feat: incoming message origin validation for react native

[michaeljsXu]

What changes are you making?

Expose allowedMessageOrigins and a typed onMessageRejected callback through the React Native API. The callback remains in JavaScript while serializable configuration crosses the native bridge, supports replacement and removal, and is cleaned up by teardown().

Both native bridges emit the same {origin, message, reason} payload, and getConfig() round-trips configured origins and the current JavaScript callback.

How to test

From platforms/react-native:

pnpm test modules/@shopify/checkout-kit-react-native/tests/index.test.ts --runInBand
pnpm module typecheck
pnpm module api:dump

[michaeljsXu]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• docs: incoming message origin validation across platforms #478
• feat: incoming message origin validation for react native #477 👈 (View in Graphite)
• feat: incoming message origin validation for ios #476
• feat: incoming message origin validation for android #475
• feat: incoming mesage origin validation for web #474
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[tiagocandido]

It looks like both native SDKs are still pinned to 4.0.0-alpha.2, which predates the APIs used by the Android and iOS bridges in this PR. Could we update both pins once compatible native releases are available so normal consumer builds pick up these APIs?

[tiagocandido]

This still depends on compatible native SDK releases. I am keeping this PR in draft and leaving the thread open until both exact pins can be updated and normal dependency resolution passes.