@owlmeans/web-payment 0.1.18-rc.20 → 0.1.18-rc.21

package/tests/consumer-hooks.spec.ts

@@ -0,0 +1,205 @@
+import { describe, expect, test } from 'bun:test'
+import { createElement } from 'react'
+import { renderToStaticMarkup } from 'react-dom/server'
+import type { RegisteredEntrypoint, RequestShape } from '@owlmeans/entrypoint'
+import { ApiStatusError } from '@owlmeans/api'
+import {
+  ConsumerRegion, PerformanceConsentRequired,
+  type CancellationBody, type CancellationReceipt, type PerformanceConsentBody, type PerformanceConsentResponse,
+  type PerformanceConsentView, type WithdrawalBody, type WithdrawalCandidateList, type WithdrawalReceipt,
+} from '@owlmeans/payment'
+import { makeAsker, makeConsentGate, passThroughGate } from '../src/consumer/ensure.js'
+import { useCancellation, usePerformanceConsent, useWithdrawal } from '../src/consumer/hooks.js'
+import { useConsentGate } from '../src/consumer/provider.js'
+import { ConsentDeclined } from '../src/consumer/refusal.js'
+
+const tick = async () => await new Promise(resolve => setTimeout(resolve, 0))
+
+interface View { required: boolean }
+
+const asker = (views: Array<View | Error>) => {
+  const shown: View[] = []
+  let loads = 0
+  const control = makeAsker<[], View, boolean>({
+    load: async () => {
+      const next = views[Math.min(loads, views.length - 1)]
+      loads++
+      if (next instanceof Error) throw next
+      return next
+    },
+    required: view => view.required,
+    show: view => { shown.push(view) },
+    skip: true,
+  })
+
+  return { control, shown, loads: () => loads }
+}
+
+describe('makeAsker — the ensure() state machine', () => {
+  test('answers true at once when nothing is required, without showing anything', async () => {
+    const { control, shown } = asker([{ required: false }])
+    expect(await control.ask()).toBe(true)
+    expect(shown).toHaveLength(0)
+  })
+
+  test('shows the view and answers what the person decides', async () => {
+    const accept = asker([{ required: true }])
+    const accepted = accept.control.ask()
+    await tick()
+    expect(accept.shown).toHaveLength(1)
+    expect(accept.control.waiting()).toBe(true)
+    accept.control.settle(true)
+    expect(await accepted).toBe(true)
+    expect(accept.control.waiting()).toBe(false)
+
+    const decline = asker([{ required: true }])
+    const declined = decline.control.ask()
+    await tick()
+    decline.control.settle(false)
+    expect(await declined).toBe(false)
+  })
+
+  test('a burst of calls shares ONE pending answer and one dialog', async () => {
+    const { control, shown, loads } = asker([{ required: true }])
+    const answers = [control.ask(), control.ask(), control.ask()]
+    await tick()
+    expect(shown).toHaveLength(1)
+    expect(loads()).toBe(1)
+    control.settle(true)
+    expect(await Promise.all(answers)).toEqual([true, true, true])
+
+    // Settled: the next call reads the view afresh.
+    const next = control.ask()
+    await tick()
+    expect(loads()).toBe(2)
+    control.settle(false)
+    expect(await next).toBe(false)
+  })
+
+  test('fails open: a view that cannot be read answers the skip value', async () => {
+    const { control, shown } = asker([new Error('network down')])
+    expect(await control.ask()).toBe(true)
+    expect(shown).toHaveLength(0)
+  })
+
+  test('settling with nothing waiting does nothing', () => {
+    const { control } = asker([{ required: true }])
+    expect(() => control.settle(true)).not.toThrow()
+    expect(control.waiting()).toBe(false)
+  })
+})
+
+describe('makeConsentGate — withConsent retries exactly once', () => {
+  const counted = (failures: unknown[]) => {
+    let calls = 0
+    const action = async () => {
+      const failure = failures[calls]
+      calls++
+      if (failure != null) throw failure
+      return 'done'
+    }
+
+    return { action, calls: () => calls }
+  }
+
+  test('no refusal: runs once and never asks', async () => {
+    let asked = 0
+    const gate = makeConsentGate(async () => { asked++; return true })
+    const { action, calls } = counted([])
+    expect(await gate.withConsent(action)).toBe('done')
+    expect([calls(), asked]).toEqual([1, 0])
+  })
+
+  test('a refusal (class or bare 428) asks with force, then retries once', async () => {
+    for (const refusal of [new PerformanceConsentRequired({ pending: 1 }), new ApiStatusError(428)]) {
+      const forced: unknown[] = []
+      const gate = makeConsentGate(async opts => { forced.push(opts?.force); return true })
+      const { action, calls } = counted([refusal])
