i = 1; i <= 3; i++) {
            await advanceTime(2, 'days');
            const retryResult = await retryPayment(subscription);

            if (i < 3) {
                expect(retryResult.attempt).toBe(i);
                expect(subscription.status).toBe('past_due');
            }
        }

        // Verify subscription cancelled after grace period
        await advanceTime(1, 'days');
        expect(subscription.status).toBe('cancelled');
    });
});

class RefundTests(unittest.TestCase):
    def test_full_refund(self):
        """Test complete refund of payment"""
        # Create and process payment
        payment = create_payment(amount=100.00)
        process_payment(payment)

        # Process full refund
        refund = create_refund(
            payment_id=payment.id,
            amount=100.00,
            reason="customer_request"
        )

        self.assertEqual(refund.status, "succeeded")
        self.assertEqual(refund.amount, 100.00)
        self.assertEqual(payment.status, "refunded")

    def test_partial_refund(self):
        """Test partial refund of payment"""
        payment = create_payment(amount=100.00)
        process_payment(payment)

        # Process partial refund
        refund = create_refund(
            payment_id=payment.id,
            amount=50.00,
            reason="partial_return"
        )

        self.assertEqual(refund.status, "succeeded")
        self.assertEqual(refund.amount, 50.00)
        self.assertEqual(payment.amount_refunded, 50.00)
        self.assertEqual(payment.status, "partially_refunded")

    def test_refund_deadline(self):
        """Test refund cannot be processed after deadline"""
        # Create payment 6 months ago
        payment = create_payment(
            amount=100.00,
            created_at=datetime.now() - timedelta(days=180)
        )

        # Attempt refund
        with self.assertRaises(RefundError) as context:
            create_refund(payment_id=payment.id, amount=100.00)

        self.assertIn("refund_deadline_exceeded", str(context.exception))

func testSubscriptionCancellation() {
    let subscription = createActiveSubscription()

    // Test immediate cancellation
    subscriptionManager.cancel(subscription, immediately: true) { result in
        XCTAssertTrue(result.isSuccess)
        XCTAssertEqual(subscription.status, .cancelled)
        XCTAssertNil(subscription.nextBillingDate)
        XCTAssertTrue(subscription.accessExpiresAt <= Date())
    }

    // Test cancellation at period end
    let subscription2 = createActiveSubscription()
    subscriptionManager.cancel(subscription2, immediately: false) { result in
        XCTAssertTrue(result.isSuccess)
        XCTAssertEqual(subscription2.status, .cancelledAtPeriodEnd)
        XCTAssertNotNil(subscription2.accessExpiresAt)
        XCTAssertTrue(subscription2.accessExpiresAt > Date())
    }
}

const currencyTestCases = [
    { currency: 'USD', amount: 100.00, formatted: '$100.00' },
    { currency: 'EUR', amount: 100.00, formatted: '100,00 €' },
    { currency: 'GBP', amount: 100.00, formatted: '£100.00' },
    { currency: 'JPY', amount: 10000, formatted: '¥10,000' },
    { currency: 'RUB', amount: 7500, formatted: '7 500 ₽' }
];

describe('Currency Formatting', () => {
    currencyTestCases.forEach(testCase => {
        it(`should format ${testCase.currency} correctly`, () => {
            const formatted = formatCurrency(
                testCase.amount,
                testCase.currency
            );
            expect(formatted).toBe(testCase.formatted);
        });
    });
});

@Test
fun testCurrencyConversion() {
    val converter = CurrencyConverter()

    // Mock exchange rate service
    whenever(exchangeRateService.getRate("USD", "EUR"))
        .thenReturn(0.85)

    val result = converter.convert(
        amount = 100.0,
        from = "USD",
        to = "EUR"
    )

    assertEquals(85.0, result, 0.01)
}

@Test
fun testPriceConsistency() {
    // Ensure prices are consistent across currencies
    val usdPrice = 9.99
    val eurPrice = 8.49
    val gbpPrice = 7.99

    val currentRate = exchangeRateService.getRate("USD", "EUR")
    val convertedPrice = usdPrice * currentRate

