@bloonio/lokotro-pay 1.1.0 → 1.1.2

package/fesm2022/bloonio-lokotro-pay.mjs

@@ -2,9 +2,9 @@ import * as i0 from '@angular/core';
 import { Injectable, EventEmitter, Output, Input, Component, forwardRef, InjectionToken, NgModule } from '@angular/core';
 import * as i1$1 from '@angular/forms';
 import { FormsModule, ReactiveFormsModule, NG_VALUE_ACCESSOR, NG_VALIDATORS, Validators } from '@angular/forms';
-import { BehaviorSubject, of, throwError, Subject, interval } from 'rxjs';
-import { UpperCasePipe } from '@angular/common';
+import { BehaviorSubject, of, Subject, throwError, interval } from 'rxjs';
 import { timeout, map, catchError, tap, shareReplay, switchMap, takeUntil } from 'rxjs/operators';
+import { UpperCasePipe } from '@angular/common';
 import * as i1 from '@angular/common/http';
 import { HttpHeaders, HttpErrorResponse } from '@angular/common/http';
 
@@ -17,8 +17,7 @@ import { HttpHeaders, HttpErrorResponse } from '@angular/common/http';
  */
 const LOKOTRO_DEV_ENV = {
     environment: 'development',
-    apiBaseUrl: 'http://10.37.31.218:6495',
-    // apiBaseUrl: 'https://dev.app.api.gtwy.lokotro.com',
+    apiBaseUrl: 'https://dev.app.api.gtwy.lokotro.com',
     paymentApiVersion: 'v1',
     debugMode: true,
     logLevel: 'debug',
@@ -1253,7 +1252,6 @@ class LokotroHttpClientService {
         this.acceptLanguage = 'fr';
         this.customHeaders = {};
         this.instanceId = ++LokotroHttpClientService.instanceCounter;
-        console.log(`[Lokotro HTTP] Instance #${this.instanceId} created`);
     }
     /**
      * Configure the HTTP client
@@ -1273,9 +1271,7 @@ class LokotroHttpClientService {
      * Set app-key for Lokotro Gateway authentication
      */
     setAppKey(appKey) {
-        console.log(`[Lokotro HTTP #${this.instanceId}] setAppKey called with:`, appKey?.substring(0, 20) + '...');
         this.appKey = appKey;
-        console.log(`[Lokotro HTTP #${this.instanceId}] appKey now set to:`, this.appKey?.substring(0, 20) + '...');
     }
     /**
      * Remove app-key
@@ -1299,7 +1295,6 @@ class LokotroHttpClientService {
      * Build request headers
      */
     buildHeaders() {
-        console.log(`[Lokotro HTTP #${this.instanceId}] buildHeaders - appKey value:`, this.appKey?.substring(0, 20) + '...');
         let headers = new HttpHeaders({
             'Content-Type': 'application/json',
             'Accept': 'application/json',
@@ -1309,10 +1304,9 @@ class LokotroHttpClientService {
         });
         if (this.appKey) {
             headers = headers.set('app-key', this.appKey);
-            console.log(`[Lokotro HTTP #${this.instanceId}] app-key header added`);
         }
-        else {
-            console.warn(`[Lokotro HTTP #${this.instanceId}] WARNING: appKey is not set, app-key header NOT added`);
+        else if (LokotroPayEnv.debugMode) {
+            console.warn('[Lokotro HTTP] appKey is not set');
         }
         // Add custom headers
         Object.entries(this.customHeaders).forEach(([key, value]) => {
@@ -3370,6 +3364,16 @@ const initialState = {
     currentScreen: LokotroPayScreenNavigation.LoadingScreen
 };
 class LokotroPaymentService {
+    /** Allowed domains for redirect URLs to prevent open redirect attacks */
+    static { this.ALLOWED_REDIRECT_DOMAINS = [
+        'lokotro.com',
+        'app.lokotro.com',
+        'api.gtwy.lokotro.com',
+        'dev.app.api.gtwy.lokotro.com',
+        'app.api.gtwy.lokotro.com',
+        'mastercard.com',
+        'ap-gateway.mastercard.com',
+    ]; }
     static { this.MOBILE_MONEY_POLL_INTERVAL = 5000; }
     static { this.MOBILE_MONEY_MAX_ATTEMPTS = 60; }
     constructor(httpClient) {
@@ -3377,6 +3381,7 @@ class LokotroPaymentService {
         this.stateSubject = new BehaviorSubject(initialState);
         this.state$ = this.stateSubject.asObservable();
         this.mobileMoneyPollingAttempts = 0;
+        this.pollingStop$ = new Subject();
     }
     /**
      * Get current state
@@ -3421,9 +3426,7 @@ class LokotroPaymentService {
         this.currentPaymentBody = paymentBody;
         this.updateState({ isLoading: true });
         const requestData = this.convertPaymentBodyToRequest(paymentBody);
-        console.log('[Lokotro Payment] Creating payment with body:', requestData);
         return this.httpClient.post(LokotroPayEnv.endpoints.collect, requestData).pipe(switchMap(response => {
-            console.log('[Lokotro Payment] Create payment response:', response);
             if (!response.isSuccess || !response.data) {
                 this.updateState({
                     isLoading: false,
@@ -3481,6 +3484,10 @@ class LokotroPaymentService {
                     return;
                 }
                 if (submitResponse.redirectUrl) {
+                    if (!this.isValidRedirectUrl(submitResponse.redirectUrl)) {
+                        this.handlePaymentFailure('Invalid redirect URL received from server');
+                        return;
+                    }
                     this.updateState({
                         isLoading: false,
                         transactionId: submitResponse.transactionId || this.resolvePaymentId(request)
@@ -3591,34 +3598,37 @@ class LokotroPaymentService {
     startMobileMoneyPolling(transactionId) {
         this.stopMobileMoneyPolling();
         this.mobileMoneyPollingAttempts = 0;
-        console.log('[Lokotro Payment] Starting mobile money status polling for:', transactionId);
+        this.pollingStop$ = new Subject();
         this.mobileMoneyPollingTimer = setInterval(() => {
             this.mobileMoneyPollingAttempts++;
             if (this.mobileMoneyPollingAttempts > LokotroPaymentService.MOBILE_MONEY_MAX_ATTEMPTS) {
-                console.warn('[Lokotro Payment] Mobile money polling max attempts reached');
                 this.stopMobileMoneyPolling();
                 this.handlePaymentFailure('Payment took too long. Please try again or contact support.');
                 return;
             }
             const endpoint = `${LokotroPayEnv.endpoints.mobileMoneyStatus}/${transactionId}`;
-            this.httpClient.get(endpoint).subscribe({
+            this.pollingSubscription = this.httpClient.get(endpoint)
+                .pipe(takeUntil(this.pollingStop$))
+                .subscribe({
                 next: (response) => {
                     if (!response.isSuccess || !response.data)
                         return;
                     const data = this.unwrapPayload(response.data);
                     const status = this.getString(data['status']).toLowerCase();
-                    console.log(`[Lokotro Payment] Mobile money poll #${this.mobileMoneyPollingAttempts}: status=${status}`);
-                    if (status === 'completed' || status === 'success' || status === 'approved') {
+                    const parsedStatus = LokotroPaymentStatusInfo.fromString(status);
+                    if (LokotroPaymentStatusInfo.isSuccess(parsedStatus)) {
                         this.stopMobileMoneyPolling();
                         this.handlePaymentSuccess(data);
                     }
-                    else if (status === 'failed' || status === 'error' || status === 'cancelled' || status === 'declined') {
+                    else if (LokotroPaymentStatusInfo.isFailure(parsedStatus)) {
                         this.stopMobileMoneyPolling();
                         this.handlePaymentFailure(this.getString(data['message']) || 'Payment failed or was declined');
                     }
                 },
                 error: (err) => {
-                    console.error('[Lokotro Payment] Mobile money polling error:', err);
+                    if (LokotroPayEnv.debugMode) {
+                        console.error('[Lokotro Payment] Mobile money polling error:', err?.message || err);
+                    }
                 }
             });
         }, LokotroPaymentService.MOBILE_MONEY_POLL_INTERVAL);
@@ -3627,11 +3637,13 @@ class LokotroPaymentService {
      * Stop mobile money status polling
      */
     stopMobileMoneyPolling() {
+        this.pollingStop$.next();
+        this.pollingSubscription?.unsubscribe();
+        this.pollingSubscription = undefined;
         if (this.mobileMoneyPollingTimer) {
             clearInterval(this.mobileMoneyPollingTimer);
             this.mobileMoneyPollingTimer = undefined;
             this.mobileMoneyPollingAttempts = 0;
-            console.log('[Lokotro Payment] Mobile money polling stopped');
         }
     }
     /**
@@ -3707,6 +3719,10 @@ class LokotroPaymentService {
                 this.handlePaymentFailure('Hosted session created but no checkout URL was provided');
                 return of(void 0);
             }
+            if (!this.isValidRedirectUrl(redirectUrl)) {
+                this.handlePaymentFailure('Invalid checkout redirect URL received from server');
+                return of(void 0);
+            }
             this.updateState({
                 isLoading: false,
                 transactionId: paymentId
@@ -3759,6 +3775,10 @@ class LokotroPaymentService {
                 const hostedCheckoutUrl = this.getString(transactionData['mastercardUrl']) ||
                     this.getString(transactionData['redirect_url']);
                 if (hostedCheckoutUrl) {
+                    if (!this.isValidRedirectUrl(hostedCheckoutUrl)) {
+                        this.handlePaymentFailure('Invalid hosted checkout URL received from server');
+                        return of(void 0);
+                    }
                     this.updateState({ isLoading: false });
                     window.location.href = hostedCheckoutUrl;
                     return of(void 0);
@@ -3862,6 +3882,9 @@ class LokotroPaymentService {
         if (body.mastercardPaymentMethod) {
             request['mastercard_payment_method'] = body.mastercardPaymentMethod;
         }
+        if (body.transactionalCurrency) {
+            request['transactional_currency'] = body.transactionalCurrency.toLowerCase();
+        }
         if (body.metadata) {
             request['metadata'] = body.metadata;
         }
@@ -4129,6 +4152,32 @@ class LokotroPaymentService {
             .map(item => this.asRecord(item))
             .filter((item) => Boolean(item));
     }
+    /**
+     * Validate that a redirect URL points to an allowed domain.