+      expect(await gate.withConsent(action)).toBe('done')
+      expect([calls(), forced]).toEqual([2, [true]])
+    }
+  })
+
+  test('a decline throws ConsentDeclined and never retries', async () => {
+    const gate = makeConsentGate(async () => false)
+    const { action, calls } = counted([new ApiStatusError(428)])
+    await expect(gate.withConsent(action)).rejects.toBeInstanceOf(ConsentDeclined)
+    expect(calls()).toBe(1)
+  })
+
+  test('a second refusal propagates — never a loop', async () => {
+    let asked = 0
+    const gate = makeConsentGate(async () => { asked++; return true })
+    const second = new ApiStatusError(428, 'second')
+    const { action, calls } = counted([new ApiStatusError(428, 'first'), second])
+    await expect(gate.withConsent(action)).rejects.toBe(second)
+    expect([calls(), asked]).toEqual([2, 1])
+  })
+
+  test('any other failure propagates without asking', async () => {
+    let asked = 0
+    const gate = makeConsentGate(async () => { asked++; return true })
+    const failure = new ApiStatusError(402)
+    await expect(gate.withConsent(async () => { throw failure })).rejects.toBe(failure)
+    expect(asked).toBe(0)
+  })
+
+  test('the pass-through gate asks nothing and lets a refusal through', async () => {
+    expect(await passThroughGate.ensure()).toBe(true)
+    const refusal = new ApiStatusError(428)
+    await expect(passThroughGate.withConsent(async () => { throw refusal })).rejects.toBe(refusal)
+  })
+})
+
+/** Render hooks once on the server and hand back what they answered. */
+const answer = <T>(hook: () => T): T => {
+  let value: T | undefined
+  const Probe = () => { value = hook(); return null }
+  renderToStaticMarkup(createElement(Probe))
+  return value as T
+}
+
+const entry = <Request extends RequestShape, Response>(call: () => Promise<Response>) =>
+  ({ call }) as unknown as RegisteredEntrypoint<Request, Response>
+
+const consentView: PerformanceConsentView = {
+  required: true, region: ConsumerRegion.Eu, country: 'DE', language: 'de', trader: 'Trader', textVersion: 'v1',
+  copyVersion: 'c1', links: { billingTerms: 'https://example.test/terms' }, purchases: [], at: new Date(),
+}
+
+describe('consumer hooks — first render', () => {
+  test('usePerformanceConsent: unknown until read, the dialog closed and wired', () => {
+    const control = answer(() => usePerformanceConsent(
+      entry<{}, PerformanceConsentView>(async () => consentView),
+      entry<{ body: PerformanceConsentBody }, PerformanceConsentResponse>(async () => ({
+        consentId: 'c', consentedAt: new Date(), purchaseIds: [], mailed: true,
+      })),
+    ))
+    expect(control.required).toBeNull()
+    expect(control.view).toBeNull()
+    expect(control.dialog.open).toBe(false)
+    expect(control.dialog.pending).toBe(false)
+    expect(typeof control.ensure).toBe('function')
+    expect(typeof control.dialog.onConfirm).toBe('function')
+    expect(control.dialog.onWithdraw).toBeUndefined()
+  })
+
+  test('useConsentGate outside a provider is the pass-through gate', async () => {
+    const gate = answer(() => useConsentGate())
+    expect(gate.required).toBeNull()
+    expect(await gate.ensure()).toBe(true)
+  })
+
+  test('useWithdrawal and useCancellation start empty and expose their form props', () => {
+    const withdrawal = answer(() => useWithdrawal(
+      entry<{}, WithdrawalCandidateList>(async () => ({ candidates: [], language: 'en', links: { billingTerms: 'https://x.test' } })),
+      entry<{ body: WithdrawalBody }, WithdrawalReceipt>(async () => { throw new Error('not called') }),
+    ))
+    expect([withdrawal.list, withdrawal.receipt, withdrawal.pending, withdrawal.form.error]).toEqual([null, null, false, false])
+
+    const cancellation = answer(() => useCancellation(
+      entry<{ body: CancellationBody }, CancellationReceipt>(async () => { throw new Error('not called') }),
+    ))
+    expect([cancellation.receipt, cancellation.pending, cancellation.form.error]).toEqual([null, false, false])
+  })
+})

package/tests/consumer.spec.ts

@@ -0,0 +1,343 @@
+import { afterAll, describe, expect, test } from 'bun:test'
+import { closeBrowser, mountComponent, type Page } from '@owlmeans/test-ui'
+import { closeHarness, harnessUrl } from './context.js'
+
+const TIMEOUT = 60_000
+
+afterAll(async () => {
+  await closeBrowser()
+  await closeHarness()
+})
+
+const open = async (query: string) => {
+  const mounted = await mountComponent({ url: `${await harnessUrl()}?${query}` })
+  // A case whose only content is a dialog (portalled) leaves an empty, zero-size <main>.
