@open-mercato/checkout 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

package/src/modules/checkout/__integration__/TC-CHK-CRUDFORM-002.spec.ts

@@ -0,0 +1,171 @@
+import { expect, test } from '@playwright/test'
+import { getAuthToken } from '@open-mercato/core/modules/core/__integration__/helpers/api'
+import {
+  assertScalarFieldsPersisted,
+  skipIfCrudFormExtensionTestsDisabled,
+} from '@open-mercato/core/helpers/integration/crudFormPersistence'
+import {
+  createFixedTemplateInput,
+  createLinkFixture,
+  createTemplateFixture,
+  deleteCheckoutEntityIfExists,
+  readLink,
+  updateLink,
+  type CheckoutLinkInput,
+} from './helpers/fixtures'
+
+/**
+ * TC-CHK-CRUDFORM-002: pay-link CrudForm persists scalars, the templateId FK, slug
+ * + custom fields (#2466 / #2566).
+ *
+ * The checkout pay-link surface is hand-written (command bus + bespoke serializer) and so does
+ * NOT fit `runCrudFormRoundTrip` — see the note in TC-CHK-CRUDFORM-001. This spec drives the
+ * canonical create → read-back → assert → update → read-back → assert → delete cycle inline,
+ * reusing the sweep harness gate + scalar assertion helper.
+ *
+ * It covers the link-specific fields on top of the shared content fields: the `templateId`
+ * foreign key and the generated `slug`, plus fixed-price money scalars, enums, booleans, an
+ * integer, and default-seeded custom fields. Every explicitly-submitted field overrides the
+ * source template (`pickExplicitParsedOverrides`), so the round-trip asserts the link's own
+ * values, not inherited ones.
+ *
+ * Verified contract:
+ * - Read-back uses the detail GET (the list route does not filter by `?ids=`/`?id=`).
+ * - Custom fields submit as a `customFields` object and return under `record.customFields`.
+ * - PUT is a partial update — omitted custom fields are retained; the slug is preserved when the
+ *   name/title change (it recomputes from the existing slug).
+ * - Self-contained: creates a throwaway template (no custom fields, so the link's own custom
+ *   fields are not affected by template copy) and deletes both fixtures in `finally`.
+ *
+ * Gated by `OM_INTEGRATION_CRUDFORM_EXTENSION_TESTS_DISABLED` (default off → runs).
+ */
+test.describe('TC-CHK-CRUDFORM-002: pay-link CrudForm persists scalars, templateId + slug + custom fields', () => {
+  test.beforeAll(() => {
+    skipIfCrudFormExtensionTestsDisabled()
+  })
+
+  test('round-trips scalars, templateId, slug, and custom fields on create and update', async ({ request }) => {
+    const token = await getAuthToken(request)
+    const stamp = Date.now()
+    let templateId: string | null = null
+    let linkId: string | null = null
+
+    try {
+      templateId = await createTemplateFixture(
+        request,
+        token,
+        createFixedTemplateInput({ name: `QA CRUDFORM Link Template ${stamp}` }),
+      )
+
+      const createInput: CheckoutLinkInput = createFixedTemplateInput({
+        name: `QA CRUDFORM Link ${stamp}`,
+        title: `QA CRUDFORM Link Title ${stamp}`,
+        subtitle: 'Original link subtitle',
+        description: 'Original link description',
+        fixedPriceAmount: 49.99,
+        fixedPriceCurrencyCode: 'USD',
+        fixedPriceIncludesTax: true,
+        fixedPriceOriginalAmount: 69.99,
+        collectCustomerDetails: true,
+        displayCustomFieldsOnPage: true,
+        customFieldsetCode: 'service_package',
+        maxCompletions: 10,
+        status: 'draft',
+        templateId,
+        slug: `qa-crudform-link-${stamp}`,
+        customFields: {
+          service_deliverables: 'One-on-one consultation call',
