search

Expensify / App

Welcome to New Expensify: a complete re-imagination of financial collaboration, centered around chat. Help us build the next generation of Expensify by sharing feedback and contributing to the code.
https://new.expensify.com
MIT License
3.3k stars 2.74k forks source link

[Payment card / Subscription] make backend 3DS code not rely on Web-Secure #46144

Closed blimpich closed 1 month ago

blimpich commented 1 month ago

https://github.com/Expensify/App/issues/44795 made it so that our backend communicated with the new dot frontend in order to properly authenticate a user using stripe's 3DS/SCA flow, but it hinged on modifying a file in web-secure in order for this to work. This is a problem for 2 reasons:

  1. we want to minimize using Web-Secure since we would like to get rid of it entirely one day
  2. this makes it difficult/cumbersome for contributors to test our 3ds flow locally even with access to our ngrok endpoints, since hitting the secure repo requires using a different ngrok endpoint

So its in our best interest to migrate this code over to web.

blimpich commented 1 month ago

Will require changing the returnUrl in the stripe class in Auth as well to not hit the secure endpoint, and instead in the normal web-expensify one. Most of the work will be in moving the necessary code from web-secure to web-expensify though.

blimpich commented 1 month ago

Also probably want a web-secure PR to get rid of all the code that won't be used anymore

blimpich commented 1 month ago

Starting working on this a bit today, got some draft PRs up. Struggling to get it to actually work locally though. Tricky flow to debug, but working through it.

blimpich commented 1 month ago

Not overdue, was the weekend.

blimpich commented 1 month ago

Not overdue, was on vacation

blimpich commented 1 month ago

Couldn't get to this today, was busy doing chores. Will try to get to this tomorrow.

blimpich commented 1 month ago

Worked on this a bit today, no major progress, still stuck trying to unbreak Old Dot. Only had a little bit of time to focus on this today though, so hoping a quiet Friday tomorrow will give me time to get through it.

blimpich commented 1 month ago

I may have found a work around that would make all these PRs not needed. Currently trying to test this with a contributor.

blimpich commented 1 month ago

Was able to figure out a workaround for this. Figured out issue in this slack thread.

So the solution was to change the return url auth is giving stripe to be the ngrok url, and also I had to delete most of callback.php in web-secure. This works for testing purposes for 3DS.

Closing as this is no longer needed.