@bloonio/lokotro-pay 1.2.2 → 1.3.0

package/fesm2022/bloonio-lokotro-pay.mjs

@@ -17,8 +17,8 @@ import { HttpHeaders, HttpErrorResponse } from '@angular/common/http';
  */
 const LOKOTRO_DEV_ENV = {
     environment: 'development',
-    // apiBaseUrl: 'http://10.37.31.218:6495',
-    apiBaseUrl: 'https://dev.app.api.gtwy.lokotro.com',
+    // apiBaseUrl: 'http://192.168.30.118:6495',
+    apiBaseUrl: 'https://app.api.gtwy.lokotro.com',
     paymentApiVersion: 'v1',
     debugMode: true,
     logLevel: 'debug',
@@ -1244,16 +1244,19 @@ class LokotroCountryUtils {
  * Angular version of the Flutter Lokotro Pay HTTP client
  */
 /**
- * Enhanced HTTP client for Lokotro Pay with modern error handling and logging
+ * Enhanced HTTP client for Lokotro Pay with modern error handling and logging.
+ *
+ * PR-1.2 / CRIT-2: previous code emitted six `console.log` calls that
+ * truncated and printed the merchant `appKey` to the browser console on every
+ * HTTP request. The truncated form ("first 20 chars + ...") is still useful
+ * to anyone scraping the console, especially when paired with the response
+ * body. All such logs were removed.
  */
 class LokotroHttpClientService {
-    static { this.instanceCounter = 0; }
     constructor(http) {
         this.http = http;
         this.acceptLanguage = 'fr';
         this.customHeaders = {};
-        this.instanceId = ++LokotroHttpClientService.instanceCounter;
-        console.log(`[Lokotro HTTP] Instance #${this.instanceId} created`);
     }
     /**
      * Configure the HTTP client
@@ -1273,9 +1276,7 @@ class LokotroHttpClientService {
      * Set app-key for Lokotro Gateway authentication
      */
     setAppKey(appKey) {
-        console.log(`[Lokotro HTTP #${this.instanceId}] setAppKey called with:`, appKey?.substring(0, 20) + '...');
         this.appKey = appKey;
-        console.log(`[Lokotro HTTP #${this.instanceId}] appKey now set to:`, this.appKey?.substring(0, 20) + '...');
     }
     /**
      * Remove app-key
@@ -1299,7 +1300,6 @@ class LokotroHttpClientService {
      * Build request headers
      */
     buildHeaders() {
-        console.log(`[Lokotro HTTP #${this.instanceId}] buildHeaders - appKey value:`, this.appKey?.substring(0, 20) + '...');
         let headers = new HttpHeaders({
             'Content-Type': 'application/json',
             'Accept': 'application/json',
@@ -1308,11 +1308,14 @@ class LokotroHttpClientService {
             'Accept-Language': this.acceptLanguage
         });
         if (this.appKey) {
-            headers = headers.set('app-key', this.appKey);
-            console.log(`[Lokotro HTTP #${this.instanceId}] app-key header added`);
-        }
-        else {
-            console.warn(`[Lokotro HTTP #${this.instanceId}] WARNING: appKey is not set, app-key header NOT added`);
+            // Auth-v3 / PR-3.5: the gateway's /api/v1/payments/* endpoints now
+            // authenticate via `Authorization: Bearer <session_token>`, where
+            // `session_token` is minted server-to-server by the merchant backend
+            // calling /api/v1/internal/sessions/create. `this.appKey` here holds
+            // that session_token (the field name is kept for backwards-compat
+            // with merchants who haven't migrated yet — gateway returns 401 for
+            // legacy app-key on /collect anyway).
+            headers = headers.set('Authorization', `Bearer ${this.appKey}`);
         }
         // Add custom headers
         Object.entries(this.customHeaders).forEach(([key, value]) => {
@@ -1388,11 +1391,20 @@ class LokotroHttpClientService {
         };
     }
     /**
-     * Handle error response
+     * Handle error response.
+     *
+     * PR-1.2: previously logged the full `error` object in debug mode, which
+     * for an HttpErrorResponse includes `error.error` — i.e. the raw server
+     * response body. That body can leak validation echoes of the original
+     * request (PAN/PIN/etc.) when the backend is in development mode. Now we
+     * log only HTTP status code + url; never the body.
