FE: Deposit Travel Rule

1. Embedding

Load the page URL returned by the server inside an iframe. There are two hosted pages; use the redirectUrl from the matching issue API — do not assemble the URL on the client except when swapping the host for QA.

Page	URL	Issued by
Pending list	`/{lng}/deposit-travel-rule?token={token}`	`POST /v1/wallet/deposit-whitelist/travel-rule-link`
Single deposit detail	`/{lng}/deposit-travel-rule-detail?token={token}&id={id}`	`POST /v1/wallet/deposit-whitelist/transactions/{transactionId}/travel-rule-detail-link`

id is the deposit transactionId (the same value used when opening Submit from the list page, and the title ID #). The detail page has no pending list: it opens the Submit form for that transaction.

iframe markup is the same for both pages:

1.1 iframe permissions: `allow` (do not use `allow-same-origin`)

The page may be embedded cross-origin. The parent page only needs:

Attribute	Description
`allow="clipboard-write"`	Allows clipboard write inside the iframe (e.g. copy Transaction ID); otherwise the browser may block copy.

Do not set allow-same-origin in sandbox: otherwise the iframe would be treated as same-origin with the embedder, allowing our page to access the embedder’s document and creating a security risk. Without sandbox, the iframe loads under our domain normally; cookies, storage, and canvas export/download work; the parent only needs to grant clipboard via allow="clipboard-write".

2. Close event: postMessage contract

When the user clicks the close button inside the hosted page, the iframe sends a postMessage to the parent window so the parent can hide the iframe, close a modal, or run other logic.

2.1 Message payload

Field	Type	Description
`type`	string	Always `'DEPOSIT_TRAVEL_RULE_CLOSED'`; use this to identify the close event.
`source`	string	Always `'deposit-travel-rule'`; identifies the sending page.

Example:

{
  "type": "DEPOSIT_TRAVEL_RULE_CLOSED",
  "source": "deposit-travel-rule"
}

2.2 When the message is sent

Sent only when the page is inside an iframe (i.e. window.parent !== window).

Sent to window.parent; targetOrigin is determined by env or default.

On the detail page, Cancel and a successful submit also emit this event (there is no list to return to).

Open item (§0.3): whether to also emit DEPOSIT_TRAVEL_RULE_SUBMITTED after successful submit (transactionId, whiteListStatus) is not decided. Not documented until product confirms.

3. Parent page: how to listen

3.1 Plain JavaScript

3.2 Validate origin (recommended)

Validate event.origin and only accept messages from trusted origins:

4. URL parameter: `darkMode` (optional)

The hosted page accepts a URL query parameter darkMode to override the user’s local/persisted theme so the parent and embed can match.

Parameter	Values	Effect
`darkMode`	`true` / `1` / `yes`	Force dark
`darkMode`	`false` / `0` / `no`	Force light

If omitted or invalid, the current theme is unchanged (local or system preference).

When setting the iframe src, the parent can append this parameter to the server-returned URL, e.g.:

https://example.com/en/deposit-travel-rule?token=xxx&darkMode=true
https://example.com/en/deposit-travel-rule-detail?token=xxx&id=796283603784611840&darkMode=true

5. Set dark mode via postMessage (overrides URL)

The parent can send a postMessage to the iframe to switch dark/light mode at runtime. This overrides the URL darkMode parameter (e.g. load with URL light, then switch to dark via postMessage).

5.1 Message format (parent → iframe)

Field	Type	Description
`type`	string	Must be `'DEPOSIT_TRAVEL_RULE_SET_DARK_MODE'`.
`darkMode`	boolean	`true` = dark, `false` = light.

5.2 How to send

Get the iframe’s contentWindow and call postMessage with the hosted page’s origin as the second argument (use window.location.origin when same-origin):

The message is only handled when the hosted page is inside an iframe; the theme set by postMessage overrides the current URL darkMode parameter.

FE: Deposit Travel Rule

1. Embedding#

1.1 iframe permissions: allow (do not use allow-same-origin)#

2. Close event: postMessage contract#

2.1 Message payload#

2.2 When the message is sent#

3. Parent page: how to listen#

3.1 Plain JavaScript#

3.2 Validate origin (recommended)#

4. URL parameter: darkMode (optional)#

5. Set dark mode via postMessage (overrides URL)#

5.1 Message format (parent → iframe)#

5.2 How to send#