Skip to content

feat(ucs): pass worldpayxml 3ds jwt credentials in the connector config - #13866

Draft
pixincreate wants to merge 2 commits into
mainfrom
feat/ucs-worldpayxml-3ds-metadata
Draft

feat(ucs): pass worldpayxml 3ds jwt credentials in the connector config#13866
pixincreate wants to merge 2 commits into
mainfrom
feat/ucs-worldpayxml-3ds-metadata

Conversation

@pixincreate

Copy link
Copy Markdown
Contributor

Type of Change

  • New feature

Description

Parses the Cardinal 3DS JWT credentials (issuer_id, organizational_unit_id, jwt_mac_key) from the worldpayxml merchant connector account metadata and forwards them on the UCS connector-specific config, following the calida shop_name pattern. UCS signs the Cardinal device-data-collection and challenge JWTs with them.

Companion to juspay/hyperswitch-prism#2182 (worldpayxml 3DS2 support in UCS). All three fields are optional: merchants without them keep working for non-3DS flows, and UCS raises a clear error if a 3DS payment is attempted without them.

Additional Changes

  • This PR modifies the API contract
  • This PR modifies the database schema
  • This PR modifies application configuration/environment variables

Motivation and Context

worldpayxml 3DS through UCS needs the Cardinal JWT credentials, which live in the MCA metadata (same place the hyperswitch-native worldpayxml integration reads them from, WorldpayxmlConnectorMetadataObject). Without this mapping UCS has no channel to receive them.

How did you test it?

Local UCS + router setup against the Worldpay Try environment, with the metadata credentials on the test MCA. Full 3DS matrix passed through the tunnel: card frictionless (pay_2JYm0vtehHPz8NgnSBKM), card challenge with the machine-cookie replay (pay_WiqfQ66gKNgxXTbOf0mp), decrypted Google Pay FPAN 3DS (pay_LQcgbhOMuX1fZwvKKulW), 3DS mandate setup + MIT (pay_690HTMTPIcnEcfAca7Dw → pay_0FTWU6p8wJOYkmAVhwIC), plus non-3DS regressions. Cardinal accepted the StepUp JWT signed with the forwarded credentials.

Checklist

  • I formatted the code cargo +nightly fmt --all
  • I addressed lints thrown by cargo clippy
  • I reviewed the submitted code
  • I added unit tests for my changes where possible

Parse issuer_id, organizational_unit_id and jwt_mac_key from the
merchant connector account metadata and forward them on the UCS
connector-specific config, following the calida shop_name pattern.
UCS signs the Cardinal DDC and challenge JWTs with them.

Signed-off-by: PiX <69745008+pixincreate@users.noreply.github.com>
@semanticdiff-com

semanticdiff-com Bot commented Aug 26, 2026

Copy link
Copy Markdown

Review changes with  SemanticDiff

Changed Files
File Status
  crates/router/src/core/unified_connector_service/connector_config.rs  34% smaller
  Cargo.lock Unsupported file format
  crates/external_services/Cargo.toml Unsupported file format
  crates/hyperswitch_interfaces/Cargo.toml Unsupported file format
  crates/hyperswitch_interfaces/src/unified_connector_service/transformers.rs Unsupported file format
  crates/router/Cargo.toml Unsupported file format
  crates/router/src/core/unified_connector_service/transformers.rs  0% smaller

The UCS connector returns WorldpayxmlDdcData and
WorldpayxmlChallengeData; they map onto the existing native
WorldpayxmlDDCForm and WorldpayxmlRedirectForm variants, whose pages
this router already renders. Pin bumped to the matching rev.

Signed-off-by: PiX <69745008+pixincreate@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant