feat(payment_link): add provision for secured payment links #5357

kashif-m · 2024-07-18T06:54:49Z

Type of Change

Description

Described in #5372

Additional Changes

This PR modifies the API contract
This PR modifies the database schema
This PR modifies application configuration/environment variables

Motivation and Context

How did you test it?

Tested locally using postman collection. Expectations -

existing payment links is available as open links (cannot list SPMs or render checkbox to store PM)
secure links are generated only when allowed_domains are configured
secure links can only be accessed from within an iframe on the allowed domains

Open links

1. Create a payment link - (unfold to view cURL)

curl --location 'http://localhost:8080/payments' \ --header 'Content-Type: application/json' \ --header 'Accept: application/json' \ --header 'api-key: dev_eBTVu8OMN1HmE2xr0I0dsfypWOVwQBlietvkxf0sgYMdyFM5nRO40M8M4MLH42Jk' \ --data '{ "customer_id": "cus_izAOZiynP5URGEvEfmgH", "amount": 100, "currency": "USD", "payment_link": true, "connector": [ "stripe" ], "session_expiry": 1000000, "return_url": "http://127.0.0.1:5500/src/pl_iframe.html", "payment_link_config": { "theme": "#14356f", "logo": "https://logosandtypes.com/wp-content/uploads/2020/08/zurich.svg", "seller_name": "Zurich Inc." } }'

Open the payment link (link in API response) and validate the functionality

Secure links

1. Update `allowed_domains` in business profile - (unfold to view cURL)

curl --location 'http://localhost:8080/account/merchant_1721984694/business_profile/pro_oXHnmgfZSnfe92PvodqP' \ --header 'Content-Type: application/json' \ --header 'api-key: test_admin' \ --data '{ "payment_link_config": { "allowed_domains": [ "*" ], "enabled_saved_payment_method": true } }'

2. Create a payment link - (unfold to view cURL)

curl --location 'http://localhost:8080/payments' \ --header 'Content-Type: application/json' \ --header 'Accept: application/json' \ --header 'api-key: dev_eBTVu8OMN1HmE2xr0I0dsfypWOVwQBlietvkxf0sgYMdyFM5nRO40M8M4MLH42Jk' \ --data '{ "customer_id": "cus_izAOZiynP5URGEvEfmgH", "amount": 100, "currency": "USD", "payment_link": true, "connector": [ "stripe" ], "session_expiry": 1000000, "return_url": "http://127.0.0.1:5500/src/pl_iframe.html", "payment_link_config": { "theme": "#14356f", "logo": "https://logosandtypes.com/wp-content/uploads/2020/08/zurich.svg", "seller_name": "Zurich Inc." } }'

3. Open the secure payment link (`secure_link` in API response) in an iframe for validating the functionality

Secure links demo

Screencast.from.26-07-24.02.34.52.PM.IST.webm

Checklist

I formatted the code cargo +nightly fmt --all
I addressed lints thrown by cargo clippy
I reviewed the submitted code
I added unit tests for my changes where possible

refactor(payment_link): segregate open and secured payment links

…ent links only when they're not opened at top

migrations/2024-07-17-131830_alter_payment_link/up.sql

crates/router/src/services/api.rs

crates/router/src/core/payouts/validator.rs

SanchithHegde · 2024-07-19T10:53:59Z

crates/router/src/routes/app.rs

@@ -1271,6 +1271,10 @@ impl PaymentLink {
                web::resource("{merchant_id}/{payment_id}")
                    .route(web::get().to(initiate_payment_link)),
            )
+            .service(
+                web::resource("s/{merchant_id}/{payment_id}")


Was this supposed to be only /{merchant_id}/{payment_id}?

We've decided to add /s/ for secure links

we should change it to secure

This was added based on the discussions, primarily for ensuring the context of open / secure links can not be inferred from these links // @knutties

crates/api_models/src/payments.rs

SanchithHegde

Other than that, looks good to me!

crates/router/src/services/api.rs

crates/api_models/src/payments.rs

crates/common_utils/src/validation.rs

sahkal · 2024-07-24T07:56:22Z

crates/router/src/core/payments/operations/payment_create.rs

+            "{}/payment_link/s/{}/{}",
+            domain_name,
+            merchant_id.clone(),
+            payment_id.clone()
+        )
+    });


what is s in the path param, why not explicitly state secure

#5357 (comment)

crates/router/src/core/payments/operations/payment_create.rs

sahkal · 2024-07-24T08:05:22Z

crates/router/src/core/payment_link.rs

+        PaymentLinkConfig {
            theme: DEFAULT_BACKGROUND_COLOR.to_string(),
            logo: DEFAULT_MERCHANT_LOGO.to_string(),
            seller_name: merchant_name_from_merchant_account,
            sdk_layout: DEFAULT_SDK_LAYOUT.to_owned(),
            display_sdk_only: DEFAULT_DISPLAY_SDK_ONLY,
            enabled_saved_payment_method: DEFAULT_ENABLE_SAVED_PAYMENT_METHOD,
+            allowed_domains: DEFAULT_ALLOWED_DOMAINS,
        }


should we make a new structs for PaymentLinkConfig as PaymentLinkOpenConfig and PaymentLinkSecureConfig. As it doesn't make sense to have allowed_domains params inside open_link

