feat(connector): [PayPal] add external 3DS authentication support for pre-authenticated payments

[awasthi21]

Summary

• Adds external 3DS (pre-authenticated) payment support for the PayPal connector
• Passes merchant-provided CAVV/ECI/dsTransactionId to PayPal via authentication_result in the card payment source
• Skips PayPal's internal SCA challenge flow when external 3DS data is present

Technical Spec

Problem

When merchants perform 3DS authentication externally and pass the authentication data (CAVV, ECI, dsTransactionId) via three_ds_data, the PayPal connector did not forward this data to PayPal's API. Instead, it would trigger PayPal's own SCA challenge flow via ThreeDsMethod::ScaAlways.

Solution

Add support for the PayPal authentication_result object within the card payment source, which allows passing externally authenticated 3DS data directly.

Payload sent to PayPal:

{
  "payment_source": {
    "card": {
      "number": "4111...",
      "expiry": "2030-10",
      "authentication_result": {
        "liability_shift": "POSSIBLE",
        "three_d_secure": {
          "authentication_status": "Y",
          "enrollment_status": "Y",
          "eci": "05",
          "cavv": "3q2+78r+ur7erb7vyv66vv////8=",
          "ds_transaction_id": "c4e59ceb-a382-4d6a-bc87-385d591fa09d",
          "three_ds_server_transaction_id": "..."
        }
      }
    }
  }
}

Changes

File	Change
paypal/transformers.rs	Add PaypalExternalAuthenticationResult struct with liability_shift and three_d_secure
paypal/transformers.rs	Add PaypalExternalThreeDsData struct with CAVV/ECI/dsTransId/acsTransId fields
paypal/transformers.rs	Add build_paypal_external_authentication helper to map AuthenticationData
paypal/transformers.rs	Add authentication_result field to CardRequestStruct
paypal/transformers.rs	Skip ScaAlways verification when external auth data is present
paypal/transformers.rs	Map transaction_status → liability_shift (Possible/No/Unknown)

Verification

Tested against PayPal sandbox — payment status: succeeded

Test plan

• Run external 3DS payment with three_ds_data containing CAVV/ECI/dsTransId targeting PayPal
• Verify payment succeeds with authentication_result in the request
• Verify non-3DS PayPal payments still work (no regression)
• Verify regular 3DS PayPal payments (without external data) still trigger SCA challenge

Fixes #11666

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
crates/hyperswitch_connectors/src/connectors/paypal/transformers.rs	13% smaller