@teleporthq/teleport-plugin-next-workflows 0.43.67 → 0.43.69

package/__tests__/app-secret-env.test.ts

@@ -0,0 +1,55 @@
+import { NextWorkflowProjectPlugin } from '../src/workflow-project-plugin'
+
+// Server code tells itself apart from a browser with the app secret: it keys
+// the signatures on results relayed between workflow steps and the
+// internal-call token, and server code presents it to its own data, invoice
+// and notification routes. An app with such routes but no authentication
+// used to ship without one — every one of those keyed from ''.
+
+const structure = (uidl: unknown): any => ({
+  uidl,
+  strategy: { pages: { options: {} } },
+  files: new Map(),
+  dependencies: {},
+  devDependencies: {},
+})
+
+const app = (extra: Record<string, unknown> = {}): any => ({
+  name: 'Site',
+  globals: { settings: { title: 'Site' } },
+  root: { name: 'Root', stateDefinitions: {}, node: { type: 'element', content: {} } },
+  ...extra,
+})
+
+const secretOf = async (uidl: any): Promise<unknown> => {
+  await new NextWorkflowProjectPlugin().runBefore(structure(uidl))
+  return uidl.globals.env?.NEXTAUTH_SECRET
+}
+
+describe('the app secret of a generated app', () => {
+  it('is written for an app with server routes and no authentication', async () => {
+    for (const extra of [
+      { workflows: { workflows: { w1: { nodes: [], edges: [] } }, customNodes: {} } },
+      { dataSources: { ds1: { type: 'postgresql' } } },
+      { invoiceSettings: { enabled: true } },
+      { ecommerceSettings: { currency: 'USD' } },
+    ]) {
+      expect(await secretOf(app(extra))).toMatch(/^[0-9a-f]{64}$/)
+    }
+  })
+
+  it('is a fresh value each time, never a constant', async () => {
+    const extra = { dataSources: { ds1: { type: 'postgresql' } } }
+    expect(await secretOf(app(extra))).not.toBe(await secretOf(app(extra)))
+  })
+
+  it('keeps a secret the project already has', async () => {
+    const uidl = app({ dataSources: { ds1: { type: 'postgresql' } } })
+    uidl.globals.env = { NEXTAUTH_SECRET: 'configured-secret' }
+    expect(await secretOf(uidl)).toBe('configured-secret')
+  })
+
+  it('is not written for a static site', async () => {
+    expect(await secretOf(app())).toBeUndefined()
+  })
+})

package/__tests__/auth-env-secret-preservation.test.ts

@@ -1,5 +1,8 @@
 import { resolveAuthEnvValue, collectOAuthCredentialEnvKeys } from '../src/workflow-project-plugin'
 
+/** What a generated NEXTAUTH_SECRET default looks like: 32 random bytes, hex. */
+const RANDOM_SECRET = /^[0-9a-f]{64}$/
+
 // Regression: OAuth provider credentials never reached the deployed env →
 // NextAuth `error=OAuthSignin` ("Continue with Google" does nothing). The auth
 // plugin's `resolveAuthEnvValue` EMPTIED every `teleporthq.secrets.X` env value
@@ -105,7 +108,7 @@ describe('resolveAuthEnvValue', () => {
   it('keeps NEXTAUTH defaults and leaves non-auth behavior unchanged', () => {
     expect(
       resolveAuthEnvValue('NEXTAUTH_SECRET', 'teleporthq.secrets.NEXTAUTH_SECRET', oauthKeys)
-    ).toBe('CHANGE_ME_TO_A_RANDOM_SECRET')
+    ).toMatch(RANDOM_SECRET)
     expect(resolveAuthEnvValue('NEXTAUTH_URL', 'teleporthq.secrets.NEXTAUTH_URL', oauthKeys)).toBe(
       'http://localhost:3000'
     )
@@ -133,8 +136,24 @@ describe('resolveAuthEnvValue', () => {
       }
     )
 
