PunchOut cXML / OCI

The problem

Large B2B buyers order from their procurement system, not from your website. To sell to them, the shop must act as a PunchOut supplier: open a session from the procurement system, show the buyer's prices, and send the cart back to the purchase requisition.

Features

• cXML PunchOut: PunchOutSetupRequest (create, edit, inspect), ProfileRequest, cart transfer and cancel through PunchOutOrderMessage.
• Purchase orders: cXML OrderRequest turned into Sylius orders.
• SAP OCI 5.0: entry, return of the OCI fields to HOOK_URL, VALIDATE and DETAIL functions.
• Buyer's prices: the shopper is logged in as the Sylius customer linked to the buyer, in a dedicated cart isolated from the regular one.
• Requisitions: edit rebuilds the cart from the requisition, inspect shows it read only.
• Classification: UNSPSC codes and units of measure per product or taxon (inherited).
• Security: buyer secrets hashed with Argon2id, replay protection, rate limiting, return URL checked against the buyer's allowed domains (deny by default), session expiry; iframe support for SAP Ariba.
• Operations: buyer admin, exchange log, retention purge, GDPR erasure, diagnostic command, buyer simulator for testing.
• No third-party cXML library: documents are read and written with DOM.

Screenshots

Installation

1. composer require tmonier/sylius-punchout-cxml-plugin
2. Register Tmonier\SyliusPunchoutCxmlPlugin\TmonierSyliusPunchoutCxmlPlugin in config/bundles.php.
3. Import @TmonierSyliusPunchoutCxmlPlugin/config/config.yaml and the routes.
4. Run php bin/console doctrine:migrations:migrate.
5. Create a buyer in the admin (identities, secret, allowed return domains); see "Setting up a buyer" in the README.

Full documentation: README on GitHub.

Compatibility

Sylius 2.2.9+ and 2.3, PHP 8.2+ with ext-dom and ext-libxml; the shop must be reachable over HTTPS. Symfony 7.4 and 8.0; MySQL, MariaDB and PostgreSQL.

Languages

English, French, German, Spanish, Italian, Dutch, Polish.