+  await mounted.page.locator('main').waitFor({ state: 'attached' })
+  return mounted
+}
+
+const text = async (page: Page, selector: string): Promise<string> =>
+  (await page.locator(selector).first().innerText()).replace(/\s+/g, ' ').trim()
+
+const attr = async (page: Page, selector: string, name: string) => await page.locator(selector).first().getAttribute(name)
+
+const output = async (page: Page, id: string): Promise<string> => (await page.locator(`#${id}`).textContent()) ?? ''
+
+/** The honeypot sits off screen and out of the tab order — present for a bot, never for a person. */
+const honeypotHidden = async (page: Page): Promise<boolean> => await page.locator('[data-honeypot] input').evaluate(input => {
+  const rect = input.getBoundingClientRect()
+  return rect.right <= 0 && input.getAttribute('tabindex') === '-1' && input.closest('[aria-hidden="true"]') != null
+})
+
+const FORBIDDEN = /non-?refundable|nicht erstattungsf|non rembours|bezzwrotn|no reembolsable|невозвратн|неповоротн|незваротн/i
+
+describe('PerformanceConsentDialog — contract language, one unchecked checkbox', () => {
+  test('shows the German statement with the purchases, gates confirm on the checkbox, and toggles to English', async () => {
+    const { page, close } = await open('case=consent&lng=de&ui=en')
+    try {
+      const dialog = page.locator('[data-consent-dialog]')
+      await dialog.waitFor()
+      expect(await dialog.getAttribute('data-language')).toBe('de')
+      expect(await dialog.getAttribute('data-contract-language')).toBe('de')
+      expect(await text(page, '[data-consent-statement]')).toStartWith('Ich verlange ausdrücklich und stimme ausdrücklich zu')
+      expect(await text(page, '[data-consent-statement]')).toContain('Example Trader')
+      expect(await page.locator('[data-consent-purchase]').count()).toBe(2)
+      expect(await attr(page, '[data-consent-purchase][data-purchase-id="pur_1"]', 'data-deadline')).toBe('2026-10-09T00:00:00.000Z')
+      expect(await text(page, '[data-consent-purchase][data-purchase-id="pur_1"]')).toContain('8. Oktober 2026')
+
+      // Unchecked by default; confirm disabled until it is ticked.
+      expect(await attr(page, '[data-consent-checkbox]', 'data-state')).toBe('unchecked')
+      expect(await page.locator('[data-consent-confirm]').isDisabled()).toBe(true)
+      expect(await text(page, '[data-consent-confirm]')).toBe('Jetzt beginnen')
+      expect(await text(page, '[data-consent-decline]')).toBe('Nicht jetzt')
+      expect(await attr(page, '[data-legal-link="billing-terms"]', 'href')).toBe('https://example.test/de/legal/billing-terms')
+      expect(await text(page, '[data-legal-link="withdrawal-function"]')).toBe('Vertrag widerrufen')
+      expect(FORBIDDEN.test(await dialog.innerText())).toBe(false)
+
+      await page.locator('[data-consent-checkbox]').click()
+      expect(await page.locator('[data-consent-confirm]').isDisabled()).toBe(false)
+
+      // The toggle is phrased in the interface language, and un-ticks: the text agreed to is the one shown.
