@agent-cards/sdk 0.23.21 → 0.23.23

package/dist/sbps.js

@@ -0,0 +1,90 @@
+// SB Payment Service (SBPS): the adapters' side of its one-time token request.
+//
+// SBPS's token script (com_sbps_system_token.js) encrypts the card in the merchant's page and sends it
+// as ONE JSONP <script> GET to /token/generateToken on token.sps-system.com (stbtoken.sps-system.com
+// for SBPS's test environment); the answer is JavaScript that calls the request's own callback with
+// {"tokenRes": {...}}. The rules that judge that request (the exact URL the browser writes for the
+// script's <script>, the merchant pins, the answer judge) live in payment-core and reach this SDK as
+// sbps.generated.ts. This module holds only what an attachment decides from them:
+//   - which request on SBPS's token hosts is the card token request to pause for the vault;
+//   - which is a variant of it this SDK does not complete (aborted, so the placeholder's ciphertext
+//     never reaches SBPS);
+//   - the script answer the paused request gets once the cardholder's device sent the real card: the
+//     token Agentcard stored, wrapped in the callback the paused URL named.
+// The 3-D Secure info request on the same host (/token/generateTds2Token: the buyer's name, phone and
+// email, no card) and the scripts continue untouched.
+import { SBPS_ANSWER_CONTENT_TYPE, SBPS_TOKEN_HOSTS, SBPS_TOKEN_PATH, isSbpsRequest, isSbpsTokenRequest, sbpsJsonp, sbpsOutcome, sbpsRequestFacts } from './sbps.generated.js';
+/** The processor id, as the registry and the API name it. */
+export const SBPS_PSP = 'sb_payment_service';
+/** The dark-launch capability the API serves the SBPS recognizer behind (payment-core definitions.js). */
+export const SBPS_CAPABILITY = 'sbps_token_jsonp';
+/** What the paused <script> is answered with. */
+export { SBPS_ANSWER_CONTENT_TYPE };
+const SBPS_HOSTNAMES = [SBPS_TOKEN_HOSTS.production, SBPS_TOKEN_HOSTS.sandbox];
+/** Which SBPS request this is, or null for a URL that is not on one of SBPS's token hosts. */
+export function classifySbpsRequest(url, method) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol !== 'https:' || parsed.port || parsed.username || parsed.password
+        || !SBPS_HOSTNAMES.includes(parsed.hostname.toLowerCase().replace(/\.$/, '')))
+        return null;
+    // Every spelling of the token path belongs to the token request family: the exact request carries the
+    // card, and any neighbour of it is nothing this SDK completes. generateTds2Token is not a neighbour.
+    if (parsed.pathname.toLowerCase().startsWith(SBPS_TOKEN_PATH.toLowerCase())) {
+        return typeof method === 'string' && isSbpsTokenRequest(url, method.toUpperCase()) ? { kind: 'token_request' } : { kind: 'unsupported' };
+    }
+    return { kind: 'sibling' };
+}
+/** The token request GET exactly as payment-core admits it: its URL alone, with no body. */
+export function isSbpsTokenGet(request) {
+    return (request.method ?? 'POST').toUpperCase() === 'GET' && isSbpsRequest({ url: request.url, method: 'GET', body: request.body ?? '' });
+}
+/**
+ * The answer a paused token request gets, or null when the stored answer is not one to hand the page:
+ * SBPS's own shape, `<callback>(<tokenRes>)` under a script type, with the callback the paused URL
+ * named. The answer must be one payment-core's judge accepts for that exact URL (result OK and the
+ * five token fields), byte for byte what the API stored after running the same judge.
+ */
+export function sbpsScriptAnswer(templateUrl, response) {
+    const facts = sbpsRequestFacts(templateUrl);
+    if (!facts || response.status !== 200 || typeof response.body !== 'string')
+        return null;
+    let body;
+    try {
+        body = sbpsJsonp(facts.callback, response.body);
+    }
+    catch {
+        return null;
+    }
+    const verdict = sbpsOutcome(200, body, templateUrl, undefined);
+    if (verdict.outcome !== 'token' || verdict.sanitizedJson !== response.body)
+        return null;
+    return { status: 200, headers: { 'content-type': SBPS_ANSWER_CONTENT_TYPE }, body };
+}
+/**
+ * One attachment's view of SBPS's token hosts. Inert (classify returns null) until the registry serves
+ * SBPS, which a client reaches only by syncing with the capability for an org the API enabled, so a
+ * build, an org or an API that never served it leaves every SBPS request exactly as before.
+ */
+export class SbpsGate {
+    vault;
+    constructor(vault) {
+        this.vault = vault;
+    }
+    /** What this request is, when the registry serves SBPS and the URL is on its token hosts; null leaves it to the other gates. */
+    classify(url, method) {
+        if (typeof this.vault?.recognizesProcessor !== 'function' || !this.vault.recognizesProcessor(SBPS_PSP))
+            return null;
+        return classifySbpsRequest(url, method);
+    }
+    /** Playwright's route predicate sees only the URL: route the token request family, never the scripts or the 3-D Secure info request. */
+    matches(url) {
+        const request = this.classify(url, 'GET');
+        return request !== null && request.kind !== 'sibling';
+    }
+}