@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/__tests__/automations-catalog-drift.test.ts

@@ -0,0 +1,97 @@
+import * as fs from 'fs'
+import * as path from 'path'
+import { CLIENT_ONLY_NODES } from '../src/api-route-generator'
+import { automationEntityOf, automationEnvelopeKeys } from '../src/automations/automations-scope'
+
+/**
+ * The code generator keeps its own copies of two things the editor's
+ * workflow schema (teleport-gui `packages/workflow-schema`) owns, because this
+ * package cannot import it:
+ *
+ * - the envelope of every business event: `automationEntityOf` (the entity's
+ *   key) and `automationEnvelopeKeys` (its top-level blocks), against the
+ *   catalog's `entity` and `details`;
+ * - the browser-only nodes a server route drops (`CLIENT_ONLY_NODES`), against
+ *   the schema's `CLIENT_ONLY_NODE_TYPES`, which the editor refuses in
+ *   automations.
+ *
+ * Both are hand-synced: this spec reads the schema's built constants and
+ * fails the moment either copy drifts, by contents.
+ */
+
+const SCHEMA_CONSTANTS = ['teleport-gui', 'packages', 'workflow-schema', 'dist', 'constants']
+
+/** Locates the workflow schema's built constants by walking up from here. */
+const findSchemaConstants = (): string | null => {
+  let dir = __dirname
+  for (let i = 0; i < 14; i++) {
+    const candidate = path.join(dir, ...SCHEMA_CONSTANTS)
+    if (fs.existsSync(path.join(candidate, 'business-events.js'))) {
+      return candidate
+    }
+    const parent = path.dirname(dir)
+    if (parent === dir) {
+      break
+    }
+    dir = parent
+  }
+  return null
+}
+
+interface CatalogEvent {
+  type: string
+  entity: string
+  details: Array<{ path: string }>
+}
+
+const constantsDir = findSchemaConstants()
+
+describe('automations — the copies of the workflow schema', () => {
+  if (!constantsDir) {
+    // tslint:disable-next-line:no-console
+    console.warn(
+      `automations catalog not compared: ${SCHEMA_CONSTANTS.join(
+        '/'
+      )}/business-events.js was not found above ${__dirname} (build teleport-gui's workflow-schema beside this repo)`
+    )
+    it.todo('builds every event envelope from the catalog blocks')
+    it.todo('drops the browser-only nodes the schema lists')
+    return
+  }
+  // tslint:disable-next-line:no-var-requires
+  const catalog = require(path.join(constantsDir, 'business-events.js'))
+    .BUSINESS_EVENTS as CatalogEvent[]
+  // tslint:disable-next-line:no-var-requires
+  const schemaClientOnly = require(path.join(constantsDir, 'automation-workflow.js'))
+    .CLIENT_ONLY_NODE_TYPES as Set<string>
+
+  it('builds every event envelope from the catalog blocks', () => {
+    expect(catalog.length).toBeGreaterThan(0)
+    const drift = catalog
+      .map((event) => {
+        const blocks = Array.from(
+          new Set(
+            event.details
+              .map((detail) => detail.path)
+              .filter((at) => at.indexOf('.') === -1 && at !== 'event' && at !== 'actor')
+          )
+        ).sort()
+        return {
+          type: event.type,
+          entity: automationEntityOf(event.type),
+          blocks: (automationEnvelopeKeys(event.type) || []).slice().sort(),
+          catalog: { entity: event.entity, blocks },
+        }
+      })
+      .filter(
+        (row) =>
+          row.entity !== row.catalog.entity ||
+          JSON.stringify(row.blocks) !== JSON.stringify(row.catalog.blocks)
+      )
+    expect(drift).toEqual([])
+  })
+
+  it('drops the browser-only nodes the schema lists', () => {
+    expect(Array.from(CLIENT_ONLY_NODES).sort()).toEqual(Array.from(schemaClientOnly).sort())
+  })
+})