+      expect(await text(page, '[data-consent-language-toggle]')).toBe('Show in English')
+      await page.locator('[data-consent-language-toggle]').click()
+      expect(await dialog.getAttribute('data-language')).toBe('en')
+      expect(await text(page, '[data-consent-statement]')).toStartWith('I expressly request and agree')
+      expect(await attr(page, '[data-legal-link="billing-terms"]', 'href')).toBe('https://example.test/legal/billing-terms')
+      expect(await text(page, '[data-legal-link="withdrawal-function"]')).toBe('Withdraw from contract here')
+      expect(await text(page, '[data-consent-language-toggle]')).toBe('Show in German')
+      expect(await attr(page, '[data-consent-checkbox]', 'data-state')).toBe('unchecked')
+      expect(await page.locator('[data-consent-confirm]').isDisabled()).toBe(true)
+
+      await page.locator('[data-consent-checkbox]').click()
+      await page.locator('[data-consent-confirm]').click()
+      const body = JSON.parse(await output(page, 'consent-result'))
+      expect(body).toEqual({
+        purchaseIds: ['pur_1', 'pur_2'], textVersion: 'terms-2026-09', language: 'en', acknowledged: true, uiLanguage: 'en',
+      })
+    } finally { await close() }
+  }, TIMEOUT)
+
+  test('records the contract language when confirmed untoggled, and declines on "Nicht jetzt"', async () => {
+    const confirmed = await open('case=consent&lng=de&ui=en')
+    try {
+      await confirmed.page.locator('[data-consent-checkbox]').click()
+      await confirmed.page.locator('[data-consent-confirm]').click()
+      expect(JSON.parse(await output(confirmed.page, 'consent-result')).language).toBe('de')
+    } finally { await confirmed.close() }
+
+    const declined = await open('case=consent&lng=de&ui=en')
+    try {
+      await declined.page.locator('[data-consent-decline]').click()
+      expect(await output(declined.page, 'consent-result')).toBe('declined')
+      expect(await declined.page.locator('[data-consent-dialog]').count()).toBe(0)
+    } finally { await declined.close() }
+  }, TIMEOUT)
+})
+
+describe('SubscriptionStartDialog', () => {
+  test('French statement, "Continuer vers le paiement" gated on the checkbox', async () => {
+    const { page, close } = await open('case=start&lng=fr')
+    try {
+      const dialog = page.locator('[data-start-dialog]')
+      await dialog.waitFor()
+      expect(await dialog.getAttribute('data-language')).toBe('fr')
+      expect(await dialog.getAttribute('data-plan-sku')).toBe('pro-monthly')
+      expect(await dialog.innerText()).toContain('Commencer les services Pro maintenant')
+      expect(await text(page, '[data-start-statement]')).toStartWith('Je demande expressément et j’accepte expressément')
+      expect(await text(page, '[data-start-price]')).toBe('€20.00 / month')
+      expect(await text(page, '[data-start-confirm]')).toBe('Continuer vers le paiement')
+      expect(await attr(page, '[data-start-checkbox]', 'data-state')).toBe('unchecked')
+      expect(await page.locator('[data-start-confirm]').isDisabled()).toBe(true)
+      expect(await text(page, '[data-start-language-toggle]')).toBe('Show in English')
+
+      await page.locator('[data-start-checkbox]').click()
+      await page.locator('[data-start-confirm]').click()
+      expect(JSON.parse(await output(page, 'start-result'))).toEqual({
+        planSku: 'pro-monthly', textVersion: 'terms-2026-09', language: 'fr', acknowledged: true,
+      })
+    } finally { await close() }
+  }, TIMEOUT)
+})
+
+describe('Withdrawal function', () => {
+  test('in-app, French: statutory entry and confirm, three steps, receipt with the time of receipt in UTC', async () => {
+    const { page, close } = await open('case=withdrawal&lng=fr&ui=en')
+    try {
+      const entry = page.locator('[data-withdrawal-function]')
+      await entry.waitFor()
+      expect((await entry.innerText()).trim()).toBe('Renoncer au contrat ici')
+      expect(await entry.getAttribute('title')).toBe('Withdraw from contract here')
+      expect(await entry.getAttribute('data-language')).toBe('fr')
+
+      await entry.click()
+      const dialog = page.locator('[data-withdrawal-dialog]')
+      await dialog.waitFor()
+      expect(await dialog.getAttribute('data-language')).toBe('fr')
+      expect(await dialog.getAttribute('data-step')).toBe('form')
+      await page.locator('[data-withdrawal-step="form"]').waitFor()
+      await page.locator('[data-withdrawal-candidate]').first().waitFor()
+      expect(await page.locator('[data-withdrawal-candidate]').count()).toBe(2)
+      expect(await attr(page, '[data-withdrawal-candidate][data-purchase-id="pur_1"] [data-withdrawal-estimate]', 'data-refund-minor')).toBe('942')
+      // Only name, contract and e-mail are asked — prefilled from the list.
+      expect(await page.locator('[data-withdrawal-field="name"]').inputValue()).toBe('Marie Curie')
+      expect(await page.locator('[data-withdrawal-field="email"]').inputValue()).toBe('marie@example.test')
+
+      // No contract chosen yet: the form stays.