+          delivery_timeline: 'Same week',
+          support_contact: 'help@example.test',
+        },
+      })
+      const created = await createLinkFixture(request, token, createInput)
+      linkId = created.id
+
+      const afterCreate = await readLink(request, token, linkId)
+      assertScalarFieldsPersisted(
+        afterCreate,
+        {
+          name: `QA CRUDFORM Link ${stamp}`,
+          title: `QA CRUDFORM Link Title ${stamp}`,
+          subtitle: 'Original link subtitle',
+          description: 'Original link description',
+          pricingMode: 'fixed',
+          fixedPriceAmount: 49.99,
+          fixedPriceCurrencyCode: 'USD',
+          fixedPriceIncludesTax: true,
+          fixedPriceOriginalAmount: 69.99,
+          collectCustomerDetails: true,
+          displayCustomFieldsOnPage: true,
+          customFieldsetCode: 'service_package',
+          maxCompletions: 10,
+          status: 'draft',
+          templateId,
+          slug: created.slug,
+        },
+        'after-create',
+      )
+      expect(afterCreate.customFields, 'after-create custom fields should persist').toMatchObject({
+        service_deliverables: 'One-on-one consultation call',
+        delivery_timeline: 'Same week',
+        support_contact: 'help@example.test',
+      })
+
+      const updatePayload: Partial<CheckoutLinkInput> = {
+        name: `QA CRUDFORM Link ${stamp} EDITED`,
+        title: `QA CRUDFORM Link Title ${stamp} EDITED`,
+        subtitle: 'Updated link subtitle',
+        description: 'Updated link description',
+        pricingMode: 'fixed',
+        fixedPriceAmount: 89.5,
+        fixedPriceCurrencyCode: 'USD',
+        fixedPriceIncludesTax: false,
+        fixedPriceOriginalAmount: 129.99,
+        gatewayProviderKey: 'mock',
+        collectCustomerDetails: false,
+        displayCustomFieldsOnPage: false,
+        customFieldsetCode: 'service_package',
+        maxCompletions: 20,
+        status: 'active',
+        customFields: {
+          delivery_timeline: 'Next business day',
+          session_format: 'In person',
+        },
+      }
+      const updateResponse = await updateLink(request, token, linkId, updatePayload)
+      expect(updateResponse.ok(), `update link failed: ${updateResponse.status()}`).toBeTruthy()
+
+      const afterUpdate = await readLink(request, token, linkId)
+      assertScalarFieldsPersisted(
+        afterUpdate,
+        {
+          name: `QA CRUDFORM Link ${stamp} EDITED`,
+          title: `QA CRUDFORM Link Title ${stamp} EDITED`,
+          subtitle: 'Updated link subtitle',
+          description: 'Updated link description',
+          pricingMode: 'fixed',
+          fixedPriceAmount: 89.5,
+          fixedPriceCurrencyCode: 'USD',
+          fixedPriceIncludesTax: false,
+          fixedPriceOriginalAmount: 129.99,
+          collectCustomerDetails: false,
+          displayCustomFieldsOnPage: false,
+          maxCompletions: 20,
+          status: 'active',
+          templateId,
+          slug: created.slug,
+        },
+        'after-update',
+      )
+      expect(afterUpdate.customFields, 'after-update custom fields should persist + retain omitted keys').toMatchObject({
+        delivery_timeline: 'Next business day',
+        session_format: 'In person',
+        service_deliverables: 'One-on-one consultation call',
+        support_contact: 'help@example.test',
+      })
+    } finally {
+      await deleteCheckoutEntityIfExists(request, token, 'links', linkId)
+      await deleteCheckoutEntityIfExists(request, token, 'templates', templateId)
+    }
+  })
+})

