WBAMS is extended by modules. An addon module adds a feature and its own administration pages; a gateway module takes money. They are separate contracts and are configured in different places.

Addon modules

An addon lives in its own directory under the extensions tree, declares its configuration, and is activated from Settings. Once active it can add administration pages, register hooks, define permissions and create its own tables.

Configuration
Declared by the module and rendered by the product, so the settings form is generated rather than written.
Access
An addon declares which administrator roles may use it. Grant access deliberately; the default is not access for everyone.
Schema
A module that needs tables creates them on activation and is responsible for them thereafter. The product’s own migrations do not touch them.
Hooks
An addon’s hooks file is loaded through the hook cache. See Hooks.

Gateway modules

A gateway module implements one payment provider. WBAMS ships 67 of them. A gateway declares its configuration fields, renders the payment step, and receives the provider’s callback.

Callbacks are the part that breaks

A gateway callback is an unauthenticated request from a third party. It must verify the message is genuinely from the provider before acting on it, using whatever signature or verification call the provider offers.

Never trust a callback because it names a valid invoice.

Anyone can post an invoice ID. Verify the message against the provider before recording a payment.

  1. Confirm the callback URL the provider holds matches the System URL currently configured.
  2. Read the gateway log to see what actually arrived, rather than what the provider’s dashboard says it sent.
  3. Check the module log for what the module did with it.

Provider vocabulary is not yours to change

Payment providers define their own event names and status values, and WBAMS uses them verbatim. PayPal’s BILLING.SUBSCRIPTION.CANCELLED and GoCardless’s cancelled mandate state keep the provider’s spelling even though WBAMS itself now uses Canceled. Respelling one of these to match house style stops the events matching.

Logging

Modules log their requests and responses to the module log. Log enough to diagnose a failure without logging credentials, card data or full customer records. A module that logs nothing is a module you cannot support.

Retiring a module

Deactivate the module before removing its files, so the product stops calling it. A module whose files are deleted while still active produces fatal errors on the pages that expected it, not a graceful absence.