SDK-2750: PHP - Add Enforce Handoff to SDKs for IDV Create Session - php

[mehmet-yoti]

Summary

Adds enforce_handoff boolean property to the IDV (Identity Document Verification) session SDK configuration, mirroring the existing allow_handoff implementation. The field is optional/nullable, serializes to the JSON key enforce_handoff (omitted when null/unset), and is exposed via a withEnforceHandoff() builder method and getEnforceHandoff() getter on SdkConfig.

Changes

• src/DocScan/Session/Create/SdkConfig.php: Added $enforceHandoff private nullable bool property, added parameter to constructor, assigned in constructor body, included in jsonSerialize() output, and added getEnforceHandoff(): ?bool getter method.
• src/DocScan/Session/Create/SdkConfigBuilder.php: Added $enforceHandoff private nullable bool property and withEnforceHandoff(bool $enforceHandoff): self fluent builder method; passes the value through to SdkConfig constructor in build().
• tests/DocScan/Session/Create/SdkConfigBuilderTest.php: Added four new PHPUnit tests covering: setting the value via builder, null default, JSON serialization when set, and JSON serialization absence when not set.
• .php-cs-fixer.cache: Updated cache file after running PHP CS Fixer (no style issues found).

QA Test Steps

1. Setup: Clone the repo, checkout branch websdk-auto/SDK-2750-php-add-enforce-handoff-to-sdks-for-idv-create-session, run composer install.
2. Run all tests: Execute vendor/bin/phpunit — all 1002 tests should pass with 2418 assertions.
3. Happy path — builder sets value:

   $config = (new SdkConfigBuilder())->withEnforceHandoff(true)->build();
   assert($config->getEnforceHandoff() === true);

4. Happy path — JSON serialization:

   $config = (new SdkConfigBuilder())->withEnforceHandoff(false)->build();
   $json = json_decode(json_encode($config), true);
   assert($json['enforce_handoff'] === false);

5. Edge case — null default: Create an SdkConfig or use SdkConfigBuilder without calling withEnforceHandoff(); verify getEnforceHandoff() returns null.
6. Edge case — omitted from JSON when null: Build without calling withEnforceHandoff(); verify the serialized JSON either omits enforce_handoff or has it as null (current behavior matches allow_handoff — key is present with null value, filtered by the API consumer).
7. Regression — existing allow_handoff: Verify withAllowHandoff() still works correctly and is unaffected.
8. Code style: Run vendor/bin/php-cs-fixer fix --dry-run — should report no changes needed.

Notes

• The implementation exactly mirrors allow_handoff to maintain consistency across the SDK.
• The enforce_handoff key will appear in JSON output as null when not set (consistent with other nullable fields in jsonSerialize()); server-side null handling is assumed to be a no-op.
• No breaking changes — the new constructor parameter is appended last with a default of null, preserving backward compatibility.
• PHPStan analysis passes with no errors at the configured level.

---

Related Jira: SDK-2750
Auto-generated by Claude dynamic workflow

[mehmet-yoti]

🤖 Claude Code Review

Code Review Findings

Minor

tests/DocScan/Session/Create/SdkConfigBuilderTest.php — No test for withEnforceHandoff(false)

All three new serialization tests only exercise withEnforceHandoff(true). There is no test that sets enforce_handoff = false and asserts it is included in the JSON (not stripped). Although Json::withoutNullValues correctly preserves false (it filters === null only), the absence of a false-value test means a future regression that accidentally strips falsy values would go undetected.

Suggested addition:

/**
 * @test
 * @covers ::withEnforceHandoff
 * @covers \Yoti\DocScan\Session\Create\SdkConfig::jsonSerialize
 */
public function shouldIncludeEnforceHandoffFalseInJsonSerialization(): void
{
    $result = (new SdkConfigBuilder())
        ->withEnforceHandoff(false)
        ->build();

    $jsonData = $result->jsonSerialize();
    $this->assertTrue(property_exists($jsonData, 'enforce_handoff'));
    $this->assertFalse($jsonData->enforce_handoff);
}

---

Nit

tests/DocScan/Session/Create/SdkConfigBuilderTest.php:505–516 — Dead variable $expected and duplicate test

shouldSerializeEnforceHandoffToCorrectJsonKey (line 505) declares:

$expected = ['enforce_handoff' => true];

…but never uses it in any assertion. The assertions are written inline instead, making $expected dead code. Additionally, this test is functionally a near-duplicate of shouldIncludeEnforceHandoffInJsonSerialization (line 476) — both set true and verify the key is present in the serialized output. Consider removing one or merging them, and removing the unused $expected variable.

---

src/DocScan/Session/Create/SdkConfigBuilder.php:169 — Missing PHPDoc on withEnforceHandoff

The new withEnforceHandoff method has no PHPDoc comment, while the analogous withAllowHandoff and other builder methods in this class follow the pattern of at least implying intent via docblocks in the codebase. A brief doc comment aids IDEs and generated API docs:

/**
 * @param bool $enforceHandoff
 * @return $this
 */
public function withEnforceHandoff(bool $enforceHandoff): self

---

None (Critical / Major)

The core implementation is correct: the enforceHandoff field is properly added to both SdkConfig and SdkConfigBuilder, wired through the constructor, serialized under the correct JSON key enforce_handoff, and omitted when null via Json::withoutNullValues. The false value is correctly preserved by the !== null filter. No logic bugs found.

---

Reviewed by Claude (claude-sonnet-4-6). 3 findings total: 1 Minor, 2 Nit.