diff --git a/README.md b/README.md index 26c9e05..22b2915 100644 --- a/README.md +++ b/README.md @@ -137,7 +137,7 @@ Once the plugin is installed, these slash commands give direct access to the mos | Command | What it does | |---|---| -| `/paymob-test-cards [card\|wallet\|kiosk]` | Prints sandbox test cards, wallet numbers, and OTPs from `references/test-credentials.md`, optionally filtered to one method. Always notes the 30-day sandbox expiry and that decline/error simulation isn't officially documented. | +| `/paymob-test-cards [card\|wallet\|kiosk\|bnpl]` | Prints sandbox test cards, wallet numbers, and OTPs from `references/test-credentials.md`, optionally filtered to one method. Always notes the 30-day sandbox expiry and that decline/error simulation isn't officially documented. For kiosk and BNPL it reports that sandbox can't test them at all, rather than offering a card as a stand-in. | | `/paymob-explain-error ` | Looks up a Paymob error against the Troubleshooting table in `SKILL.md`, explains the cause, and — for code fixes — pulls the corrected snippet from the matching `references/code-*.md` file for your stack. Falls back to `references/live-resources.md` for anything not in the table instead of guessing. | | `/paymob-check-hmac [path]` | Statically audits your webhook HMAC verification against `references/hmac-verification.md`: SHA-512 (not SHA-256), exact field order, `body.obj` sourcing, no `obj.id`/`obj.order.id` mix-up, fail-closed behavior, and unique-constraint-backed idempotency. Never asks you to paste your HMAC secret or API key; only invoked manually, never automatically. | diff --git a/commands/paymob-test-cards.md b/commands/paymob-test-cards.md index e220d49..6ccd132 100644 --- a/commands/paymob-test-cards.md +++ b/commands/paymob-test-cards.md @@ -1,6 +1,6 @@ --- -description: Show Paymob sandbox test cards, wallet, and kiosk credentials, optionally filtered by payment method. -argument-hint: "[card|wallet|kiosk]" +description: Show Paymob sandbox test card and wallet credentials, optionally filtered by payment method. +argument-hint: "[card|wallet|kiosk|bnpl]" allowed-tools: Read --- @@ -9,7 +9,8 @@ Read `${CLAUDE_PLUGIN_ROOT}/skills/paymob-integration/references/test-credential Argument handling for `$ARGUMENTS`: - `card` → show only the Mastercard and Visa test card sections. - `wallet` → show only the test mobile wallet section. -- `kiosk` → this reference file does not currently list kiosk sandbox credentials. Say so explicitly, then point the user to `references/live-resources.md` (the `llms.txt` doc index and developer docs) or `support@paymob.com` to get current kiosk sandbox details — do not invent kiosk numbers. +- `kiosk`, `bnpl`, or a named BNPL provider (Valu, Souhoola, Tabby, Tamara, Sympl, …) → report what the file's **Methods with no sandbox test path** section says. Do not offer a workaround that section doesn't list, and do not substitute a test card so the method looks covered. +- Any other method the file has no section for (Apple/Google Pay, bank installments) → say plainly that the file has no entry for it, then point the user to `references/live-resources.md` (the `llms.txt` doc index and developer docs) or `support@paymob.com`. **Do not invent numbers, and do not substitute a card number as a stand-in.** Do not assert how that method's sandbox flow works either — if it isn't in the reference file, it isn't established here. - No argument → show all sections the file contains (cards and wallet). Always carry over, verbatim in meaning, these two caveats from the source file regardless of which filter was used: diff --git a/skills/paymob-integration/references/test-credentials.md b/skills/paymob-integration/references/test-credentials.md index a1e21fb..b547f6e 100644 --- a/skills/paymob-integration/references/test-credentials.md +++ b/skills/paymob-integration/references/test-credentials.md @@ -36,6 +36,20 @@ Use these **only** with Test-mode keys and Test-mode Integration IDs. Never use - MPIN code: `123456` - OTP: `123456` +## Methods with no sandbox test path + +⚠️ **These methods cannot be tested in sandbox at all.** No test credentials exist for them, and a payment cannot be completed end-to-end in Test mode. (Confirmed with Paymob, August 2026.) + +- **Kiosk** — Aman, Masary +- **BNPL** — Valu, Souhoola, Tabby, Tamara, Sympl, and the other providers + +What that means in practice: + +- Do **not** substitute a test card for one of these methods and record it as validated — that exercises the card rail, not theirs. +- **A green sandbox run does not cover them.** If the merchant is enabling kiosk or BNPL, tell them *before* they plan go-live, not after: cards and wallets validate in sandbox as normal, but these have to be verified with their Paymob account manager or `support@paymob.com`. The Phase 3 exit criteria in `SKILL.md` ("only flip to Live after a full successful test run") is not achievable for these methods, so don't present a passing sandbox suite as clearing them. + +**Not confirmed either way — don't assume:** Apple Pay, Google Pay, and bank installments. (`README.md` notes bank installments are "Live IDs only," which points the same way, but confirm with `support@paymob.com` before telling a merchant whether they can test it.) Don't infer a sandbox path for any of these from the card/wallet sections above. + ## Using them 1. Make sure the Integration ID used in the Intention request is the **Test** version of the relevant payment method (Cards or Wallets), and that the Secret Key used is also Test mode — mismatched modes cause a 404 on intention creation (see `intention-api.md`).