Feature: Redesign and refactor admin settings

[justelis22]

Self-Checks

• I have performed a self-review of my code.
• I have updated/added necessary technical documentation in the README file.

JIRA task link

Summary

QA Checklist Labels

• Bug fix?
• New feature?
• Improvement?
• Technical debt?
• Reusable?
• Covered by tests?

QA Checklist

Additional Context

Frontend Changes

[gemini-code-assist]

Code Review

This pull request migrates the Saferpay admin settings to a React-based single-page application, consolidating the fields and payment controllers into a unified settings controller driven by AJAX. It also introduces a new capture behavior when 3D Secure fails, improves accessibility across front-end templates, and adds explicit credential-based API methods. The review identified a critical security vulnerability where AJAX actions bypass PrestaShop's native permission checks, an undefined variable bug in the notification controller, and a regression in API error logging that suppresses HTTP error responses. Additionally, an optimization was suggested for the build process to exclude all React development files from the production ZIP.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

By bypassing parent::postProcess() for AJAX requests, the controller completely skips PrestaShop's native permission checks (such as verifying if the logged-in employee has edit permissions for this controller). This allows any employee with basic view access to perform state-changing actions like saving credentials, changing payment methods, or deleting saved credit cards.

Please explicitly verify that the employee has edit permissions before executing any state-changing AJAX actions.

        if (!$this->validateAjaxToken()) {
            $this->ajaxResponse(false, $this->module->l('Invalid security token', self::FILE_NAME));
            return;
        }

        $action = Tools::getValue('action');
        if (!$action || !in_array($action, self::ALLOWED_AJAX_ACTIONS)) {
            $this->ajaxResponse(false, $this->module->l('Invalid action', self::FILE_NAME));
            return;
        }

        // State-changing actions require 'edit' permission
        $stateChangingActions = [
            'saveCredentials',
            'savePaymentProcessing',
            'saveEmailSettings',
            'saveGeneralSettings',
            'savePaymentMethods',
            'generateFieldAccessToken',
        ];
        if (in_array($action, $stateChangingActions) && !$this->access('edit')) {
            $this->ajaxResponse(false, $this->module->l('You do not have permission to edit these settings.', self::FILE_NAME));
            return;
        }

[gemini-code-assist]

The variable $transactionStatus is used on line 175, but it is never defined in this controller. This will trigger an Undefined variable notice/error in PHP and break the notification callback when the payment behavior is set to capture without 3D Secure.

Please retrieve the transaction status from $assertResponseBody before using it.

            $paymentBehaviorWithout3D = (int) Configuration::get(SaferPayConfig::PAYMENT_BEHAVIOR_WITHOUT_3D);
            $transactionStatus = $assertResponseBody->getTransaction()->getStatus();

[gemini-code-assist]

By wrapping the error logging in if ($response === null), any API errors where a response was actually received (e.g., HTTP 400 or 500 errors) will no longer be logged. This is a major regression in error monitoring.

To prevent the original null pointer exception while preserving full error logging, safely check if $response is not null when decoding the body.

            $this->logger->error($exception->getMessage(), [
                'context' => [
                    'headers' => $this->getHeaders(),
                ],
                'request' => $params,
                'response' => $response ? json_decode($response->raw_body) : null,
                'exceptions' => ExceptionUtility::getExceptions($exception),
            ]);

[gemini-code-assist]

Similar to the get method, wrapping the error logging in if ($response === null) disables logging for all API errors where a response was received. Please log the error in both cases, safely handling the response.

            $this->logger->error($exception->getMessage(), [
                'context' => [],
                'request' => $params,
                'response' => $response ? json_decode($response->raw_body) : null,
                'exceptions' => ExceptionUtility::getExceptions($exception),
            ]);

[gemini-code-assist]

Similar to the other methods, wrapping the error logging in if ($response === null) disables logging for all API errors where a response was received. Please log the error in both cases, safely handling the response.

            $this->logger->error($exception->getMessage(), [
                'context' => [],
                'request' => $params,
                'response' => $response ? json_decode($response->raw_body) : null,
                'exceptions' => ExceptionUtility::getExceptions($exception),
            ]);

[gemini-code-assist]

Instead of deleting only node_modules and src directories, the entire views/js/admin/settings-app directory should be deleted during prepare-zip. The production module ZIP only needs the built assets in views/js/admin/dist/ and does not require any of the development configuration files (such as package.json, tsconfig.json, vite.config.ts, etc.). This keeps the production package clean and reduces the ZIP size.

	rm -rf views/js/admin/settings-app && \