Wire-contract parity: per-call host resolution, sync checkout_decide, and dropoff_latitude

[tomas-amaro]

What this is

Wire-contract parity fixes for the PHP SDK, derived from the language-neutral
Riskified contract corpus and audited against the C# reference implementation
(Riskified/sdk_net @ 9165cf5). Two commits, production source plus regression
tests.

Changes

Sticky host selection (data-leak class)

AbstractTransport::$url was reassigned in place by decideOrder, eligible, opt_in and all eight account methods, and never restored. Once an instance called login(), every later call on it — including submitOrder() — went to api.riskified.com, silently cross-posting order data to the Account Secure host.

The host family is now scoped to the single call that asked for it (on_host()), and endpoint_prefix() resolves the host through host() per request. $url is written only by the constructor. The public API is unchanged: no constructor, method name, or signature moved.

checkout_decide() posted to the wrong production host

It posts to /api/decide, and the C# reference has exactly one /api/decide call site, unconditionally FlowStrategy.Sync (Orders/OrdersGateway.cs:142). In production it was posting to wh.riskified.com; sandbox is unaffected, having no sync host. Cross-checking every PHP endpoint against the full BuildUrl inventory turned up no other unwrapped call to a path an on_host() family serves.

dropoff_latitude — reverted, this SDK was already correct

An earlier revision of this branch renamed LineItem's dropoff_latitude to the transposed dropoff_latitiude, and added a $_field_aliases mechanism to AbstractModel so the correct spelling kept working as a deprecated input name. Both have been reverted.

The rename rested on a contract-corpus claim that the transposition was the live wire name, on the grounds that the reference C# SDK sends it. That inference was wrong:

• Both OpenAPI specs declare dropoff_latitude, with a description and an example. The transposed spelling appears in neither, nor anywhere else in the reference export.
• It occurs exactly once in all of sdk_net (OrderElements/RideTicketLineItem.cs:100), with no test covering it, while pickup_latitude (:89) and dropoff_longitude (:104) in the same class are spelled correctly.

So the transposition is a defect in the C# SDK, not the contract. This SDK had the name right; the rename would have broken a field that worked, and the alias existed only to soften that break. AbstractModel is restored to master — the resolve_field() indirection and the E_USER_DEPRECATED path had exactly one consumer, so keeping them would leave dead code rather than a general facility.

The corpus has been corrected in Riskified/sdk-orchestrator.

Tests

• tests/OrderWebhook/Transport/HostSelectionTest.php, with a RecordingTransport double that records the URL each call would have used.
• tests/OrderWebhook/Model/LineItemTest.php — asserts dropoff_latitude is the emitted key and dropoff_latitiude is not, that the transposed name is rejected as an unknown property, and that all four ride geolocation fields use their contract names. Guarded in both directions, since this branch pinned it the wrong way once.

Both are reported to fail at c0b0f87.

Deliberately unchanged

Null handling and the always-emitted defaults, the vendor Accept header, api-version, hash_equals, old_status, error parsing, retries and timeouts.

An order serialized before and after this branch is byte-identical: no payload key changes in either direction. (An earlier revision of this branch changed one — dropoff_latitude → dropoff_latitiude — and that has been reverted.)

Reviewer notes

• Branch is based on c0b0f87 and is one commit behind master (3b6652e). It merges cleanly.
• The test suite was not executed in the environment where these commits were authored; please let CI be the judge.

🤖 Generated with Claude Code