-    it('a blank NEXTAUTH_SECRET heals to the placeholder default', () => {
-      expect(resolveAuthEnvValue('NEXTAUTH_SECRET', '', oauthKeys)).toBe(
+    // NEXTAUTH_SECRET signs every session and is the secret server code shows
+    // its own routes: a default anyone can read in the generator is no secret.
+    // Each generation draws its own; the deploy worker still replaces the line.
+    it('a blank NEXTAUTH_SECRET heals to a fresh random secret, never a known constant', () => {
+      const first = resolveAuthEnvValue('NEXTAUTH_SECRET', '', oauthKeys)
+      const second = resolveAuthEnvValue('NEXTAUTH_SECRET', '', oauthKeys)
+      expect(first).toMatch(RANDOM_SECRET)
+      expect(second).toMatch(RANDOM_SECRET)
+      expect(first).not.toBe(second)
+      expect(first).not.toBe('CHANGE_ME_TO_A_RANDOM_SECRET')
+    })
+
+    it('the constant earlier generations shipped is replaced, not carried over from a .env', () => {
+      expect(
+        resolveAuthEnvValue('NEXTAUTH_SECRET', 'CHANGE_ME_TO_A_RANDOM_SECRET', oauthKeys)
+      ).toMatch(RANDOM_SECRET)
+      // Only for the secret: another key holding that text is left alone.
+      expect(resolveAuthEnvValue('SOME_OTHER_KEY', 'CHANGE_ME_TO_A_RANDOM_SECRET', oauthKeys)).toBe(
         'CHANGE_ME_TO_A_RANDOM_SECRET'
       )
     })

package/__tests__/auth-nextauth-url.test.ts

@@ -1,87 +1,171 @@
 /* tslint:disable:no-eval */
 import { generateNextAuthRouteFile } from '../src/auth-generator'
 
-// The generated .env ships a localhost NEXTAUTH_URL (the deploy domain is
-// unknown at build time). NextAuth builds OAuth callback/redirect URLs from
-// NEXTAUTH_URL, so on a published domain that localhost value would break the
-// OAuth round-trip. The generated /api/auth/[...nextauth] route now derives the
-// real origin from the incoming request — without hardcoding it — while
-// respecting an explicitly-set NEXTAUTH_URL and leaving local dev alone.
-
-// Load the emitted route with `next-auth` + auth-options stubbed so we can
-// exercise the per-request NEXTAUTH_URL derivation against a fake request.
-function loadRoute(): (req: any, res: any) => any {
-  const code = generateNextAuthRouteFile()
-  const fakeNextAuth = () => (_req: any, _res: any) => ({ usedUrl: process.env.NEXTAUTH_URL })
+// The generated .env ships a localhost (or empty) NEXTAUTH_URL — the deploy
+// domain is unknown at build time. NextAuth builds OAuth callback/redirect URLs
+// AND picks its cookie names ("__Secure-" on https) from NEXTAUTH_URL, so the
+// generated /api/auth/[...nextauth] route derives the origin from the incoming
+// request — without hardcoding it — while respecting an explicitly-set real
+// NEXTAUTH_URL.
+//
+// The configured value is read ONCE per process, before any request; every request
+// then gets its own origin. It used to be written back and kept, so one request
+// through an https tunnel (ngrok forwarding webhooks to a local dev server)
+// turned every later localhost request into an https one: NextAuth issued
+// "__Secure-" cookies on localhost beside the plain ones, and the middleware,
+// reading the stale plain cookie, refused a signed-in admin.
+
+type Handler = (req: unknown, res: unknown) => unknown
+
+const CONFIGURED_STORE_KEY = '__tqConfiguredNextAuthUrl'
+
+// Loads the emitted route with `next-auth` + auth-options stubbed, under the
+// NEXTAUTH_URL the deployment configured — as a fresh process would, unless
+// `hotReload` re-evaluates it inside the same process. Returns the handler and
+// a reader for the origin NextAuth saw on the last call.
+function loadRoute(
+  configured: string | undefined,
+  options: { hotReload?: boolean } = {}
+): {
+  handler: Handler
+  originSeen: () => string | undefined
+} {
+  if (!options.hotReload) {
+    delete (globalThis as Record<string, unknown>)[CONFIGURED_STORE_KEY]
+    if (configured === undefined) {
+      delete process.env.NEXTAUTH_URL
+    } else {
+      process.env.NEXTAUTH_URL = configured
+    }
+  }
+  let seen: string | undefined
+  const fakeNextAuth = () => () => {
+    // NextAuth reads the env var synchronously when the handler is entered.
+    seen = process.env.NEXTAUTH_URL
+  }
   const fakeRequire = (id: string) => (id === 'next-auth' ? fakeNextAuth : {})
-  const moduleObj: { exports: any } = { exports: {} }
+  const moduleObj: { exports: Handler } = { exports: (() => undefined) as Handler }
   // eslint-disable-next-line @typescript-eslint/no-implied-eval
-  const fn = new Function('require', 'module', 'process', code)
-  fn(fakeRequire, moduleObj, process)
-  return moduleObj.exports
+  const fn = new Function('require', 'module', 'process', 'console', generateNextAuthRouteFile())
+  fn(fakeRequire, moduleObj, process, { error: () => undefined })
+  return { handler: moduleObj.exports, originSeen: () => seen }
 }
 
-describe('generated NextAuth route — dynamic NEXTAUTH_URL', () => {
-  const handler = loadRoute()
+const request = (headers: Record<string, string | string[]>) => ({ headers })
+
+describe('generated NextAuth route — per-request NEXTAUTH_URL', () => {
   let saved: string | undefined
 
   beforeEach(() => {
     saved = process.env.NEXTAUTH_URL
   })
   afterEach(() => {
-    if (saved === undefined) delete process.env.NEXTAUTH_URL
-    else process.env.NEXTAUTH_URL = saved
+    delete (globalThis as Record<string, unknown>)[CONFIGURED_STORE_KEY]
+    if (saved === undefined) {
+      delete process.env.NEXTAUTH_URL
+    } else {
+      process.env.NEXTAUTH_URL = saved
+    }
   })
 
   it('derives the origin from the request host when NEXTAUTH_URL is the localhost default', () => {
-    process.env.NEXTAUTH_URL = 'http://localhost:3000'
-    handler({ headers: { host: 'my-app.teleporthq.dev', 'x-forwarded-proto': 'https' } }, {})
-    expect(process.env.NEXTAUTH_URL).toBe('https://my-app.teleporthq.dev')
+    const { handler, originSeen } = loadRoute('http://localhost:3000')
+    handler(request({ host: 'my-app.teleporthq.dev', 'x-forwarded-proto': 'https' }), {})
+    expect(originSeen()).toBe('https://my-app.teleporthq.dev')
   })
 
-  it('uses x-forwarded-host and defaults the protocol to https', () => {
-    process.env.NEXTAUTH_URL = ''
-    handler({ headers: { 'x-forwarded-host': 'sugary.teleporthq.dev', host: 'internal:3000' } }, {})
-    expect(process.env.NEXTAUTH_URL).toBe('https://sugary.teleporthq.dev')
+  it('uses x-forwarded-host and defaults the protocol to https for a real domain', () => {
+    const { handler, originSeen } = loadRoute('')
+    handler(request({ 'x-forwarded-host': 'sugary.teleporthq.dev', host: 'internal:3000' }), {})
+    expect(originSeen()).toBe('https://sugary.teleporthq.dev')
   })
 
-  it('respects an explicitly-configured real NEXTAUTH_URL (does not clobber it)', () => {
-    process.env.NEXTAUTH_URL = 'https://custom-domain.com'
-    handler({ headers: { host: 'my-app.teleporthq.dev', 'x-forwarded-proto': 'https' } }, {})
-    expect(process.env.NEXTAUTH_URL).toBe('https://custom-domain.com')
+  it('respects an explicitly-configured real NEXTAUTH_URL on every request', () => {
+    const { handler, originSeen } = loadRoute('https://custom-domain.com')
+    handler(request({ host: 'my-app.teleporthq.dev', 'x-forwarded-proto': 'https' }), {})
+    expect(originSeen()).toBe('https://custom-domain.com')
+    handler(request({ host: 'localhost:3001' }), {})
+    expect(originSeen()).toBe('https://custom-domain.com')
   })
 
