b4772d10c72bba3ae1e6227ca19b298500cae7c4
2 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
sdarbinyan
|
d27c10dd17 |
feat: start @marketplaces/payment implementation
package.json already had @marketplaces/payment added (uncommitted) when this
started. Wired it in.
- app.config.ts: provideMarketplacesPayment(). apiUrl is environment.qrApiUrl
with its trailing /api stripped - found and fixed a real bug while wiring
this: qrApiUrl already ends in /api, and the package's default
paymentsPath is '/api/v1/payments', so passing qrApiUrl unchanged would
have silently doubled the path to .../api/api/v1/payments. Confirmed by
reading the package's baseUrl() concatenation directly, not guessed.
marketplaceDomain is a plain closure (not TenantResolverService) since
provideMarketplacesPayment runs outside the injector.
- cart.component.ts: createPaymentIntent() and startPolling() now go through
MARKETPLACES_PAYMENT_GATEWAY instead of api.service.ts's
createPaymentIntent/checkCartPaymentStatus/checkCartCardPaymentStatus (our
own earlier inferred contract, now superseded by the package's real,
published one - POST/GET {qrApiUrl}/api/v1/payments). Deliberately did NOT
swap to the package's own <mp-payment> UI component - that has a different
UX paradigm entirely (window.open for redirects instead of an iframe
popup, client-side QR generation instead of an external image service) and
replacing the existing, already-tested 769-line popup state machine
wholesale is a separate, much larger change than "wire the new package
in." Only the I/O layer moved; the surrounding state machine (paymentStatus,
checkoutInFlight, timeout/success/error handling, bank-iframe UX) is
untouched.
Response shape differs from the legacy provider: the package's
PaymentStatus is a fixed union (created/pending/authorized/paid/failed/
cancelled/expired), not a free-form string+code pair - simplified the
status-check conditionals accordingly and added 'authorized' as a second
success state (PaymentResult's own status union), which the legacy check
didn't have. The package also carries no TTL/expiry field on its response,
unlike the legacy provider's qrTTL - polling duration now falls back to
PAYMENT_MIN_POLL_SECONDS alone; flagged in a comment.
- api.service.ts's createPaymentIntent and its QrCreateResponse-based
resolvePaymentQrId/resolvePaymentQrUrl/resolvePaymentLink/
resolveBankPaymentUrl helpers are now dead code. Left in place rather than
deleted in the same pass that adds a new external dependency, so a revert
doesn't also need to resurrect deleted code.
Verified: production build succeeds, 247/247 unit tests, arch:check clean.
E2E: 2 of 7 tests currently fail
(checkout-request-shape.spec.ts, checkout-idempotent-click.spec.ts), and
this is disclosed honestly rather than hidden. Root cause, confirmed by
tracing real network requests: the customer-session cookie fake these tests
rely on stops working somewhere between the cookie being demonstrably
present in the browser (context.cookies(), and document.cookie read from a
plain page on the same origin) and Angular's own AuthService reading it -
the session-check request never fires at all. This reproduces with or
without this session's payment changes (checkout-idempotent-click.spec.ts
doesn't touch payment creation and fails the same way), so it is not a
regression introduced here, but it is unresolved. Tried switching
context.addCookies from {domain,path} to {url} form (the standard fix for
this class of Playwright cookie issue) - did not fix it, kept anyway as the
more correct form. Documented as a known, unresolved issue directly in both
spec files and e2e/README.md rather than deleting or silently marking the
tests skip - the request-shape assertions those tests make are still
correct, they are just currently unverifiable through this harness.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
||
|
sdarbinyan
|
fc53a3b7f5 |
feat: server-authoritative checkout, no client-computed amount
Some checks failed
Architecture Governance / architecture (push) Has been cancelled
F14-F16 of the frontend backlog. Contract: PHASE-1-MONEY-FX-PAYMENTS-CONTRACT.md §5.2. The highest-priority change in Phase 1: `POST /cart` sent `amount` computed client-side (this.convertTotal(this.totalWithDelivery())) and the backend was asked to trust it. Replaced with two calls: 1. POST /api/v2/storefront/checkout - offer ids + qty only. Returns checkoutSessionId and the server-computed total. 2. POST /api/v2/storefront/payments/intents - references checkoutSessionId only. Same response shape as before (qrId/qrUrl/bankUrl/qrTTL via the existing resolvePaymentQrId/resolvePaymentLink/resolveBankPaymentUrl helpers) - this replaces how the charged amount is determined, not the QR/card provider polling flow, which Phase 1 does not redesign. merchantReference (PARTNER-PROVISIONING-API-CONTRACT.md's RoutingContext field) is sent on the payment intent, generated the same way the old orderId was - our own correlation id, now with a name that matches what it is. api.service.ts: CheckoutSessionRequest/Response and PaymentIntentRequest types added, old CartPaymentRequest/createCartPayment left in place (Phase 7 reconciliation and any other caller may still reference the shape) but no longer called from checkout. offerId uses item.itemID: this codebase has no distinct Offer entity yet (Phase 3, Product/Offer split, not shipped in this model) - itemID is the same catalog identifier every other endpoint already keys off. Flagged in a code comment for whoever ships Phase 3 to revisit. Dead code removed as a consequence, not a separate pass: buildPaymentItems, getPaymentUserId, getPaymentDescription (no other caller once the old payload was gone), the ConfigService/TenantResolverService injects that existed only for getPaymentDescription, and the now-orphaned cart.paymentDescriptionFallback i18n key in all three locales. Verification: cart.component.ts has no unit spec (no src/app/pages/cart/ *.spec.ts exists) - this session's E2E suite is the only coverage the checkout request shape has. Added checkout-request-shape.spec.ts, scoped narrowly to the request/response contract rather than a full add-to-cart UI journey: seeds cart state directly into localStorage, fakes the customer session via cookie + intercepted session-check, intercepts both new endpoints and asserts on the captured request bodies. Confirms concretely: no `amount` or `price` field ever leaves the client, offers carry the right offerId/qty, and the payment intent correctly threads checkoutSessionId through. Verified: 5/5 E2E green, 115/115 unit tests green, arch:check clean, production build succeeds. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |