[EPC-9504] Add CSP nonce to PayPal SDK

Model/Ui/AdyenGenericConfigProvider.php

@@ -15,6 +15,7 @@
 use Adyen\Payment\Helper\Data;
 use Adyen\Payment\Model\Config\Source\RenderMode;
 use Magento\Checkout\Model\ConfigProviderInterface;
+use Magento\Csp\Helper\CspNonceProvider;
 use Magento\Framework\App\RequestInterface;
 use Magento\Framework\UrlInterface;
 use Magento\Store\Model\StoreManagerInterface;
@@ -24,42 +25,32 @@ class AdyenGenericConfigProvider implements ConfigProviderInterface
 {
     const CODE = 'adyen_abstract';
 
-    protected Data $adyenHelper;
-    protected StoreManagerInterface $storeManager;
-    protected RequestInterface $request;
-    protected UrlInterface $url;
-    private Config $adyenConfigHelper;
-    private AgreementsConfigProvider $agreementsConfigProvider;
     /**
+     * @param Data $adyenHelper
+     * @param Config $adyenConfigHelper
+     * @param StoreManagerInterface $storeManager
+     * @param RequestInterface $request
+     * @param UrlInterface $url
+     * @param AgreementsConfigProvider $agreementsConfigProvider
+     * @param CspNonceProvider $cspNonceProvider
      * This data member will be passed to the js frontend. It will be used to map the method code (adyen_ideal) to the
      * corresponding txVariant (ideal). The txVariant will then be used to instantiate the component
-     */
-    protected array $txVariants;
-    /**
+     * @param array $txVariants
      * These payment methods have a custom method render file. This array has been used in the adyen-method.js
      * file to push correct payment method renderer.
+     * @param array $customMethodRenderers
      */
-    protected array $customMethodRenderers;
-
     public function __construct(
-        Data $adyenHelper,
-        Config $adyenConfigHelper,
-        StoreManagerInterface $storeManager,
-        RequestInterface $request,
-        UrlInterface $url,
-        AgreementsConfigProvider $agreementsConfigProvider,
-        array $txVariants = [],
-        array $customMethodRenderers = []
-    ) {
-        $this->adyenHelper = $adyenHelper;
-        $this->adyenConfigHelper = $adyenConfigHelper;
-        $this->storeManager = $storeManager;
-        $this->request = $request;
-        $this->url = $url;
-        $this->agreementsConfigProvider = $agreementsConfigProvider;
-        $this->txVariants = $txVariants;
-        $this->customMethodRenderers = $customMethodRenderers;
-    }
+        protected readonly Data $adyenHelper,
+        private readonly Config $adyenConfigHelper,
+        protected readonly StoreManagerInterface $storeManager,
+        protected readonly RequestInterface $request,
+        protected readonly UrlInterface $url,
+        private readonly AgreementsConfigProvider $agreementsConfigProvider,
+        private readonly CspNonceProvider $cspNonceProvider,
+        protected array $txVariants = [],
+        protected array $customMethodRenderers = []
+    ) { }
 
     public function getConfig(): array
     {
@@ -93,6 +84,7 @@ public function getConfig(): array
             ['_secure' => $this->request->isSecure()]
         );
         $config['payment']['adyen']['agreementsConfig'] = $this->agreementsConfigProvider->getConfig();
+        $config['payment']['adyen']['cspNonce'] = $this->cspNonceProvider->generateNonce();
 
         return $config;
     }
@@ -105,4 +97,4 @@ protected function showLogos(): bool
         }
         return false;
     }
-}
+}

