Checkout: only customer fields on order updates, verified PayPal capture, safe logging (#6)

Co-authored-by: Michael Czechowski <mail@librete.ch>

tests/unit/order-state.test.ts

@@ -0,0 +1,56 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { isLockedForCustomer, missingCheckoutFields } from "../../src/checkout/order-state.ts";
+
+// Shaped like the row PUT /orders/:uuid/cart reads with strapi.db.query("api::order.order").findOne before it updates.
+const order = (overrides = {}) => ({
+	id: 4711,
+	uuid: "11111111-2222-4333-8444-555555555555",
+	email: "erika@example.org",
+	paymentAuthorised: false,
+	paymentStatus: null,
+	invoiceSent: false,
+	...overrides
+});
+
+test("an order is open for the customer until its payment is authorised", () => {
+	assert.equal(isLockedForCustomer(order()), false);
+	// false is the schema's default, but a row can hold null
+	assert.equal(isLockedForCustomer(order({ paymentAuthorised: null })), false);
+	assert.equal(isLockedForCustomer({}), false);
+});
+
+test("an order is locked once its payment is authorised", () => {
+	// what capturePayment writes once the capture is verified (src/checkout/capture-payment.ts)
+	assert.equal(isLockedForCustomer(order({ paymentAuthorised: true, paymentStatus: "captured" })), true);
+	// what it wrote before
+	assert.equal(isLockedForCustomer(order({ paymentAuthorised: true, paymentStatus: "authorised" })), true);
+});
+
+// Shaped like the row POST /orders/:uuid/checkout reads (strapi.db.query findOne with orderDefaultParams), after both checkout steps.
+const readyForCheckout = (overrides = {}) =>
+	order({
+		invoiceAddress: "Erika Mustermann\nMusterstraße 1\n70190 Stuttgart",
+		deliveryAddress: "Erika Mustermann\nMusterstraße 1\n70190 Stuttgart",
+		delivery: { id: 1, name: "DHL", price: 4.95 },
+		...overrides
+	});
+
+test("an order that went through both checkout steps lacks nothing for the checkout", () => {
+	assert.deepEqual(missingCheckoutFields(readyForCheckout()), []);
+});
+
+test("names the email, invoice address and delivery method an order still lacks for the checkout", () => {
+	// a new order: POST /orders creates it empty
+	assert.deepEqual(missingCheckoutFields({ email: null, invoiceAddress: null, delivery: null }), ["email", "invoiceAddress", "delivery"]);
+	assert.deepEqual(missingCheckoutFields({}), ["email", "invoiceAddress", "delivery"]);
+	// after step 1 alone
+	assert.deepEqual(missingCheckoutFields(readyForCheckout({ invoiceAddress: null, deliveryAddress: null, delivery: null })), [
+		"invoiceAddress",
+		"delivery"
+	]);
+	assert.deepEqual(missingCheckoutFields(readyForCheckout({ email: "  " })), ["email"]);
+	assert.deepEqual(missingCheckoutFields(readyForCheckout({ invoiceAddress: "" })), ["invoiceAddress"]);
+	// a delivery method that was deleted is populated as null
+	assert.deepEqual(missingCheckoutFields(readyForCheckout({ delivery: null })), ["delivery"]);
+});