+      await page.locator('[data-withdrawal-continue]').click()
+      expect(await attr(page, '[data-withdrawal-form]', 'data-withdrawal-step')).toBe('form')
+
+      await page.locator('[data-withdrawal-candidate-input="pur_1"]').check()
+      await page.locator('[data-withdrawal-continue]').click()
+      await page.locator('[data-withdrawal-step="review"]').waitFor()
+      expect(await dialog.getAttribute('data-step')).toBe('review')
+      expect(await text(page, '[data-withdrawal-confirm]')).toBe('Confirmer la rétractation')
+
+      await page.locator('[data-withdrawal-language-toggle]').click()
+      expect(await text(page, '[data-withdrawal-confirm]')).toBe('Confirm withdrawal')
+      await page.locator('[data-withdrawal-language-toggle]').click()
+      expect(await text(page, '[data-withdrawal-confirm]')).toBe('Confirmer la rétractation')
+
+      await page.locator('[data-withdrawal-confirm]').click()
+      const receipt = page.locator('[data-withdrawal-receipt]')
+      await receipt.waitFor()
+      expect(await dialog.getAttribute('data-step')).toBe('receipt')
+      expect(await receipt.getAttribute('data-status')).toBe('refunded')
+      expect(await receipt.getAttribute('data-declaration-id')).toBe('wd_7Kq2')
+      expect(await receipt.getAttribute('data-received-at')).toBe('2026-09-27T14:05:09.000Z')
+      expect(await text(page, '[data-withdrawal-received-at]')).toContain('14:05:09')
+      expect(await text(page, '[data-withdrawal-received-at]')).toContain('UTC')
+      expect(await receipt.innerText()).toContain('Votre rétractation a été reçue le')
+
+      expect(JSON.parse(await output(page, 'withdrawal-body'))).toEqual({
+        purchaseId: 'pur_1', contractRef: 'CR-260923-AB12CD', name: 'Marie Curie', email: 'marie@example.test', language: 'fr',
+      })
+    } finally { await close() }
+  }, TIMEOUT)
+
+  test('public, German: contract reference, name and e-mail only, a honeypot no one reaches', async () => {
+    const { page, close } = await open('case=withdrawal-public&lng=de&ui=de')
+    try {
+      await page.locator('[data-withdrawal-form]').waitFor()
+      // Contract, name, e-mail — and the honeypot, which no person sees.
+      expect(await page.locator('[data-withdrawal-form] input').count()).toBe(4)
+      expect(await honeypotHidden(page)).toBe(true)
+      await page.locator('[data-withdrawal-field="contract"]').fill('CR-260923-AB12CD')
+      await page.locator('[data-withdrawal-field="name"]').fill('Max Mustermann')
+      await page.locator('[data-withdrawal-field="email"]').fill('not-an-address')
+      await page.locator('[data-withdrawal-continue]').click()
+      expect(await attr(page, '[data-withdrawal-form]', 'data-step')).toBe('form')
+      await page.locator('[data-withdrawal-field="email"]').fill('max@example.test')
+      await page.locator('[data-withdrawal-continue]').click()
+      expect(await text(page, '[data-withdrawal-confirm]')).toBe('Widerruf bestätigen')
+      await page.locator('[data-withdrawal-confirm]').click()
+      await page.locator('[data-withdrawal-receipt]').waitFor()
+      expect(await attr(page, '[data-withdrawal-receipt]', 'data-status')).toBe('received')
+      expect(JSON.parse(await output(page, 'withdrawal-body'))).toEqual({
+        contractRef: 'CR-260923-AB12CD', name: 'Max Mustermann', email: 'max@example.test', language: 'de',
+      })
+    } finally { await close() }
+  }, TIMEOUT)
+})
+
+describe('CancellationForm', () => {
+  test('German: kind, reason for cause, summary with "Jetzt kündigen", receipt with the effective date and print', async () => {
+    const { page, close } = await open('case=cancellation&lng=de&ui=de')
+    try {
+      const form = page.locator('[data-cancellation-form]')
+      await form.waitFor()
+      expect(await form.getAttribute('data-cancellation-step')).toBe('form')
+      expect(await form.getAttribute('data-language')).toBe('de')
+      expect(await honeypotHidden(page)).toBe(true)
+
+      await page.locator('[data-cancellation-field="kind"][data-kind="extraordinary"]').check()
+      await page.locator('[data-cancellation-field="name"]').fill('Max Mustermann')
+      await page.locator('[data-cancellation-field="email"]').fill('max@example.test')
+      await page.locator('[data-cancellation-continue]').click()
+      // A cancellation for cause needs its reason.