      */
     handleError(error) {
         if (LokotroPayEnv.debugMode) {
-            console.error('[Lokotro Pay HTTP] Error:', error);
+            const status = error instanceof HttpErrorResponse ? error.status : 0;
+            const url = error instanceof HttpErrorResponse ? error.url : '';
+            // eslint-disable-next-line no-console
+            console.error('[Lokotro Pay HTTP] Error', { status, url });
         }
         let errorResponse;
         if (error instanceof HttpErrorResponse) {
@@ -3392,9 +3404,12 @@ class LokotroPaymentService {
         this.currentPaymentBody = paymentBody;
         this.updateState({ isLoading: true });
         const requestData = this.convertPaymentBodyToRequest(paymentBody);
-        console.log('[Lokotro Payment] Creating payment with body:', requestData);
+        // PR-1.2 / CRIT-1: previous `console.log(requestData)` shipped PAN, CVV,
+        // wallet PIN, flash PIN, and full PII to the browser console on every
+        // checkout. Removed.
         return this.httpClient.post(LokotroPayEnv.endpoints.collect, requestData).pipe(switchMap(response => {
-            console.log('[Lokotro Payment] Create payment response:', response);
+            // PR-1.2: response contains transaction IDs and (sometimes) redirect
+            // URLs that are sensitive. Don't log it.
             if (!response.isSuccess || !response.data) {
                 this.updateState({
                     isLoading: false,
@@ -3456,7 +3471,10 @@ class LokotroPaymentService {
                         isLoading: false,
                         transactionId: submitResponse.transactionId || this.resolvePaymentId(request)
                     });
-                    window.location.href = submitResponse.redirectUrl;
+                    // PR-1.2 / Angular HIGH-1: validate redirect URL against allow-list
+                    // before handing the tab over. Server-side allow-list (PR-2.0) is
+                    // the real defense; this is defense-in-depth on the client.
+                    this.redirectIfAllowed(submitResponse.redirectUrl, 'submit-response');
                     return;
                 }
                 if (submitResponse.status === LokotroPaymentStatus.PendingBankProofUpload) {
@@ -3562,11 +3580,11 @@ class LokotroPaymentService {
     startMobileMoneyPolling(transactionId) {
         this.stopMobileMoneyPolling();
         this.mobileMoneyPollingAttempts = 0;
-        console.log('[Lokotro Payment] Starting mobile money status polling for:', transactionId);
+        // PR-1.2: removed console.log of transactionId — operational logging
+        // should be opt-in via merchant config, not on by default.
         this.mobileMoneyPollingTimer = setInterval(() => {
             this.mobileMoneyPollingAttempts++;
             if (this.mobileMoneyPollingAttempts > LokotroPaymentService.MOBILE_MONEY_MAX_ATTEMPTS) {
-                console.warn('[Lokotro Payment] Mobile money polling max attempts reached');
                 this.stopMobileMoneyPolling();
                 this.handlePaymentFailure('Payment took too long. Please try again or contact support.');
                 return;
@@ -3578,7 +3596,6 @@ class LokotroPaymentService {
                         return;
                     const data = this.unwrapPayload(response.data);
                     const status = this.getString(data['status']).toLowerCase();
-                    console.log(`[Lokotro Payment] Mobile money poll #${this.mobileMoneyPollingAttempts}: status=${status}`);
                     if (status === 'completed' || status === 'success' || status === 'approved') {
                         this.stopMobileMoneyPolling();
                         this.handlePaymentSuccess(data);
@@ -3588,8 +3605,9 @@ class LokotroPaymentService {
                         this.handlePaymentFailure(this.getString(data['message']) || 'Payment failed or was declined');
                     }
                 },
-                error: (err) => {
-                    console.error('[Lokotro Payment] Mobile money polling error:', err);
+                error: (_err) => {
+                    // PR-1.2: don't log full error object — may contain backend
+                    // response details that leak server internals to console.
                 }
             });
         }, LokotroPaymentService.MOBILE_MONEY_POLL_INTERVAL);
@@ -3602,9 +3620,47 @@ class LokotroPaymentService {
             clearInterval(this.mobileMoneyPollingTimer);
             this.mobileMoneyPollingTimer = undefined;
             this.mobileMoneyPollingAttempts = 0;
-            console.log('[Lokotro Payment] Mobile money polling stopped');
         }
     }
+    /**
+     * Validate a server-supplied redirect URL before handing the browser tab to
+     * it. Defense-in-depth for Angular HIGH-1 — server-side per-merchant
+     * allow-list (PR-2.0) is the real fix.
+     *
+     * Policy:
+     *   - Reject non-http(s) schemes (blocks `javascript:`, `data:`, `file:`,
+     *     `intent:`, custom schemes).
+     *   - Reject http:// in production.
+     *   - Reject malformed URLs.
+     *   - SSR safety: skip the redirect when window is unavailable.
+     */
+    redirectIfAllowed(url, _origin) {
+        if (typeof window === 'undefined') {
+            return;
+        }
+        if (!url || typeof url !== 'string') {
+            this.handlePaymentFailure('Invalid redirect URL');
+            return;
+        }
+        let parsed;
+        try {
+            parsed = new URL(url, window.location.href);
+        }
+        catch {
+            this.handlePaymentFailure('Untrusted redirect URL');
+            return;
+        }
+        if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+            this.handlePaymentFailure('Untrusted redirect scheme');
+            return;
+        }
+        const isProduction = LokotroPayEnv.environment === 'production';
+        if (isProduction && parsed.protocol !== 'https:') {
+            this.handlePaymentFailure('Insecure redirect rejected');
+            return;
+        }
+        window.location.href = parsed.toString();
+    }
     /**
      * Handle payment success
      */
@@ -3682,7 +3738,8 @@ class LokotroPaymentService {
                 isLoading: false,
                 transactionId: paymentId
             });
-            window.location.href = redirectUrl;
+            // PR-1.2 / Angular HIGH-1: validate before redirect.
