Advisory code review - guest checkout without login (Swish + QR)
ℹ️ host: true binds Vite to 0.0.0.0, exposing the dev server on the LAN when running outside Docker. Consider restricting this to only when VITE_API_PROXY_TARGET is set.
Rebased onto master + added frontend tests
Rebase: replayed the 4 guest-checkout commits on top of master (which now includes PR #16: Swish QR scannability fix, payment unit tests, e2e…
🔵 Removing curl -f correctly fixes the false-failure (404 on a non-existent plate is a valid "server-up" signal), but it also masks HTTP 500 — which would indicate a genuinely broken backend (e.g., DB-connection error after Spring Boot boots). If Spring Boot Actuator is available, pointing at a real health endpoint would be cleaner:\nsh\ncurl -sf http://backend:8080/actuator/health > /dev/null && break;\n\nOtherwise, explicitly exclude 5xx:\n```sh\ncurl -s -o /dev/null -w "%{http_code}" http://backend:8080/api/vehicles/ZZZ999
Verdict: Solid fix — Swish QR scannability addressed at the root cause, well-tested. One suggestion on the e2e health check.
Investigated the E2E browser test failure (CI run 103).
Root cause
The E2E job failed because 2 of 94 tests timed out on navigation to /betalning/ under 4 parallel Playwright workers…
🔴 Swish QR quiet zone too small — won't scan on desktop.
🔵 Isolate QR generation in its own try/catch.
🟡 Honor-system pay — no payment verification.
Advisory review — guest checkout (Swish Tier 0 + QR)
💡 Suggestion (low): /[\s+]/g strips every + from anywhere in the string, but the JSDoc above (L51) and the PR note describe stripping only a leading +. For valid phone numbers this is harmless (a + only ever appears as the international prefix), so no behaviour change — but the comment slightly overstates the intent. Either reword to "strips whitespace and any +", or for leading-only use replace(/\s/g, '').replace(/^\+/, ''). Either is fine.