1 files changed, 63 insertions, 32 deletions

diff --git a/packages/merchant-backoffice-ui/src/paths/instance/accounts/update/UpdatePage.tsx b/packages/merchant-backoffice-ui/src/paths/instance/accounts/update/UpdatePage.tsx
index 6dd264f29..1a8e9bdc1 100644
--- a/packages/merchant-backoffice-ui/src/paths/instance/accounts/update/UpdatePage.tsx
+++ b/packages/merchant-backoffice-ui/src/paths/instance/accounts/update/UpdatePage.tsx
@@ -33,8 +33,7 @@ import { InputPaytoForm } from "../../../../components/form/InputPaytoForm.js";
 import { InputSelector } from "../../../../components/form/InputSelector.js";
 import { undefinedIfEmpty } from "../../../../utils/table.js";
 
-type Entity = TalerMerchantApi.BankAccountEntry
-  & WithId;
+type Entity = TalerMerchantApi.BankAccountEntry & WithId;
 
 const accountAuthType = ["unedit", "none", "basic"];
 interface Props {
@@ -43,32 +42,56 @@ interface Props {
   account: Entity;
 }
 
-
 export function UpdatePage({ account, onUpdate, onBack }: Props): VNode {
   const { i18n } = useTranslationContext();
 
-  const [state, setState] = useState<Partial<TalerMerchantApi.AccountPatchDetails>>(account);
+  const [state, setState] =
+    useState<Partial<TalerMerchantApi.AccountPatchDetails>>(account);
 
   // @ts-expect-error "unedit" is fine since is part of the accountAuthType values
   if (state.credit_facade_credentials?.type === "unedit") {
     // we use this to set creds to undefined but server don't get this type
-    state.credit_facade_credentials = undefined
+    state.credit_facade_credentials = undefined;
   }
 
+  const facadeURL = safeConvertURL(state.credit_facade_url);
+
   const errors: FormErrors<TalerMerchantApi.AccountPatchDetails> = {
-    credit_facade_url: !state.credit_facade_url ? undefined : !isValidURL(state.credit_facade_url) ? i18n.str`invalid url` : undefined,
+    credit_facade_url: !state.credit_facade_url
+      ? undefined
+      : !facadeURL
+        ? i18n.str`Invalid url`
+        : !facadeURL.href.endsWith("/")
+          ? i18n.str`URL should end with a '/'`
+          : facadeURL.searchParams.size > 0
+            ? i18n.str`URL should not contain params`
+            : facadeURL.hash
+              ? i18n.str`URL should not hash param`
+                : undefined,
     credit_facade_credentials: undefinedIfEmpty({
+      username:
+        state.credit_facade_credentials?.type !== "basic"
+          ? undefined
+          : !state.credit_facade_credentials.username
+            ? i18n.str`required`
+            : undefined,
 
-      username: state.credit_facade_credentials?.type !== "basic" ? undefined
-        : !state.credit_facade_credentials.username ? i18n.str`required` : undefined,
-
-      password: state.credit_facade_credentials?.type !== "basic" ? undefined
-        : !state.credit_facade_credentials.password ? i18n.str`required` : undefined,
-
-      repeatPassword: state.credit_facade_credentials?.type !== "basic" ? undefined
-        : !(state.credit_facade_credentials as any).repeatPassword ? i18n.str`required` :
-          (state.credit_facade_credentials as any).repeatPassword !== state.credit_facade_credentials.password ? i18n.str`doesn't match`
+      password:
+        state.credit_facade_credentials?.type !== "basic"
+          ? undefined
+          : !state.credit_facade_credentials.password
+            ? i18n.str`required`
             : undefined,
+
+      repeatPassword:
+        state.credit_facade_credentials?.type !== "basic"
+          ? undefined
+          : !(state.credit_facade_credentials as any).repeatPassword
+            ? i18n.str`required`
+            : (state.credit_facade_credentials as any).repeatPassword !==
+                state.credit_facade_credentials.password
+              ? i18n.str`doesn't match`
+              : undefined,
     }),
   };
 
@@ -78,18 +101,25 @@ export function UpdatePage({ account, onUpdate, onBack }: Props): VNode {
 
   const submitForm = () => {
     if (hasErrors) return Promise.reject();
-
-    const credit_facade_url = !state.credit_facade_url ? undefined : new URL("/", state.credit_facade_url).href
-
-    const credit_facade_credentials: TalerMerchantApi.FacadeCredentials | undefined =
-      credit_facade_url == undefined || state.credit_facade_credentials === undefined ? undefined :
-        state.credit_facade_credentials.type === "basic" ? {
-          type: "basic",
-          password: state.credit_facade_credentials.password,
-          username: state.credit_facade_credentials.username,
-        } : {
-          type: "none"
-        };
+    const credit_facade_url = !state.credit_facade_url
+      ? undefined
+      : facadeURL?.href;
+
+    const credit_facade_credentials:
+      | TalerMerchantApi.FacadeCredentials
+      | undefined =
+      credit_facade_url == undefined ||
+      state.credit_facade_credentials === undefined
+        ? undefined
+        : state.credit_facade_credentials.type === "basic"
+          ? {
+              type: "basic",
+              password: state.credit_facade_credentials.password,
+              username: state.credit_facade_credentials.username,
+            }
+          : {
+              type: "none",
+            };
 
     return onUpdate({ credit_facade_credentials, credit_facade_url });
   };
@@ -140,7 +170,7 @@ export function UpdatePage({ account, onUpdate, onBack }: Props): VNode {
                   toStr={(str) => {
                     if (str === "none") return "Without authentication";
                     if (str === "basic") return "With authentication";
-                    return "Do not change"
+                    return "Do not change";
                   }}
                 />
                 {state.credit_facade_credentials?.type === "basic" ? (
@@ -191,11 +221,12 @@ export function UpdatePage({ account, onUpdate, onBack }: Props): VNode {
   );
 }
 
-function isValidURL(s: string): boolean {
+//TODO: move to utils
+export function safeConvertURL(s?: string): URL | undefined {
+  if (!s) return undefined;
   try {
-    const u = new URL("/", s)
-    return true;
+    return new URL(s);
   } catch (e) {
-    return false;
+    return undefined;
   }
 }