refactor(swift): log message rejections as warnings - #646
Merged
tiagocandido merged 1 commit intoAug 17, 2026
Conversation
Remove Configuration.onMessageRejected and the public MessageRejection type before they ship in a release. Origin-validation rejections are now always logged at warn level with the trusted origin and reason; the untrusted message body is never logged. Child-frame messages are ignored at debug level as ambient noise.
Contributor
Author
This stack of pull requests is managed by Graphite. Learn more about stacking. |
This was referenced Aug 14, 2026
tiagocandido
marked this pull request as ready for review
August 14, 2026 15:05
Install this buildOpen Tophat, select your target device, then click Install. Links open on the Mac running Tophat.
Checkout Kit E2E results
|
markmur
approved these changes
Aug 14, 2026
Contributor
Author
Merge activity
|
tiagocandido
deleted the
08-14-refactor_swift_message_rejection_warn_logging
branch
August 17, 2026 08:15
tiagocandido
added a commit
that referenced
this pull request
Aug 17, 2026
### What changes are you making? Same as #646, for Android: remove `Configuration.onMessageRejected` and the public `RejectedMessage` type while they have only shipped in an alpha. Origin-validation rejections are always logged as warnings with the verified origin and reason; the untrusted message body is not logged. ### How to test From `platforms/android`: ```sh ./gradlew test ./gradlew :lib:apiCheck ```
7 tasks
tiagocandido
added a commit
that referenced
this pull request
Aug 17, 2026
### What changes are you making? Release the Swift packages as `4.0.0-alpha.5`. This updates the SwiftPM and CocoaPods version metadata, public installation examples, and user-agent expectations. The release includes the Swift changes merged since `4.0.0-alpha.4`, including the removal of the `onMessageRejected` configuration callback in favor of warn-level rejection logging (#646). ### How to test ```sh .github/scripts/validate-release-version iOS 4.0.0-alpha.5 cd platforms/swift ./Scripts/xcode_run test ShopifyCheckoutKit-Package UserAgentTests ./Scripts/api check ``` --- ### Before you merge - [x] I've updated tests for the new version - [x] I have read and agree with the [Contribution Guidelines](./CONTRIBUTING.md) - [x] I have read and agree with the [Code of Conduct](./CODE_OF_CONDUCT.md) - [x] I've updated `platforms/swift/README.md` - [x] I have bumped the version in `ShopifyCheckoutKit.podspec` - [x] I have bumped the version in `platforms/swift/Sources/ShopifyCheckoutKit/ShopifyCheckoutKit.swift` - [x] I have updated the SwiftPM and CocoaPods version snippets
This was referenced Aug 17, 2026
tiagocandido
added a commit
that referenced
this pull request
Aug 17, 2026
### What changes are you making? Expose `allowedMessageOrigins` through the React Native configuration and round-trip it across both native bridges. Rejections are logged as warnings by the native SDKs (#646, #647); there is no JavaScript callback. Bumps the native SDK pins to `4.0.0-alpha.5` — the first release with warn-level rejection logging and without `onMessageRejected` — and regenerates both Podfile.locks against the published pods. Replaces #477. ### How to test From `platforms/react-native`: ```sh pnpm test modules/@shopify/checkout-kit-react-native/tests/index.test.ts --runInBand pnpm module typecheck pnpm module api:dump ```
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes are you making?
Remove
Configuration.onMessageRejectedand the publicMessageRejectiontype while they have only shipped in an alpha. Origin validation keeps a single configuration surface:allowedMessageOrigins.Rejected messages are never silently dropped — each rejection is logged as a warning with the trusted origin and reason. The untrusted message body is not logged. Child-frame messages are ignored at debug level as ambient noise. A structured observability API for rejections can be added later without a breaking change.
How to test
From
platforms/swift:./Scripts/xcode_run test ShopifyCheckoutKit-Package ./Scripts/api check