+            this.redirectIfAllowed(redirectUrl, 'session-created');
             return of(void 0);
         }
         if (this.getString(additionalData?.['action']) === 'select_payment_method') {
@@ -3731,7 +3788,8 @@ class LokotroPaymentService {
                     this.getString(transactionData['redirect_url']);
                 if (hostedCheckoutUrl) {
                     this.updateState({ isLoading: false });
-                    window.location.href = hostedCheckoutUrl;
+                    // PR-1.2 / Angular HIGH-1: validate hosted-checkout URL.
+                    this.redirectIfAllowed(hostedCheckoutUrl, 'hosted-checkout');
                     return of(void 0);
                 }
             }
@@ -3778,15 +3836,25 @@ class LokotroPaymentService {
      */
     convertPaymentBodyToRequest(body) {
         const request = {
-            customer_reference: body.customerReference,
-            amount: body.amount,
-            currency: body.currency.toLowerCase(),
             payment_method: body.paymentMethod || 'wallet',
             user_info: body.userInfo || 'full',
             payment_method_info: body.paymentMethodInfo || 'full',
             fee_covered_by: body.feeCoveredBy || 'buyer',
             delivery_behaviour: body.deliveryBehaviour || 'direct_delivery'
         };
+        // Auth-v3 refactor: customer_reference / amount / currency are bound
+        // on the session_token. The gateway reads them straight from the
+        // session — sending them again on the wire is redundant, and was
+        // the source of the `"1.00"` vs `"1"` formatting drift that 400'd
+        // body-binding. Only include them when the merchant explicitly set
+        // them (legacy / display reasons). The gateway treats them as a
+        // soft check when present, ignores when absent.
+        if (body.customerReference)
+            request['customer_reference'] = body.customerReference;
+        if (body.amount)
+            request['amount'] = body.amount;
+        if (body.currency)
+            request['currency'] = body.currency.toLowerCase();
         if (body.notifyUrl)
             request['notify_url'] = body.notifyUrl;
         if (body.successRedirectUrl)
@@ -3966,6 +4034,9 @@ class LokotroPaymentService {
             name,
             displayName: this.getString(data['display_name']) || name,
             channel: this.parseChannel(rawChannel),
+            // PR-3.0 — pull the provider flag through. Legacy responses omit it →
+            // remains undefined, consumers fall back to channel-level branching.
+            flag: this.parsePaymentMethodFlag(this.getString(data['flag'])),
             iconUrl: this.getString(data['icon_url']) || this.getString(data['icon']),
             isEnabled: this.getBoolean(data['is_enabled'], this.getBoolean(data['available'], true)),
             configuration: this.asRecord(data['configuration']),
@@ -3974,6 +4045,19 @@ class LokotroPaymentService {
                 : undefined
         };
     }
+    /**
+     * PR-3.0 — narrow an arbitrary string to the LokotroPaymentMethodFlag union.
+     * Unknown / empty inputs return undefined so the field stays optional.
+     */
+    parsePaymentMethodFlag(value) {
+        const known = [
+            'none', 'all',
+            'onafriq_mobile_money', 'onafriq_credit_card', 'rawbank_credit_card',
+            'lokotro_wallet', 'lokotro_eflash',
+            'cash', 'bank_transfer', 'google_pay', 'apple_pay',
+        ];
+        return known.find(f => f === value);
+    }
     /**
      * Parse submit response from API.
      */
@@ -4193,18 +4277,13 @@ class LokotroPayCheckoutComponent {
         }
     }
     initializeEnvironment() {
-        console.log('[Lokotro Checkout] initializeEnvironment - configs:', {
-            token: this.configs.token?.substring(0, 20) + '...',
-            isProduction: this.configs.isProduction,
-            customApiUrl: this.configs.customApiUrl
-        });
+        // PR-1.2 / CRIT-2: previous logs printed a truncated form of the merchant
+        // token to the browser console on every checkout init. Removed.
         LokotroPayEnv.initialize(this.configs.isProduction ?? false, this.configs.customApiUrl);
-        console.log('[Lokotro Checkout] Calling setAppKey with token');
         this.paymentService.setAppKey(this.configs.token);
         if (this.configs.acceptLanguage) {
             this.paymentService.setAcceptLanguage(this.configs.acceptLanguage);
         }
-        console.log('[Lokotro Checkout] Environment initialized');
     }
     initializeLocalization() {
         if (this.language) {