feature(3DS): Implement show method and return response with enriched nonce

[siddy2181]

Description

The ThreeDomainSecureClient component provides a method to the merchant to display the 3DS challenge to the buyer if the response from the isEligible method is true. After the buyer has completed the 3DS challenge, the ilabilityShift, authenticationState, and anonce with enriched 3DS data will be returned to the merchant.

Code Sample:

const submitButton = document.getElementById("submit-button");

submitButton.addEventListener("click", async () => {
  if (isThreeDomainSecureEligible) {
    const {
      liabilityShift, // "no", "unknown", "possible"
      authenticationState, // "succeeded", "cancelled", "errored"
      nonce, //Enriched nonce or the original nonce
    } = await threeDomainSecureComponent.show();
    
    if (authenticationState === "succeeded") {
      // Check the liability shift and decide on continuing the transaction
    } else {
      // Cancelled or errored, merchant needs to decide what they want to check on
    }
  }
})

Why are we making these changes? Include references to any related Jira tasks or GitHub Issues

This PR covers the following tickets

DTPPCPSDK-2662
DTPPCPSDK-2665
DTPPCPSDK-2805
DTPPCPSDK-2855

❤️ Thank you!

[mchoun]

We don't need to automatic: true anymore, correct? I believe we were testing this when we were running into the zoid xprops issue.

[siddy2181]

I believe, having automatic: true wouldn't hurt. It would make this component available automatically when created. My understanding was that it will prevent collision with the old 3DS component.

[mchoun]

automatic: true will return this component for everyone that loads the JS SDK. The exported setup() method is what will automatically create the zoid component when the component is loaded.

This will probably be fine for now since this component is still protected but we should remove this before we allow this in Production. If we don't, paypal.ThreeDomainSecureClient will be available to everyone even if they don't pass three-domain-secure into the components query param.

[wsbrunson]

we should probably remove it now because even though its hidden, it will show up in all bundles served. I'm sure its super small but might as well not ship javascript if we don't have to

Invalid review