SDK-2798: Go - Remove the API for AML check in connect - php

[mehmet-yoti]

Summary

Removes the decommissioned AML (Anti-Money Laundering) check API from the PHP SDK. The Connect AML service (/aml-check endpoint) has been decommissioned and all related code, tests, sample data, and examples have been deleted. The performAmlCheck() method has been removed from YotiClient and supporting tests have been refactored accordingly.

Changes

• src/Aml/ — Deleted entire directory: Address.php, Country.php, Profile.php, Result.php, Service.php
• src/Exception/AmlException.php — Deleted AML-specific exception class
• src/YotiClient.php — Removed performAmlCheck() method and related AML imports
• examples/aml-check/ — Deleted entire example directory (.env.dist, .gitignore, README.md, aml-check-usa.php, aml-check.php, bootstrap.php, composer.json, keys/.gitignore)
• tests/Aml/ — Deleted all AML unit tests: AddressTest.php, CountryTest.php, ProfileTest.php, ResultTest.php, ServiceTest.php
• tests/sample-data/ — Deleted aml-check-private-key.pem, aml-check-public-key.pem, aml-check-result.json
• tests/YotiClientTest.php — Removed AML-related test methods; refactored assertApiUrlStartsWith() to use createShareUrl()
• tests/Http/RequestSignerTest.php — Replaced AML key references with PEM_FILE
• tests/Profile/ActivityDetailsTest.php — Removed unused AML import
• tests/TestData.php — Removed AML test constants

QA Test Steps

1. Setup: Clone the repo and checkout websdk-auto/SDK-2798-php-remove-the-api-for-aml-check-in-connect, then run composer install.
2. Run tests: Execute vendor/bin/phpunit — all 952 tests should pass with no failures or errors.
3. Verify removal: Confirm src/Aml/ directory no longer exists and YotiClient has no performAmlCheck() method.
4. Check autoload: Run composer dump-autoload and confirm no references to Yoti\Aml or Yoti\Exception\AmlException in the generated autoload map.
5. Regression: Run vendor/bin/php-cs-fixer fix --dry-run to confirm no code style regressions.
6. Edge case: Search the codebase (grep -r 'AmlCheck\|AmlException\|performAmlCheck\|aml-check' src/ tests/ examples/) — confirm no remaining references.

Notes

• The AML check service was a Yoti Connect feature that has been officially decommissioned; this change reflects that on the SDK side.
• No API-breaking changes to any other YotiClient methods were made.
• The examples/aml-check/ directory and all its contents have been removed; any existing integrations relying on this example should be updated.
• All 952 remaining tests continue to pass after the removal.

---

Related Jira: SDK-2798
Auto-generated by Claude dynamic workflow

[mehmet-yoti]

Code Review Findings

This PR removes the decommissioned AML check API from the PHP SDK. The removal is clean and complete. Two findings surfaced during review.

---

Minor

tests/Http/RequestSignerTest.php:40-43 — Hand-rolled public-key PEM wrapper is fragile and unnecessary

The new setup() method reads a raw base64 blob from PEM_AUTH_KEY and manually reconstructs a PEM envelope:

$rawPublicKey = file_get_contents(TestData::PEM_AUTH_KEY);
$this->publicKey = "-----BEGIN PUBLIC KEY-----\n" .
    chunk_split($rawPublicKey, 64, "\n") .
    "-----END PUBLIC KEY-----\n";

chunk_split appends a trailing \n after the last chunk, meaning the PEM line count and line-length are correct only if strlen($rawPublicKey) is an exact multiple of 64. For this key (392 base64 chars = 6×64 + 8), the last chunk ends with the extra \n placed before -----END PUBLIC KEY-----\n, which happens to be valid; but the approach is error-prone for any future key rotation. The existing yw-access-security.pem is an RSA private key whose public component can be extracted directly:

$privKey = openssl_pkey_get_private(file_get_contents(TestData::PEM_FILE));
$this->publicKey = openssl_pkey_get_details($privKey)['key'];

This is self-consistent (the private and public key are provably the same key pair), needs no separate pem-auth-key.txt file, and removes the fragile manual wrapping.

---

Nit

src/Aml/Result.php (deleted) — pre-existing duplicate key in checkAttributes was never fixed before deletion

Lines 118-120 of the now-deleted src/Aml/Result.php contained:

$expectedAttributes = [
    self::ON_PEP_LIST_KEY,
    self::ON_WATCH_LIST_KEY,
    self::ON_WATCH_LIST_KEY,   // duplicated; should have been ON_FRAUD_LIST_KEY
];

ON_FRAUD_LIST_KEY was missing from the validation list, so a response that omitted on_fraud_list would have passed checkAttributes silently, and $this->onFraudList = (bool) $result[self::ON_FRAUD_LIST_KEY] would have evaluated to false rather than throwing. The deleted test even enshrined the wrong error message (on_pep_list,on_watch_list,on_watch_list). Since the entire Aml\ namespace is being deleted by this PR, no fix is needed — but worth noting for the historical record that the class had a latent validation gap.

---

Critical / Major

None.

---

Reviewed the diff across src/Aml/, src/Exception/AmlException.php, src/YotiClient.php, tests/Aml/, tests/Http/RequestSignerTest.php, tests/Profile/ActivityDetailsTest.php, tests/TestData.php, tests/YotiClientTest.php, and examples/aml-check/. No remaining AML references found in src/ or tests/.

🤖 Generated with Claude Code

[mehmet-yoti]

Closing — this ticket (SDK-2798, titled "Go - ...") was mistakenly processed against the php SDK due to a static TRIAGE_SDK_FILTER=php misconfiguration in the auto-PR pipeline, not because php was the intended target. Fixing the pipeline to auto-detect the SDK from the ticket title.