The CURRENT saved-card SCA contract (Square card.tokenize(verificationDetails,
cardId)) returns a one-time tokenize-result that must be sent as the charge
SOURCE (source_id), not a separate verification_token.
- square_dev.go: the mock validates the WIRE BODY (mockPaymentWireBody — an
independently assembled copy of buildCreatePaymentBody) so it accepts exactly
the request shape the real client emits. SimulateSavedCardVerificationRequired
now demands SCA on every saved-card charge in both wire shapes: (a) a genuine
tokenize-result (cnon:sca-... — isSCATokenizeResultSource) as source_id +
customer_id is ACCEPTED (the token IS the buyer verification); a RAW
card.tokenize() nonce in the tokenize-result slot is REJECTED
CARD_DECLINED_VERIFICATION_REQUIRED (money-F2 — the mock is the enforcement
point that stops the forged shape); (b) legacy ccof: + verification_token is
kept for backward-compat.
- square_http_client.go: byte-identical body assembly shared with the mock, so
TestCreatePayment_SCA_SavedCard_WireBody_ByteIdentical pins the mock and the
real client emit identical CreatePayment bodies (a wire drift fails the test
before reaching prod).
popertots
d25ba16aa7