Add passive hCaptcha to radar_session #7722

awush-stripe · 2023-12-12T20:55:58Z

Summary

Add a compile-only passive hCaptcha to radar sessions.

Motivation

Part of #ir-enthrall-blossom. See project description here.

Testing

Added tests
Modified tests
Manually verified

Changelog

Added

awush-stripe · 2023-12-12T20:58:30Z

payments-core/src/main/java/com/stripe/android/Stripe.kt

     */
    @UiThread
    @JvmOverloads
    fun createRadarSession(
        stripeAccountId: String? = this.stripeAccountId,
-        callback: ApiResultCallback<RadarSession>
+        callback: ApiResultCallback<RadarSession>,
+        activity: AppCompatActivity? = null


This is a new requirement for anyone calling this endpoint. I have some mild FUD with adding this, but it's required by hCaptcha, so we may not have a choice.

this isn't something we can obtain programmatically?

Unfortunately because we don't know the context in which this method is called, no. I'll revisit how the SDK actually uses this and see if we can omit it.

github-actions · 2023-12-12T21:01:27Z

Diffuse output:

OLD: paymentsheet-example-release-master.apk (signature: V1, V2)
NEW: paymentsheet-example-release-pr.apk (signature: V1, V2)

          │             compressed             │            uncompressed            
          ├───────────┬───────────┬────────────┼───────────┬───────────┬────────────
 APK      │ old       │ new       │ diff       │ old       │ new       │ diff       
──────────┼───────────┼───────────┼────────────┼───────────┼───────────┼────────────
      dex │   3.6 MiB │   3.6 MiB │      +96 B │   7.8 MiB │   7.8 MiB │     +376 B 
     arsc │   2.3 MiB │   2.4 MiB │ +115.4 KiB │   2.3 MiB │   2.4 MiB │ +115.4 KiB 
 manifest │   5.1 KiB │   5.1 KiB │       +1 B │  25.4 KiB │  25.4 KiB │        0 B 
      res │ 922.9 KiB │ 926.8 KiB │   +3.9 KiB │   1.4 MiB │   1.4 MiB │  +14.4 KiB 
   native │   2.6 MiB │   2.6 MiB │        0 B │     6 MiB │     6 MiB │        0 B 
    asset │     3 MiB │     3 MiB │      -18 B │     3 MiB │     3 MiB │      -18 B 
    other │ 205.3 KiB │ 205.5 KiB │     +196 B │ 462.1 KiB │ 462.4 KiB │     +328 B 
──────────┼───────────┼───────────┼────────────┼───────────┼───────────┼────────────
    total │  12.5 MiB │  12.6 MiB │ +119.6 KiB │  20.9 MiB │    21 MiB │ +130.5 KiB 

 DEX     │ old   │ new   │ diff       
─────────┼───────┼───────┼────────────
   files │     1 │     1 │  0         
 strings │ 38811 │ 38814 │ +3 (+4 -1) 
   types │ 12994 │ 12995 │ +1 (+1 -0) 
 classes │ 10978 │ 10979 │ +1 (+1 -0) 
 methods │ 53986 │ 53993 │ +7 (+7 -0) 
  fields │ 35916 │ 35916 │  0 (+0 -0) 

 ARSC    │ old  │ new  │ diff         
─────────┼──────┼──────┼──────────────
 configs │  292 │  327 │ +35 (+35 -0) 
 entries │ 6940 │ 6947 │  +7 (+7 -0)