Test/Unit/Model/Ui/AdyenGenericConfigProviderTest.php

@@ -0,0 +1,151 @@
+<?php
+/**
+ *
+ * Adyen Payment module (https://www.adyen.com/)
+ *
+ * Copyright (c) 2025 Adyen N.V. (https://www.adyen.com/)
+ * See LICENSE.txt for license details.
+ *
+ * Author: Adyen <magento@adyen.com>
+ */
+
+namespace Adyen\Payment\Model\Ui;
+
+use Adyen\Payment\Helper\Config;
+use Adyen\Payment\Helper\Data;
+use Adyen\Payment\Test\Unit\AbstractAdyenTestCase;
+use Magento\CheckoutAgreements\Model\AgreementsConfigProvider;
+use Magento\Csp\Helper\CspNonceProvider;
+use Magento\Framework\App\RequestInterface;
+use Magento\Framework\UrlInterface;
+use Magento\Store\Api\Data\StoreInterface;
+use Magento\Store\Model\StoreManagerInterface;
+use PHPUnit\Framework\MockObject\MockObject;
+
+class AdyenGenericConfigProviderTest extends AbstractAdyenTestCase
+{
+    protected AdyenGenericConfigProvider $provider;
+    protected Data|MockObject $adyenHelperMock;
+    protected Config|MockObject $adyenConfigHelperMock;
+    protected StoreManagerInterface|MockObject $storeManagerMock;
+    protected RequestInterface|MockObject $requestMock;
+    protected UrlInterface|MockObject $urlMock;
+    protected AgreementsConfigProvider|MockObject $agreementsConfigProviderMock;
+    protected CspNonceProvider|MockObject $cspNonceProviderMock;
+    protected array $txVariants = [];
+    protected array $customMethodRenderers = [];
+
+    protected function setUp(): void
+    {
+        $this->adyenHelperMock = $this->createMock(Data::class);
+        $this->adyenConfigHelperMock = $this->createMock(Config::class);
+        $this->storeManagerMock = $this->createMock(StoreManagerInterface::class);
+        $this->requestMock = $this->createMock(RequestInterface::class);
+        $this->urlMock = $this->createMock(UrlInterface::class);
+        $this->agreementsConfigProviderMock = $this->createMock(AgreementsConfigProvider::class);
+        $this->cspNonceProviderMock = $this->createMock(CspNonceProvider::class);
+
+        $this->provider = new AdyenGenericConfigProvider(
+            $this->adyenHelperMock,
+            $this->adyenConfigHelperMock,
+            $this->storeManagerMock,
+            $this->requestMock,
+            $this->urlMock,
+            $this->agreementsConfigProviderMock,
+            $this->cspNonceProviderMock,
+            $this->txVariants,
+            $this->customMethodRenderers
+        );
+    }
+
+    public function testGetConfig(): void
+    {
+        $storeId = 1;
+        $clientKeyMock = 'CLIENT_KEY';
+        $merchantAccountMock = 'MERCHANT_ACCOUNT';
+        $isDemo = true;
+        $environment = 'test';
+        $nonceMock = 'NONCE';
+        $checkoutEnvironment = 'test';
+        $storeLocale = 'nl_NL';
+        $chargedCurrency = 'display';
+        $hasHolderName = true;
+        $holderNameRequired = true;
+
+        $storeMock = $this->createMock(StoreInterface::class);
+        $storeMock->expects($this->once())
+            ->method('getId')
+            ->willReturn($storeId);
+
+        $this->storeManagerMock->expects($this->once())
+            ->method('getStore')
+            ->willReturn($storeMock);
+
+        $this->adyenConfigHelperMock->expects($this->once())
+            ->method('isDemoMode')
+            ->willReturn($isDemo);
+
+        $this->adyenConfigHelperMock->expects($this->once())
+            ->method('getClientKey')
+            ->with($environment)
+            ->willReturn($clientKeyMock);
+
+        $this->adyenConfigHelperMock->expects($this->once())
+            ->method('getMerchantAccount')
+            ->with($storeId)
+            ->willReturn($merchantAccountMock);
+
+        $this->adyenHelperMock->expects($this->once())
+            ->method('getCheckoutEnvironment')