+      expect(await form.getAttribute('data-cancellation-step')).toBe('form')
+      await page.locator('[data-cancellation-field="kind"][data-kind="ordinary"]').check()
+      await page.locator('[data-cancellation-field="contract"]').fill('CR-260925-ZZ99YY')
+      await page.locator('[data-cancellation-continue]').click()
+
+      await page.locator('[data-cancellation-step="review"]').waitFor()
+      expect(await text(page, '[data-cancellation-summary] [data-summary="contract"]')).toBe('CR-260925-ZZ99YY')
+      expect(await text(page, '[data-cancellation-confirm]')).toBe('Jetzt kündigen')
+      await page.locator('[data-cancellation-confirm]').click()
+
+      const receipt = page.locator('[data-cancellation-receipt]')
+      await receipt.waitFor()
+      expect(await receipt.getAttribute('data-status')).toBe('scheduled')
+      expect(await receipt.getAttribute('data-effective-at')).toBe('2026-10-31T00:00:00.000Z')
+      expect(await receipt.getAttribute('data-received-at')).toBe('2026-09-27T16:30:00.000Z')
+      expect(await text(page, '[data-cancellation-effective]')).toContain('31. Oktober 2026')
+      await page.locator('[data-cancellation-print]').click()
+      expect(await output(page, 'printed')).toBe('printed')
+      expect(JSON.parse(await output(page, 'cancellation-body'))).toEqual({
+        kind: 'ordinary', name: 'Max Mustermann', contractRef: 'CR-260925-ZZ99YY', effective: 'earliest',
+        email: 'max@example.test', language: 'de',
+      })
+    } finally { await close() }
+  }, TIMEOUT)
+
+  test('French and English statutory confirm labels', async () => {
+    for (const [lng, label] of [['fr', 'Notification de la résiliation'], ['en', 'Cancel now']] as const) {
+      const { page, close } = await open(`case=cancellation&lng=${lng}&ui=${lng}`)
+      try {
+        await page.locator('[data-cancellation-field="name"]').fill('A Person')
+        await page.locator('[data-cancellation-field="email"]').fill('a@example.test')
+        await page.locator('[data-cancellation-continue]').click()
+        expect(await text(page, '[data-cancellation-confirm]')).toBe(label)
+      } finally { await close() }
+    }
+  }, TIMEOUT)
+})
+
+describe('Checkout limit', () => {
+  test('a per-purchase limit hides presets above it, names its maximum, and refuses more', async () => {
+    const { page, close } = await open('case=limit')
+    try {
+      const note = page.locator('[data-checkout-limit]')
+      await note.waitFor()
+      expect(await note.getAttribute('data-max-minor')).toBe('2500')
+      expect(await note.getAttribute('data-blocked')).toBe('false')
+      expect(await note.getAttribute('data-reason')).toBe('per-purchase')
+      expect(await note.innerText()).toContain('You can add up to $25.00 right now.')
+      expect(await page.locator('[data-amount-preset]').evaluateAll(items => items.map(item => item.getAttribute('data-amount-preset'))))
+        .toEqual(['1000', '2000'])
+      expect(await page.locator('[data-harness-legal-note]').count()).toBe(1)
+
+      const input = page.getByLabel('Custom amount')
+      await input.fill('30')
+      expect(await page.getByText('The most you can add right now is $25.00.').count()).toBe(1)
+      expect(await page.locator('[data-amount-confirm]').isDisabled()).toBe(true)
+      await input.fill('25')
+      expect(await page.locator('[data-amount-confirm]').isDisabled()).toBe(false)
+      await page.locator('[data-amount-confirm]').click()
+      expect(await output(page, 'confirmed')).toBe('2500')
+    } finally { await close() }
+  }, TIMEOUT)
+
+  test('a blocked limit disables the amount and the confirm button', async () => {
+    const { page, close } = await open('case=limit&blocked=true')
+    try {
+      const note = page.locator('[data-checkout-limit]')
+      await note.waitFor()
+      expect(await note.getAttribute('data-blocked')).toBe('true')
+      expect(await note.getAttribute('data-reason')).toBe('window')
+      expect(await note.innerText()).toContain('You cannot add credits right now.')
+      expect(await page.getByLabel('Custom amount').isDisabled()).toBe(true)
+      expect(await page.locator('[data-amount-confirm]').isDisabled()).toBe(true)
+      expect(await page.locator('[data-amount-preset]').count()).toBe(0)
+    } finally { await close() }
+  }, TIMEOUT)
+})
+
+describe('Locked billing country', () => {
+  test('the estimate adopts the locked country and the picker is disabled with its note', async () => {
+    const { page, close } = await open('case=country-locked')
+    try {
+      await page.locator('[data-country-select][data-locked="true"]').waitFor()
+      await page.locator('#locked:text("true")').waitFor()
+      expect(await attr(page, '[data-country-select]', 'data-country')).toBe('DE')
+      expect(await page.getByLabel('Billing country').isDisabled()).toBe(true)
+      expect(await text(page, '[data-country-note]')).toBe('Your billing country was set by your first purchase and cannot be changed here.')
+      // The first request named no country; the locked answer's country is the one asked next.