package/src/modules/checkout/__integration__/TC-CHKT-008.spec.ts

@@ -14,7 +14,11 @@ import {
 } from './helpers/fixtures'
 
 test.describe('TC-CHKT-008: Attempt update on locked link, verify 422', () => {
+  test.setTimeout(120_000)
+
   test('rejects link edits after the first transaction locks the record', async ({ request }) => {
+    test.slow()
+
     let token: string | null = null
     let linkId: string | null = null
     let transactionId: string | null = null

package/src/modules/checkout/__integration__/TC-CHKT-039-null-gateway-edit.spec.ts

@@ -0,0 +1,131 @@
+import { expect, test } from '@playwright/test'
+import { getAuthToken } from '@open-mercato/core/modules/core/__integration__/helpers/api'
+import { readJsonSafe } from '@open-mercato/core/modules/core/__integration__/helpers/generalFixtures'
+import {
+  createFixedTemplateInput,
+  createLinkFixture,
+  createTemplateFixture,
+  deleteCheckoutEntityIfExists,
+  readLink,
+  readTemplate,
+  updateLink,
+  updateTemplate,
+} from './helpers/fixtures'
+
+test.describe('TC-CHKT-039: Draft template/pay-link gateway provider edit validation', () => {
+  test('template: clearing the required gateway provider is rejected and preserves the previous value', async ({ request }) => {
+    let token: string | null = null
+    let templateId: string | null = null
+
+    try {
+      token = await getAuthToken(request)
+      templateId = await createTemplateFixture(request, token, createFixedTemplateInput({ status: 'draft' }))
+
+      const clearResponse = await updateTemplate(request, token, templateId, {
+        name: 'Consulting Fee (no gateway)',
+        pricingMode: 'fixed',
+        fixedPriceAmount: 49.99,
+        fixedPriceCurrencyCode: 'USD',
+        status: 'draft',
+        gatewayProviderKey: null,
+      })
+      expect(clearResponse.status()).toBe(400)
+      const clearBody = await readJsonSafe<{ fieldErrors?: { gatewayProviderKey?: string }; error?: string }>(clearResponse)
+      expect(clearBody?.fieldErrors?.gatewayProviderKey ?? clearBody?.error ?? '').toContain('checkout.validation.gatewayProviderKey.required')
+
+      const cleared = await readTemplate(request, token, templateId)
+      expect(cleared.gatewayProviderKey).toBe('mock')
+      expect(cleared.name).not.toBe('Consulting Fee (no gateway)')
+
+      const renameResponse = await updateTemplate(request, token, templateId, {
+        name: 'Consulting Fee renamed',
+      })
+      expect(
+        renameResponse.ok(),
+        `Editing a field while retaining the existing gateway should succeed: ${renameResponse.status()} ${JSON.stringify(await readJsonSafe(renameResponse))}`,
+      ).toBeTruthy()
+
+      const renamed = await readTemplate(request, token, templateId)
+      expect(renamed.gatewayProviderKey).toBe('mock')
+      expect(renamed.name).toBe('Consulting Fee renamed')
+
+      const blankResponse = await updateTemplate(request, token, templateId, {
+        gatewayProviderKey: '   ',
+      })
+      expect(blankResponse.status()).toBe(400)
+      const blankBody = await readJsonSafe<{ fieldErrors?: { gatewayProviderKey?: string }; error?: string }>(blankResponse)
