Pruebas de Sistemas de Pago Móvil: Guía Completa para Ingenieros QA

// Habilitar modo sandbox en app iOS
#if DEBUG
    let configuration = PKPaymentAuthorizationConfiguration()
    configuration.merchantIdentifier = "merchant.com.tuapp.sandbox"
    configuration.supportedNetworks = [.visa, .masterCard, .amex]
    configuration.merchantCapabilities = .capability3DS
#else
    // Configuración de producción
#endif

func testApplePayAuthorization() {
    let request = PKPaymentRequest()
    request.merchantIdentifier = "merchant.com.tuapp"
    request.supportedNetworks = [.visa, .masterCard, .amex]
    request.merchantCapabilities = .capability3DS
    request.countryCode = "US"
    request.currencyCode = "USD"

    let item = PKPaymentSummaryItem(label: "Producto de Prueba", amount: NSDecimalNumber(string: "9.99"))
    request.paymentSummaryItems = [item]

    // Verificar presentación del controlador de autorización
    let controller = PKPaymentAuthorizationController(paymentRequest: request)
    controller.delegate = self
    controller.present { presented in
        XCTAssertTrue(presented, "El controlador de pago debe presentarse")
    }
}

// Configuración de Google Pay en Android
private fun createPaymentsClient(): PaymentsClient {
    val walletOptions = Wallet.WalletOptions.Builder()
        .setEnvironment(WalletConstants.ENVIRONMENT_TEST) // Usar entorno de prueba
        .build()
    return Wallet.getPaymentsClient(this, walletOptions)
}

private fun createPaymentDataRequest(): PaymentDataRequest {
    val request = PaymentDataRequest.fromJson(
        """
        {
            "apiVersion": 2,
            "apiVersionMinor": 0,
            "allowedPaymentMethods": [
                {
                    "type": "CARD",
                    "parameters": {
                        "allowedAuthMethods": ["PAN_ONLY", "CRYPTOGRAM_3DS"],
                        "allowedCardNetworks": ["MASTERCARD", "VISA"]
                    },
                    "tokenizationSpecification": {
                        "type": "PAYMENT_GATEWAY",
                        "parameters": {
                            "gateway": "example",
                            "gatewayMerchantId": "exampleMerchantId"
                        }
                    }
                }
            ],
            "merchantInfo": {
                "merchantId": "TEST_MERCHANT_ID",
                "merchantName": "Comerciante de Prueba"
            },
            "transactionInfo": {
                "totalPriceStatus": "FINAL",
                "totalPrice": "12.34",
                "currencyCode": "USD"
            }
        }
        """.trimIndent()
    )
    return request
}

@Test
fun testGooglePayAvailability() {
    val isReadyToPayRequest = IsReadyToPayRequest.fromJson(
        """
        {
            "apiVersion": 2,
            "apiVersionMinor": 0,
            "allowedPaymentMethods": [
                {
                    "type": "CARD",
                    "parameters": {
                        "allowedAuthMethods": ["PAN_ONLY", "CRYPTOGRAM_3DS"],
                        "allowedCardNetworks": ["MASTERCARD", "VISA"]
                    }
                }
            ]
        }
        """.trimIndent()
    )

    paymentsClient.isReadyToPay(isReadyToPayRequest)
        .addOnCompleteListener { task ->
            assertTrue("Google Pay debe estar disponible", task.isSuccessful)
        }
}

fun validatePaymentToken(token: String) {
    val jsonToken = JSONObject(token)

    // Verificar campos requeridos
    assertTrue(jsonToken.has("signature"))
    assertTrue(jsonToken.has("protocolVersion"))
    assertTrue(jsonToken.has("signedMessage"))

    // Verificar validez de firma
    val signedMessage = jsonToken.getString("signedMessage")
    assertNotNull(signedMessage)
    assertFalse(signedMessage.isEmpty())
}

// Pruebas de StoreKit en iOS
import StoreKit

class IAPManager: NSObject, SKPaymentTransactionObserver {
    func purchaseProduct(productId: String) {
        guard SKPaymentQueue.canMakePayments() else {
            print("El usuario no puede hacer pagos")
            return
        }

        let payment = SKPayment(product: product)
        SKPaymentQueue.default().add(payment)
    }

    func paymentQueue(_ queue: SKPaymentQueue,
                     updatedTransactions transactions: [SKPaymentTransaction]) {
        for transaction in transactions {
            switch transaction.transactionState {
            case .purchased:
                // Verificar recibo y desbloquear contenido
                completeTransaction(transaction)
            case .failed:
                // Manejar fallo
                failedTransaction(transaction)
            case .restored:
                // Restaurar compra anterior
                restoreTransaction(transaction)
            case .deferred:
                // Pago pendiente de aprobación
                print("Pago diferido")
            case .purchasing:
                print("Comprando...")
            @unknown default:
                break
            }
        }
    }
}

class BillingManager(private val context: Context) : PurchasesUpdatedListener {
    private lateinit var billingClient: BillingClient

    fun initializeBilling() {
        billingClient = BillingClient.newBuilder(context)
            .setListener(this)
            .enablePendingPurchases()
            .build()

        billingClient.startConnection(object : BillingClientStateListener {
            override fun onBillingSetupFinished(result: BillingResult) {
                if (result.responseCode == BillingClient.BillingResponseCode.OK) {
                    // Consultar productos disponibles
                    queryProducts()
                }
            }

            override fun onBillingServiceDisconnected() {
                // Reintentar conexión
            }
        })
    }

    override fun onPurchasesUpdated(result: BillingResult, purchases: List<Purchase>?) {
        when (result.responseCode) {
            BillingClient.BillingResponseCode.OK -> {
                purchases?.forEach { purchase ->
                    if (purchase.purchaseState == Purchase.PurchaseState.PURCHASED) {
                        // Reconocer compra
                        acknowledgePurchase(purchase)
                    }
                }
            }
            BillingClient.BillingResponseCode.USER_CANCELED -> {
                // Manejar cancelación del usuario
            }
            else -> {
                // Manejar otros errores
            }
        }
    }
}

// Ejemplo de procesamiento de pago backend (Node.js)
const stripe = require('stripe')(process.env.STRIPE_TEST_KEY);

async function processPayment(paymentData) {
    try {
        // Crear intención de pago
        const paymentIntent = await stripe.paymentIntents.create({
            amount: paymentData.amount,
            currency: 'usd',
            payment_method_types: ['card'],
            metadata: {
                orderId: paymentData.orderId,
                userId: paymentData.userId
            }
        });

        // Confirmar pago
        const confirmedPayment = await stripe.paymentIntents.confirm(
            paymentIntent.id,
            {
                payment_method: paymentData.paymentMethodId
            }
        );

        return {
            success: true,
            transactionId: confirmedPayment.id,
            status: confirmedPayment.status
        };
    } catch (error) {
        return {
            success: false,
            error: error.message,
            code: error.code
        };
    }
}

# Ejemplo de prueba de integración en Python
import unittest
import requests

class PaymentGatewayTests(unittest.TestCase):
    def setUp(self):
        self.base_url = "https://api.payment-gateway.test"
        self.api_key = "test_api_key_12345"

    def test_successful_payment(self):
        """Probar procesamiento de pago exitoso"""
        payload = {
            "amount": 1000,  # Cantidad en centavos
            "currency": "USD",
            "card": {
                "number": "4242424242424242",
                "exp_month": 12,
                "exp_year": 2025,
                "cvc": "123"
            }
        }

        response = requests.post(
            f"{self.base_url}/charges",
            json=payload,
            headers={"Authorization": f"Bearer {self.api_key}"}
        )

        self.assertEqual(response.status_code, 200)
        self.assertTrue(response.json()["success"])

    def test_insufficient_funds(self):
        """Probar pago rechazado por fondos insuficientes"""
        payload = {
            "amount": 1000,
            "currency": "USD",
            "card": {
                "number": "4000000000009995",  # Tarjeta rechazada
                "exp_month": 12,
                "exp_year": 2025,
                "cvc": "123"
            }
        }

        response = requests.post(
            f"{self.base_url}/charges",
            json=payload,
            headers={"Authorization": f"Bearer {self.api_key}"}
        )

        self.assertEqual(response.status_code, 402)
        self.assertEqual(response.json()["error_code"], "insufficient_funds")