-  it('leaves local development untouched', () => {
-    process.env.NEXTAUTH_URL = 'http://localhost:3000'
-    handler({ headers: { host: 'localhost:3000' } }, {})
-    expect(process.env.NEXTAUTH_URL).toBe('http://localhost:3000')
+  it('gives local development its own plain-http origin, port included', () => {
+    const { handler, originSeen } = loadRoute('http://localhost:3000')
+    handler(request({ host: 'localhost:3000' }), {})
+    expect(originSeen()).toBe('http://localhost:3000')
+    handler(request({ host: 'localhost:3001' }), {})
+    expect(originSeen()).toBe('http://localhost:3001')
+    handler(request({ host: '[::1]:3001' }), {})
+    expect(originSeen()).toBe('http://[::1]:3001')
+  })
+
+  it('THE DEFECT: a request through an https tunnel does not change the origin of the next localhost request', () => {
+    const { handler, originSeen } = loadRoute('')
+    handler(
+      request({
+        host: 'localhost:3001',
+        'x-forwarded-host': 'b16a-example.ngrok-free.app',
+        'x-forwarded-proto': 'https',
+      }),
+      {}
+    )
+    expect(originSeen()).toBe('https://b16a-example.ngrok-free.app')
+
+    // The next browser request on localhost: plain http again, so NextAuth
+    // keeps using (and refreshing) the plain session cookie.
+    handler(request({ host: 'localhost:3001' }), {})
+    expect(originSeen()).toBe('http://localhost:3001')
+  })
+
+  it('a dev server reloading the route after a tunnel request still knows what was configured', () => {
+    const first = loadRoute('')
+    first.handler(
+      request({ host: 'b16a-example.ngrok-free.app', 'x-forwarded-proto': 'https' }),
+      {}
+    )
+    // process.env now holds the tunnel origin; the module is evaluated again.
+    const reloaded = loadRoute(undefined, { hotReload: true })
+    reloaded.handler(request({ host: 'localhost:3001' }), {})
+    expect(reloaded.originSeen()).toBe('http://localhost:3001')
+  })
+
+  it('reads the client-facing hop of a proxy chain', () => {
+    const { handler, originSeen } = loadRoute(undefined)
+    handler(request({ host: 'my-app.teleporthq.dev', 'x-forwarded-proto': 'https,http' }), {})
+    expect(originSeen()).toBe('https://my-app.teleporthq.dev')
+    handler(request({ host: ['shop.example.com'], 'x-forwarded-proto': ['https'] }), {})
+    expect(originSeen()).toBe('https://shop.example.com')
   })
 
   // Project a62338f9 published with `NEXTAUTH_URL=teleporthq.secrets.NEXTAUTH_URL`.
   // The old check saw a non-empty, non-localhost string and treated it as
   // explicitly configured, so NextAuth normalised it to
   // `https://teleporthq.secrets.nextauth_url`, advertised that as the sign-in
-  // origin and issued `__Host-`/`__Secure-` cookies against it. Sign-in failed
-  // with a bare `credentialsSignin`. An unresolved placeholder is now treated
-  // as unset, so an already-published site self-heals on its next request.
+  // origin and issued `__Host-`/`__Secure-` cookies against it. An unresolved
+  // placeholder is treated as unset, so an already-published site self-heals.
   it('overrides an unresolved secret placeholder on a published domain', () => {
-    process.env.NEXTAUTH_URL = 'teleporthq.secrets.NEXTAUTH_URL'
-    handler(
-      { headers: { host: 'rare-last-dunlin.teleporthq.dev', 'x-forwarded-proto': 'https' } },
-      {}
-    )
-    expect(process.env.NEXTAUTH_URL).toBe('https://rare-last-dunlin.teleporthq.dev')
+    const { handler, originSeen } = loadRoute('teleporthq.secrets.NEXTAUTH_URL')
+    handler(request({ host: 'rare-last-dunlin.teleporthq.dev', 'x-forwarded-proto': 'https' }), {})
+    expect(originSeen()).toBe('https://rare-last-dunlin.teleporthq.dev')
   })
 
