fix(forward): move secret item path to /secrets/{name} (INT-1666) by armando-rodriguez-cko · Pull Request #443 · checkout/checkout-sdk-node

armando-rodriguez-cko · 2026-07-23T17:47:55Z

Completes the Forward secrets path rename (swagger 2026-07-20): the item endpoints PATCH/DELETE moved from /forward/secrets/{name} to /secrets/{name}, dropping the /forward prefix so the item matches the collection already on /secrets.

Jira: INT-1666
Tests: green (forward suite).

🤖 Generated with Claude Code

agent-wall-e · 2026-07-23T17:48:03Z

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

no_low_class_matched
prod_source_modified
2.2.6_logical_extension:The change only updates existing URL string constants and their derivation in config/special-urls, then substitutes the new config property for hardcoded URL fragments in already-existing HTTP calls — no new endpoints, no new auth, no new data persistence, and no new abstractions are introduced.

Operational gates

✅ jira_ticket (INT-1666)
✅ independent_review

Files analysed: 4

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

agent-wall-e · 2026-07-23T17:48:04Z

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
`no_low_class_matched`	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
`prod_source_modified`	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.
`2.2.6_logical_extension` — `The change only updates existing URL string constants and their derivation in config/special-urls, then substitutes the new config property for hardcoded URL fragments in already-existing HTTP calls — no new endpoints, no new auth, no new data persistence, and no new abstractions are introduced.`	classifying	§2.2.6	Sonnet 4.6 evaluator promoted minor → low: the change reuses existing code paths and does not cross a trust boundary.

Kinds:

classifying — this rule contributed to the chosen tier.
informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

agent-wall-e

✅ Auto-approved — this PR meets all Low-risk criteria.

All checks passed, no unresolved comments, and the change classification is:

no_low_class_matched
prod_source_modified
2.2.6_logical_extension:The change only updates URL constants and config mappings for an existing endpoint path rename, reusing all existing code paths, HTTP methods, and abstractions without adding new integrations, persisted data, or auth changes.

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

The forward secrets collection endpoints (create, list) moved from /forward/secrets to /secrets, while the per-item endpoint remains at /forward/secrets/{name}. Reflects the incomplete rename in the swagger spec.

Swagger 2026-07-20 completed the rename: PATCH/DELETE moved from /forward/secrets/{name} to /secrets/{name}. Build the item path from forwardSecretsUrl (forward host root + /secrets) instead of forwardUrl, so it no longer carries the /forward prefix; update the unit tests accordingly.

agent-wall-e · 2026-07-24T09:11:43Z

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

no_low_class_matched
prod_source_modified
2.2.6_logical_extension:The change only updates existing URL constants and config mappings to point to a renamed API path on the same service, reusing all existing code paths, abstractions, and HTTP methods without adding new endpoints, persisted data, auth changes, or external integrations.

Operational gates

✅ jira_ticket (INT-1666)
✅ independent_review

Files analysed: 4

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

agent-wall-e · 2026-07-24T09:11:44Z

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
`no_low_class_matched`	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
`prod_source_modified`	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.
`2.2.6_logical_extension` — `The change only updates existing URL constants and config mappings to point to a renamed API path on the same service, reusing all existing code paths, abstractions, and HTTP methods without adding new endpoints, persisted data, auth changes, or external integrations.`	classifying	§2.2.6	Sonnet 4.6 evaluator promoted minor → low: the change reuses existing code paths and does not cross a trust boundary.

Kinds:

classifying — this rule contributed to the chosen tier.
informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

…hods (INT-1666) Address review: drop the duplicated per-subdomain FORWARD_SECRETS_* constants and forwardSecretsUrl. Keep a single forward host-root config (FORWARD_SANDBOX_URL/ FORWARD_LIVE_URL) and append the 'forward' and 'secrets' path segments in the ForwardClient methods, matching every other SDK. Resulting URLs are unchanged.

agent-wall-e · 2026-07-24T09:26:37Z

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

no_low_class_matched
prod_source_modified
2.2.6_logical_extension:This is a non-destructive URL path refactoring that moves path segments from config constants into the client methods, reusing all existing endpoints, abstractions, and HTTP helpers without adding new integrations, persisted data, or auth changes.