+      expect(blankBody?.fieldErrors?.gatewayProviderKey ?? blankBody?.error ?? '').toContain('checkout.validation.gatewayProviderKey.required')
+
+      const blanked = await readTemplate(request, token, templateId)
+      expect(blanked.gatewayProviderKey).toBe('mock')
+    } finally {
+      await deleteCheckoutEntityIfExists(request, token, 'templates', templateId)
+    }
+  })
+
+  test('pay-link: clearing the gateway provider on a draft saves and round-trips as null', async ({ request }) => {
+    let token: string | null = null
+    let linkId: string | null = null
+
+    try {
+      token = await getAuthToken(request)
+      const link = await createLinkFixture(request, token, createFixedTemplateInput({ status: 'draft' }))
+      linkId = link.id
+
+      const clearResponse = await updateLink(request, token, link.id, {
+        name: 'Pay link (no gateway)',
+        pricingMode: 'fixed',
+        fixedPriceAmount: 49.99,
+        fixedPriceCurrencyCode: 'USD',
+        status: 'draft',
+        gatewayProviderKey: null,
+      })
+      expect(
+        clearResponse.ok(),
+        `Clearing the gateway on a draft pay-link should succeed: ${clearResponse.status()} ${JSON.stringify(await readJsonSafe(clearResponse))}`,
+      ).toBeTruthy()
+
+      const cleared = await readLink(request, token, link.id)
+      expect(cleared.gatewayProviderKey ?? null).toBeNull()
+      expect(cleared.name).toBe('Pay link (no gateway)')
+
+      const renameResponse = await updateLink(request, token, link.id, {
+        name: 'Pay link renamed',
+        gatewayProviderKey: null,
+      })
+      expect(
+        renameResponse.ok(),
+        `Editing a field on a gateway-less draft pay-link should succeed: ${renameResponse.status()} ${JSON.stringify(await readJsonSafe(renameResponse))}`,
+      ).toBeTruthy()
+
+      const renamed = await readLink(request, token, link.id)
+      expect(renamed.gatewayProviderKey ?? null).toBeNull()
+      expect(renamed.name).toBe('Pay link renamed')
+    } finally {
+      await deleteCheckoutEntityIfExists(request, token, 'links', linkId)
+    }
+  })
+
+  test('pay-link: publishing still requires a gateway provider', async ({ request }) => {
+    let token: string | null = null
+    let linkId: string | null = null
+
+    try {
+      token = await getAuthToken(request)
+      const link = await createLinkFixture(request, token, createFixedTemplateInput({ status: 'draft' }))
+      linkId = link.id
+
+      const publishResponse = await updateLink(request, token, link.id, {
+        status: 'active',
+        gatewayProviderKey: null,
+      })
+      expect([400, 422]).toContain(publishResponse.status())
+      const body = await readJsonSafe<{ error?: string; fieldErrors?: { gatewayProviderKey?: string } }>(publishResponse)
+      const fieldError = typeof body?.fieldErrors?.gatewayProviderKey === 'string' ? body.fieldErrors.gatewayProviderKey : ''
+      const errorMessage = typeof body?.error === 'string' ? body.error : ''
+      expect(`${fieldError} ${errorMessage}`.toLowerCase()).toContain('gateway')
+    } finally {
+      await deleteCheckoutEntityIfExists(request, token, 'links', linkId)
+    }
+  })
+})

package/src/modules/checkout/__integration__/TC-CHKT-039-stale-delete-lock.spec.ts

@@ -0,0 +1,98 @@
+import { expect, test } from '@playwright/test'
+import { getAuthToken } from '@open-mercato/core/modules/core/__integration__/helpers/api'
+import { createFixedTemplateInput, createLinkFixture, readLink } from './helpers/fixtures'
+
+/**
+ * TC-CHKT-039: OSS optimistic locking now guards the pay-link/template DELETE.
+ *
+ * QA round-6 (PR #2055): after a save conflict surfaced the unified conflict
+ * bar, clicking Delete still removed the stale record. The pay-link/template
+ * delete path was unguarded — the client sent no version header and the
+ * `checkout.link.delete` / `checkout.template.delete` commands never called
+ * `enforceCommandOptimisticLock` (only the *.update commands did).
+ *
+ * This spec proves the server contract the UI relies on:
+ *   - GET detail exposes `updatedAt`.
+ *   - DELETE without the header succeeds (strictly additive).
+ *   - DELETE with a stale header returns 409 with the structured conflict body.
+ *   - DELETE with a fresh header deletes the record.
+ *
+ * Requires `OM_OPTIMISTIC_LOCK=all` (CI default).
+ */
+const OPTIMISTIC_LOCK_HEADER = 'x-om-ext-optimistic-lock-expected-updated-at'
+
+function readUpdatedAt(record: Record<string, unknown>): string {
+  const raw = record.updatedAt ?? record.updated_at
+  expect(typeof raw, 'link detail should expose updatedAt as a string').toBe('string')
+  return new Date(Date.parse(raw as string)).toISOString()
+}
+
+test.describe('TC-CHKT-039: pay-link stale DELETE optimistic-lock guard', () => {
+  test('stale DELETE returns 409; fresh DELETE succeeds; header-less stays backward-compatible', async ({ request }) => {
+    const token = await getAuthToken(request)
+
+    // Two links: one to prove the stale→409→fresh path, one to prove the
+    // strictly-additive header-less delete still works.
+    const guarded = await createLinkFixture(request, token, createFixedTemplateInput())
+    const additive = await createLinkFixture(request, token, createFixedTemplateInput())
+    let guardedDeleted = false
+    let additiveDeleted = false
+
+    try {
+      const detail = await readLink(request, token, guarded.id)
+      const t0 = readUpdatedAt(detail as Record<string, unknown>)
+
+      // A save advances the version, making t0 stale.
+      const bump = await request.fetch(`/api/checkout/links/${encodeURIComponent(guarded.id)}`, {
+        method: 'PUT',
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+        data: { subtitle: 'bumped for stale-delete test' },
+      })
+      expect(bump.status(), 'PUT bump should succeed').toBeLessThan(300)
+
+      // Stale DELETE → 409 with the structured conflict body; record survives.
+      const staleDelete = await request.fetch(`/api/checkout/links/${encodeURIComponent(guarded.id)}`, {
+        method: 'DELETE',
+        headers: { Authorization: `Bearer ${token}`, [OPTIMISTIC_LOCK_HEADER]: t0 },
+      })
+      expect(staleDelete.status(), 'DELETE with a stale header should return 409').toBe(409)
+      expect((await staleDelete.json()) as Record<string, unknown>).toMatchObject({
+        code: 'optimistic_lock_conflict',
+        expectedUpdatedAt: t0,
+      })
+
+      const stillThere = await readLink(request, token, guarded.id)
+      const t1 = readUpdatedAt(stillThere as Record<string, unknown>)
+      expect(t1, 'stale delete must NOT have removed the record').not.toBe(t0)
+
+      // Fresh DELETE → succeeds.
+      const freshDelete = await request.fetch(`/api/checkout/links/${encodeURIComponent(guarded.id)}`, {
+        method: 'DELETE',
+        headers: { Authorization: `Bearer ${token}`, [OPTIMISTIC_LOCK_HEADER]: t1 },
+      })
+      expect(freshDelete.status(), 'DELETE with a fresh header should succeed').toBeLessThan(300)
+      guardedDeleted = true
+
+      // Header-less DELETE still works (strictly additive).
+      const nohdrDelete = await request.fetch(`/api/checkout/links/${encodeURIComponent(additive.id)}`, {
+        method: 'DELETE',
+        headers: { Authorization: `Bearer ${token}` },
+      })
+      expect(nohdrDelete.status(), 'DELETE without a header should succeed').toBeLessThan(300)
+      additiveDeleted = true
+    } finally {
+      if (!guardedDeleted) {
+        await request.fetch(`/api/checkout/links/${encodeURIComponent(guarded.id)}`, {
+          method: 'DELETE',
+          headers: { Authorization: `Bearer ${token}` },
+        }).catch(() => undefined)
+      }
+      if (!additiveDeleted) {
+        await request.fetch(`/api/checkout/links/${encodeURIComponent(additive.id)}`, {
+          method: 'DELETE',
+          headers: { Authorization: `Bearer ${token}` },
+        }).catch(() => undefined)
+      }
+    }
+  })
+})

package/src/modules/checkout/__integration__/TC-CHKT-040-gateway-settings-select.spec.ts

