PIQ-5878: Remove fallback origins and company names, release 1.3.3

CHANGES.md

@@ -1,3 +1,8 @@
+### 1.3.3
+- Origin validation now accepts messages only from the origin of the configured `hostedfieldsurl`. The two built-in fallback origins are removed, so `hostedfieldsurl` must point at the host the iframes actually load from
+- Remove repository, author and brand keywords from package metadata, and publish only `dist` and `index.d.ts`
+- Update readme
+
 ### 1.3.2
 - Add `HostedFields.updateStyles(styles)` to apply new custom styles at runtime without reloading the iframes (requires hosted fields 1.1.9+)
 

README.md

@@ -2,17 +2,6 @@
 
 Hosted fields SDK is a toolkit that allows you generate a form/set of fields. It is published as a node-module to the public [npm registry](https://www.npmjs.com/package/hosted-fields-sdk).
 
-> [!CAUTION]
-> **Migration and Deprecation Notice:** Starting from version 1.0.50, it is mandatory to use the `'https://card-fields.paymentiq.io/1.1.1/index.html'` as `hostedfieldsurl` value for **production** environments. Please update your configurations accordingly to avoid potential disruptions.
->
-> The old hostedfieldsurl: `'https://hostedpages.paymentiq.io/1.0.51/index.html'` and well as *all versions previous to 1.0.50* **are deprecated**. Please note that using older versions and the old domain may expose your system to potential risks. Starting with version 1.1.1, **hostedpages** domain will not be used anymore.
-> 
-> This change is meant to enhance security and future compliance with the new requirements in the Payment Card Industry Data Security Standards. We advise all users to transition to the new domain as soon as possible to maintain compliance and benefit from improved security measures.
-> 
-> Obs. **The new domain supports versions starting with 1.0.50 and above.** Make sure your implementation is updated to at least this version to ensure compatibility.
-> 
-
-
 ## Demo
 [[Live demo](https://codesandbox.io/s/dry-fire-q9txy?file=/src/App.js:5219-5240)]
 
@@ -90,7 +79,7 @@ Setup is the first function you will call. It takes a config-object as its only
 ````js
 {
     merchantId: 123456789,
-    hostedfieldsurl: 'https://card-fields.paymentiq.io/1.1.1/index.html',
+    hostedfieldsurl: 'https://<hosted-fields-host>/<version>/index.html',
     fields: my_fields, //fields you've generated using the Field-constructor
     renderMode: 'single', // defaults to 'multiple', separate iframes per field
     service: 'payment_method_service', // service of the payment method. Not mandatory (AstropayCard requires this)
@@ -166,28 +155,14 @@ The callback triggered when receive a success response after a ClickToPay checko
 **onClickToPayCheckoutErrorCallback**
 The callback triggered when receive an error after a ClickToPay cehckout.
 
-**Possible values for hostedfieldsurl:**
-
-For test environments use: `'https://test-hostedpages.paymentiq.io/1.1.1/index.html'`.
+**hostedfieldsurl**
 
-For production environments use `'https://card-fields.paymentiq.io/1.1.1/index.html'`.
+The URL of the hosted fields page, in the form `https://<hosted-fields-host>/<version>/index.html`. Your account manager provides the host for each environment.
 
-**Available versions for `'https://card-fields.paymentiq.io/1.1.1/index.html'`(where the part 1.1.1 represents the version number):**
-- 1.1.1
-- 1.0.61
-- 1.0.60
-- 1.0.58
-- 1.0.57
-- 1.0.56
-- 1.0.55
-- 1.0.54
-- 1.0.53
-- 1.0.52
-- 1.0.51
-- 1.0.50
+Messages from the fields are accepted only from the origin of this URL, so it must point at the host the iframes are loaded from.
 
-> [!NOTE]  
-> Versions older than 1.0.50 are no longer supported.
+> [!NOTE]
+> Hosted fields version 1.0.50 or later (the `<version>` in `hostedfieldsurl`) is required. Older versions are no longer supported.
 
 
 **get**
@@ -316,7 +291,7 @@ let fields = fieldConfig.map(conf => {
 ````js
 HostedFields.setup({
   merchantId: 123456789,
-  hostedfieldsurl: 'https://card-fields.paymentiq.io/1.1.1/index.html',
+  hostedfieldsurl: 'https://<hosted-fields-host>/<version>/index.html',
   fields: fields,
   service: 'some service',
   styles: '* .hosted-input-container .input-container input { color: green; }',
@@ -463,7 +438,7 @@ let fields = fieldConfig.map(conf => {
 