Operational gates

✅ jira_ticket (INT-1666)
✅ independent_review

Files analysed: 3

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

agent-wall-e · 2026-07-24T09:26:38Z

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
`no_low_class_matched`	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
`prod_source_modified`	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.
`2.2.6_logical_extension` — `This is a non-destructive URL path refactoring that moves path segments from config constants into the client methods, reusing all existing endpoints, abstractions, and HTTP helpers without adding new integrations, persisted data, or auth changes.`	classifying	§2.2.6	Sonnet 4.6 evaluator promoted minor → low: the change reuses existing code paths and does not cross a trust boundary.

Kinds:

classifying — this rule contributed to the chosen tier.
informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

…g slash (INT-1666) Per review: make the join robust instead of relying on a trailing slash. Forward host root has no trailing slash and methods join with an explicit '/' (${forwardUrl}/${SECRETS_PATH}). Builds .../forward, .../secrets and .../secrets/{name} — secrets correctly hang off the host root, not under /forward.

agent-wall-e · 2026-07-24T12:45:51Z

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

no_low_class_matched
prod_source_modified
2.2.6_logical_extension:This is a pure URL path refactoring that moves path segments from config constants into the client methods, reusing existing HTTP helpers and endpoints without adding new integrations, persisted data, auth changes, or new abstractions.

Operational gates

✅ jira_ticket (INT-1666)
✅ independent_review

Files analysed: 3

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

agent-wall-e · 2026-07-24T12:45:52Z

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
`no_low_class_matched`	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
`prod_source_modified`	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.
`2.2.6_logical_extension` — `This is a pure URL path refactoring that moves path segments from config constants into the client methods, reusing existing HTTP helpers and endpoints without adding new integrations, persisted data, auth changes, or new abstractions.`	classifying	§2.2.6	Sonnet 4.6 evaluator promoted minor → low: the change reuses existing code paths and does not cross a trust boundary.

Kinds:

classifying — this rule contributed to the chosen tier.
informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

sonarqubecloud · 2026-07-24T12:49:52Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Release 4.1.0 bundles three changes: the Forward secrets path fix (#443, INT-1666), the new Address Document Verification endpoints (#444, INT-1665) and the challenge indicator documentation alignment (#445, INT-1667). ## Forward secrets path fix (behaviour change) Swagger 2026-07-20 completed the rename of the Forward secrets endpoints. Requests now go to the Forward host root, without the `/forward` prefix: * Collection endpoints (create, list) moved from `/forward/secrets` to `/secrets`. * Item endpoints (`PATCH`, `DELETE`) moved from `/forward/secrets/{name}` to `/secrets/{name}`. * `src/config.js` keeps a single Forward host root (`FORWARD_SANDBOX_URL` / `FORWARD_LIVE_URL`) with no trailing slash, and `ForwardClient` appends the `forward` and `secrets` path segments explicitly, matching every other SDK. Forward request URLs themselves are unchanged. * Unit tests updated accordingly. (`src/api/forward/forward.js`, `src/config.js`, `test/forward/forward-unit.js`) Anyone calling the secrets methods will now hit the new paths, so this is worth calling out in the release notes. ## Address Document Verification (Adv) endpoints Implements the Adv family from swagger 2026-07-16: `POST`/`GET /address-document-verifications`, anonymize, attempts (create, list, get) and pdf-report. * New `src/api/identities/address-document-verifications.js`, wired into the identities client. (`src/api/identities/identities.js`) * TypeScript definitions added. (`types/dist/api/identities/address-document-verifications.d.ts`, `types/dist/api/identities/identities.d.ts`) * Unit tests under `test/identities/address-document-verifications/`. ## Challenge indicator documentation alignment Clarifies the allowed values of `3ds.challenge_indicator` per endpoint. No runtime behaviour changes here, only JSDoc plus a new test. * Documented in `hosted-payments.js`, `payments-links.js`, `payment-sessions.js` and `payments.js` that the field accepts only the four standard values (`no_preference`, `no_challenge_requested`, `challenge_requested`, `challenge_requested_mandate`), and that exemption values are not accepted on these endpoints. * Documented in `sessions.js` that `challenge_indicator` uniquely accepts all nine values, including exemption requests, and explained the fallback behaviour when an exemption cannot be applied. * Added `test/sessions/challenge-indicator.js` covering the accepted value sets.

