qa-payment
Payment platform sandbox testing: Stripe test cards + webhooks, Adyen test mode, PayPal sandbox, Braintree test cards; 3DS test flow + PCI DSS scope + payment flow states references; refund + chargeback + webhook-replay builders. Distinct from qa-compliance/pci-dss-control-test-author (compliance / scope verification); this plugin is platform-specific sandbox testing + payment flow state matrices.
Install this plugin
/plugin install qa-payment@testland-qaPart of role bundle: qa-role-backend
qa-payment
Payment platform testing: Stripe test cards + webhooks, Stripe subscription billing test clocks, the Adyen / PayPal / Braintree sandbox umbrella, the payment lifecycle state-machine + 3DS flow reference, and the refund / dispute / webhook-replay suite-authoring workflow. Distinct from qa-compliance/pci-dss-control-test-author (PCI DSS scope + control verification - the PCI scope catalog now lives there as references/pci-scope.md); this plugin is platform-specific sandbox testing + payment flow suites.
Components
| Type | Name | Description |
|---|---|---|
| Skill | stripe-test-cards-and-webhooks | Stripe test-mode: canonical test cards + webhook signing and replay. |
| Skill | stripe-subscription-billing-test-author | Tests recurring-billing flows: trials, proration, dunning, cancel/reactivate, via Stripe Billing test clocks. |
| Skill | payment-gateway-sandboxes | Vendor-generic sandbox pattern with per-gateway references for Adyen, PayPal, and Braintree. |
| Skill | payment-flow-states-reference | Pure reference: payment lifecycle state machines across gateways + EMVCo 3DS 2.x flows. |
| Skill | payment-flow-test-author | Build-an-X suite for refunds, chargebacks/disputes, and webhook replay via gateway-native simulators. |
| Agent | payment-flow-critic | Adversarial read-only reviewer: flags missing idempotency keys, unverified webhook signatures, PAN/CVV in logs, unhandled requires_action/3DS states, and double-charge race risk. Emits per-finding severity + BLOCK/PASS verdict. |
PCI DSS scope guidance (SAQ levels, PAN-storage rules, scope-reduction patterns) moved to qa-compliance/pci-dss-control-test-author.
Install
/plugin marketplace add testland/qa
/plugin install qa-payment@testland-qaSkills
payment-flow-states-reference
Pure-reference catalog of payment lifecycle state machines across Stripe, Adyen, PayPal, and Braintree: canonical states (created / requires_action / processing / succeeded / requires_capture / canceled / failed), authorisation vs capture, asynchronous webhook states, refund / dispute / chargeback transitions, and the 3-D Secure (EMVCo 3DS 2.x) frictionless / challenge flow paths with per-gateway 3DS test cards (references/3ds-flows.md). Use when designing tests for payment flows, auditing state-handling code, or covering a 3DS round-trip; this is the state model, not a builder - to author suites on it use payment-flow-test-author (refunds, disputes, webhook replay).
payment-flow-test-author
Build-an-X workflow that authors the full payment-flow test suite in three phases: the refund matrix (full / partial / multiple-partials / over-refund / already-refunded, per-gateway APIs for Stripe, Adyen, PayPal, Braintree), the chargeback / dispute suite (Visa + Mastercard reason codes, evidence submission windows, won / lost / accepted dispositions), and webhook replay + recovery via gateway-native simulators (Stripe CLI trigger / resend, Adyen Customer Area resend, PayPal Webhook Simulator, Braintree sampleNotification). Driven by the state model in payment-flow-states-reference. Use when building refund, dispute, or payment-webhook-robustness coverage for a payment integration; for generic (non-payment) webhook receiver testing use webhook-delivery-tester in the qa-notifications plugin.
payment-gateway-sandboxes
Wraps the vendor-generic payment-gateway sandbox pattern - test credentials, sandbox base URLs / environment switches, deterministic test-card matrices, and gateway-native webhook simulators - with per-gateway references for Adyen test mode, PayPal Sandbox, and Braintree sandbox. Use when testing code integrated with Adyen, PayPal, or Braintree; for Stripe use stripe-test-cards-and-webhooks (one-time payments) or stripe-subscription-billing-test-author (recurring billing).
stripe-subscription-billing-test-author
Builds test suites for Stripe recurring-billing flows: trial-to-paid conversion, proration on plan upgrade and downgrade, dunning on failed renewal, cancel and reactivation, and the full subscription webhook event matrix (invoice.payment_failed, customer.subscription.updated, customer.subscription.deleted, invoice.paid). Uses Stripe Billing test clocks (POST /v1/test_helpers/test_clocks) to time-travel through billing cycles without calendar delay. Distinct from stripe-test-cards-and-webhooks (one-time PaymentIntents) and payment-flow-test-author (idempotency + replay robustness). Does not cover single-event CLI replay or handler idempotency testing (see payment-flow-test-author for those). Use when authoring tests for subscription or recurring-billing integrations.
stripe-test-cards-and-webhooks
Wraps Stripe API testing patterns: test-mode initialization, the canonical test cards (4242 success; 4000 0000 0000 0002 declined; 4000 0027 6000 3184 3DS challenge per the 3DS flows reference in payment-flow-states-reference), the Stripe CLI webhook flow (`stripe listen --forward-to`), the Stripe CLI fixture commands (`stripe trigger payment_intent.succeeded`), and the webhook signature verification (Stripe-Signature header + HMAC-SHA256). Use when testing Stripe-integrated code.