Apple Pay / Google Pay on the Stripe guest checkout #65

Activity

1. evtivity-admin commented on Nov 13, 2026

   

   evtivity-admin

   on Nov 13, 2026

   Contributor

   More actions

   Thanks @6lyxt, this is a good addition and the proposal fits the current flow well.

   1. Would you accept this as a PR against main?

   Yes. The server side needs no change: the guest hold already takes a one-time PaymentMethod id with manual capture and automatic payment methods without redirects (authorizeHold in packages/payments/src/providers/stripe/index.ts), so a wallet card PaymentMethod goes through the same hold, capture and 3DS handling.

   A few points to cover:

   • When a site has a Stripe Connect payout account, the hold is a destination charge with on_behalf_of. The deferred Elements then need the matching onBehalfOf option. Please test at a site with a payout account as well as without one.
   • Apple Pay and Google Pay only: turn Link and the other wallets off.
   • The divider in all six portal locales and the tests in stripe.test.tsx, as you planned.
   • The PR needs the CLA signed and green CI (lint, typecheck, format, unit tests).

   2. Domain registration: same PR or a follow-up?

   Please include it in the same PR, so operators can use the feature without a manual step in the Stripe dashboard. A good model is the Stripe Create Webhook action: POST /v1/settings/stripe/webhook in packages/api/src/routes/payments.ts and its button on the Stripe settings card in the CSMS. What it needs:

   • A route that registers the portal domain (from PORTAL_URL) through Stripe's Payment Method Domains API, with the settings.payment:write permission, plus a way to show the current registration status.
   • Every Stripe call in @evtivity/payments (the only package that calls a payment provider), not in the route.
   • Connected accounts: when sites have Stripe Connect payout accounts, check Stripe's rules for registering the domain on those accounts and handle them.
   • An audit row for the registration, any new error codes with their messages in the CSMS locales, and the button's labels in all six CSMS locales, with tests.
   • The OpenAPI spec and the AI tool catalog regenerated (npm run codegen:ai-tools -w @evtivity/api), since a new route changes them. The new route should not be callable by the AI assistant.

   We take care of the website docs.

   3. CSP constraints?

   No change should be needed: the portal script-src allows https://js.stripe.com, and frame-src allows https://js.stripe.com and every https: source. If a real device shows that something is missing:

   • The same CSP lives in three places that must stay identical: packages/portal/nginx-security-headers.conf, the Compose dev image and the Helm chart's nginx ConfigMap. web-security-headers.test.ts checks them.
   • frame-ancestors 'none' must stay.
   • Please keep each new source as narrow as possible and say in the PR why it is needed.

   Looking forward to the PR.
2. evtivity-admin

   added

   enhancementNew feature or requestNew feature or request

   documentationImprovements or additions to documentationImprovements or additions to documentation

   on Nov 13, 2026
3. evtivity-admin

   assigned

   6lyxt

   on Nov 13, 2026