feature/INT-1667 - ChallengeIndicator/SessionChallengeIndicator enum alignment

[david-ruiz-cko]

This pull request updates the Sessions API model to align with the latest Checkout.com API specification, adds missing fields, corrects value sets, and introduces comprehensive spec-conformance tests to prevent regressions. The changes improve the accuracy and maintainability of the SDK by ensuring all wire values and model fields match the API exactly, and by removing fields that are not part of the spec.

API Model Corrections and Additions

• Added missing fields to SessionRequest, including google_spa (with new GoogleSpa model), preferred_experiences (with new Experience value module), and device_information. Removed the undocumented prior_transaction_reference field. [1] [2] [3] [4] [5]
• Added the SessionChallengeIndicator value module to support the full set of challenge indicator values required by the Sessions API, and updated references from the shared payments challenge indicator. [1] [2] [3] [4]
• Added missing fields to BrowserSession for Google SPA support: iframe_payment_allowed and user_agent_client_hint. [1] [2]
• Added new schemes to SessionScheme: DISCOVER and UPI.

Value Corrections

• Corrected wire values to match the API spec: fixed non_payment to snake_case in Category, fixed QUASI_CARD_TRANSACTION spelling in TransactionType, updated ThreeDsMethodCompletion to use uppercase codes, and replaced visa with the correct set in ShippingIndicator. [1] [2] [3] [4]

Field Removals

• Removed the store_for_future_use field from CardSource, which is not present in the Sessions API model.

Spec-Conformance Tests

• Added a comprehensive RSpec suite to verify that all value modules and model fields exactly match the Checkout.com API spec, catch casing errors, and prevent future regressions.

---

References:
[1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18]

[agent-wall-e]

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

• security_sensitive_path:lib/checkout_sdk/sessions/category.rb
• security_sensitive_path:lib/checkout_sdk/sessions/channel/three_ds_method_completion.rb
• security_sensitive_path:lib/checkout_sdk/sessions/experience.rb
• security_sensitive_path:lib/checkout_sdk/sessions/google_spa.rb
• security_sensitive_path:lib/checkout_sdk/sessions/session_challenge_indicator.rb

Operational gates

• ✅ jira_ticket (INT-1667)
• ✅ independent_review

Files analysed: 11

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
security_sensitive_path — lib/checkout_sdk/sessions/category.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/channel/three_ds_method_completion.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/experience.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/google_spa.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/session_challenge_indicator.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/session_request.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/sessions.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/shipping_indicator.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/source/session_scheme.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/transaction_type.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — spec/checkout_sdk/sessions/sessions_values_spec.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

• security_sensitive_path:lib/checkout_sdk/sessions/category.rb
• security_sensitive_path:lib/checkout_sdk/sessions/channel/browser_session.rb
• security_sensitive_path:lib/checkout_sdk/sessions/channel/three_ds_method_completion.rb
• security_sensitive_path:lib/checkout_sdk/sessions/experience.rb
• security_sensitive_path:lib/checkout_sdk/sessions/google_spa.rb

Operational gates

• ✅ jira_ticket (INT-1667)
• ✅ independent_review

Files analysed: 13

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
security_sensitive_path — lib/checkout_sdk/sessions/category.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/channel/browser_session.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/channel/three_ds_method_completion.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/experience.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/google_spa.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/session_challenge_indicator.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/session_request.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/sessions.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/shipping_indicator.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/source/card_source.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/source/session_scheme.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — lib/checkout_sdk/sessions/transaction_type.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — spec/checkout_sdk/sessions/sessions_values_spec.rb	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud