add validations for isEligible merchant payload

src/three-domain-secure/component.jsx

@@ -5,7 +5,7 @@ import { type LoggerType } from "@krakenjs/beaver-logger/src";
 import { type ZoidComponent } from "@krakenjs/zoid/src";
 import { base64encode } from "@krakenjs/belter/src";
 import { ZalgoPromise } from "@krakenjs/zalgo-promise/src";
-import { FPTI_KEY } from "@paypal/sdk-constants/src";
+import { FPTI_KEY, CURRENCY } from "@paypal/sdk-constants/src";
 
 import { PAYMENT_3DS_VERIFICATION, AUTH } from "../constants/api";
 import { ValidationError } from "../lib";
@@ -94,6 +94,8 @@ export class ThreeDomainSecureComponent {
   }
 
   async isEligible(merchantPayload: MerchantPayloadData): Promise<boolean> {
+    this.validateMerchantPayload(merchantPayload);
+
     const data = parseMerchantPayload({ merchantPayload });
     this.fastlaneNonce = merchantPayload.nonce;
 
@@ -218,6 +220,49 @@ export class ThreeDomainSecureComponent {
     });
   }
 
+  validateMerchantPayload(merchantPayload: MerchantPayloadData): void {
+    // TODO we have a ticket to standardize client-side validations
+    // eslint-disable-next-line flowtype/no-weak-types
+    const isRequired = (value: any) => Boolean(value);
+    // eslint-disable-next-line flowtype/no-weak-types
+    const isString = (value: any) => typeof value === "string";
+
+    const validations = {
+      amount: {
+        test: [isString, isRequired],
+        message: (value) =>
+          `[amount] is required and must be a string. received: ${value}`,
+      },
+      currency: {
+        test: [(value) => value in CURRENCY, isRequired],
+        message: (value) =>
+          `[currency] is required and must be a valid currency. received: ${value}`,
+      },
+      nonce: {
+        test: [isString, isRequired],
+        message: (value) =>
+          `[nonce] is required and must be a string. received: ${value}`,
+      },
+    };
+
+    const errors = [];
+
+    Object.entries(merchantPayload).forEach(([key, value]) => {
+      if (key in validations) {
+        if (!validations[key]?.test?.every((validation) => validation(value))) {
+          errors.push(validations[key]?.message(value));
+        }
+      }
+    });
+
+    if (errors.length) {
+      const joinedErrors = errors.join("\n");
+
+      this.logger.warn(joinedErrors);
+      throw new ValidationError(joinedErrors);
+    }
+  }
+
   updateNonceWith3dsData(threeDSRefID: string): Promise<GqlResponse> {
     // $FlowFixMe Zalgopromise not recognized
     return this.graphQLClient.request({

src/three-domain-secure/component.test.js

@@ -4,6 +4,8 @@ import { describe, expect, vi, afterEach } from "vitest";
 import { getEnv } from "@paypal/sdk-client/src";
 import { FPTI_KEY } from "@paypal/sdk-constants/src";
 
+import { ValidationError } from "../lib";
+
 import { ThreeDomainSecureComponent } from "./component";
 
 const defaultSdkConfig = {
@@ -150,6 +152,55 @@ describe("three domain secure component - isEligible method", () => {
     ).rejects.toThrow(new Error("Error with API"));
     expect(mockRestClient.request).toHaveBeenCalled();
   });
+
+  test.each([
+    [
+      "undefined nonce",
+      { currency: "USD", amount: "12.00", nonce: undefined },
+      "[nonce] is required and must be a string. received: undefined",
+    ],
+
+    [
+      "undefined currency",
+      { currency: undefined, amount: "12.00", nonce: "abc-nonce" },
+      "[currency] is required and must be a valid currency. received: undefined",
+    ],
+    [
+      "invalid currency",
+      { currency: "FOO", amount: "12.00", nonce: "abc-nonce" },
+      "[currency] is required and must be a valid currency. received: FOO",
+    ],
+    [
+      "amount as a number",
+      { currency: "USD", amount: 12, nonce: "abc-nonce" },
+      "[amount] is required and must be a string. received: 12",
+    ],
+    [
+      "undefined amount",
+      { currency: "USD", amount: undefined, nonce: "abc-nonce" },
+      "[amount] is required and must be a string. received: undefined",
+    ],
+    [
+      "multiple errors",
+      { currency: undefined, amount: undefined, nonce: undefined },
+      "[currency] is required and must be a valid currency. received: undefined\n" +
+        "[amount] is required and must be a string. received: undefined\n" +
+        "[nonce] is required and must be a string. received: undefined",
+    ],
+  ])(
+    "should throw validation error on %s",
+    async (_assertion, params, expected) => {
+      const threeDomainSecureClient = createThreeDomainSecureComponent();
+
+      await expect(() =>
+        threeDomainSecureClient.isEligible(params)
+      ).rejects.toThrow(new ValidationError(expected));
+
+      expect(threeDomainSecureClient.logger.warn).toHaveBeenCalledWith(
+        expected
+      );
+    }
+  );
 });
 
 describe.todo("three domain descure component - show method", () => {