fix(payment): PI-4517 skip messages from wrong sources for the Access…

[vitalii-koshovyi]

… Worldpay

What/Why?

Skip post messages from wrong sources for the Access Worldpay 3ds check. Due to the issue with react dev tools extention.

Rollout/Rollback

Revert this PR

Testing

Non 3ds

Screen.Recording.2025-11-07.at.16.53.02.mov

3ds frictionless

Screen.Recording.2025-11-07.at.16.56.03.mov

3ds challenged

Screen.Recording.2025-11-07.at.16.59.13.mov

[sentry]

Bug: Promise hangs indefinitely if only wrong-origin MessageEvents are received, due to missing timeout.
_{Severity: CRITICAL | Confidence: 1.00}

🔍 Detailed Analysis

The Promise created within worldpayaccess-payment-strategy.ts at lines 73-75 will never resolve or reject if messageEventListener receives only MessageEvent objects where event.origin does not match 'https://centinelapistag.cardinalcommerce.com'. The if condition at line 75 causes the listener to return early without settling the promise, leading to an indefinite hang. This occurs when non-matching origin messages, such as those from browser extensions, are the only messages received, preventing the legitimate message from the correct origin from ever being processed.

💡 Suggested Fix

Implement a timeout mechanism for the Promise at lines 73-75. This could involve setTimeout with a reject fallback, Promise.race to introduce a timeout, or an AbortController to cancel the listener after a reasonable duration (e.g., 30-60 seconds) if no valid message arrives.

🤖 Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location:
packages/worldpayaccess-integration/src/worldpayaccess-payment-strategy.ts#L73-L75

Potential issue: The `Promise` created within `worldpayaccess-payment-strategy.ts` at
lines 73-75 will never resolve or reject if `messageEventListener` receives only
`MessageEvent` objects where `event.origin` does not match
'https://centinelapistag.cardinalcommerce.com'. The `if` condition at line 75 causes the
listener to return early without settling the promise, leading to an indefinite hang.
This occurs when non-matching origin messages, such as those from browser extensions,
are the only messages received, preventing the legitimate message from the correct
origin from ever being processed.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[vitalii-koshovyi]

We decided do not add auto-resolve promise, because it can produce issues with longer responses from Cardinal.