 HostedFields.setup({
   merchantId: 123456789,
-  hostedfieldsurl: 'https://card-fields.paymentiq.io/1.1.1/index.html',
+  hostedfieldsurl: 'https://<hosted-fields-host>/<version>/index.html',
   fields: fields,
   service: 'some service',
   styles: '.hosted-input-container .input-container input { color: red; }',
@@ -480,28 +455,3 @@ Fields that are to be encrypted (Card number + CVV) will return the encrypted va
 If any errors are detected, an error message will be returned as the value of that field, prefixed with ERROR
 
 ````
-
-### Notes
-
-#### Minimum Supported Version
-Version 1.0.50 or later is required. Older versions are no longer supported.
-
-#### New Domain:
-Domain: `card-fields.paymentiq.io/1.1.1/`
-
-#### Compatibility Note:
-Supported Versions: This domain supports versions starting with 1.0.50 and above. Make sure your implementation is updated to at least this version to ensure compatibility.
-
-#### Why Change?
-- Security and Compliance: The new domain aligns with the latest PCI DSS requirements and offers enhanced security features.
-- Future-proofing: By migrating to the new domain, users avoid potential disruptions caused by the deprecation of the old domain.
-
-#### Action Required:
-Upgrade Your Version: Ensure your integration uses version 1.0.50 or later.
-Migrate to the New Domain: Begin using the new domain by updating your configurations accordingly.
-
-#### Deprecation Timeline:
-Old Domain: The old domain is deprecated and no longer supported.
-
-#### Additional Notes:
-Reach out to our support team if you encounter any issues during the transition or require further assistance.

package.json

@@ -1,10 +1,14 @@
 {
   "name": "hosted-fields-sdk",
-  "version": "1.3.2",
+  "version": "1.3.3",
   "description": "Hosted fields sdk",
   "main": "dist/index.js",
   "types": "index.d.ts",
   "module": "dist/esm/index.js",
+  "files": [
+    "dist",
+    "index.d.ts"
+  ],
   "exports": {
     ".": {
       "default": "./dist/index.js",
@@ -38,22 +42,11 @@
     "rimraf": "^3.0.2",
     "watchify": "^4.0.0"
   },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/devcode-git/hosted-fields-sdk.git"
-  },
   "keywords": [
     "UI",
-    "Payments",
-    "Bambora",
-    "Devcode"
+    "Payments"
   ],
-  "author": "simon.solders@bambora.com",
   "license": "ISC",
-  "bugs": {
-    "url": "https://github.com/devcode-git/hosted-fields-sdk/issues"
-  },
-  "homepage": "https://github.com/devcode-git/hosted-fields-sdk#readme",
   "dependencies": {
     "@babel/runtime": "^7.27.0"
   },

src/sdk/api/index.js

@@ -104,12 +104,7 @@ function setup (config) {
 }
 
 function validateOrigin (origin) {
-    const fallbackOrigins = [
-        'https://test-hostedpages.paymentiq.io',
-        'https://card-fields.paymentiq.io'
-    ]
-    const validOrigins = [...allowedOrigins, ...fallbackOrigins]
-    return validOrigins.indexOf(origin) > -1
+    return allowedOrigins.indexOf(origin) > -1
 }
 
 function get () {