@economist/web-apple-pay 0.1.3-beta.2 → 0.1.3-beta.21

package/dist/src/stories/utils/story-env.js

@@ -1,18 +1,11 @@
 // src/clients/payment-checkout/config.ts
 var runtimeConfig = null;
 var configureApplePay = (config) => {
-  console.log("[web-apple-pay] configureApplePay called", {
-    merchantId: config.merchantId,
-    walletApiBaseUrl: config.walletApiBaseUrl,
-    debugBypassEnabled: config.debugBypassEnabled,
-    recaptchaSiteKey: config.recaptchaSiteKey ? "***" : void 0
-  });
   runtimeConfig = {
     ...config
   };
 };
 var resetApplePayConfig = () => {
-  console.log("[web-apple-pay] resetApplePayConfig called");
   runtimeConfig = null;
 };
 
@@ -39,6 +32,24 @@ var createFetchMock = (sessionResponse, sessionStatus = 200) => {
         headers: { "content-type": "application/json" }
       });
     }
+    if (requestUrl.includes("/v1/wallet/payment-options/sku/")) {
+      return new Response(
+        JSON.stringify({
+          options: {
+            apple_pay: {
+              provider: "apple-pay",
+              settings: {
+                supported_networks: ["visa", "masterCard", "amex"]
+              }
+            }
+          }
+        }),
+        {
+          status: 200,
+          headers: { "content-type": "application/json" }
+        }
+      );
+    }
     return new Response("Not Found", {
       status: 404,
       statusText: "Not Found"

package/dist/src/utils/expressCheckoutRedirect.d.ts

@@ -1,11 +1,24 @@
 /**
  * Centralized redirect URL builders for the Express Checkout payment handler.
  *
- * All redirects include a `returnUrl` parameter so downstream pages
- * (/checkout/complete, onboarding) can return the user to the original article.
+ * Before redirecting, the origin article URL is persisted to localStorage under
+ * the `checkout-redirect` key so that sma-checkout / the onboarding app can
+ * return the user to the article after checkout and onboarding complete.
  *
  * Matches sma-checkout: src/lib/navigate-to-checkout/index.tsx
  */
+/**
+ * Validates that a URL is safe to use as a post-checkout redirect destination,
+ * then writes it to localStorage under `checkout-redirect`.
+ *
+ * Allowed values:
+ *  - Relative paths (start with `/`)
+ *  - Absolute URLs on `economist.com` or any subdomain of it
+ *
+ * Any other value (e.g. an external domain) is silently rejected to prevent
+ * open-redirect vulnerabilities.
+ */
+export declare const writeCheckoutRedirect: (originUrl: string) => void;
 /**
  * Captures the current page URL (the article the user is reading).
  * Must be called before any redirect occurs.
@@ -29,26 +42,34 @@ export declare const buildQueryString: () => string;
 export declare const decodeSku: (sku: string) => string;
 /**
  * Builds the success redirect URL.
- * /checkout/complete?basketId={id}&lmo_offer={sku}&status={userStatus}&redirectToCheckout=true&returnUrl=...
+ * /checkout/complete?basketId={id}&lmo_offer={sku}&status={userStatus}&redirectToCheckout=true
+ *
+ * The origin article URL is written to localStorage by the caller via
+ * writeCheckoutRedirect() before this redirect fires.
  */
 export declare const redirectToCheckoutComplete: (params: {
     basketId: string;
     status: "nex" | "lex";
     skuId: string;
-    returnUrl: string;
     queryString?: string;
 }) => string;
 /**
  * Builds the fallback redirect URL for error scenarios.
- * /checkout?lmo_offer={sku}&inlineError=...&returnUrl=...
+ * /checkout?lmo_offer={offerPath}&inlineError=...
+ *
+ * The skuId is decoded via decodeSku() before being set as lmo_offer, producing
+ * a Limio offer path (e.g. /offers2/UK-UK.DIGITAL.1YAR.X.DISC.30.NYT) as
+ * checkout expects. If decoding fails (malformed SKU), the raw skuId is used.
  *
  * Builds on top of the current page URL (window.location.href) so that any
  * existing query params (UTM tags, campaign flags) are preserved — matching
  * sma-checkout: src/lib/navigate-to-checkout/index.tsx
+ *
+ * The origin article URL is written to localStorage by the caller via
+ * writeCheckoutRedirect() before this redirect fires.
  */
 export declare const redirectToCheckoutFallback: (params: {
     skuId: string;
-    returnUrl: string;
     inlineError?: string;
     emailError?: string;
     email?: string;

package/dist/src/utils/expressCheckoutRedirect.js

@@ -1,4 +1,20 @@
 // src/utils/expressCheckoutRedirect.ts
+var CHECKOUT_REDIRECT_KEY = "checkout-redirect";
+var ALLOWED_REDIRECT_HOSTNAME = "economist.com";
+var writeCheckoutRedirect = (originUrl) => {
+  if (originUrl.startsWith("/")) {
+    localStorage.setItem(CHECKOUT_REDIRECT_KEY, originUrl);
+    return;
+  }
+  try {
+    const { hostname } = new URL(originUrl);
+    const isAllowed = hostname === ALLOWED_REDIRECT_HOSTNAME || hostname.endsWith(`.${ALLOWED_REDIRECT_HOSTNAME}`);
+    if (isAllowed) {
+      localStorage.setItem(CHECKOUT_REDIRECT_KEY, originUrl);
+    }
+  } catch {
+  }
+};
 var captureOriginUrl = () => window.location.href;
 var buildQueryString = () => {
   const countryCode = new URLSearchParams(window.location.search).get(
@@ -23,18 +39,16 @@ var redirectToCheckoutComplete = (params) => {
   url.searchParams.set("lmo_offer", params.skuId);
   url.searchParams.set("status", params.status);
   url.searchParams.set("redirectToCheckout", "true");
-  url.searchParams.set("returnUrl", params.returnUrl);
   return url.pathname + url.search;
 };
 var redirectToCheckoutFallback = (params) => {
   const url = new URL(window.location.href);
   url.pathname = "/checkout";
-  url.searchParams.set("lmo_offer", params.skuId);
+  url.searchParams.set("lmo_offer", decodeSku(params.skuId));
   if (params.inlineError)
     url.searchParams.set("inlineError", params.inlineError);
   if (params.email) url.searchParams.set("email", params.email);
   if (params.emailError) url.searchParams.set("emailError", params.emailError);
-  url.searchParams.set("returnUrl", params.returnUrl);
   return url.pathname + url.search;
 };
 export {
@@ -42,5 +56,6 @@ export {
   captureOriginUrl,
   decodeSku,
   redirectToCheckoutComplete,
-  redirectToCheckoutFallback
+  redirectToCheckoutFallback,
+  writeCheckoutRedirect
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@economist/web-apple-pay",
   "description": "Web component package for Apple Pay checkout UI",
-  "version": "0.1.3-beta.2",
+  "version": "0.1.3-beta.21",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",