chore(POCP-1226): support 8-digit IINs in card event

examples/card-form/index.html

@@ -55,7 +55,7 @@
           function (form) {
             let preferredCardType = null;
             form.getNumberField().on("input", function (e) {
-              if (e.card_number_length == 6) {
+              if (e.card_number_length == 8) {
                 client.getCardInformation(
                   e.card_iin,
                   function(cardInfo) {
@@ -65,7 +65,7 @@
                       const radioGroup = document.createElement('div')
                       radioGroup.className = 'combo-card-types'
                       radioGroup.style.cssText = 'margin: 15px 0; padding: 15px; border: 1px solid #ddd; border-radius: 5px; background: #f9f9f9;'
-                      
+
                       radioGroup.innerHTML = `
                         <h4 style="margin: 0 0 10px 0; color: #333;">Select Card Type:</h4>
                         ${cardInfo.combo_card_types.map((type, index) => `
@@ -75,11 +75,11 @@ <h4 style="margin: 0 0 10px 0; color: #333;">Select Card Type:</h4>
                           </label>
                         `).join('')}
                       `
-                      
+
                       // Insert before the Pay button
                       const payButton = document.querySelector('.submit-button')
                       payButton.parentNode.insertBefore(radioGroup, payButton)
-                      
+
                       // Add event listener to track selection changes
                       const radioButtons = radioGroup.querySelectorAll('input[name="cardType"]')
                       radioButtons.forEach(radio => {
@@ -88,7 +88,7 @@ <h4 style="margin: 0 0 10px 0; color: #333;">Select Card Type:</h4>
                           console.log("User selected card type:", preferredCardType)
                         })
                       })
-                      
+
                       // Set initial value
                       preferredCardType = null
                     }
@@ -98,7 +98,7 @@ <h4 style="margin: 0 0 10px 0; color: #333;">Select Card Type:</h4>
                   }
                 )
               }
-    
+
               document.getElementById("errors").innerHTML = ""
             })
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "processout.js",
-  "version": "1.9.7",
+  "version": "1.9.8",
   "description": "ProcessOut.js is a JavaScript library for ProcessOut's payment processing API.",
   "scripts": {
     "build:processout": "tsc -p src/processout && uglifyjs --compress --keep-fnames --ie8 dist/processout.js -o dist/processout.js",

src/dynamic-checkout/payment-methods/card.ts

@@ -918,7 +918,12 @@ module ProcessOut {
         return
       }
 
-      const isAllowedIin = restrictToIins.indexOf(iin) !== -1
+      // card_iin may carry more digits than the configured entries (IINs can
+      // be 6 or 8 digits), so match on prefix: an allowed entry matches when
+      // the detected IIN starts with it.
+      const isAllowedIin = restrictToIins.some(function (allowedIin) {
+        return allowedIin.length > 0 && iin.substring(0, allowedIin.length) === allowedIin
+      })
 
       this.setCardRestrictionState(!isAllowedIin)
     }

src/processout/card.ts

@@ -455,10 +455,55 @@ module ProcessOut {
         public static getIIN(number: string): string {
             number = Card.parseNumber(number); // Remove potential spaces
 
-            var l = number.length;
-            if (l > 6)
-                l = 6;
-            return number.substring(0, l);
+            if (number.length < 6)
+                return number;
+
+            // Only expose an 8-digit IIN when PCI rules allow it: the scheme
+            // must permit it and the full PAN must be exactly 16 digits.
+            // Everything else caps at 6 to avoid over-exposing the BIN.
+            // Mirrors binder's TruncateNumber / api (controllers/card_inn.go).
+            if (Card.canExpose8DigitIIN(number))
+                return number.substring(0, 8);
+
+            return number.substring(0, 6);
+        }
+
+        /**
+         * Schemes permitted to surface an 8-digit IIN, mirroring the backend
+         * allow-list in api (controllers/card_inn.go). Every other scheme -
+         * notably American Express - is capped at 6 digits. Note the JS
+         * scheme key "union-pay" maps to the backend's "china union pay".
+         */
+        private static iin8DigitSchemes: Array<string> = [
+            "visa", "mastercard", "discover", "jcb", "union-pay", "carte bancaire"
+        ];
+
+        /**
+         * canExpose8DigitIIN reports whether an 8-digit IIN may be surfaced
+         * for the given card number. Mirrors binder's TruncateNumber: the PAN
+         * must be exactly 16 digits and every detected scheme must be in the
+         * allow-list. Conservative on co-badged or ambiguous prefixes (and
+         * unknown schemes), which fall back to 6 digits.
+         * @param {string} number
+         * @return {boolean}
+         */
+        public static canExpose8DigitIIN(number: string): boolean {
+            number = Card.parseNumber(number); // Remove potential spaces
+
+            // PCI: 8-digit BINs are only defined for 16-digit PANs.
+            if (number.length != 16)
+                return false;
+
+            var schemes = Card.getPossibleSchemes(number);
+            if (schemes.length == 0)
+                return false;
+
+            for (var i = 0; i < schemes.length; i++) {
+                if (Card.iin8DigitSchemes.indexOf(schemes[i]) === -1)
+                    return false;
+            }
+
+            return true;
         }
 
         /**

src/processout/processout.ts

@@ -1676,7 +1676,10 @@ module ProcessOut {
         return
       }
 
-      const iin = cardNumber.substring(0, 6)
+      // Support up to 8-digit IINs (some networks issue 8-digit IINs, which
+      // yield more accurate issuer information); fall back to whatever is
+      // available when fewer digits were provided.
+      const iin = cardNumber.substring(0, 8)
       const apiEndpoint = `iins/${iin}`
 
       this.apiRequest(