feat(card): mint the secure card details token (LIVE-34778) - #21467
feat(card): mint the secure card details token (LIVE-34778)#21467philipptpunkt wants to merge 1 commit into
Conversation
`POST /v1/card/details/token` answers with a token and an image URL. The image renders PAN, CVV and expiry, so the card data never passes through the app. - A mutation, though it reads. The provider spends the token the first time the image is fetched, so a cached answer would be a spent one, and RTK Query retains query results while a subscriber lives. Mutations are neither cached nor retained, and a test asserts the token never reaches the cache. - `customCss` is optional and validated as hex here, so a bad colour fails before the request rather than as a 422. - `token` is a plain non-empty string. The reference calls it a UUID, but the card id in the same API is a digit string despite looking like one, and the sandbox has already diverged from the reference three times this week.
Web Tools Build Status
|
Mobile Bundle Checks
Desktop Bundle Checks |
There was a problem hiding this comment.
🟡 Changes recommended
The implementation does not currently validate customCss before sending the request, which contradicts the PR/changeset claims and can lead to invalid payloads still reaching the backend.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds a new Card Management API endpoint to mint a single-use “card details” token + image URL (so PAN/CVV/expiry can be rendered from an image without the app handling raw card details), along with supporting schemas/types, tests, docs, and a changeset for @domain/api-card-management.
Changes:
- Introduces
createCardDetailsTokenRTK Query mutation forPOST /v1/card/details/token. - Adds Zod schemas + inferred types for the token response and optional
customCsspayload. - Extends test coverage (schema + request behavior) and updates package README + changeset.
File summaries
| File | Description |
|---|---|
| domain/api/card-management/src/types.ts | Adds inferred types for customCss and the token response. |
| domain/api/card-management/src/schema.ts | Defines Zod schemas for customCss (hex colors) and the token response. |
| domain/api/card-management/src/schema.test.ts | Adds schema tests for token response and customCss validation. |
| domain/api/card-management/src/api.ts | Adds createCardDetailsToken mutation and exports its generated hook. |
| domain/api/card-management/src/api.test.ts | Adds endpoint exposure tests + request tests and a “not in queries cache” assertion. |
| domain/api/card-management/README.md | Documents the new endpoint in the package endpoint table. |
| .changeset/pay-card-details-token.md | Declares a minor bump and documents the new endpoint behavior. |
Review details
- Files reviewed: 7/7 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| createCardDetailsToken: build.mutation<PayCardDetailsToken, PayCardDetailsCss | void>({ | ||
| query: customCss => ({ | ||
| url: "/v1/card/details/token", | ||
| method: "POST", | ||
| ...(customCss ? { body: { customCss } } : {}), |
Rsdoctor Bundle Diff AnalysisFound 7 projects in monorepo, 7 projects with changes. 📊 Quick Summary
📋 Detailed Reports (Click to expand)📁 desktop-mainPath:
📁 desktop-preloaderPath:
📁 desktop-rendererPath:
📁 desktop-webviewDappPreloaderPath:
📁 desktop-webviewPreloaderPath:
📁 desktop-workersPath:
📁 mobilePath:
Generated by Rsdoctor GitHub Action |
|
Stack (managed by stac-man)
POST /v1/card/details/tokenanswers with a token and an image URL. The imagerenders PAN, CVV and expiry, so the card data never passes through the app.
image is fetched, so a cached answer would be a spent one, and RTK Query
retains query results while a subscriber lives. Mutations are neither cached
nor retained, and a test asserts the token never reaches the cache.
customCssis optional and validated as hex here, so a bad colour failsbefore the request rather than as a 422.
tokenis a plain non-empty string. The reference calls it a UUID, but thecard id in the same API is a digit string despite looking like one, and the
sandbox has already diverged from the reference three times this week.