feat: add support to trustedOrigins option

[almeidazs]

Summary by CodeRabbit

Release Notes

• New Features

  • Added trustedOrigins configuration option to validate checkout redirect URLs against an allowlist.
  • Support for relative redirect URLs (e.g., "/success") when configured with trusted origins.
  • Wildcard pattern matching for flexible origin validation.

• Documentation

  • Added comprehensive documentation for trustedOrigins configuration and relative URL handling.

• Tests

  • Added test coverage for redirect URL validation and trusted origin matching scenarios.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
paymesh	Ready	Preview, Comment	Jun 13, 2026 4:17am

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

This pull request introduces trusted origins validation for checkout redirect URLs across Paymesh. The feature adds a trustedOrigins allowlist option to createClient, validates successUrl, cancelUrl, and returnUrl origins at payment creation and plugin route resolution time, and supports both exact origins and wildcard patterns. Integration into Dash enables relative URL resolution within request-scoped plugin routes.

Changes

Trusted Origins Checkout Redirect Validation

Layer / File(s)	Summary
Type Contracts and Interfaces packages/paymesh/src/types/client.ts, packages/paymesh/src/types/plugins.ts, packages/dash/src/types.ts	ClientOptions adds optional trustedOrigins allowlist; PluginRouteContext and DashboardRequestContext each add resolveTrustedUrl(url?: string): string | undefined helper.
Origin Validation and Resolution Logic packages/paymesh/src/client/payments.ts, packages/paymesh/src/index.ts, packages/paymesh/src/plugins/runtime.ts	createClient normalizes and validates trustedOrigins entries; createPaymentsClient validates redirect URL origins during create; bootstrapPlugins provides resolveTrustedUrl helper that resolves relative URLs against request origin and validates absolute origins against trusted list with wildcard/pattern support.
Client Infrastructure Wiring packages/paymesh/src/client/managers.ts	createClientManagers extracts trustedOrigins from options and wires it to both createPaymentsClient and bootstrapPlugins initialization.
Dash Dashboard Integration packages/dash/src/routes.ts, packages/dash/src/data.ts	getDashboardContext adds request and resolveTrustedUrl to DashboardRequestContext; createPayment uses resolveTrustedUrl to validate and normalize redirect URLs before sending to payments client.
Paymesh Client Tests packages/paymesh/test/client.test.ts	Comprehensive test suite validating trustedOrigins normalization, rejection of invalid entries, redirect URL origin validation, exact and wildcard origin matching, and resolveTrustedUrl resolution through plugin routes.
Dash Integration Tests packages/dash/test/dash.test.ts	Test /admin/paymesh/api/payments endpoint with trusted/untrusted origin scenarios, relative URL resolution, wildcard pattern matching, and expected error responses; extend provider stub with onPaymentCreate callback to capture payment input.
User Documentation apps/web/content/docs/reference/client-options.mdx, apps/web/content/docs/plugins/dash.mdx	Document trustedOrigins option, origin validation rules (exact, wildcard patterns, rejection modes for invalid/untrusted origins), relative URL support in request-scoped plugin routes, and configuration examples.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Suggested labels

documentation

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The pull request description is completely empty, missing all required template sections including description, related issues, checklist items, and any context.	Add a comprehensive description following the provided template, including what the feature does, why it's needed, test coverage confirmation, documentation updates, and any relevant context.
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main feature being added: support for a trustedOrigins option across multiple packages and documentation.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/trusted-origins

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}