+      expect(JSON.parse(await output(page, 'requested'))).toEqual(['', 'DE'])
+    } finally { await close() }
+  }, TIMEOUT)
+})
+
+describe('PerformanceConsentProvider + useConsentGate', () => {
+  test('a bare 428 opens the one dialog, and after consent the action is retried exactly once', async () => {
+    const { page, close } = await open('case=consent-gate&lng=pl&ui=en')
+    try {
+      await page.locator('#gate-run').click()
+      const dialog = page.locator('[data-consent-dialog]')
+      await dialog.waitFor()
+      expect(await dialog.getAttribute('data-language')).toBe('pl')
+      await page.locator('[data-consent-checkbox]').click()
+      await page.locator('[data-consent-confirm]').click()
+      await page.locator('#gate-result:text("ok:2")').waitFor()
+      expect(JSON.parse(await output(page, 'recorded'))).toEqual(expect.objectContaining({
+        purchaseIds: ['pur_1', 'pur_2'], language: 'pl', acknowledged: true,
+      }))
+      await dialog.waitFor({ state: 'detached' })
+
+      // Recorded: ensure() now answers true with no dialog.
+      await page.locator('#gate-ensure').click()
+      await page.locator('#gate-result:text("ensure:true")').waitFor()
+      expect(await page.locator('[data-consent-dialog]').count()).toBe(0)
+    } finally { await close() }
+  }, TIMEOUT)
+
+  test('a decline throws ConsentDeclined and the action is not retried', async () => {
+    const { page, close } = await open('case=consent-gate&lng=pl&ui=en')
+    try {
+      await page.locator('#gate-run').click()
+      await page.locator('[data-consent-dialog]').waitFor()
+      await page.locator('[data-consent-decline]').click()
+      await page.locator('#gate-result:text("declined:1")').waitFor()
+      expect(await output(page, 'gate-calls')).toBe('1')
+    } finally { await close() }
+  }, TIMEOUT)
+})

package/tests/context.ts

@@ -21,7 +21,7 @@ export const harnessUrl = async (): Promise<string> => {
     // makes Vite re-optimize under a new hash, and the page briefly runs two copies of React.
     optimizeDeps: {
       include: [
-        'react', 'react-dom/client', '@radix-ui/react-dialog', '@radix-ui/react-label',
+        'react', 'react-dom/client', '@radix-ui/react-checkbox', '@radix-ui/react-dialog', '@radix-ui/react-label',
         '@radix-ui/react-progress', '@radix-ui/react-select', '@radix-ui/react-slot',
         'class-variance-authority', 'clsx', 'tailwind-merge',
       ],

package/tests/harness/consumer-fixtures.ts

@@ -0,0 +1,105 @@
+import {
+  CancellationStatus, ConsumerRegion, PurchaseKind, TaxBehavior, TaxEstimateStatus, TaxType, WithdrawalStatus,
+} from '@owlmeans/payment'
+import type {
+  AmountCheckoutPolicy, CheckoutLimitView, ConsumerRightsLinks, PerformanceConsentView, PriceEstimate,
+  SubscriptionStartView, WithdrawalCandidateList,
+} from '@owlmeans/payment'
+
+/** Canned consumer-rights data for the Playwright harness — no server, no Stripe. */
+
+export const TRADER = 'Example Trader'
+
+/** Links per language — a toggle switches them with the text. */
+export const LINKS: Record<string, ConsumerRightsLinks> = Object.fromEntries(['en', 'de', 'fr', 'pl', 'es'].map(lng => {
+  const prefix = lng === 'en' ? '' : `/${lng}`
+  return [lng, {
+    billingTerms: `https://example.test${prefix}/legal/billing-terms`,
+    withdrawalInformation: `https://example.test${prefix}/legal/withdrawal`,
+    withdrawalFunction: `https://example.test${prefix}/legal/withdraw`,
+  }]
+}))
+
+export const linksOf = (lng: string): ConsumerRightsLinks => LINKS[lng] ?? LINKS.en
+
+export const consentView = (lng: string): PerformanceConsentView => ({
+  required: true, region: ConsumerRegion.Eu, country: lng.toUpperCase(), language: lng, trader: TRADER,
+  textVersion: 'terms-2026-09', copyVersion: '2026-09-23', links: linksOf(lng),
+  purchases: [