// Ejemplo de encriptación en iOS
import CryptoKit

func encryptCardData(_ cardNumber: String, publicKey: String) throws -> Data {
    let key = try P256.KeyAgreement.PublicKey(pemRepresentation: publicKey)
    let symmetricKey = SymmetricKey(size: .bits256)

    let sealedBox = try AES.GCM.seal(
        cardNumber.data(using: .utf8)!,
        using: symmetricKey
    )

    return sealedBox.combined!
}

# Verificar datos sensibles en logs
grep -r "4[0-9]{15}" ./logs/  # Buscar posibles números de tarjeta de crédito
grep -r "cvv\|cvc" ./logs/    # Buscar referencias CVV

# Analizar tráfico de app con proxy
mitmproxy -p 8080  # Interceptar tráfico HTTPS para verificar encriptación

# Gestión de configuración
environments:
  development:
    payment_gateway: "sandbox"
    api_key: "${SANDBOX_API_KEY}"
    endpoint: "https://sandbox.payment-gateway.com"

  staging:
    payment_gateway: "sandbox"
    api_key: "${STAGING_API_KEY}"
    endpoint: "https://sandbox.payment-gateway.com"

  production:
    payment_gateway: "production"
    api_key: "${PRODUCTION_API_KEY}"
    endpoint: "https://api.payment-gateway.com"

// Implementación de bandera de característica
const config = {
    useSandbox: process.env.NODE_ENV !== 'production',
    enableTestCards: process.env.ENABLE_TEST_CARDS === 'true',
    skipReceiptValidation: process.env.SKIP_RECEIPT_VALIDATION === 'true'
};

function getPaymentClient() {
    return config.useSandbox
        ? new SandboxPaymentClient(config.sandboxApiKey)
        : new ProductionPaymentClient(config.productionApiKey);
}

# Prueba de certificate pinning
import ssl
import socket

def test_certificate_pinning(hostname, port, expected_cert_hash):
    """Verificar que la app implementa certificate pinning"""
    context = ssl.create_default_context()

    with socket.create_connection((hostname, port)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
            cert_der = ssock.getpeercert(binary_form=True)
            cert_hash = hashlib.sha256(cert_der).hexdigest()

            assert cert_hash == expected_cert_hash, \
                "Hash de certificado no coincide - posible ataque MITM"

# Inspección de iOS Keychain
security dump-keychain ~/Library/Keychains/login.keychain-db

# Verificación de SharedPreferences en Android
adb shell run-as com.tuapp.package cat /data/data/com.tuapp.package/shared_prefs/preferences.xml

# Análisis de volcado de memoria
fridump -U com.tuapp.package -s
grep -r "4[0-9]{15}" dump/  # Buscar números de tarjeta en memoria

// Prueba de gestión de sesión
describe('Seguridad de Sesión de Pago', () => {
    it('debe expirar sesión después de 15 minutos de inactividad', async () => {
        const session = await createPaymentSession();

        // Esperar período de timeout
        await sleep(15 * 60 * 1000);

        // Intentar usar sesión expirada
        const result = await processPayment(session.id);

        expect(result.error).toBe('session_expired');
    });

    it('debe prevenir ataques de replay', async () => {
        const payment = await capturePaymentRequest();

        // Procesar pago
        await processPayment(payment);

        // Intentar replay del mismo pago
        const replayResult = await processPayment(payment);

        expect(replayResult.error).toBe('duplicate_transaction');
    });
});

// Simular timeout de red
@Test
fun testPaymentNetworkTimeout() {
    // Mockear capa de red para simular timeout
    mockWebServer.enqueue(MockResponse().setSocketPolicy(SocketPolicy.NO_RESPONSE))

    val result = paymentService.processPayment(testPaymentData)

    assertTrue(result is PaymentResult.NetworkError)
    assertEquals("Request timeout", result.message)
}

func testInsufficientFunds() {
    let testCard = TestCard(number: "4000000000009995") // Tarjeta rechazada

    let expectation = XCTestExpectation(description: "Pago rechazado")

    paymentProcessor.process(card: testCard, amount: 100.00) { result in
        switch result {
        case .failure(let error):
            XCTAssertEqual(error, .insufficientFunds)
            expectation.fulfill()
        case .success:
            XCTFail("El pago debería haber sido rechazado")
        }
    }

    wait(for: [expectation], timeout: 10.0)
}

// Probar lógica de reintento automático
async function testPaymentRetry() {
    let attempts = 0;
    const maxRetries = 3;

    // Mockear servicio de pago para fallar dos veces, éxito en tercer intento
    paymentService.process = jest.fn()
        .mockRejectedValueOnce(new Error('Fallo temporal'))
        .mockRejectedValueOnce(new Error('Fallo temporal'))
        .mockResolvedValueOnce({ success: true, transactionId: '12345' });

    const result = await paymentWithRetry(paymentData, maxRetries);

    expect(paymentService.process).toHaveBeenCalledTimes(3);
    expect(result.success).toBe(true);
}

func testSubscriptionCreation() {
    let subscription = Subscription(
        productId: "monthly_premium",
        period: .monthly,
        price: 9.99
    )

    subscriptionManager.subscribe(to: subscription) { result in
        XCTAssertTrue(result.isSuccess)
        XCTAssertNotNil(result.receiptData)
        XCTAssertEqual(result.expirationDate, expectedDate)
    }
}

@Test
fun testAutoRenewal() = runTest {
    // Crear suscripción que expira pronto
    val subscription = createTestSubscription(
        expiresAt = now().plusMinutes(5)
    )

    // Esperar ventana de auto-renovación
    advanceTimeBy(6.minutes)

    // Verificar suscripción renovada
    val renewed = subscriptionRepository.getSubscription(subscription.id)
    assertTrue(renewed.isActive)
    assertEquals(now().plusMonths(1), renewed.expiresAt)
}

def test_billing_cycle():
    """Probar facturación de suscripción a través de múltiples ciclos"""
    subscription = create_subscription(
        user_id="test_user",
        plan="monthly",
        start_date=datetime(2025, 1, 1)
    )

    # Probar primera facturación
    first_charge = process_billing_cycle(subscription, datetime(2025, 1, 1))
    assert first_charge.amount == 9.99
    assert first_charge.status == "succeeded"

    # Probar segunda facturación
    second_charge = process_billing_cycle(subscription, datetime(2025, 2, 1))
    assert second_charge.amount == 9.99
    assert second_charge.status == "succeeded"

    # Probar pago fallido
    set_payment_method_invalid(subscription)
    third_charge = process_billing_cycle(subscription, datetime(2025, 3, 1))
    assert third_charge.status == "failed"
    assert subscription.status == "past_due"

describe('Período de Gracia de Suscripción', () => {
    it('debe reintentar pagos fallidos durante período de gracia', async () => {
        const subscription = await createSubscription({
            gracePeriodDays: 7,
            retryAttempts: 3
        });

        // Simular pago fallido
        await simulateFailedPayment(subscription);

        // Verificar estado de suscripción
        expect(subscription.status).toBe('past_due');
        expect(subscription.gracePeriodEnds).toBe(addDays(now(), 7));

        // Simular intentos de reintento
        for (let i = 1; i <= 3; i++) {
            await advanceTime(2, 'days');
            const retryResult = await retryPayment(subscription);

            if (i < 3) {
                expect(retryResult.attempt).toBe(i);
                expect(subscription.status).toBe('past_due');
            }
        }

        // Verificar suscripción cancelada después de período de gracia
        await advanceTime(1, 'days');
        expect(subscription.status).toBe('cancelled');
    });
});

class RefundTests(unittest.TestCase):
    def test_full_refund(self):
        """Probar reembolso completo de pago"""
        # Crear y procesar pago
        payment = create_payment(amount=100.00)
        process_payment(payment)