This is stored in DB as well, we will need to split tables / columns if we want to store different structs

crates/router/src/core/payment_methods.rs

sahkal · 2024-07-24T08:07:12Z

crates/router/src/routes/app.rs

@@ -1271,6 +1271,10 @@ impl PaymentLink {
                web::resource("{merchant_id}/{payment_id}")
                    .route(web::get().to(initiate_payment_link)),
            )
+            .service(
+                web::resource("s/{merchant_id}/{payment_id}")


we should change it to secure

crates/router/src/services/api/generic_link_response.rs

crates/router/src/services/api.rs

crates/router/src/types/transformers.rs

migrations/2024-07-17-131830_alter_payment_link/up.sql

crates/api_models/src/payments.rs

committed from GitHub web Co-authored-by: Sanchith Hegde <[email protected]>

hyperswitch-bot bot added M-database-changes Metadata: This PR involves database schema changes M-api-contract-changes Metadata: This PR involves API contract changes labels Jul 18, 2024

feat(payment_link): add provision for secured payment links

4a51278

refactor(payment_link): segregate open and secured payment links

kashif-m force-pushed the payment_links_sec branch from 4904cd7 to 4a51278 Compare July 19, 2024 07:20

kashif-m self-assigned this Jul 19, 2024

kashif-m changed the title ~~Payment links sec~~ feat(payment_link): add provision for secured payment links Jul 19, 2024

kashif-m linked an issue Jul 19, 2024 that may be closed by this pull request

[FEATURE] provision for secure payment links #5372

Closed

2 tasks

feat(payment_link): add client side checks for initiating secure paym…

b0e89e4

…ent links only when they're not opened at top

kashif-m marked this pull request as ready for review July 19, 2024 08:09

kashif-m requested review from a team as code owners July 19, 2024 08:09

kashif-m added A-payments Area: payments Payment Links labels Jul 19, 2024

Merge remote-tracking branch 'origin/main' into payment_links_sec

1df15fd

seekshiva previously approved these changes Jul 19, 2024

View reviewed changes

chore(payment_links): code update after merging w main]

54a9d45

kashif-m dismissed seekshiva’s stale review via 54a9d45 July 19, 2024 08:23

SanchithHegde reviewed Jul 19, 2024

View reviewed changes

kashif-m added 3 commits July 23, 2024 10:52

chore: resolve comments

8968908

Merge remote-tracking branch 'origin/main' into payment_links_sec

bcedc00

refactor: remove iframe checks from open payment link

cb0457e

kashif-m commented Jul 23, 2024

View reviewed changes

crates/api_models/src/payments.rs Outdated Show resolved Hide resolved

refactor: hack fixes

e086dd2

kashif-m requested a review from SanchithHegde July 23, 2024 09:02

SanchithHegde reviewed Jul 23, 2024

View reviewed changes

crates/router/src/services/api.rs Outdated Show resolved Hide resolved

sahkal reviewed Jul 24, 2024

View reviewed changes

crates/api_models/src/payments.rs Outdated Show resolved Hide resolved

sahkal reviewed Jul 24, 2024

View reviewed changes

crates/common_utils/src/validation.rs Outdated Show resolved Hide resolved

sahkal reviewed Jul 24, 2024

View reviewed changes

crates/router/src/core/payments/operations/payment_create.rs Outdated Show resolved Hide resolved

sahkal requested changes Jul 24, 2024

View reviewed changes

kashif-m and others added 4 commits July 25, 2024 10:46

refactor: resolve comments

69d2217

Merge remote-tracking branch 'origin/main' into payment_links_sec

7ba33fd

docs(openapi): re-generate OpenAPI specification

63e355b

refactor: update after merging w main

56f966b

kashif-m requested review from sahkal and SanchithHegde July 25, 2024 05:29

refactor: revert development.toml changes

22928cc

kashif-m force-pushed the payment_links_sec branch from c133f9e to 22928cc Compare July 25, 2024 08:26

refactor(payment_link): update redirection for secure link

a5da70f

sahkal previously approved these changes Jul 27, 2024

View reviewed changes

seekshiva previously approved these changes Jul 29, 2024

View reviewed changes

SanchithHegde reviewed Jul 29, 2024

View reviewed changes

crates/api_models/src/payments.rs Outdated Show resolved Hide resolved

refactor(docs): remove abbreviation

5e0814a

committed from GitHub web Co-authored-by: Sanchith Hegde <[email protected]>

kashif-m dismissed stale reviews from seekshiva and sahkal via 5e0814a July 29, 2024 16:47

docs(openapi): re-generate OpenAPI specification

bcb75ea

kashif-m requested a review from SanchithHegde July 30, 2024 03:04

SanchithHegde approved these changes Jul 30, 2024

View reviewed changes

kashif-m requested review from seekshiva and sahkal July 30, 2024 06:10

seekshiva approved these changes Jul 30, 2024

View reviewed changes

sahkal approved these changes Jul 30, 2024

View reviewed changes

Gnanasundari24 added this pull request to the merge queue Jul 30, 2024

Merged via the queue into main with commit 043abb5 Jul 30, 2024
14 checks passed

Gnanasundari24 deleted the payment_links_sec branch July 30, 2024 08:06

feat(payment_link): add provision for secured payment links #5357

feat(payment_link): add provision for secured payment links #5357

Uh oh!

Conversation

kashif-m commented Jul 18, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Type of Change

Description

Additional Changes

Motivation and Context

How did you test it?

Open links

Secure links

Secure links demo

Checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

SanchithHegde left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kashif-m commented Jul 18, 2024 •

edited

Loading