+    {
+      purchaseId: 'pur_1', contractRef: 'CR-260923-AB12CD', kind: PurchaseKind.TopUp,
+      purchasedAt: new Date('2026-09-23T10:00:00Z'), deadline: new Date('2026-10-09T00:00:00Z'),
+      productSku: 'credits', amountTotalMinor: 1_256, currency: 'eur', withdrawable: true,
+    },
+    {
+      purchaseId: 'pur_2', contractRef: 'CR-260926-EF34GH', kind: PurchaseKind.TopUp,
+      purchasedAt: new Date('2026-09-26T09:30:00Z'), deadline: new Date('2026-10-14T00:00:00Z'),
+      productSku: 'credits', amountTotalMinor: 2_460, currency: 'eur', withdrawable: true,
+    },
+  ],
+  deadline: new Date('2026-10-14T00:00:00Z'),
+  at: new Date('2026-09-27T12:00:00Z'),
+})
+
+export const startView = (lng: string): SubscriptionStartView => ({
+  required: true, planSku: 'pro-monthly', language: lng, trader: TRADER, textVersion: 'terms-2026-09',
+  copyVersion: '2026-09-23', links: linksOf(lng), region: ConsumerRegion.Eu,
+})
+
+/** What the account withdrawal list answers on the wire — dates as ISO strings. */
+export const withdrawalList = (lng: string): WithdrawalCandidateList => JSON.parse(JSON.stringify({
+  language: lng, links: linksOf(lng), name: 'Marie Curie', email: 'marie@example.test',
+  candidates: [
+    {
+      purchaseId: 'pur_1', contractRef: 'CR-260923-AB12CD', kind: PurchaseKind.TopUp,
+      purchasedAt: new Date('2026-09-23T10:00:00Z'), deadline: new Date('2026-10-09T00:00:00Z'),
+      amountTotalMinor: 1_256, currency: 'eur', automatic: true,
+      estimate: { refundMinor: 942, currency: 'eur', timeDeductionMinor: 0, unitsDeductionMinor: 314, unitsUsed: 125_000, unitsGranted: 500_000 },
+    },
+    {
+      purchaseId: 'pur_3', contractRef: 'CR-260925-ZZ99YY', kind: PurchaseKind.Subscription,
+      purchasedAt: new Date('2026-09-25T08:00:00Z'), deadline: new Date('2026-10-10T00:00:00Z'),
+      amountTotalMinor: 2_460, currency: 'eur', automatic: true, estimate: null,
+    },
+  ],
+})) as WithdrawalCandidateList
+
+export const withdrawalReceipt = {
+  declarationId: 'wd_7Kq2', receivedAt: '2026-09-27T14:05:09.000Z', content: { name: 'Marie Curie' }, mailed: true,
+  status: WithdrawalStatus.Refunded, refundMinor: 942, currency: 'eur',
+}
+
+export const publicReceipt = {
+  declarationId: 'wd_pub1', receivedAt: '2026-09-27T14:05:09.000Z', content: {}, mailed: true,
+}
+
+export const cancellationReceipt = {
+  declarationId: 'cn_4Rt8', receivedAt: '2026-09-27T16:30:00.000Z', content: {}, mailed: true,
+  status: CancellationStatus.Scheduled, effectiveAt: '2026-10-31T00:00:00.000Z',
+}
+
+export const POLICY: AmountCheckoutPolicy = {
+  currency: 'usd', minimumMinor: 500, maximumMinor: 50_000, defaultMinor: 1_000,
+  presetsMinor: [1_000, 2_000, 5_000, 10_000], fixedMinor: 0, rateBps: 200,
+}
+
+export const PER_PURCHASE_LIMIT: CheckoutLimitView = {
+  productSku: 'credits', currency: 'usd', minimumMinor: 500, maximumMinor: 2_500, narrowed: true, blocked: false,
+  reason: 'per-purchase', resetsAt: new Date('2026-10-01T09:00:00Z'),
+}
+
+export const BLOCKED_LIMIT: CheckoutLimitView = {
+  productSku: 'credits', currency: 'usd', minimumMinor: 500, maximumMinor: 0, narrowed: true, blocked: true,
+  reason: 'window', resetsAt: new Date('2026-09-30T12:00:00Z'), remainingMinor: 0,
+}
+
+/** An estimate for a LOCKED billing country: the requested country is ignored. */
+export const lockedEstimate = (subtotalMinor: number): PriceEstimate => ({
+  country: 'DE', source: 'profile', locked: true, region: ConsumerRegion.Eu, currency: 'usd',
+  behavior: TaxBehavior.Exclusive,
+  tax: {
+    status: TaxEstimateStatus.Taxed, subtotalMinor, taxMinor: Math.round(subtotalMinor * 0.19),
+    totalMinor: subtotalMinor + Math.round(subtotalMinor * 0.19), scalable: true,
+    rates: [{ type: TaxType.Vat, percentage: '19', ratePpm: 190_000, country: 'DE' }],
+  },
+})