From 148ba58f6e9a39115d738709dd664cbec3b6022a Mon Sep 17 00:00:00 2001 From: aiirvizionz Date: Tue, 28 Jul 2026 22:52:32 -0600 Subject: [PATCH] Validate WorldRemit payout inputs --- packages/payments/worldremit/src/index.test.ts | 16 ++++++++++++++++ packages/payments/worldremit/src/index.ts | 4 ++++ 2 files changed, 20 insertions(+) diff --git a/packages/payments/worldremit/src/index.test.ts b/packages/payments/worldremit/src/index.test.ts index 0c893270..c305ec9d 100644 --- a/packages/payments/worldremit/src/index.test.ts +++ b/packages/payments/worldremit/src/index.test.ts @@ -1,7 +1,23 @@ import { smokeTest } from '@profullstack/sh1pt-core/testing'; +import { describe, expect, it } from 'vitest'; import adapter from './index.js'; // worldremit is a payouts adapter, not a checkout provider — supports[] is // intentionally empty (the interface's supports field enumerates buyer-side // currencies/methods). requireSupports skipped. smokeTest(adapter, { idPrefix: 'payment', requireSupports: false }); + +describe('payment-worldremit payout validation', () => { + it('rejects missing payout recipients before returning a transfer id', async () => { + await expect(adapter.payout(' ', 1000, 'USD', {})).rejects.toThrow('recipient accountId is required'); + }); + + it('rejects invalid payout amounts before returning a transfer id', async () => { + await expect(adapter.payout('recipient-1', 0, 'USD', {})).rejects.toThrow('positive finite number'); + await expect(adapter.payout('recipient-1', Number.NaN, 'USD', {})).rejects.toThrow('positive finite number'); + }); + + it('rejects malformed payout currencies before returning a transfer id', async () => { + await expect(adapter.payout('recipient-1', 1000, 'US', {})).rejects.toThrow('3-letter ISO code'); + }); +}); diff --git a/packages/payments/worldremit/src/index.ts b/packages/payments/worldremit/src/index.ts index 2f916548..a5fe1a17 100644 --- a/packages/payments/worldremit/src/index.ts +++ b/packages/payments/worldremit/src/index.ts @@ -23,6 +23,10 @@ export default definePayment({ return { type: 'unknown', payload: JSON.parse(rawBody) }; }, async payout(accountId, amount, currency) { + const recipient = accountId.trim(); + if (!recipient) throw new Error('WorldRemit payout recipient accountId is required'); + if (!Number.isFinite(amount) || amount <= 0) throw new Error('WorldRemit payout amount must be a positive finite number'); + if (!/^[a-z]{3}$/i.test(currency)) throw new Error('WorldRemit payout currency must be a 3-letter ISO code'); // TODO: quote → create transfer → pay via saved funding source return { id: `wr_${Date.now()}` }; },