        # Procesar reembolso completo
        refund = create_refund(
            payment_id=payment.id,
            amount=100.00,
            reason="customer_request"
        )

        self.assertEqual(refund.status, "succeeded")
        self.assertEqual(refund.amount, 100.00)
        self.assertEqual(payment.status, "refunded")

    def test_partial_refund(self):
        """Probar reembolso parcial de pago"""
        payment = create_payment(amount=100.00)
        process_payment(payment)

        # Procesar reembolso parcial
        refund = create_refund(
            payment_id=payment.id,
            amount=50.00,
            reason="partial_return"
        )

        self.assertEqual(refund.status, "succeeded")
        self.assertEqual(refund.amount, 50.00)
        self.assertEqual(payment.amount_refunded, 50.00)
        self.assertEqual(payment.status, "partially_refunded")

    def test_refund_deadline(self):
        """Probar que reembolso no puede procesarse después de fecha límite"""
        # Crear pago hace 6 meses
        payment = create_payment(
            amount=100.00,
            created_at=datetime.now() - timedelta(days=180)
        )

        # Intentar reembolso
        with self.assertRaises(RefundError) as context:
            create_refund(payment_id=payment.id, amount=100.00)

        self.assertIn("refund_deadline_exceeded", str(context.exception))

func testSubscriptionCancellation() {
    let subscription = createActiveSubscription()

    // Probar cancelación inmediata
    subscriptionManager.cancel(subscription, immediately: true) { result in
        XCTAssertTrue(result.isSuccess)
        XCTAssertEqual(subscription.status, .cancelled)
        XCTAssertNil(subscription.nextBillingDate)
        XCTAssertTrue(subscription.accessExpiresAt <= Date())
    }

    // Probar cancelación al final del período
    let subscription2 = createActiveSubscription()
    subscriptionManager.cancel(subscription2, immediately: false) { result in
        XCTAssertTrue(result.isSuccess)
        XCTAssertEqual(subscription2.status, .cancelledAtPeriodEnd)
        XCTAssertNotNil(subscription2.accessExpiresAt)
        XCTAssertTrue(subscription2.accessExpiresAt > Date())
    }
}

const currencyTestCases = [
    { currency: 'USD', amount: 100.00, formatted: '$100.00' },
    { currency: 'EUR', amount: 100.00, formatted: '100,00 €' },
    { currency: 'GBP', amount: 100.00, formatted: '£100.00' },
    { currency: 'JPY', amount: 10000, formatted: '¥10,000' },
    { currency: 'RUB', amount: 7500, formatted: '7 500 ₽' }
];

describe('Formato de Divisas', () => {
    currencyTestCases.forEach(testCase => {
        it(`debe formatear ${testCase.currency} correctamente`, () => {
            const formatted = formatCurrency(
                testCase.amount,
                testCase.currency
            );
            expect(formatted).toBe(testCase.formatted);
        });
    });
});

@Test
fun testCurrencyConversion() {
    val converter = CurrencyConverter()

    // Mockear servicio de tipo de cambio
    whenever(exchangeRateService.getRate("USD", "EUR"))
        .thenReturn(0.85)

    val result = converter.convert(
        amount = 100.0,
        from = "USD",
        to = "EUR"
    )

    assertEquals(85.0, result, 0.01)
}

@Test
fun testPriceConsistency() {
    // Asegurar que precios son consistentes entre divisas
    val usdPrice = 9.99
    val eurPrice = 8.49
    val gbpPrice = 7.99

    val currentRate = exchangeRateService.getRate("USD", "EUR")
    val convertedPrice = usdPrice * currentRate

    // Permitir 5% de varianza para redondeo de precios
    assertTrue(abs(convertedPrice - eurPrice) / eurPrice < 0.05)
}

