Skip to content

docs(ack-pay): document incomplete checks in verifyPaymentReceiptClaim #249

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
forumevi wants to merge 1 commit into from
Closed

docs(ack-pay): document incomplete checks in verifyPaymentReceiptClaim #249

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 19 additions & 2 deletions packages/ack-pay/src/receipt-claim-verifier.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,25 @@ async function verifyPaymentReceiptClaim(
throw new InvalidCredentialSubjectError()
}

return Promise.resolve()
// TODO: The schema check above confirms the credential subject is
// structurally valid (paymentRequestToken is a JWT string, paymentOptionId
// is present). Deeper semantic checks that could be added here:
//
// 1. Verify that paymentRequestToken is not expired (call
// verifyPaymentRequestToken with verifyExpiry: true). Note that
// verifyPaymentReceipt already does this on the outer credential, but
// the ClaimVerifier runs against the proof-decoded subject and could
// enforce it independently.
//
// 2. Verify that paymentOptionId matches one of the options in the
// decoded paymentRequestToken. verifyPaymentReceipt already performs
// this check, but centralising it here would make the ClaimVerifier
// self-contained and usable outside of verifyPaymentReceipt.
//
// Both checks require the resolver (or at minimum the decoded payment
// request), so the ClaimVerifier interface would need to be extended to pass
// additional context, or the checks should remain in verifyPaymentReceipt
// where that context is already available.
}

/**
Expand All @@ -52,7 +70,6 @@ async function verifyPaymentReceiptClaim(
export function getReceiptClaimVerifier(): ClaimVerifier {
return {
accepts: (type: string[]) => type.includes("PaymentReceiptCredential"),
// For now, we just verify the credential subject matches the expected schema
verify: verifyPaymentReceiptClaim,
}
}