feat: incoming message origin validation for react native#477
Conversation
Assisted-By: devx/6d172f11-c70b-447c-9803-84d58a5e6c3a
|
Warning This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
This stack of pull requests is managed by Graphite. Learn more about stacking. |
| } | ||
|
|
||
| if (config.hasKey("allowedMessageOrigins")) { | ||
| configuration.setAllowedMessageOrigins(toStringSet(config.getArray("allowedMessageOrigins"))); |
There was a problem hiding this comment.
It looks like both native SDKs are still pinned to 4.0.0-alpha.2, which predates the APIs used by the Android and iOS bridges in this PR. Could we update both pins once compatible native releases are available so normal consumer builds pick up these APIs?
| * | ||
| * @default [] (all origins trusted) | ||
| */ | ||
| allowedMessageOrigins?: string[]; |
There was a problem hiding this comment.
Would it make sense to expose a typed rejection callback or event through both native bridges? React Native consumers cannot currently observe rejected messages, and the debug log is hidden by the default error log level. Native debug logging could remain the fallback.
| colorScheme?: string; | ||
| logLevel?: string; | ||
| preloading?: boolean; | ||
| allowedMessageOrigins?: string[]; |
There was a problem hiding this comment.
It looks like getConfig() will omit allowedMessageOrigins after it has been set. Could we add the field to the result spec and both native getters, with a round-trip test?
2 participants
What changes are you making?
How to test
Before you merge
Important
platforms/swift/README.mdand/orplatforms/android/README.md)Releasing a new Swift version?
ShopifyCheckoutKit.podspecplatforms/swift/Sources/ShopifyCheckoutKit/ShopifyCheckoutKit.swiftplatforms/swift/README.md(major version only)Releasing a new Embedded Checkout Protocol version?
embeddedCheckoutProtocolAndroidinplatforms/android/gradle/libs.versions.tomlprotocol/languages/kotlin/embedded-checkout-protocol/api/embedded-checkout-protocol.apiif the public API changedReleasing a new Android version?
checkoutKitAndroidinplatforms/android/gradle/libs.versions.tomlplatforms/android/README.mdTip
See the Contributing documentation for the full release process per platform.