agent-wall-e Bot approved these changes Jul 23, 2026

View reviewed changes

armando-rodriguez-cko added 2 commits July 24, 2026 11:11

fix(forward): update secrets collection path to /secrets

a68f71d

The forward secrets collection endpoints (create, list) moved from /forward/secrets to /secrets, while the per-item endpoint remains at /forward/secrets/{name}. Reflects the incomplete rename in the swagger spec.

armando-rodriguez-cko force-pushed the fix/INT-1666-forward-secrets-path branch from 70f6755 to 447d9e9 Compare July 24, 2026 09:11

david-ruiz-cko requested changes Jul 24, 2026

View reviewed changes

Comment thread src/config.js Outdated

armando-rodriguez-cko requested a review from david-ruiz-cko July 24, 2026 09:42

david-ruiz-cko previously approved these changes Jul 24, 2026

View reviewed changes

armando-rodriguez-cko dismissed david-ruiz-cko’s stale review via 834807f July 24, 2026 12:45

david-ruiz-cko approved these changes Jul 24, 2026

View reviewed changes

armando-rodriguez-cko merged commit 5747159 into master Jul 24, 2026
1 check passed

armando-rodriguez-cko deleted the fix/INT-1666-forward-secrets-path branch July 24, 2026 12:49

armando-rodriguez-cko mentioned this pull request Aug 6, 2026

Release 4.1.0 - Forward secrets path fix + Address Document Verification endpoints + challenge indicator docs #446

Merged

Navigation Menu

Uh oh!

fix(forward): move secret item path to /secrets/{name} (INT-1666) - #443

fix(forward): move secret item path to /secrets/{name} (INT-1666)#443
armando-rodriguez-cko merged 4 commits into
masterfrom
fix/INT-1666-forward-secrets-path

armando-rodriguez-cko commented Jul 23, 2026

Uh oh!

agent-wall-e Bot commented Jul 23, 2026

Uh oh!

agent-wall-e Bot commented Jul 23, 2026

Uh oh!

agent-wall-e Bot left a comment

Uh oh!

agent-wall-e Bot commented Jul 24, 2026

Uh oh!

agent-wall-e Bot commented Jul 24, 2026

Uh oh!

Uh oh!

agent-wall-e Bot commented Jul 24, 2026

Uh oh!

agent-wall-e Bot commented Jul 24, 2026

Uh oh!

agent-wall-e Bot commented Jul 24, 2026

Uh oh!

agent-wall-e Bot commented Jul 24, 2026

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

armando-rodriguez-cko commented Jul 23, 2026

Uh oh!

agent-wall-e Bot commented Jul 23, 2026

🟢 Risk Classification: LOW

Classification reasons

Operational gates

Uh oh!

agent-wall-e Bot commented Jul 23, 2026

Uh oh!

agent-wall-e Bot left a comment

Choose a reason for hiding this comment

Uh oh!

agent-wall-e Bot commented Jul 24, 2026

🟢 Risk Classification: LOW

Classification reasons

Operational gates

Uh oh!

agent-wall-e Bot commented Jul 24, 2026

Uh oh!

Uh oh!

agent-wall-e Bot commented Jul 24, 2026

🟢 Risk Classification: LOW

Classification reasons

Operational gates

Uh oh!

agent-wall-e Bot commented Jul 24, 2026

Uh oh!

agent-wall-e Bot commented Jul 24, 2026

🟢 Risk Classification: LOW

Classification reasons

Operational gates

Uh oh!

agent-wall-e Bot commented Jul 24, 2026

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jul 24, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants