Skip to content

feat: fetch Google Pay config from Bolt API, add button theme support#46

Merged
RhysAtBolt merged 2 commits intomainfrom
feat-fetch-google-pay-config
Apr 1, 2026
Merged

feat: fetch Google Pay config from Bolt API, add button theme support#46
RhysAtBolt merged 2 commits intomainfrom
feat-fetch-google-pay-config

Conversation

@arstiefel
Copy link
Copy Markdown
Collaborator

@arstiefel arstiefel commented Mar 31, 2026

Description

Simplifies the Google Pay integration by auto-fetching merchant/gateway configuration (tokenization spec, merchant IDs, merchant name) from Bolt's /v1/apm_config/googlepay API endpoint using the publishable key. Developers no longer need to provide gatewayMerchantId, googleMerchantId, or merchantName — only presentation options like currencyCode, amount, label, and billingAddressCollectionFormat. Also adds buttonTheme prop (dark/light) to the Google Pay button, wired through to Android's ButtonConstants.ButtonTheme.

Testing

  • Updated GoogleWallet.test.tsx with new simplified config shape and APM config mock validation.
  • Updated WalletTypes.test.ts to verify the new GooglePayConfig accepts only presentation options and all fields are optional.
  • All 117 tests pass; TypeScript compiles clean.
  • Manual testing needed on Android to verify the API fetch + Google Pay sheet flow end-to-end, and buttonTheme rendering (dark vs light).

Security Review

Important

A security review is required for every PR in this repository to comply with PCI requirements.

  • I have considered and reviewed security implications of this PR and included the summary below.

Security Impact Summary

This PR adds an HTTP request to Bolt's API (GET /v1/apm_config/googlepay) using the publishable key as a merchant_token header. The publishable key is already a public credential designed for client-side use. The response contains non-sensitive merchant configuration (merchant name, tokenization gateway params). No new secrets, user data, or authentication flows are introduced. The tokenization and payment flows remain unchanged — the Google Pay token is still sent to Bolt's /v1/googlepay/tokenize endpoint with Bearer auth as before.

@arstiefel arstiefel requested review from a team as code owners March 31, 2026 18:08
@snyk-io
Copy link
Copy Markdown

snyk-io bot commented Mar 31, 2026

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@arstiefel arstiefel force-pushed the feat-fetch-google-pay-config branch from f401783 to 2da6a60 Compare March 31, 2026 18:28
@RhysAtBolt RhysAtBolt merged commit 30d29fb into main Apr 1, 2026
7 checks passed
@RhysAtBolt RhysAtBolt deleted the feat-fetch-google-pay-config branch April 1, 2026 08:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants