feat(payout_link): secure payout links using server side validations and client side headers

[kashif-m]

Type of Change

• Bugfix
• New feature
• Enhancement
• Refactoring
• Dependency updates
• Documentation
• CI/CD

Description

This PR includes below changes -

• adding allowed_domains field in payout link config
  • this is added at both business profile level and individual payout txns
  • business profile config is used as a fallback in case allowed_domains are not passed in payout link's create request
  • this is a required field in production env
• server side validations for incoming render request
  • check Sec-Fetch-Dest [ref] for request source (must be iframe)
  • check Origin / Referer for the host of the incoming request (must match one in allowed_domains)
  • these are skipped if allowed_domains is not setup (only in non-production env)
• client side headers
  • attach CSP header - frame-ancestors for directing which hosts can embed the links in an iframe [ref]
  • attach X-Frame header - similar to CSP, but for older browsers [ref] Removing this as it's outdated
• update status UI for payout links

feat(generic_link): add allowed_domains in GenericLink response
feat(payout_link): add allowed_domains in payout_link_config (fallback profile config + payout request config)
feat(payout_link): consume meta headers for validating render request for payout links
feat(payout_link): consume CSP and X-Frame headers in the link's response

Additional Changes

• This PR modifies the API contract
• This PR modifies the database schema
• This PR modifies application configuration/environment variables

Motivation and Context

How did you test it?

Tested locally using postman

1. Update business profile's payout_link_config to include allowed_domains

curl --location 'http://localhost:8080/account/merchant_1721206540/business_profile/pro_iMeDAsjCBueHxdjCiZ9I' \
--header 'Content-Type: application/json' \
--header 'api-key: test_admin' \
--data '{
    "payout_link_config": {
        "allowed_domains": ["127.0.0.1:5500"]
    }
}'

2. Create a payout link

curl --location 'http://localhost:8080/payouts/create' \
--header 'Content-Type: application/json' \
--header 'api-key: dev_Ew5ejag6iXMc80CDUUflU4daqTvm0wsMc1AgUo174U7iaV1GFvf8kkwt8LLCxDkT' \
--data '{
    "amount": 3000,
    "currency": "EUR",
    "billing": {
        "address": {
            "city": "Hoogeveen",
            "country": "NL",
            "line1": "Raadhuisplein",
            "line2": "92",
            "zip": "7901 BW",
            "state": "FL"
        },
        "phone": {
            "number": "0650242319",
            "country_code": "+31"
        }
    },
    "payout_link": true,
    "payout_link_config": {
        "theme": "#143F1E",
        "logo": "https://upload.wikimedia.org/wikipedia/commons/8/84/Spotify_icon.svg",
        "merchant_name": "Spotify"
    }
}'

3. Try opening this link in a new tab (should not open)
4. Open this inside an iframe (should open provided the allowed_domains and the iframe's host is same)

Test cases

cargo test --package common_utils --lib -- link_utils::domain_tests --show-output

Checklist

• I formatted the code cargo +nightly fmt --all
• I addressed lints thrown by cargo clippy
• I reviewed the submitted code
• I added unit tests for my changes where possible

[sahkal]

can we have a seperate forked UI for these failures doesn't look good throwing json error in user flow

[kashif-m]

For later

[sahkal]

There seems to be a bug in the payout link configs, since we are focusing on json. if one of the field is not sent in payment create and is set in business config, we will make the not sent value as None. Which is not the expected behavior i suppose.