POST /api/guest-orders/{token}/pay is public (no JWT) and
confirmGuestPayment simply transitions PENDING_PAYMENT -> PROCESSING
without verifying any Swish payment was received. A guest can mark an
order paid without paying, and BilHej eats the PostNord cost for a
free letter.
Interim fix (Tier 1 Swish Commerce API integration is a separate,
larger effort): self-confirmed guest orders now enter PENDING_REVIEW
instead of PROCESSING, gating fulfillment on manual admin
confirmation.
Changes:
- OrderStatus: add PENDING_REVIEW("pending_review")
- OrderService.confirmGuestPayment: set PENDING_REVIEW instead of
PROCESSING; do NOT call notifyOrderProcessing (no fulfillment yet)
- AdminOrderStatusRules: allow PENDING_REVIEW -> PROCESSING,
CANCELLED, FAILED; canRegisterShipment returns false for
PENDING_REVIEW
- AdminOrderWorkflowService: when admin advances PENDING_REVIEW ->
PROCESSING, call notifyOrderProcessing to trigger fulfillment
- GuestOrderPage.vue: status label 'Betalning mottagen, under
granskning' for pending_review
- OrderServiceTest: assert PENDING_REVIEW status + no notification
after guest self-confirm
- AdminOrderStatusRulesTest: 3 new tests for PENDING_REVIEW
transitions (allowed targets, valid PROCESSING transition,
rejected SENT transition)
The authenticated confirmPayment path is unchanged (acknowledged
Phase 0 honor-system with user traceability).
Closes#18
5825723420