>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3619100. --> Reported by: [mably](https://www.drupal.org/user/3375160) Related to !51 >>> <p>A full audit of the module before the next alpha, covering duplicated logic, security, performance, documentation and translations. Four findings, all fixed here.</p> <h3>The three movements were one type written three times</h3> <p>A clone detector over production code found 79 duplicated blocks, and almost all of them were the same thing: <code>RefundInterface</code> and <code>ReversalInterface</code> declared identical method sets, ten methods with the same names and the same three <code>STATE_*</code> constants, while <code>ClaimInterface</code> added exactly one, <code>isFinal()</code>. The entity classes differed only in docblock wording; every accessor body was byte-identical. The tell was <code>getLatestMovement()</code> returning <code>ClaimInterface|RefundInterface|ReversalInterface</code>, a three-way union standing in for a type nobody had written.</p> <p>So <code>MovementInterface</code> now holds the shared contract and the three extend it, and <code>Entity\Movement</code> holds the accessors and the field construction, with each subclass saying only what it is for through <code>describeFields()</code>. That is 758 lines removed with no behaviour change: the field sets are byte-identical per entity, so storage does not move and nothing needs reinstalling.</p> <p>Two things are deliberately not shared, and a later sweep should not "fix" them. <code>label()</code> stays on each entity, because a template taking the noun as a placeholder would leave that noun untranslated and cannot carry a language's own word order: French reads "Remboursement n&deg; 12", not "Refund #12". And the three stay separate entity types, because a claim, a refund and a reversal are counted and queried separately, and one table with a discriminator would make every per-kind total a filtered scan.</p> <h3>The docs documented a method that no longer exists</h3> <p><span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/kessai/-/work_items/3619065" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/kessai/-/work_items/3619065</a></span> renamed <code>defaultDeadline()</code> to <code>getDefaultDeadline()</code> and four doc references survived it, in <code>gateways.md</code> twice, <code>architecture.md</code> and <code>worldline.md</code>. One of them is the code example that shows implementers how to write a gateway, so anyone copying it wrote a method the engine never calls.</p> <h3>metrics.md was fifteen days stale</h3> <p>Dated 2026-08-10 and predating three merged issues. Regenerated; it reaches a fixed point on the first pass, which matters because the page counts itself.</p> <h3>WorldlineClientFactoryInterface had no @api marker</h3> <p>Every other public interface carried one. It is swappable on purpose, since pointing <code>kessai_worldline.client_factory</code> at another class is how a deployment sources its credentials from somewhere this module does not know about. That is now said out loud rather than left to be inferred.</p> <h3>Audited and found clean</h3> <p><strong>Security.</strong> Every token comparison uses <code>hash_equals</code>, and tokens are HMAC over the site hash salt. The webhook verifies its signature over the raw body before trusting anything, and acknowledges an unconfigured endpoint with 200 and a logged warning rather than letting the provider retry forever. No secret reaches a log line, and there is no raw SQL anywhere: every read is an entity query.</p> <p><strong>Performance.</strong> No N+1: the only queries inside loops are batch <code>loadMultiple()</code> calls. <code>getLatestMovement()</code> reads a single indexed row through <code>range(0, 1)</code> rather than sorting a history. Two declared indexes cover both hot paths, the subject-scoped lookup and cron's due-payment sweep, and the movement tables rely on core's own index over an entity reference's target column.</p> <p><strong>Translations.</strong> 175 msgids across five files, with zero orphans and zero untranslated source strings, checked in both directions before and after the refactor.</p> <p><strong>Config schema.</strong> Every shipped key is covered, 2 of 2 and 12 of 12; the views and audit_trail configs are schema'd by the modules that own them.</p> <p><strong>Coverage.</strong> Four classes are never named in a test, and all four are exercised by behaviour: the requirements hook through <code>class_resolver</code>, the views hook through its installed config, the plugin manager through its service id, and the abstract gateway exception through 39 references to its two subclasses.</p> <p>The next-major lane had also never been played on <code>1.x</code>, only on merge requests. It has been now, and it is green.</p> <p>AI-Generated: Yes (Claude Code was used to run the audit, draft this summary and write the refactor on the merge request. I reviewed and ran the work myself before posting it.)</p>