    // Allow 5% variance for price rounding
    assertTrue(abs(convertedPrice - eurPrice) / eurPrice < 0.05)
}

# .github/workflows/payment-tests.yml
name: Payment Integration Tests

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  payment-tests:
    runs-on: ubuntu-latest

    env:
      STRIPE_TEST_KEY: ${{ secrets.STRIPE_TEST_KEY }}
      PAYPAL_SANDBOX_CLIENT: ${{ secrets.PAYPAL_SANDBOX_CLIENT }}

    steps:
      - uses: actions/checkout@v3

      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '18'

      - name: Install dependencies
        run: npm ci

      - name: Run payment unit tests
        run: npm run test:payment:unit

      - name: Run payment integration tests
        run: npm run test:payment:integration

      - name: Run payment security tests
        run: npm run test:payment:security

      - name: Generate payment test report
        if: always()
        run: npm run test:report

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: payment-test-results
          path: test-results/

// mock-payment-server.js
const express = require('express');
const app = express();

app.post('/v1/charges', (req, res) => {
    const { card, amount } = req.body;

    // Simulate various card scenarios
    const testCards = {
        '4242424242424242': { success: true },
        '4000000000000002': { success: false, error: 'card_declined' },
        '4000000000009995': { success: false, error: 'insufficient_funds' },
        '4000000000000069': { success: false, error: 'expired_card' }
    };

    const result = testCards[card.number] || { success: true };

    if (result.success) {
        res.json({
            id: `ch_test_${Date.now()}`,
            amount: amount,
            status: 'succeeded',
            paid: true
        });
    } else {
        res.status(402).json({
            error: {
                type: 'card_error',
                code: result.error,
                message: getErrorMessage(result.error)
            }
        });
    }
});

app.listen(3001, () => {
    console.log('Mock payment server running on port 3001');
});

from locust import HttpUser, task, between

class PaymentLoadTest(HttpUser):
    wait_time = between(1, 3)

    @task(3)
    def create_payment_intent(self):
        """Test payment intent creation under load"""
        self.client.post("/v1/payment_intents", json={
            "amount": 1000,
            "currency": "usd",
            "payment_method_types": ["card"]
        }, headers={"Authorization": f"Bearer {self.api_key}"})

    @task(2)
    def confirm_payment(self):
        """Test payment confirmation under load"""
        # Create payment intent first
        response = self.client.post("/v1/payment_intents", json={
            "amount": 1000,
            "currency": "usd"
        }, headers={"Authorization": f"Bearer {self.api_key}"})

        if response.status_code == 200:
            intent_id = response.json()["id"]

            # Confirm payment
            self.client.post(f"/v1/payment_intents/{intent_id}/confirm",
                json={"payment_method": "pm_card_visa"},
                headers={"Authorization": f"Bearer {self.api_key}"})

    @task(1)
    def retrieve_payment(self):
        """Test payment retrieval performance"""
        self.client.get("/v1/charges/ch_test_12345",
            headers={"Authorization": f"Bearer {self.api_key}"})

// Monitoring payment health in production
const monitor = {
    async checkPaymentHealth() {
        const metrics = {
            successRate: await this.calculateSuccessRate(),
            avgProcessingTime: await this.getAvgProcessingTime(),
            failureReasons: await this.getFailureBreakdown()
        };

        // Alert if success rate drops below threshold
        if (metrics.successRate < 0.95) {
            this.sendAlert({
                severity: 'high',
                message: `Payment success rate dropped to ${metrics.successRate}`,
                metrics: metrics
            });
        }

        return metrics;
    },

    async calculateSuccessRate() {
        const last24h = new Date(Date.now() - 24 * 60 * 60 * 1000);
        const payments = await Payment.find({
            createdAt: { $gte: last24h }
        });

        const successful = payments.filter(p => p.status === 'succeeded').length;
        return successful / payments.length;
    }
};

// Run health check every 5 minutes
setInterval(() => monitor.checkPaymentHealth(), 5 * 60 * 1000);