   it('falls back to an http origin locally, so cookies are not Secure-prefixed', () => {
-    process.env.NEXTAUTH_URL = 'teleporthq.secrets.NEXTAUTH_URL'
-    handler({ headers: { host: 'localhost:3001' } }, {})
-    expect(process.env.NEXTAUTH_URL).toBe('http://localhost:3001')
+    const { handler, originSeen } = loadRoute('teleporthq.secrets.NEXTAUTH_URL')
+    handler(request({ host: 'localhost:3001' }), {})
+    expect(originSeen()).toBe('http://localhost:3001')
   })
 
   it('overrides any value that is not an absolute http(s) origin', () => {
-    process.env.NEXTAUTH_URL = 'my-app.teleporthq.dev'
-    handler({ headers: { host: 'my-app.teleporthq.dev', 'x-forwarded-proto': 'https' } }, {})
-    expect(process.env.NEXTAUTH_URL).toBe('https://my-app.teleporthq.dev')
+    const { handler, originSeen } = loadRoute('my-app.teleporthq.dev')
+    handler(request({ host: 'my-app.teleporthq.dev', 'x-forwarded-proto': 'https' }), {})
+    expect(originSeen()).toBe('https://my-app.teleporthq.dev')
+  })
+
+  it('keeps the configured value when the request names no host at all', () => {
+    const { handler, originSeen } = loadRoute('http://localhost:3000')
+    handler(request({}), {})
+    expect(originSeen()).toBe('http://localhost:3000')
+    const bare = loadRoute(undefined)
+    bare.handler(request({}), {})
+    expect(bare.originSeen()).toBe('http://localhost:3000')
   })
 })

