@@ -29,85 +29,220 @@ interface EbicsClientInterface
2929 public const FILE_PARSER_FORMAT_ZIP_FILES = 'zip_files ' ;
3030
3131 /**
32- * Create user signatures A, E and X on first launch.
32+ * Create user signatures A (Authorization), E (Encryption), and X (Authentication) on first launch.
33+ *
34+ * EBICS Protocol Context:
35+ * This method initializes the cryptographic key pairs required for EBICS communication.
36+ * It generates three types of signatures:
37+ * - Signature A (A005/A006): Used for authorization/order signing
38+ * - Signature E (E002): Used for encryption of order data
39+ * - Signature X (X002): Used for authentication of requests
40+ *
41+ * The method should be called once during initial setup before any EBICS transactions.
42+ * It creates the key pairs and stores them in the keyring for subsequent use.
43+ *
3344 * @param array<string, mixed>|null $options Setup to specify custom certificate, private, public keys and version
34- * for Electronic Signature, Authorization and Identification, Encryption details.
45+ * for Electronic Signature (E), Authorization and Identification (A), Encryption details.
46+ * Supported options:
47+ * - 'x509_generator': Custom X509GeneratorInterface implementation
48+ * - 'signature_a_version': Version for signature A (A005 or A006)
49+ * - 'signature_e_version': Version for signature E (E002)
50+ * - 'signature_x_version': Version for signature X (X002)
51+ * - 'certificate': Custom X.509 certificate
52+ * - 'private_key': Custom private key
53+ * - 'public_key': Custom public key
3554 */
3655 public function createUserSignatures (?array $ options = null ): void ;
3756
3857 /**
39- * Generate certificate for issuer.
40- * @return array
58+ * Generate X.509 certificate for issuer (certificate authority).
59+ *
60+ * EBICS Protocol Context:
61+ * Creates a self-signed X.509 certificate that can be used as the issuer certificate
62+ * for signing user certificates in the EBICS protocol. This is part of the certificate
63+ * infrastructure required for secure EBICS communication with certified banks.
64+ *
65+ * The certificate is used in the INI/HIA/H3K initialization processes.
66+ *
67+ * @return array Certificate data array containing:
68+ * - 'certificate': The X.509 certificate in PEM format
69+ * - 'private_key': The corresponding private key
70+ * - 'public_key': The corresponding public key
4171 */
4272 public function generateIssuerCertificate (): array ;
4373
4474 /**
45- * Execute Initialization Order.
46- * @param InitializationOrderInterface $order
47- * @return InitializationOrderResult
75+ * Execute an EBICS initialization order.
76+ *
77+ * EBICS Protocol Context:
78+ * Initialization orders are used during the initial setup phase with the bank to exchange
79+ * cryptographic keys and certificates. These orders establish the trust relationship
80+ * between the client and the bank.
81+ *
82+ * The typical initialization sequence is: INI → HIA → HPB (or H3K → HPB for version 3.0).
83+ *
84+ * @param InitializationOrderInterface $order The initialization order to execute
85+ *
86+ * @return InitializationOrderResult Result containing order execution status and any returned data
4887 */
4988 public function executeInitializationOrder (InitializationOrderInterface $ order ): InitializationOrderResult ;
5089
5190 /**
52- * Execute Standard Order.
53- * @param StandardOrderInterface $order
54- * @return StandardOrderResult
91+ * Execute an EBICS standard order.
92+ *
93+ * EBICS Protocol Context:
94+ * Standard orders are used for general information retrieval and administrative tasks.
95+ * These orders do not involve file transfer and typically return metadata or status information.
96+ *
97+ * Supported standard order types:
98+ * - HEV: Get supported EBICS protocol versions from the bank
99+ * - HPD: Download server parameters (bank capabilities and configuration)
100+ * - HKD: Download customer information (account details, partner data)
101+ * - HTD: Download subscriber information (user permissions and settings)
102+ * - HAA: Download available order types that the customer is authorized to use
103+ * - PTK: Download transaction status report in plain text format
104+ * - HAC: Download transaction status report in XML format
105+ *
106+ * Standard orders follow the request-response pattern without file segmentation.
107+ *
108+ * @param StandardOrderInterface $order The standard order to execute
109+ *
110+ * @return StandardOrderResult Result containing order execution status and returned data
55111 */
56112 public function executeStandardOrder (StandardOrderInterface $ order ): StandardOrderResult ;
57113
58114 /**
59- * Execute Download Order.
60- * @param DownloadOrderInterface $order
61- * @return DownloadOrderResult
115+ * Execute an EBICS download order.
116+ *
117+ * EBICS Protocol Context:
118+ * Download orders are used to retrieve files and data from the bank. The download process
119+ * follows a multi-phase transaction model:
120+ *
121+ * 1. Initialization Phase: Client requests download with order type and date range
122+ * 2. Distribution Phase: Bank prepares the requested data
123+ * 3. Retrieval Phase: Client retrieves the data in segments (if large)
124+ * 4. Receipt Phase: Client confirms successful receipt (optional for some order types)
125+ *
126+ * The order data may be compressed (ZIP), encrypted, and split into multiple segments
127+ * for large files. The client handles automatic decompression and reassembly.