+            ->with($storeId)
+            ->willReturn($checkoutEnvironment);
+
+        $this->adyenHelperMock->expects($this->once())
+            ->method('getStoreLocale')
+            ->with($storeId)
+            ->willReturn($storeLocale);
+
+        $this->adyenConfigHelperMock->expects($this->once())
+            ->method('getChargedCurrency')
+            ->with($storeId)
+            ->willReturn($chargedCurrency);
+
+        $this->adyenConfigHelperMock->expects($this->once())
+            ->method('getHasHolderName')
+            ->with($storeId)
+            ->willReturn($hasHolderName);
+
+        $this->adyenConfigHelperMock->expects($this->once())
+            ->method('getHolderNameRequired')
+            ->with($storeId)
+            ->willReturn($holderNameRequired);
+
+        $this->cspNonceProviderMock->expects($this->once())
+            ->method('generateNonce')
+            ->willReturn($nonceMock);
+
+
+        $config = $this->provider->getConfig();
+
+        $this->assertIsArray($config);
+        $this->assertArrayHasKey('payment', $config);
+        $this->assertArrayHasKey('adyen', $config['payment']);
+        $this->assertArrayHasKey('clientKey', $config['payment']['adyen']);
+        $this->assertArrayHasKey('merchantAccount', $config['payment']['adyen']);
+        $this->assertArrayHasKey('checkoutEnvironment', $config['payment']['adyen']);
+        $this->assertArrayHasKey('locale', $config['payment']['adyen']);
+        $this->assertArrayHasKey('chargedCurrency', $config['payment']['adyen']);
+        $this->assertArrayHasKey('hasHolderName', $config['payment']['adyen']);
+        $this->assertArrayHasKey('holderNameRequired', $config['payment']['adyen']);
+        $this->assertArrayHasKey('cspNonce', $config['payment']['adyen']);
+
+        $this->assertEquals($clientKeyMock, $config['payment']['adyen']['clientKey']);
+        $this->assertEquals($merchantAccountMock, $config['payment']['adyen']['merchantAccount']);
+        $this->assertEquals($checkoutEnvironment, $config['payment']['adyen']['checkoutEnvironment']);
+        $this->assertEquals($storeLocale, $config['payment']['adyen']['locale']);
+        $this->assertEquals($chargedCurrency, $config['payment']['adyen']['chargedCurrency']);
+        $this->assertEquals($hasHolderName, $config['payment']['adyen']['hasHolderName']);
+        $this->assertEquals($holderNameRequired, $config['payment']['adyen']['holderNameRequired']);
+        $this->assertEquals($nonceMock, $config['payment']['adyen']['cspNonce']);
+    }
+}

composer.json

@@ -19,6 +19,7 @@
     "magento/module-multishipping": ">=100.4.4",
     "magento/module-graph-ql": ">=100.4.4",
     "magento/module-instant-purchase": ">=100.4.3",
+    "magento/module-checkout-agreements": ">=100.4.3",
     "ext-json": "*"
   },
   "require-dev": {

view/frontend/web/js/model/adyen-configuration.js

@@ -44,6 +44,9 @@ define(
             },
             getAgreementsConfig: function () {
                 return window.checkoutConfig.payment.adyen.agreementsConfig;
+            },
+            getCspNonce: function () {
+                return window.checkoutConfig.payment.adyen.cspNonce;
             }
         };
     },

view/frontend/web/js/view/payment/method-renderer/adyen-paypal-method.js

@@ -38,6 +38,7 @@ define(
                 let baseComponentConfiguration = this._super();
                 let paypalConfiguration = Object.assign(baseComponentConfiguration, paymentMethodsExtraInfo[paymentMethod.type].configuration);
                 paypalConfiguration.showPayButton = true;
+                paypalConfiguration.cspNonce = adyenConfiguration.getCspNonce();
 
                 let agreementsConfig = adyenConfiguration.getAgreementsConfig();