Issue #3587372 by plopesc: Add JWT v2 shared secret (HMAC HS256) authentication support

Pablo Lópezrequested to merge
issue/commerce_cybersource-3587372:3587372-add-jwt-v2 into 8.x-1.x

CyberSource is retiring the HTTP Signature authentication method in September 2026. This adds support for JWT v2 with HMAC HS256, signed using the existing shared-secret credentials so no new key material is required.

Key points:

  • New JwtV2ApiClient subclass overrides callAuthenticationHeader() to generate JWT v2 tokens. The official SDK only ships with RS256 (P12 certificate); the HS256 variant is implemented here using firebase/ php-jwt.
  • Flex gateway gains an "Authentication type" setting with the existing http_signature option and the new jwt_shared_secret option. Existing installations are migrated by a post_update hook that defaults the new field to http_signature.
  • Schema adds a Choice constraint on auth_type so configuration import rejects unknown values.
  • Flex.php uses setRunEnvironment() instead of setHost() so the merchant configuration's runEnvironment field is populated; the JWT request-host claim is read from there.
  • Per the CyberSource shared-secret JWT spec, request-method is sent in lowercase and exp is set to iat + 120 seconds (the maximum allowed).

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

Closes #3587372

Merge request reports