128+ *
129+ * @param DownloadOrderInterface $order The download order to execute
130+ *
131+ * @return DownloadOrderResult Result containing downloaded order data, transaction details, and file contents
62132 */
63133 public function executeDownloadOrder (DownloadOrderInterface $ order ): DownloadOrderResult ;
64134
65135 /**
66- * Execute Upload Order.
67- * @param UploadOrderInterface $order
68- * @return UploadOrderResult
136+ * Execute an EBICS upload order.
137+ *
138+ * EBICS Protocol Context:
139+ * Upload orders are used to send files and data to the bank. The upload process
140+ * follows a multi-phase transaction model:
141+ *
142+ * 1. Initialization Phase: Client sends upload request with order metadata
143+ * 2. Transfer Phase: Client uploads the order data (may be segmented for large files)
144+ * 3. Receipt Phase: Bank confirms receipt with transaction status
145+ *
146+ * The order data is automatically compressed and may be encrypted before transmission.
147+ * Large files are automatically segmented according to EBICS protocol limits.
148+ *
149+ * @param UploadOrderInterface $order The upload order to execute
150+ *
151+ * @return UploadOrderResult Result containing upload transaction status and bank receipt
69152 */
70153 public function executeUploadOrder (UploadOrderInterface $ order ): UploadOrderResult ;
71154
72155 /**
73- * Get Keyring.
156+ * Get the keyring containing cryptographic keys and certificates.
157+ *
158+ * EBICS Protocol Context:
159+ * The keyring stores all cryptographic materials required for EBICS communication:
160+ * - User signatures (A, E, X) - key pairs for authorization, encryption, and authentication
161+ * - Bank signatures - bank's public keys received via HPB order
162+ * - X.509 certificates - for certified EBICS communication
163+ * - Transaction keys - AES keys for encrypting order data
164+ *
165+ * The keyring should be persisted between sessions using a KeyringManager.
74166 *
75- * @return Keyring
167+ * @return Keyring The keyring object containing all signatures and certificates
76168 */
77169 public function getKeyring (): Keyring ;
78170
79171 /**
80- * Get Bank .
172+ * Get the bank configuration and connection details .
81173 *
82- * @return Bank
174+ * EBICS Protocol Context:
175+ * The Bank object contains:
176+ * - Host ID: Unique identifier for the EBICS server
177+ * - URL: Endpoint URL for EBICS communication
178+ * - Country code: Bank's country code for protocol-specific behavior
179+ *
180+ * @return Bank The bank configuration object
83181 */
84182 public function getBank (): Bank ;
85183
86184 /**
87- * Get User.
185+ * Get the user (subscriber) configuration.
186+ *
187+ * EBICS Protocol Context:
188+ * The User object represents an EBICS subscriber (participant) and contains:
189+ * - Partner ID: Identifies the contracting partner with the bank
190+ * - User ID: Identifies the specific user/subscriber within the partner
191+ *
192+ * Together with the Bank, this forms the unique identification for EBICS sessions.
88193 *
89- * @return User
194+ * @return User The user configuration object
90195 */
91196 public function getUser (): User ;
92197
93198 /**
94- * Get response handler for manual process response.
199+ * Get the response handler for manual response processing.
200+ *
201+ * EBICS Protocol Context:
202+ * The ResponseHandler provides access to the raw XML response from the bank,
203+ * allowing custom processing of:
204+ * - Response codes and messages
205+ * - Transaction IDs
206+ * - Order data extraction
207+ * - Error handling and diagnostics
208+ *
209+ * This is primarily useful for advanced use cases requiring direct access
210+ * to the EBICS response structure.
95211 *
96- * @return ResponseHandler
212+ * @return ResponseHandler The response handler object
97213 */
98214 public function getResponseHandler (): ResponseHandler ;
99215
100216 /**
101- * Check keyring is valid.
217+ * Validate that the keyring contains valid and complete cryptographic material .
102218 *
103- * @return bool
219+ * EBICS Protocol Context:
220+ * Checks whether the keyring has all required signatures and certificates
221+ * for EBICS communication. This includes verification of:
222+ * - User signature A (authorization) - required for signed orders
223+ * - User signature E (encryption) - required for encrypted orders
224+ * - User signature X (authentication) - required for all orders
225+ * - Bank signatures - required for verifying bank responses
226+ *
227+ * Should be called after initial setup or when loading a persisted keyring
228+ * to ensure the client is ready for EBICS communication.
229+ *
230+ * @return bool True if keyring is valid, false if initialization is needed
104231 */
105232 public function checkKeyring (): bool ;
106233
107234 /**
108- * Change password for keyring.
235+ * Update the encryption password for the keyring storage.
236+ *
237+ * EBICS Protocol Context:
238+ * The keyring password is used to encrypt the private keys when persisting
239+ * them to storage (file, database, etc.). This method allows changing
240+ * the password without regenerating the cryptographic key pairs.
241+ *
242+ * Important: This does NOT change the EBICS signatures known to the bank.
243+ * It only changes the local storage encryption password.
109244 *
110- * @param string $newPassword
245+ * @param string $newPassword The new encryption password for keyring storage
111246 *
112247 * @return void
113248 */
0 commit comments