+     * Prevents open redirect attacks if the API response is compromised.
+     */
+    isValidRedirectUrl(url) {
+        try {
+            const parsed = new URL(url);
+            if (parsed.protocol !== 'https:') {
+                return false;
+            }
+            return LokotroPaymentService.ALLOWED_REDIRECT_DOMAINS.some(domain => parsed.hostname === domain || parsed.hostname.endsWith(`.${domain}`));
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Full cleanup - call when the host component is destroyed.
+     * Addresses singleton state collision by ensuring polling and state are reset.
+     */
+    destroy() {
+        this.stopMobileMoneyPolling();
+        this.pollingStop$.complete();
+        this.currentPaymentBody = undefined;
+        this.stateSubject.next(initialState);
+    }
     static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.18", ngImport: i0, type: LokotroPaymentService, deps: [{ token: LokotroHttpClientService }], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.18", ngImport: i0, type: LokotroPaymentService, providedIn: 'root' }); }
 }
@@ -4155,6 +4204,7 @@ class LokotroPayCheckoutComponent {
         this.closed = new EventEmitter();
         this.isDarkTheme = true;
         this.retryAttempts = 0;
+        this.destroy$ = new Subject();
     }
     /** Check if user has retries left */
     get hasRetriesLeft() {
@@ -4167,22 +4217,17 @@ class LokotroPayCheckoutComponent {
         this.initializePayment();
     }
     ngOnDestroy() {
+        this.destroy$.next();
+        this.destroy$.complete();
         this.stateSubscription?.unsubscribe();
-        this.paymentService.resetState();
+        this.paymentService.destroy();
     }
     initializeEnvironment() {
-        console.log('[Lokotro Checkout] initializeEnvironment - configs:', {
-            token: this.configs.token?.substring(0, 20) + '...',
-            isProduction: this.configs.isProduction,
-            customApiUrl: this.configs.customApiUrl
-        });
         LokotroPayEnv.initialize(this.configs.isProduction ?? false, this.configs.customApiUrl);
-        console.log('[Lokotro Checkout] Calling setAppKey with token');
         this.paymentService.setAppKey(this.configs.token);
         if (this.configs.acceptLanguage) {
             this.paymentService.setAcceptLanguage(this.configs.acceptLanguage);
         }
-        console.log('[Lokotro Checkout] Environment initialized');
     }
     initializeLocalization() {
         if (this.language) {
@@ -4221,9 +4266,13 @@ class LokotroPayCheckoutComponent {
         });
     }
     initializePayment() {
-        this.paymentService.createPayment(this.paymentBody).subscribe({
+        this.paymentService.createPayment(this.paymentBody)
+            .pipe(takeUntil(this.destroy$))
+            .subscribe({
             error: (err) => {
-                console.error('[Lokotro Pay] Payment initialization error:', err);
+                if (LokotroPayEnv.debugMode) {
+                    console.error('[Lokotro Pay] Payment initialization error:', err?.message || err);
+                }
             }
         });
     }
@@ -4289,9 +4338,13 @@ class LokotroPayCheckoutComponent {
             paymentMethod: this.state?.selectedPaymentMethod?.name || '',
             ...formData
         };
-        this.paymentService.submitPaymentDetails(submitRequest).subscribe({
+        this.paymentService.submitPaymentDetails(submitRequest)
+            .pipe(takeUntil(this.destroy$))
+            .subscribe({
             error: (err) => {
-                console.error('[Lokotro Pay] Form submission error:', err);
+                if (LokotroPayEnv.debugMode) {
+                    console.error('[Lokotro Pay] Form submission error:', err?.message || err);
+                }
             }
         });
     }
@@ -4301,9 +4354,12 @@ class LokotroPayCheckoutComponent {
         this.paymentService.verifyOtp({
             paymentId: this.state.transactionId,
             otpCode: otp
-        }).subscribe({
+        }).pipe(takeUntil(this.destroy$))
+            .subscribe({
             error: (err) => {
-                console.error('[Lokotro Pay] OTP verification error:', err);
+                if (LokotroPayEnv.debugMode) {
+                    console.error('[Lokotro Pay] OTP verification error:', err?.message || err);
+                }
             }
         });
     }
@@ -4312,9 +4368,12 @@ class LokotroPayCheckoutComponent {
             return;
         this.paymentService.resendOtp({
             paymentId: this.state.transactionId
-        }).subscribe({
+        }).pipe(takeUntil(this.destroy$))
+            .subscribe({
             error: (err) => {
-                console.error('[Lokotro Pay] OTP resend error:', err);
+                if (LokotroPayEnv.debugMode) {
+                    console.error('[Lokotro Pay] OTP resend error:', err?.message || err);
+                }
             }
         });
     }