# .github/workflows/payment-tests.yml
name: Pruebas de Integración de Pago

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  payment-tests:
    runs-on: ubuntu-latest

    env:
      STRIPE_TEST_KEY: ${{ secrets.STRIPE_TEST_KEY }}
      PAYPAL_SANDBOX_CLIENT: ${{ secrets.PAYPAL_SANDBOX_CLIENT }}

    steps:
      - uses: actions/checkout@v3

      - name: Configurar Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '18'

      - name: Instalar dependencias
        run: npm ci

      - name: Ejecutar pruebas unitarias de pago
        run: npm run test:payment:unit

      - name: Ejecutar pruebas de integración de pago
        run: npm run test:payment:integration

      - name: Ejecutar pruebas de seguridad de pago
        run: npm run test:payment:security

      - name: Generar reporte de pruebas de pago
        if: always()
        run: npm run test:report

      - name: Subir resultados de pruebas
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: payment-test-results
          path: test-results/

// mock-payment-server.js
const express = require('express');
const app = express();

app.post('/v1/charges', (req, res) => {
    const { card, amount } = req.body;

    // Simular varios escenarios de tarjeta
    const testCards = {
        '4242424242424242': { success: true },
        '4000000000000002': { success: false, error: 'card_declined' },
        '4000000000009995': { success: false, error: 'insufficient_funds' },
        '4000000000000069': { success: false, error: 'expired_card' }
    };

    const result = testCards[card.number] || { success: true };

    if (result.success) {
        res.json({
            id: `ch_test_${Date.now()}`,
            amount: amount,
            status: 'succeeded',
            paid: true
        });
    } else {
        res.status(402).json({
            error: {
                type: 'card_error',
                code: result.error,
                message: getErrorMessage(result.error)
            }
        });
    }
});

app.listen(3001, () => {
    console.log('Servidor de pago mock ejecutándose en puerto 3001');
});

from locust import HttpUser, task, between

class PaymentLoadTest(HttpUser):
    wait_time = between(1, 3)

    @task(3)
    def create_payment_intent(self):
        """Probar creación de intención de pago bajo carga"""
        self.client.post("/v1/payment_intents", json={
            "amount": 1000,
            "currency": "usd",
            "payment_method_types": ["card"]
        }, headers={"Authorization": f"Bearer {self.api_key}"})

    @task(2)
    def confirm_payment(self):
        """Probar confirmación de pago bajo carga"""
        # Crear intención de pago primero
        response = self.client.post("/v1/payment_intents", json={
            "amount": 1000,
            "currency": "usd"
        }, headers={"Authorization": f"Bearer {self.api_key}"})

        if response.status_code == 200:
            intent_id = response.json()["id"]

            # Confirmar pago
            self.client.post(f"/v1/payment_intents/{intent_id}/confirm",
                json={"payment_method": "pm_card_visa"},
                headers={"Authorization": f"Bearer {self.api_key}"})

    @task(1)
    def retrieve_payment(self):
        """Probar rendimiento de recuperación de pago"""
        self.client.get("/v1/charges/ch_test_12345",
            headers={"Authorization": f"Bearer {self.api_key}"})

// Monitorear salud de pago en producción
const monitor = {
    async checkPaymentHealth() {
        const metrics = {
            successRate: await this.calculateSuccessRate(),
            avgProcessingTime: await this.getAvgProcessingTime(),
            failureReasons: await this.getFailureBreakdown()
        };

        // Alertar si la tasa de éxito cae bajo el umbral
        if (metrics.successRate < 0.95) {
            this.sendAlert({
                severity: 'high',
                message: `Tasa de éxito de pago cayó a ${metrics.successRate}`,
                metrics: metrics
            });
        }

        return metrics;
    },

    async calculateSuccessRate() {
        const last24h = new Date(Date.now() - 24 * 60 * 60 * 1000);
        const payments = await Payment.find({
            createdAt: { $gte: last24h }
        });

        const successful = payments.filter(p => p.status === 'succeeded').length;
        return successful / payments.length;
    }
};

// Ejecutar verificación de salud cada 5 minutos
setInterval(() => monitor.checkPaymentHealth(), 5 * 60 * 1000);