Improve VoP polling flow and TAN response detection in approve_vop_response

1. Implement VoP polling (FinTS spec E.8.3.1): when the bank returns
   HIVPP with a polling_id but no vop_id, re-send HKVPP with
   polling_id + aufsetzpunkt (from HIRMS 3040) until the VoP check
   resolves and a vop_id is returned.

2. Broaden 3945 response code detection in VoP flow: check all
   HIRMG/HIRMS segments, not just tan_seg responses, since some banks
   attach it to different segments.

3. Add TAN fallback in approve_vop_response: after VoP approval,
   check command_seg and global HIRMG/HIRMS segments for 0030/3955
   TAN-required codes (mirrors Fix 4 from PR raphaelm#210 but in the VoP
   approval path).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Arlind

fints/client.py

@@ -28,7 +28,7 @@
     PinTanTwoStepAuthenticationMechanism,
 )
 from .segments.accounts import HISPA1, HKSPA1
-from .segments.auth import HIPINS1, HKTAB4, HKTAB5, HKTAN2, HKTAN3, HKTAN5, HKTAN6, HKTAN7, HIVPPS1, HIVPP1, PSRD1, HKVPA1
+from .segments.auth import HIPINS1, HKTAB4, HKTAB5, HKTAN2, HKTAN3, HKTAN5, HKTAN6, HKTAN7, HIVPPS1, HIVPP1, HKVPP1, PSRD1, HKVPA1
 from .segments.bank import HIBPA3, HIUPA4, HKKOM4
 from .segments.debit import (
     HKDBS1, HKDBS2, HKDMB1, HKDMC1, HKDME1, HKDME2,
@@ -1447,11 +1447,16 @@ def _send_pay_with_possible_retry(self, dialog, command_seg, resume_func):
         - 'RVNM' - no match, no extra info seen
         - 'RVNA' - check not available, reason in single_vop_result.na_reason
         - 'PDNG' - pending, seems related to something not implemented right now.
+
+        VoP polling flow (FinTS spec E.8.3.1):
+        Some banks return HIVPP with no vop_id but a polling_id and code 3040:aufsetzpunkt.
+        The client must poll by re-sending HKVPP with polling_id + aufsetzpunkt (without
+        HKCCS/HKTAN) until the bank returns HIVPP with a vop_id and the actual VoP result.
+        After that, the client sends HKVPA + HKCCS + HKTAN to authorize.
         """
         vop_seg = []
         vop_standard = self._find_vop_format_for_segment(command_seg)
         if vop_standard:
-            from .segments.auth import HKVPP1
             vop_seg = [HKVPP1(supported_reports=PSRD1(psrd=[vop_standard]))]
 
         with dialog:
@@ -1464,9 +1469,52 @@ def _send_pay_with_possible_retry(self, dialog, command_seg, resume_func):
                 if vop_standard:
                     hivpp = response.find_segment_first(HIVPP1, throw=True)
 
+                    # Check if VOP polling is required: HIVPP has no vop_id but has polling_id
+                    if not hivpp.vop_id and hivpp.polling_id:
+                        # Extract aufsetzpunkt from HIRMS 3040 response
+                        aufsetzpunkt = None
+                        for hirms_seg in response.find_segments(HIRMS2):
+                            for resp in hirms_seg.responses:
+                                if resp.code == '3040' and resp.parameters:
+                                    aufsetzpunkt = resp.parameters[0]
+
+                        wait_seconds = int(hivpp.wait_for_seconds) if hivpp.wait_for_seconds else 2
+                        logger.info("VoP polling required (polling_id=%r, aufsetzpunkt=%r, wait=%ds)",
+                                    hivpp.polling_id, aufsetzpunkt, wait_seconds)
+
+                        import time
+                        time.sleep(wait_seconds)
+
+                        # Poll: send HKVPP with polling_id + aufsetzpunkt (no HKCCS, no HKTAN)
+                        poll_seg = HKVPP1(
+                            supported_reports=PSRD1(psrd=[vop_standard]),
+                            polling_id=hivpp.polling_id,
+                            aufsetzpunkt=aufsetzpunkt,
+                        )
+                        poll_response = dialog.send(poll_seg)
+                        hivpp = poll_response.find_segment_first(HIVPP1, throw=True)
+                        logger.info("VoP poll result: vop_id=%r", hivpp.vop_id)
+
                     vop_result = hivpp.vop_single_result
-                     # Not Applicable, No Match, Close Match, or exact match but still requires confirmation
-                    if vop_result.result in ('RVNA', 'RVNM', 'RVMC')  or (vop_result.result == 'RCVC' and '3945' in [res.code for res in response.responses(tan_seg)]): 
+                    # Not Applicable, No Match, Close Match, or exact match but still requires confirmation
+                    tan_codes = [res.code for res in response.responses(tan_seg)]
+                    command_codes = [res.code for res in response.responses(command_seg)]
+                    all_codes = []
+                    for seg in response.find_segments((HIRMG2, HIRMS2)):
+                        all_codes.extend(r.code for r in seg.responses)
+
+                    # If we have a vop_id (from initial or polling), return NeedVOPResponse
+                    # so the caller can inspect the result and then call approve_vop_response
+                    if hivpp.vop_id:
+                        return NeedVOPResponse(
+                            vop_result=hivpp,
+                            command_seg=command_seg,
+                            resume_method=resume_func,
+                        )
+
+                    if vop_result and (vop_result.result in ('RVNA', 'RVNM', 'RVMC') or (
+                        vop_result.result == 'RCVC' and '3945' in all_codes
+                    )):
                         return NeedVOPResponse(
                             vop_result=hivpp,
                             command_seg=command_seg,
@@ -1536,6 +1584,30 @@ def approve_vop_response(self, challenge: NeedVOPResponse):
                         challenge.vop_result,
                     )
 
+            for resp in response.responses(challenge.command_seg):
+                if resp.code in ('0030', '3955'):
+                    return NeedTANResponse(
+                        challenge.command_seg,
+                        response.find_segment_first('HITAN'),
+                        challenge.resume_method,
+                        self.is_challenge_structured(),
+                        resp.code == '3955',
+                        challenge.vop_result,
+                    )
+
+            for seg in response.find_segments((HIRMG2, HIRMS2)):
+                for resp in seg.responses:
+                    if resp.code not in ('0030', '3955'):
+                        continue
+                    return NeedTANResponse(
+                        challenge.command_seg,
+                        response.find_segment_first('HITAN'),
+                        challenge.resume_method,
+                        self.is_challenge_structured(),
+                        resp.code == '3955',
+                        challenge.vop_result,
+                    )
+
             resume_func = getattr(self, challenge.resume_method)
             return resume_func(challenge.command_seg, response)