fix(ack-pay): bind payment receipt issuer to receiptService

[Kewe63]

Summary

Fixes #192

• Bind verified payment receipt issuers to the selected payment option receiptService when receiptService is a DID.
• Reject receipts whose paymentOptionId does not exist in the verified payment request.
• Add regression coverage for the cross-issuer case where both receipt issuers are globally trusted, but only one matches the selected option.

---

Root Cause

verifyPaymentReceipt verified the receipt issuer against trustedReceiptIssuers and verified the embedded paymentRequestToken, but it did not compare the selected payment option's receiptService DID with the verified receipt issuer.

---

What Changed

• Look up the selected payment option by verifiedReceipt.credentialSubject.paymentOptionId.
• Throw InvalidCredentialSubjectError when the payment option is missing.
• Throw UntrustedIssuerError when the selected payment option receiptService is a DID and does not match verifiedReceipt.issuer.id.

---

Tests

• Added a regression test where two receipt issuers are globally trusted, but the receipt is signed by the wrong trusted issuer for the selected payment option.
• Confirmed the regression test fails without the production fix and passes with it.

---

How to Test

pnpm --filter ./packages/ack-pay test -- --run src/verify-payment-receipt.test.ts
pnpm run format
pnpm run lint
pnpm --filter ./packages/ack-pay test
pnpm --filter ./packages/ack-pay build

---

Checklist

• Tests pass — new regression test added, confirmed fails without fix / passes with fix
• Lint/format clean
• Follows Conventional Commits
• Changes scoped to this fix only

---

Risk & Impact

Low-to-medium. The change only tightens verification: receipts whose paymentOptionId is missing or whose issuer doesn't match a DID-typed receiptService are now rejected. Payment options with a URL-typed receiptService, or a matching DID issuer, are unaffected — existing valid verification flows continue to pass.

Type: 🐛 Bug fix / 🔒 Security fix
Fixes: #192

Summary by CodeRabbit

• Bug Fixes
  • Payment receipt verification now confirms that the receipt references a payment option included in the verified payment request.
  • Receipts are rejected when their issuer does not match the payment option’s declared receipt service, even if the issuer is otherwise trusted.
  • Added coverage for mismatched receipt issuers to help ensure invalid receipts cannot be accepted.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 490af8f4-e303-4f50-8097-cf5f556875d7

📥 Commits

Reviewing files that changed from the base of the PR and between 7d23f83 and 7b75959.

📒 Files selected for processing (2)

• packages/ack-pay/src/verify-payment-receipt.test.ts
• packages/ack-pay/src/verify-payment-receipt.ts

Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

Walkthrough

Changes

Payment receipt issuer binding

Layer / File(s)	Summary
Receipt issuer validation packages/ack-pay/src/verify-payment-receipt.ts	verifyPaymentReceipt finds the selected payment option by paymentOptionId. When receiptService is a DID, it rejects receipts whose issuer does not match.
Issuer binding test coverage packages/ack-pay/src/verify-payment-receipt.test.ts	The test fixture declares receiptService. A new test rejects a receipt from a different trusted issuer with UntrustedIssuerError.

Estimated code review effort: 2 (Simple) | ~15 minutes

Merge Risk: ⚪ Minimal · up to 7b759

The PR tightens payment receipt validation by requiring DID-based issuers to match the selected payment option and rejecting unknown options; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: venables, efedurmaz16

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: binding the payment receipt issuer to the selected payment option's receiptService.
Linked Issues check	✅ Passed	The implementation satisfies issue #192 by validating that paymentOptionId selects an existing payment option and by requiring a DID receiptService to match the verified receipt issuer. URL-based rece…
Out of Scope Changes check	✅ Passed	The changes are limited to receipt issuer validation and regression tests for the linked issue. No unrelated code changes are identified.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.

Full details: Linked Issues check

Explanation

The implementation satisfies issue #192 by validating that paymentOptionId selects an existing payment option and by requiring a DID receiptService to match the verified receipt issuer. URL-based receiptService values remain unaffected, and regression coverage verifies mismatched trusted issuers are rejected.

✨ Finishing Touches 💡 1

⚔️ Resolve merge conflicts 💡

• Resolve merge conflict in branch fix-192-bind-receipt-service

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}