APK

      compressed       │      uncompressed      │                                
──────────┬────────────┼───────────┬────────────┤                                
 size     │ diff       │ size      │ diff       │ path                           
──────────┼────────────┼───────────┼────────────┼────────────────────────────────
  2.4 MiB │ +115.4 KiB │   2.4 MiB │ +115.4 KiB │ ∆ resources.arsc               
  3.2 KiB │   +3.2 KiB │  12.8 KiB │  +12.8 KiB │ + res/Sq.xml                   
    785 B │     +785 B │   1.6 KiB │   +1.6 KiB │ + res/Bh.xml                   
 50.4 KiB │     +110 B │ 148.1 KiB │     +164 B │ ∆ META-INF/MANIFEST.MF         
  3.6 MiB │      +96 B │   7.8 MiB │     +376 B │ ∆ classes.dex                  
 66.1 KiB │      +88 B │ 148.2 KiB │     +164 B │ ∆ META-INF/CERT.SF             
  6.7 KiB │      -19 B │   6.6 KiB │      -19 B │ ∆ assets/dexopt/baseline.prof  
  1.2 KiB │       -2 B │   1.2 KiB │        0 B │ ∆ META-INF/CERT.RSA            
    852 B │       +1 B │     720 B │       +1 B │ ∆ assets/dexopt/baseline.profm 
  5.1 KiB │       +1 B │  25.4 KiB │        0 B │ ∆ AndroidManifest.xml          
    805 B │       -1 B │   1.7 KiB │        0 B │ ∆ res/0H.xml                   
    735 B │       +1 B │   1.4 KiB │        0 B │ ∆ res/0o.xml                   
  1.2 KiB │       -1 B │   3.9 KiB │        0 B │ ∆ res/2d.xml                   
    902 B │       +1 B │     2 KiB │        0 B │ ∆ res/2j.xml                   
    596 B │       +1 B │     1 KiB │        0 B │ ∆ res/3A.xml                   
    444 B │       +1 B │     816 B │        0 B │ ∆ res/3h.xml                   
    743 B │       +1 B │   1.5 KiB │        0 B │ ∆ res/9V.xml                   
  1.1 KiB │       +1 B │   3.2 KiB │        0 B │ ∆ res/B7.xml                   
  1.2 KiB │       -1 B │   3.7 KiB │        0 B │ ∆ res/BH.xml                   
    383 B │       +1 B │     504 B │        0 B │ ∆ res/D5.xml                   
    871 B │       -1 B │   2.4 KiB │        0 B │ ∆ res/Jw.xml                   
    708 B │       -1 B │   1.6 KiB │        0 B │ ∆ res/K5.xml                   
    583 B │       -1 B │     1 KiB │        0 B │ ∆ res/S8.xml                   
    370 B │       +1 B │     472 B │        0 B │ ∆ res/TZ.xml                   
    878 B │       +1 B │   2.3 KiB │        0 B │ ∆ res/YB.xml                   
    417 B │       -1 B │     624 B │        0 B │ ∆ res/cy.xml                   
    782 B │       -1 B │   1.7 KiB │        0 B │ ∆ res/dX.xml                   
    949 B │       -1 B │   2.5 KiB │        0 B │ ∆ res/de.xml                   
    810 B │       +1 B │   1.8 KiB │        0 B │ ∆ res/eA.xml                   
    445 B │       +1 B │     816 B │        0 B │ ∆ res/fg.xml                   
    683 B │       -1 B │   1.5 KiB │        0 B │ ∆ res/hP1.xml                  
    383 B │       -1 B │     508 B │        0 B │ ∆ res/in.xml                   
    423 B │       +1 B │     728 B │        0 B │ ∆ res/lE.xml                   
    407 B │       +1 B │     596 B │        0 B │ ∆ res/lW.xml                   
    426 B │       -1 B │     736 B │        0 B │ ∆ res/od.xml                   
    726 B │       +1 B │   1.6 KiB │        0 B │ ∆ res/pq.xml                   
    381 B │       +1 B │     556 B │        0 B │ ∆ res/wF.xml                   
──────────┼────────────┼───────────┼────────────┼────────────────────────────────
  6.1 MiB │ +119.6 KiB │  10.5 MiB │ +130.5 KiB │ (total)

DEX

STRINGS:

   old   │ new   │ diff       
  ───────┼───────┼────────────
   38811 │ 38814 │ +3 (+4 -1) 
  + Lcom/stripe/hcaptcha/webview/HCaptchaWebView;
  + TEST
  + got content
  + ~~R8{backend:dex,compilation-mode:release,has-checksums:false,min-api:21,pg-map-id:4f1b6ed,r8-mode:full,version:8.2.33}
  
  - ~~R8{backend:dex,compilation-mode:release,has-checksums:false,min-api:21,pg-map-id:3f6dd17,r8-mode:full,version:8.2.33}
  

TYPES:

   old   │ new   │ diff       
  ───────┼───────┼────────────
   12994 │ 12995 │ +1 (+1 -0) 
  + Lcom/stripe/hcaptcha/webview/HCaptchaWebView;
  

METHODS:

   old   │ new   │ diff       
  ───────┼───────┼────────────
   53986 │ 53993 │ +7 (+7 -0) 
  + com.stripe.hcaptcha.webview.HCaptchaWebView <init>(Context, AttributeSet)
  + com.stripe.hcaptcha.webview.HCaptchaWebView onCheckIsTextEditor() → boolean
  + com.stripe.hcaptcha.webview.HCaptchaWebView onReceiveContent(ContentInfo) → ContentInfo
  + com.stripe.hcaptcha.webview.HCaptchaWebView performClick() → boolean
  + android.webkit.WebView <init>(Context, AttributeSet)
  + android.webkit.WebView onCheckIsTextEditor() → boolean
  + android.webkit.WebView onReceiveContent(ContentInfo) → ContentInfo

ARSC

CONFIGS:

   old │ new │ diff         
  ─────┼─────┼──────────────
   292 │ 327 │ +35 (+35 -0) 
  + string-ceb
  + string-co
  + string-cy
  + string-eo
  + string-fy
  + string-ga
  + string-gd
  + string-ha
  + string-haw
  + string-hmn
  + string-ht
  + string-ig
  + string-ji
  + string-jw
  + string-ku
  + string-la
  + string-lb
  + string-mg
  + string-mi
  + string-no
  + string-ny
  + string-ps
  + string-rw
  + string-sd
  + string-sm
  + string-sn
  + string-so
  + string-st
  + string-su
  + string-tg
  + string-tk
  + string-tt
  + string-ug
  + string-xh
  + string-yo
  

ENTRIES:

   old  │ new  │ diff       
  ──────┼──────┼────────────
   6940 │ 6947 │ +7 (+7 -0) 
  + drawable/stripe_ic_hcaptcha_logo
  + id/loadingContainer
  + id/webView
  + layout/stripe_hcaptcha_fragment
  + string/stripe_hcaptcha_loading_text
  + string/stripe_hcaptcha_logo_description
  + style/StripeHCaptchaDialogTheme

awush-stripe · 2023-12-12T21:01:37Z

Tests coming shortly

payments-ui-core/src/main/java/com/stripe/android/ui/core/IsStripeCardScanAvailable.kt

jaynewstrom-stripe · 2023-12-12T21:04:57Z

payments-core/src/main/java/com/stripe/android/hcaptcha/HCaptchaProxy.kt

+    private val onComplete: (hcaptchaToken: String) -> Unit,
+) : HCaptchaProxy {
+    override fun performPassiveHCaptcha() {
+        if (BuildConfig.DEBUG) {


This will be false anytime a merchant consumes our SDK (we publish in release mode).

see below comment

jaynewstrom-stripe · 2023-12-12T21:05:38Z

payments-core/src/main/java/com/stripe/android/Stripe.kt

-            )
+            ).flatMap { radarSession ->
+                val siteKey = radarSession.passiveCaptchaSiteKey
+                if (activity == null && BuildConfig.DEBUG) {


This will be false anytime a merchant consumes our SDK (we publish in release mode).

This is specifically intended for our own test apps, and mirrors the existing StripeCardScanProxy. In the event I'm trying to track down what went wrong with our test merchant, it'd be nice to have a specific error I can identify within the code.

… to RadarSessionJsonParser

payments-core/build.gradle

hcaptcha/src/main/java/com/stripe/hcaptcha/HCaptcha.kt

CHANGELOG.md

payments-core/src/main/java/com/stripe/android/Stripe.kt

jaynewstrom-stripe · 2024-01-11T20:46:37Z

payments-core/src/main/java/com/stripe/android/model/RadarSession.kt

@@ -5,5 +5,7 @@ import kotlinx.parcelize.Parcelize

 @Parcelize
 data class RadarSession(
-    val id: String
+    val id: String,
+    val passiveCaptchaSiteKey: String?,


This is a public class, with a public constructor, we can't add params here. (at least not without jvmoverloads and defaults.

Do these new params need to be exposed to merchants? Can we restrict them?

makes sense. I've created a new internal RadarSessionWithHCaptcha object which comes from the repository, and gets converted here.

jaynewstrom-stripe · 2024-01-11T22:31:29Z

payments-core/detekt-baseline.xml

@@ -25,6 +24,7 @@
    <ID>EmptyFunctionBlock:PaymentSessionViewModel.kt$PaymentSessionViewModel${ }</ID>
    <ID>EmptyFunctionBlock:StripeTextWatcher.kt$StripeTextWatcher${ }</ID>
    <ID>ExplicitGarbageCollectionCall:WeakMapInjectorRegistryTest.kt$WeakMapInjectorRegistryTest$gc()</ID>
+    <ID>ImportOrdering:com.stripe.android.googlepaylauncher.GooglePayLauncherViewModelTest.kt:3</ID>


Can we fix this?

🤦 I fixed the ordering but forgot to update the detekt baseline. will do.

awush-stripe requested review from a team as code owners December 12, 2023 20:55

awush-stripe requested a review from jaynewstrom-stripe December 12, 2023 20:55

awush-stripe commented Dec 12, 2023

View reviewed changes

bmathews-stripe reviewed Dec 12, 2023

View reviewed changes

payments-ui-core/src/main/java/com/stripe/android/ui/core/IsStripeCardScanAvailable.kt Outdated Show resolved Hide resolved

jaynewstrom-stripe reviewed Dec 12, 2023

View reviewed changes

payments-ui-core/src/main/java/com/stripe/android/ui/core/IsStripeCardScanAvailable.kt Outdated Show resolved Hide resolved

jaynewstrom-stripe reviewed Dec 12, 2023

View reviewed changes

awush-stripe force-pushed the awush/add_passive_hcaptcha_to_radar_session branch 2 times, most recently from 6d9bea6 to 729258f Compare December 22, 2023 20:04

awush-stripe mentioned this pull request Dec 22, 2023

Add hcaptcha sdk #7733

Merged

3 tasks

awush-stripe force-pushed the awush/add_passive_hcaptcha_to_radar_session branch from 729258f to eddad8a Compare December 22, 2023 21:42

awush-stripe force-pushed the awush/add_passive_hcaptcha_to_radar_session branch from 15ba712 to bc3f03d Compare January 8, 2024 18:48

awush-stripe added 15 commits January 11, 2024 11:47

Add hCaptcha SDK to stripe

00c1469

Add hcaptcha SDK into stripe, converted to kotlin

bcc783f

Lint

d51f2e6

Revert codestyle change

ceea229

Add prefixes, update docstring

6634d3a

Cleanup hCaptcha API surfaces

cfbcca7

Cleanup imports

2ecaf36

Cleanup some funcs

653c285

Add passive hCaptcha to radar_session

656aa26

More appropriately handle configuration errors

9be2412

Add changelog entry

df13ec6

Revert accidental changes to IsStripeCardScanAvailable and add fields…

967afb0

… to RadarSessionJsonParser

Clean up interface

5c8c3c2

Use internal hCaptcha SDK

1b48607

Update how hCaptcha is used

4ae951e

awush-stripe added 4 commits January 11, 2024 11:47

Get the radar session test working

8a7958a

Fix imports

7867439

Fix tests

ec4e8d4

Fix lint

5f70a18

awush-stripe force-pushed the awush/add_passive_hcaptcha_to_radar_session branch from bc3f03d to 5f70a18 Compare January 11, 2024 16:48

awush-stripe added 3 commits January 11, 2024 12:33

Fix detekt

19302da

Update detekt baseline

5824864

Update api

5c6ffea

jaynewstrom-stripe reviewed Jan 11, 2024

View reviewed changes

payments-core/build.gradle Show resolved Hide resolved

jaynewstrom-stripe reviewed Jan 11, 2024

View reviewed changes

Do not modify the RadarSession public object

12c23f3

awush-stripe requested a review from jaynewstrom-stripe January 11, 2024 21:20

jaynewstrom-stripe previously approved these changes Jan 11, 2024

View reviewed changes

Fix lint

66ec995

awush-stripe dismissed jaynewstrom-stripe’s stale review via 66ec995 January 12, 2024 16:26

awush-stripe force-pushed the awush/add_passive_hcaptcha_to_radar_session branch from ef1e76e to 66ec995 Compare January 12, 2024 16:26

Remove baseline for import ordering

41bfb8e

jaynewstrom-stripe approved these changes Jan 12, 2024

View reviewed changes

awush-stripe merged commit f6957e3 into master Jan 16, 2024
17 checks passed

awush-stripe deleted the awush/add_passive_hcaptcha_to_radar_session branch January 16, 2024 16:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add passive hCaptcha to radar_session #7722

Add passive hCaptcha to radar_session #7722

awush-stripe commented Dec 12, 2023

awush-stripe Dec 12, 2023

bmathews-stripe Dec 12, 2023

awush-stripe Dec 12, 2023

github-actions bot commented Dec 12, 2023 •

edited

Loading

awush-stripe commented Dec 12, 2023

jaynewstrom-stripe Dec 12, 2023

awush-stripe Dec 12, 2023

jaynewstrom-stripe Dec 12, 2023

awush-stripe Dec 12, 2023

jaynewstrom-stripe Jan 11, 2024

jaynewstrom-stripe Jan 11, 2024

awush-stripe Jan 11, 2024

jaynewstrom-stripe Jan 11, 2024

awush-stripe Jan 12, 2024

Add passive hCaptcha to radar_session #7722

Add passive hCaptcha to radar_session #7722

Conversation

awush-stripe commented Dec 12, 2023

Summary

Motivation

Testing

Changelog

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Dec 12, 2023 • edited Loading

awush-stripe commented Dec 12, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Dec 12, 2023 •

edited

Loading