jocke/bilhej
1
0
Fork 0
Code Issues 6 Pull requests 6 Projects Releases 1 Packages Wiki Activity Actions
bilhej/frontend
History
Hermes Agent 5825723420
Some checks failed
CI / Lint, type check, unit tests, coverage (pull_request) Successful in 2m47s
Details
CI / E2E browser tests (pull_request) Failing after 1m44s
Details
fix(security): gate guest self-confirmed orders behind PENDING_REVIEW 
POST /api/guest-orders/{token}/pay is public (no JWT) and
confirmGuestPayment simply transitions PENDING_PAYMENT -> PROCESSING
without verifying any Swish payment was received. A guest can mark an
order paid without paying, and BilHej eats the PostNord cost for a
free letter.

Interim fix (Tier 1 Swish Commerce API integration is a separate,
larger effort): self-confirmed guest orders now enter PENDING_REVIEW
instead of PROCESSING, gating fulfillment on manual admin
confirmation.

Changes:
  - OrderStatus: add PENDING_REVIEW("pending_review")
  - OrderService.confirmGuestPayment: set PENDING_REVIEW instead of
    PROCESSING; do NOT call notifyOrderProcessing (no fulfillment yet)
  - AdminOrderStatusRules: allow PENDING_REVIEW -> PROCESSING,
    CANCELLED, FAILED; canRegisterShipment returns false for
    PENDING_REVIEW
  - AdminOrderWorkflowService: when admin advances PENDING_REVIEW ->
    PROCESSING, call notifyOrderProcessing to trigger fulfillment
  - GuestOrderPage.vue: status label 'Betalning mottagen, under
    granskning' for pending_review
  - OrderServiceTest: assert PENDING_REVIEW status + no notification
    after guest self-confirm
  - AdminOrderStatusRulesTest: 3 new tests for PENDING_REVIEW
    transitions (allowed targets, valid PROCESSING transition,
    rejected SENT transition)

The authenticated confirmPayment path is unchanged (acknowledged
Phase 0 honor-system with user traceability).

Closes #18
2026-07-18 11:49:28 +00:00
..
e2e fix(e2e): use unique plate in QR code test to avoid admin row collision 2026-06-19 14:04:26 +00:00
public refactor: add design system with CSS tokens, utilities, and app shell 2026-05-16 16:09:35 +02:00
src fix(security): gate guest self-confirmed orders behind PENDING_REVIEW 2026-07-18 11:49:28 +00:00
.gitignore feat: add login page with Playwright E2E tests 2026-05-13 19:17:29 +02:00
.prettierrc feat: scaffold Vue 3 + Vite frontend with TypeScript, Router, Pinia, Vitest, ESLint, Prettier 2026-05-01 00:52:38 +02:00
eslint.config.ts feat: scaffold Vue 3 + Vite frontend with TypeScript, Router, Pinia, Vitest, ESLint, Prettier 2026-05-01 00:52:38 +02:00
index.html refactor: add design system with CSS tokens, utilities, and app shell 2026-05-16 16:09:35 +02:00
package-lock.json feat(payment): Swish QR code and pre-filled payment link 2026-06-19 12:06:29 +00:00
package.json feat(payment): Swish QR code and pre-filled payment link 2026-06-19 12:06:29 +00:00
playwright.config.ts fix(e2e): retry transient CI failures and fix backend health check 2026-06-22 10:05:36 +00:00
README.md feat: scaffold Vue 3 + Vite frontend with TypeScript, Router, Pinia, Vitest, ESLint, Prettier 2026-05-01 00:52:38 +02:00
tsconfig.app.json fix: E2E pipeline — vite preview instead of nginx, ts build fixes 2026-05-19 18:53:52 +02:00
tsconfig.json feat: scaffold Vue 3 + Vite frontend with TypeScript, Router, Pinia, Vitest, ESLint, Prettier 2026-05-01 00:52:38 +02:00
tsconfig.node.json feat: scaffold Vue 3 + Vite frontend with TypeScript, Router, Pinia, Vitest, ESLint, Prettier 2026-05-01 00:52:38 +02:00
vite.config.ts feat(guest): guest checkout without login (Swish + QR) 2026-06-22 10:35:56 +00:00

README.md

Vue 3 + TypeScript + Vite

This template should help get you started developing with Vue 3 and TypeScript in Vite. The template uses Vue 3 <script setup> SFCs, check out the script setup docs to learn more.

Learn more about the recommended Project Setup and IDE Support in the Vue Docs TypeScript Guide.