@spare-technologies/spare-link 1.0.0 → 1.1.0

package/src/ui/hosted/hosted-payment-webview.tsx

@@ -1,8 +1,10 @@
-import { useCallback, useEffect } from 'react';
+import { useCallback, useEffect, useRef } from 'react';
 import { StyleSheet, View } from 'react-native';
 import { WebView, type WebViewMessageEvent } from 'react-native-webview';
+import { parseHostedBridgeMessage } from '../../internal/hosted/bridge-message';
 import { buildHostedPaymentUrl, isHostedOriginUrl } from '../../internal/hosted/hosted-url';
 import { createLogger } from '../../internal/logger';
+import { createTelemetryRequestHandler } from '../../internal/telemetry/native-telemetry-reply';
 import { parseUrlParts } from '../../internal/url-parts';
 import { Colors } from '../theme';
 
@@ -44,6 +46,15 @@ export interface HostedPaymentWebViewProps {
    * this component stays a transport.
    */
   onBridgeMessage: (message: unknown) => void;
+  /**
+   * Answers the page's telemetry request with this device's native risk facts.
+   *
+   * The reply travels back by injected script rather than a return value, so it
+   * is handled here where the webview reference lives, and the message never
+   * reaches [onBridgeMessage]. Absent, or answering null, means the page
+   * proceeds with what the browser alone can see.
+   */
+  onTelemetryRequest?: () => Promise<Record<string, unknown> | null>;
   /** Called when the page itself could not be loaded. */
   onLoadFailure?: () => void;
   /**
@@ -63,8 +74,10 @@ export interface HostedPaymentWebViewProps {
  * the page reports, and refuses to navigate anywhere else.
  */
 export function HostedPaymentWebView(props: HostedPaymentWebViewProps): JSX.Element {
-  const { baseUrl, reference, onBridgeMessage, onLoadFailure, onMounted } = props;
+  const { baseUrl, reference, onBridgeMessage, onTelemetryRequest, onLoadFailure, onMounted } =
+    props;
   const uri = buildHostedPaymentUrl({ baseUrl, reference });
+  const webViewRef = useRef<WebView>(null);
 
   // This reports that *this* webview exists, and a retry mounts a fresh instance
   // which reports itself anew. Re-running on a new callback identity would
@@ -76,9 +89,23 @@ export function HostedPaymentWebView(props: HostedPaymentWebViewProps): JSX.Elem
 
   const handleMessage = useCallback(
     (event: WebViewMessageEvent) => {
-      onBridgeMessage(event.nativeEvent.data);
+      const raw = event.nativeEvent.data;
+
+      // The telemetry request is answered here, where the webview reference
+      // lives, because the reply is delivered by injecting script — a channel
+      // only this component holds. Everything else stays the caller's.
+      if (onTelemetryRequest && parseHostedBridgeMessage(raw)?.type === 'telemetryRequest') {
+        const respond = createTelemetryRequestHandler({
+          collect: onTelemetryRequest,
+          inject: (script) => webViewRef.current?.injectJavaScript(script),
+        });
+        void respond();
+        return;
+      }
+
+      onBridgeMessage(raw);
     },
-    [onBridgeMessage],
+    [onBridgeMessage, onTelemetryRequest],
   );
 
   // Every navigation is routed through here rather than through `originWhitelist`.
@@ -99,6 +126,7 @@ export function HostedPaymentWebView(props: HostedPaymentWebViewProps): JSX.Elem
     // modal, so this fills what it is given.
     <View style={styles.container} testID="hosted-payment-webview">
       <WebView
+        ref={webViewRef}
         source={{ uri }}
         onMessage={handleMessage}
         originWhitelist={ALLOW_ALL_ORIGINS}
@@ -141,6 +169,16 @@ export function HostedPaymentWebView(props: HostedPaymentWebViewProps): JSX.Elem
         style={styles.webview}
         javaScriptEnabled
         domStorageEnabled
+        // Lets the page's consent screen ask for a coarse location fix, which it
+        // attaches to the payment as a risk signal. Android only; iOS raises its
+        // own per-origin system prompt, gated by the host app's usage-description
+        // entry. This toggle is frame-wide — the platform offers no per-origin
+        // answer here — so the scope rests on `handleShouldStartLoad` above
+        // refusing every off-origin document in this frame. The toggle alone also
+        // reveals nothing: the host application must hold the user-facing location
+        // permission, and without it the page's request fails and the payment
+        // proceeds without the signal.
+        geolocationEnabled
         // The page holds a payment in progress and nothing else should share its
         // storage, on this device or between payers on it.
         incognito

package/src/version.ts

@@ -6,4 +6,4 @@
  * `changeset version`). The src/index.ts smoke test asserts this matches
  * package.json's version.
  */
-export const SDK_VERSION = '1.0.0' as const;
+export const SDK_VERSION = '1.1.0' as const;