Merge pull request #12094 from mozilla/FXA-4606--subplat-trim-whitespace-on-stripe-metadata-befor

feat(auth): trim whitespace off metadata

packages/fxa-auth-server/lib/payments/stripe.ts

@@ -35,6 +35,7 @@ import {
 } from 'fxa-shared/subscriptions/types';
 import { StatsD } from 'hot-shots';
 import ioredis from 'ioredis';
+import mapValues from 'lodash/mapValues';
 import moment from 'moment';
 import { Logger } from 'mozlog';
 import { Stripe } from 'stripe';
@@ -1608,6 +1609,8 @@ export class StripeHelper {
         );
         continue;
       }
+      item.product.metadata = mapValues(item.product.metadata, (v) => v.trim());
+      item.metadata = mapValues(item.metadata, (v) => v.trim());
 
       const { error } =
         await subscriptionProductMetadataValidator.validateAsync({

packages/fxa-auth-server/test/local/payments/stripe.js

@@ -2356,6 +2356,7 @@ describe('StripeHelper', () => {
         object: 'plan',
         product: {
           metadata: Object.assign({}, validProductMetadata, {
+            // Include some invalid whitespace that will be trimmed.
             'product:privacyNoticeDownloadURL': 'https://example.com',
           }),
         },
@@ -2363,6 +2364,11 @@ describe('StripeHelper', () => {
 
       const goodPlan = deepCopy(plan1);
       goodPlan.product = deepCopy(product1);
+      goodPlan.product.metadata['product:privacyNoticeURL'] =
+        'https://accounts-static.cdn.mozilla.net/legal/privacy\n\n';
+      goodPlan.metadata['product:privacyNoticeURL'] =
+        'https://accounts-static.cdn.mozilla.net/legal/privacy\n\n';
+      const dupeGoodPlan = deepCopy(goodPlan);
 
       const planList = [
         planMissingProduct,
@@ -2380,6 +2386,17 @@ describe('StripeHelper', () => {
       /** Assert that only the "good" plan was returned */
       assert.deepEqual(actual, [goodPlan]);
 
+      // Assert that the product metadata was trimmed
+      assert.equal(
+        actual[0].product.metadata['product:privacyNoticeURL'],
+        dupeGoodPlan.product.metadata['product:privacyNoticeURL'].trim()
+      );
+      // Assert that the plan metadata was trimmed
+      assert.equal(
+        actual[0].metadata['product:privacyNoticeURL'],
+        dupeGoodPlan.metadata['product:privacyNoticeURL'].trim()
+      );
+
       /** Verify the error cases were handled properly */
       assert.equal(stripeHelper.log.error.callCount, 4);