package/__tests__/cart-add-item-kinds.test.ts

@@ -0,0 +1,259 @@
+/* tslint:disable:function-constructor */
+import { cartAddItem } from '../src/nodes/cart/cart-add-item'
+
+/**
+ * One order holds ONE kind of line — a subscription (billed by the provider,
+ * alone, quantity one), digital goods (delivered from the order page) or
+ * physical goods (shipped) — so the cart does too. `cart-add-item` refuses a
+ * line of another kind BEFORE anything is written and says which kind needs
+ * its own order; the workflow toasts that message. A storefront line written
+ * before the flags existed reads as physical.
+ */
+
+interface AddToCartResult {
+  added: boolean
+  reason?: string
+  message?: string
+  quantity?: number
+}
+
+type Handler = (config: Record<string, unknown>) => Promise<AddToCartResult>
+
+function loadHandler(store: Record<string, string>): Handler {
+  ;(global as any).localStorage = {
+    getItem: (key: string) => (key in store ? store[key] : null),
+    setItem: (key: string, value: string) => {
+      store[key] = value
+    },
+  }
+  ;(global as any).window = { dispatchEvent: () => true }
+  ;(global as any).CustomEvent = function CustomEvent() {
+    return {}
+  }
+  const source = cartAddItem.generateHandler()
+  return new Function('config', `${source}\nreturn cart_add_item(config)`) as Handler
+}
+
+const storedCart = (store: Record<string, string>): Array<Record<string, unknown>> =>
+  JSON.parse(store.workflow_cart)
+
+const withCart = (lines: Array<Record<string, unknown>>): Record<string, string> => ({
+  workflow_cart: JSON.stringify(lines),
+})
+
+afterEach(() => {
+  delete (global as any).localStorage
+  delete (global as any).window
+  delete (global as any).CustomEvent
+})
+
+describe('cart-add-item — one kind of line per cart', () => {
+  it('answers added: true for a line that joins an empty cart, carrying its kind', async () => {
+    const store: Record<string, string> = {}
+    const result = await loadHandler(store)({
+      productId: 'sub',
+      quantity: 3,
+      price: 24,
+      isRecurring: 'true',
+      recurringInterval: 'month',
+      recurringIntervalCount: '3',
+      trialDays: '14',
+    })
+    expect(result).toMatchObject({ added: true, quantity: 1 })
+    expect(storedCart(store)[0]).toMatchObject({
+      isRecurring: true,
+      recurringInterval: 'month',
+      recurringIntervalCount: 3,
+      trialDays: 14,
+      isDigital: false,
+      quantity: 1,
+    })
+  })
+
+  it('refuses a digital line beside a physical one, naming the digital kind', async () => {
+    const store = withCart([{ id: 'c1', productId: 'mug', quantity: 1, price: 12 }])
+    const result = await loadHandler(store)({ productId: 'ebook', price: 9, isDigital: true })
+    expect(result).toEqual({
+      added: false,
+      reason: 'mixed-cart',
+      message:
+        'Digital products need a separate order. Complete your current order or remove the other items from your cart first.',
+    })
+    expect(storedCart(store)).toHaveLength(1)
+  })
+
+  it('refuses a physical line beside a digital one, naming the physical kind', async () => {
+    const store = withCart([
+      { id: 'c1', productId: 'ebook', quantity: 1, price: 9, isDigital: true },
+    ])
+    const result = await loadHandler(store)({ productId: 'mug', price: 12 })
+    expect(result).toMatchObject({ added: false, reason: 'mixed-cart' })
+    expect(result.message).toMatch(/^Physical products need a separate order\./)
+    expect(storedCart(store)).toHaveLength(1)
+  })
+
+  it('refuses a subscription beside anything, and anything beside a subscription', async () => {
+    const besidePhysical = withCart([{ id: 'c1', productId: 'mug', quantity: 1, price: 12 }])
+    expect(
+      await loadHandler(besidePhysical)({ productId: 'plan', price: 24, isRecurring: 'true' })
+    ).toEqual({
+      added: false,
+      reason: 'one-subscription',
+      message:
+        'Subscriptions are checked out on their own. Finish or empty your current cart first.',
+    })
+    const besideSubscription = withCart([
+      { id: 'c1', productId: 'plan', quantity: 1, price: 24, isRecurring: 'true' },
+    ])
+    expect(
+      await loadHandler(besideSubscription)({ productId: 'ebook', price: 9, isDigital: 't' })
+    ).toMatchObject({
+      added: false,
+      reason: 'one-subscription',
+    })
+  })
+
+  it('keeps a gift card on its own: it joins no other kind, and no other kind joins it', async () => {
+    const besidePhysical = withCart([{ id: 'c1', productId: 'mug', quantity: 1, price: 12 }])
+    expect(
+      await loadHandler(besidePhysical)({ productId: 'card', price: 50, isGiftCard: 'true' })
+    ).toEqual({
+      added: false,
+      reason: 'mixed-cart',
+      message:
+        'Gift cards need a separate order. Complete your current order or remove the other items from your cart first.',
+    })
+    const besideDigital = withCart([
+      { id: 'c1', productId: 'ebook', quantity: 1, price: 9, isDigital: true },
+    ])
+    expect(
+      await loadHandler(besideDigital)({ productId: 'card', price: 50, isGiftCard: true })
