SDK-2801: PHP - Remove the API for AML check in connect - php

[mehmet-yoti]

Summary

Removes the AML (Anti-Money-Laundering) check API from the yoti-php-sdk as the underlying endpoint has been decommissioned. This is a breaking change that eliminates the entire `Aml` namespace, the `performAmlCheck()` method on `YotiClient`, and all associated example code. The version has been bumped to 4.6.0 to signal the breaking change.

Changes

• Deleted `src/Aml/` — Removed `Address.php`, `Country.php`, `Profile.php`, `Result.php`, `Service.php`
• Deleted `src/Exception/AmlException.php` — AML-specific exception class removed
• Modified `src/YotiClient.php` — Removed `performAmlCheck()` method and all related imports
• Deleted `examples/aml-check/` — Removed entire example application (bootstrap, env config, sample scripts, README)
• Deleted `tests/Aml/` — Removed all five AML test files (`AddressTest`, `CountryTest`, `ProfileTest`, `ResultTest`, `ServiceTest`)
• Modified `tests/YotiClientTest.php` — Removed AML-related test cases; added `testPerformAmlCheckMethodDoesNotExist()` to assert the method is gone
• Modified `tests/Http/RequestSignerTest.php` — Updated key file references from `aml-check-{private,public}-key.pem` to `signing-{private,public}-key.pem`
• Renamed sample key files — `tests/sample-data/aml-check-private-key.pem` → `signing-private-key.pem`, `aml-check-public-key.pem` → `signing-public-key.pem`
• Deleted `tests/sample-data/aml-check-result.json` — Removed AML sample response fixture
• Modified `composer.json` and `src/Constants.php` — Version bumped to 4.6.0
• Added `CHANGELOG.md` — Documents the breaking removal of the AML check API

QA Test Steps

1. Setup

   • Clone or update the repo and check out this branch
   • Run `composer install` to ensure dependencies are installed

2. Run the full test suite

   • Execute `vendor/bin/phpunit`
   • Confirm all 949 tests pass with 0 failures

3. Verify AML method removal

   • Confirm `YotiClient` has no `performAmlCheck` method: `grep -r 'performAmlCheck' src/` should return no results
   • The new test `testPerformAmlCheckMethodDoesNotExist` should pass and assert `method_exists(YotiClient::class, 'performAmlCheck') === false`

4. Verify namespace removal

   • Confirm `src/Aml/` directory no longer exists: `ls src/Aml/` should produce an error
   • Confirm `src/Exception/AmlException.php` is gone

5. Verify example removal

   • Confirm `examples/aml-check/` no longer exists

6. Verify key file renames

   • Confirm `tests/sample-data/signing-private-key.pem` and `signing-public-key.pem` exist
   • Confirm old `aml-check-{private,public}-key.pem` filenames are gone
   • Run `RequestSignerTest` specifically to confirm it passes with the renamed keys

7. Regression: Verify unrelated functionality

   • Test a standard Yoti token activity detail retrieval flow using the remaining SDK methods to ensure no unintended side effects

Notes

• This is a breaking change — any consumer code calling `YotiClient::performAmlCheck()` or using the `Yoti\Aml\` namespace will break after upgrading to 4.6.0
• The decommissioned AML endpoint is the root cause; there is no migration path or replacement endpoint
• The renamed key files (`signing-{private,public}-key.pem`) are functionally identical to the previous `aml-check-*` keys; they are simply repurposed for request signing tests

---

Related Jira: SDK-2801
Auto-generated by Claude dynamic workflow

[mehmet-yoti]

🤖 Claude Code Review

Code Review Findings

Major

tests/YotiClientTest.php — API URL resolution is now untested

Four tests that covered YotiClient's API URL logic were deleted in this PR (testDefaultApiUrl, testApiUrlOptionOverridesEnvironmentVariable, testApiUrlEnvironmentVariable, testEmptyApiUrlEnvironmentVariable). Those tests were only deleted because they used performAmlCheck() as the vehicle to trigger an HTTP call. The underlying logic they were testing — the env-var resolution at YotiClient::__construct() line 53 — is still present and untested:

$options[Config::API_URL] = $options[Config::API_URL] ?? Env::get(Constants::ENV_API_URL);

Scenario: A future change silently breaks env-var or option-override URL resolution for YotiClient (e.g. YOTI_API_URL being ignored) and there is no test to catch it.

Suggested fix: Add equivalent API-URL tests that drive through getActivityDetails() or createShareUrl() instead of the removed performAmlCheck().

---

Minor

src/Aml/Result.php (deleted) — on_fraud_list was never validated by checkAttributes()

The deleted Result::checkAttributes() had a copy-paste bug: ON_WATCH_LIST_KEY appeared twice in $expectedAttributes (lines 119–120) instead of ON_WATCH_LIST_KEY + ON_FRAUD_LIST_KEY. This meant a response missing on_fraud_list would silently pass validation; isOnFraudList() would then cast null to false. The associated test (testMissingAttributes) even encoded the wrong expected message (on_pep_list,on_watch_list,on_watch_list) confirming the bug was untested. The PR correctly removes all this code, so no action is needed — flagging for awareness only.

---

Nit

tests/YotiClientTest.php:107 — misleading @covers annotation

testPerformAmlCheckMethodDoesNotExist() is annotated with @covers ::__construct but never calls the constructor or exercises any constructor code path. The annotation should be removed (or changed to @covers ::performAmlCheck with a note that it checks non-existence).

// Current
/**
 * Asserts that the AML check method has been removed from the public API.
 *
 * @covers ::__construct   ← misleading
 */
public function testPerformAmlCheckMethodDoesNotExist()

// Suggested
/**
 * Asserts that the AML check method has been removed from the public API.
 */
public function testPerformAmlCheckMethodDoesNotExist()

---

Summary

The removal itself is clean — all Yoti\Aml\* classes, AmlException, performAmlCheck(), tests, sample data, and the example app are consistently gone. The version bump and CHANGELOG entry are correct. The only substantive concern is the gap left in API URL test coverage for YotiClient.