@@ -0,0 +1,60 @@
+import { expect, test, type Locator, type Page } from '@playwright/test'
+import { getAuthToken } from '@open-mercato/core/modules/core/__integration__/helpers/api'
+import { login } from '@open-mercato/core/helpers/integration/auth'
+import {
+  createFixedTemplateInput,
+  createTemplateFixture,
+  deleteCheckoutEntityIfExists,
+  readTemplate,
+} from './helpers/fixtures'
+
+async function waitForCaptureMethodSelect(page: Page): Promise<Locator> {
+  const captureMethodField = page.getByText('Capture method').locator('xpath=ancestor::div[contains(@class, "space-y-2")]').first()
+  const captureMethodSelect = captureMethodField.getByRole('combobox').first()
+
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    if (await captureMethodSelect.isVisible({ timeout: 20_000 }).catch(() => false)) {
+      return captureMethodSelect
+    }
+    if (attempt < 2) {
+      await page.reload({ waitUntil: 'domcontentloaded' })
+    }
+  }
+
+  await expect(page.locator('main').getByText(/Edit Template|Capture method/).first()).toBeVisible({ timeout: 5_000 })
+  return captureMethodSelect
+}
+
+test.describe('TC-CHKT-040: Gateway setting selects round-trip through template edit UI', () => {
+  test('prefills and saves the checkout capture method', async ({ page, request }) => {
+    test.setTimeout(120_000)
+    let token: string | null = null
+    let templateId: string | null = null
+
+    try {
+      token = await getAuthToken(request)
+      templateId = await createTemplateFixture(request, token, createFixedTemplateInput({
+        gatewayProviderKey: 'mock_processing',
+        gatewaySettings: { captureMethod: 'manual' },
+        status: 'draft',
+      }))
+
+      await login(page, 'admin')
+      await page.goto(`/backend/checkout/templates/${encodeURIComponent(templateId)}`, { waitUntil: 'domcontentloaded' })
+
+      const captureMethodSelect = await waitForCaptureMethodSelect(page)
+      await expect(captureMethodSelect).toBeVisible()
+      await expect(captureMethodSelect).toContainText('Manual capture')
+
+      await captureMethodSelect.click()
+      await page.getByRole('option', { name: 'Automatic capture' }).click()
+      await page.locator('form').getByRole('button', { name: 'Save' }).click()
+      await expect(page).toHaveURL(/\/backend\/checkout\/templates(?:\?.*)?$/)
+
+      const saved = await readTemplate(request, token, templateId)
+      expect((saved.gatewaySettings as Record<string, unknown> | undefined)?.captureMethod).toBe('automatic')
+    } finally {
+      await deleteCheckoutEntityIfExists(request, token, 'templates', templateId)
+    }
+  })
+})

package/src/modules/checkout/__integration__/TC-CHKT-041-template-stale-delete-conflict.spec.ts

@@ -0,0 +1,58 @@
+import { expect, test } from '@playwright/test'
+import { getAuthToken } from '@open-mercato/core/modules/core/__integration__/helpers/api'
+import { readJsonSafe } from '@open-mercato/core/modules/core/__integration__/helpers/generalFixtures'
+import {
+  createFixedTemplateInput,
+  createTemplateFixture,
+  deleteCheckoutEntityIfExists,
+  deleteTemplate,
+  updateTemplate,
+} from './helpers/fixtures'
+
+const OPTIMISTIC_LOCK_HEADER = 'x-om-ext-optimistic-lock-expected-updated-at'
+const STALE_EXPECTED_AT = '2020-01-01T00:00:00.000Z'
+
+function resolveUrl(path: string): string {
+  const base = process.env.BASE_URL?.trim() || null
+  return base ? `${base}${path}` : path
+}
+
+// Regression for #2529 (alinadivante comment 4638514821, "TC A" optimistic-lock gap):
+// editing a checkout template that was deleted in another tab must surface a clean
+// optimistic-lock conflict (409) when the client sent the expected-version header —
+// not a bare "Template not found" 404. Plain API clients that send no header keep the
+// existing 404 (fail-open).
+test.describe('TC-CHKT-041: Checkout template stale-edit after delete', () => {
+  test('PUT with stale optimistic-lock header on a deleted template returns 409 conflict', async ({ request }) => {
+    const token = await getAuthToken(request, 'admin')
+    let templateId: string | null = null
+
+    try {
+      templateId = await createTemplateFixture(request, token, createFixedTemplateInput({ status: 'draft' }))
+
+      // Simulate "deleted in another tab".
+      const deleteResponse = await deleteTemplate(request, token, templateId)
+      expect(deleteResponse.ok(), 'template delete fixture should succeed').toBeTruthy()
+
+      // Replay a stale edit carrying the optimistic-lock header → expect 409.
+      const conflictResponse = await request.fetch(resolveUrl(`/api/checkout/templates/${encodeURIComponent(templateId)}`), {
+        method: 'PUT',
+        headers: {
+          Authorization: `Bearer ${token}`,
+          'Content-Type': 'application/json',
+          [OPTIMISTIC_LOCK_HEADER]: STALE_EXPECTED_AT,
+        },
+        data: { name: 'QA stale edit' },
+      })
+      expect(conflictResponse.status(), 'stale edit after delete should be a 409 conflict').toBe(409)
+      const conflictBody = await readJsonSafe<{ code?: string }>(conflictResponse)
+      expect(conflictBody?.code, 'conflict body should carry the optimistic-lock code').toBe('optimistic_lock_conflict')
+
+      // Without the header, the same edit keeps the plain 404 (fail-open).
+      const notFoundResponse = await updateTemplate(request, token, templateId, { name: 'QA stale edit no header' })
+      expect(notFoundResponse.status(), 'no-header edit after delete should stay 404').toBe(404)
+    } finally {
+      await deleteCheckoutEntityIfExists(request, token, 'templates', templateId)
+    }
+  })
+})

package/src/modules/checkout/backend/checkout/pay-links/page.tsx

@@ -14,6 +14,7 @@ import { Button } from '@open-mercato/ui/primitives/button'
 import { Badge } from '@open-mercato/ui/primitives/badge'
 import { apiCallOrThrow, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
 import { normalizeCrudServerError } from '@open-mercato/ui/backend/utils/serverErrors'
+import { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'
 
 type LinkRow = {
   id: string
@@ -205,6 +206,13 @@ export default function CheckoutPayLinksPage() {
               </Link>
             </Button>
           )}
+          emptyState={(
+            <ListEmptyState
+              entityName={t('checkout.admin.payLinks.title')}
+              createHref="/backend/checkout/pay-links/create"
+              createLabel={t('checkout.admin.payLinks.actions.create')}
+            />
+          )}
           rowActions={(row) => (
             <RowActions items={[
               { id: 'edit', label: t('checkout.common.actions.edit'), href: `/backend/checkout/pay-links/${encodeURIComponent(row.id)}` },

package/src/modules/checkout/backend/checkout/templates/page.tsx

@@ -10,6 +10,7 @@ import { DataTable } from '@open-mercato/ui/backend/DataTable'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { apiCallOrThrow, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'
 
 type TemplateRow = {
   id: string
@@ -129,6 +130,13 @@ export default function CheckoutTemplatesPage() {
               </Link>
             </Button>
           )}
+          emptyState={(
+            <ListEmptyState
+              entityName={t('checkout.admin.templates.title')}
+              createHref="/backend/checkout/templates/create"
+              createLabel={t('checkout.admin.templates.actions.create')}
+            />
+          )}
           rowActions={(row) => (
             <RowActions items={[
               { id: 'edit', label: t('checkout.common.actions.edit'), href: `/backend/checkout/templates/${encodeURIComponent(row.id)}` },