+    ).toMatchObject({ added: false, reason: 'mixed-cart' })
+    const besideCard = withCart([
+      { id: 'c1', productId: 'card', quantity: 1, price: 50, isGiftCard: true },
+    ])
+    expect(
+      await loadHandler(besideCard)({ productId: 'ebook', price: 9, isDigital: true })
+    ).toMatchObject({
+      added: false,
+      reason: 'mixed-cart',
+      message: expect.stringMatching(/^Digital products need a separate order\./),
+    })
+    const secondCard = await loadHandler(besideCard)({
+      productId: 'card-100',
+      price: 100,
+      isGiftCard: true,
+    })
+    expect(secondCard).toMatchObject({ added: true })
+    expect(storedCart(besideCard).map((line) => line.isGiftCard)).toEqual([true, true])
+  })
+
+  it('never turns the one subscription in the cart into two units', async () => {
+    const store = withCart([
+      { id: 'c1', productId: 'plan', quantity: 1, price: 24, isRecurring: true },
+    ])
+    const result = await loadHandler(store)({ productId: 'plan', price: 24, isRecurring: true })
+    expect(result).toMatchObject({ added: false, reason: 'one-subscription' })
+    expect(storedCart(store)[0].quantity).toBe(1)
+  })
+
+  it('refuses the same subscription again with other options: another configuration is another line', async () => {
+    const store = withCart([
+      {
+        id: 'c1',
+        productId: 'plan',
+        quantity: 1,
+        price: 24,
+        isRecurring: true,
+        configuration: '[{"key":"roast","value":"dark"}]',
+        configurationKey: 'aaaaaaaaaaaaaaaa',
+      },
+    ])
+    const result = await loadHandler(store)({
+      productId: 'plan',
+      price: 24,
+      isRecurring: true,
+      configuration: '[{"key":"roast","value":"light"}]',
+      configurationKey: 'bbbbbbbbbbbbbbbb',
+    })
+    expect(result).toEqual({
+      added: false,
+      reason: 'one-subscription',
+      message:
+        'Subscriptions are checked out on their own. Finish or empty your current cart first.',
+    })
+    expect(storedCart(store)).toHaveLength(1)
+  })
+
+  it('lets a line of the same kind join, and re-stamps the kind on an existing line', async () => {
+    const store = withCart([
+      { id: 'c1', productId: 'ebook', quantity: 1, price: 9, isDigital: true },
+    ])
+    const joined = await loadHandler(store)({ productId: 'preset', price: 19, isDigital: 'yes' })
+    expect(joined).toMatchObject({ added: true })
+    const bumped = await loadHandler(store)({
+      productId: 'ebook',
+      quantity: 1,
+      price: 9,
+      isDigital: true,
+    })
+    expect(bumped).toMatchObject({ added: true, quantity: 2 })
+    expect(storedCart(store).map((line) => line.isDigital)).toEqual([true, true])
+  })
+})
+
+describe('cart-add-item — one currency per cart', () => {
+  it('refuses a line priced in another currency, naming both, and writes nothing', async () => {
+    const store = withCart([
+      { id: 'c1', productId: 'mug', quantity: 1, price: 12, currency: 'USD' },
+    ])
+    const result = await loadHandler(store)({ productId: 'tea', price: 19.99, currency: 'ron' })
+    expect(result).toEqual({
+      added: false,
+      reason: 'mixed-currency',
+      message:
+        'Products priced in RON need a separate order. Complete your current order or remove the items priced in USD from your cart first.',
+    })
+    expect(storedCart(store)).toHaveLength(1)
+  })
+
+  it('judges the kind first', async () => {
+    const store = withCart([
+      { id: 'c1', productId: 'mug', quantity: 1, price: 12, currency: 'USD' },
+    ])
+    const result = await loadHandler(store)({
+      productId: 'ebook',
+      isDigital: true,
+      currency: 'EUR',
+    })
+    expect(result).toMatchObject({ added: false, reason: 'mixed-cart' })
+  })
+
+  it('lets a line of the same currency join, and a re-added line change its own', async () => {
+    const store = withCart([
+      { id: 'c1', productId: 'mug', quantity: 1, price: 12, currency: 'usd' },
+    ])
+    const joined = await loadHandler(store)({ productId: 'tea', price: 5, currency: 'USD' })
+    expect(joined).toMatchObject({ added: true })
+    // The only line: nothing else to be priced against.
+    const alone = withCart([
+      { id: 'c1', productId: 'mug', quantity: 1, price: 12, currency: 'USD' },
+    ])
+    const bumped = await loadHandler(alone)({ productId: 'mug', price: 12, currency: 'EUR' })
+    expect(bumped).toMatchObject({ added: true, quantity: 2 })
+    expect(storedCart(alone)[0]).toMatchObject({ currency: 'EUR' })
+  })
+
+  it('does not judge a line, or a cart, that names no currency', async () => {
+    const legacy = withCart([{ id: 'c1', productId: 'mug', quantity: 1, price: 12 }])
+    expect(
+      await loadHandler(legacy)({ productId: 'tea', price: 5, currency: 'RON' })
+    ).toMatchObject({ added: true })
+    const priced = withCart([
+      { id: 'c1', productId: 'mug', quantity: 1, price: 12, currency: 'USD' },
+    ])
+    expect(await loadHandler(priced)({ productId: 'tea', price: 5 })).toMatchObject({
+      added: true,
+    })
+  })
+})