package/__tests__/booking-calendar-feed-route.test.ts

@@ -250,11 +250,26 @@ describe('the bookings calendar feed route — behaviour', () => {
     const response = await bootRoute(pg)({})
     expect(response.statusCode).toBe(404)
     expect(response.body).toBe('Not found')
-    expect(pg.calls).toEqual([{ sql: FEED_STATEMENT, params: [KEY] }])
+    expect(pg.calls).toEqual([
+      { sql: "BEGIN; SET LOCAL statement_timeout = '10s'", params: undefined },
+      { sql: FEED_STATEMENT, params: [KEY] },
+      { sql: 'COMMIT', params: undefined },
+    ])
     expect(pg.connections).toBe(1)
     expect(pg.ended).toBe(1)
   })
 
+  it('cuts the feed statement off after 10 s, for its own transaction only', async () => {
+    const pg = makePgStub([calendarRow()])
+    expect((await bootRoute(pg)({})).statusCode).toBe(200)
+    const sql = pg.calls.map((call) => call.sql)
+    expect(sql[0]).toBe("BEGIN; SET LOCAL statement_timeout = '10s'")
+    expect(sql.indexOf(FEED_STATEMENT)).toBe(1)
+    expect(sql[2]).toBe('COMMIT')
+    // A session-wide SET would outlive the request on a pooled connection.
+    expect(sql.some((text) => /^SET statement_timeout/i.test(text))).toBe(false)
+  })
+
   it('writes the calendar with all-day and timed events', async () => {
     const pg = makePgStub([
       calendarRow(),
@@ -275,7 +290,9 @@ describe('the bookings calendar feed route — behaviour', () => {
     expect(response.headers['Content-Length']).toBe(
       String(Buffer.byteLength(response.body as string, 'utf8'))
     )
-    expect(pg.calls).toEqual([{ sql: FEED_STATEMENT, params: [KEY] }])
+    expect(pg.calls.filter((call) => call.sql === FEED_STATEMENT)).toEqual([
+      { sql: FEED_STATEMENT, params: [KEY] },
+    ])
     expect(pg.ended).toBe(1)
     expect(response.body).toBe(
       [
@@ -463,7 +480,7 @@ describe('the bookings calendar feed route — behaviour', () => {
     expect(head.headers).toEqual(get.headers)
     expect(head.body).toBeUndefined()
     expect(head.ended).toBe(1)
-    expect(pg.calls).toHaveLength(1)
+    expect(pg.calls.filter((call) => call.sql === FEED_STATEMENT)).toHaveLength(1)
 
     const missing = await bootRoute(makePgStub([]))({ method: 'HEAD' })
     expect(missing.statusCode).toBe(404)

package/__tests__/cart-price-order.test.ts

@@ -20,6 +20,7 @@ const baseSettings = {
   vouchersEnabled: true,
   subscriptions: { enabled: false, providers: [] },
   paymentKinds: {},
+  paymentMethods: { cashOnDelivery: false, providers: ['stripe'] },
   regional: null,
   discounts: null,
   giftCards: null,
@@ -65,8 +66,10 @@ async function price(
 ): Promise<any> {
   const handler = loadHandler('cart-price-order', { cartPricingSettings: settings })
   const api = withDataApi(rows, failTable)
+  // Every checkout names its payment method; the store above takes Stripe.
+  const named = 'paymentMethod' in config ? config : { paymentMethod: 'stripe', ...config }
   try {
-    return await handler(config, { __baseUrl: 'http://store.test' })
+    return await handler(named, { __baseUrl: 'http://store.test' })
   } finally {
     api.restore()
   }
@@ -188,6 +191,7 @@ describe('cart-price-order', () => {
       reason:
         'Your cart holds products priced in USD, EUR and RON. Each currency needs its own order: remove the products priced in one of them and try again.',
       lines: [],
+      stockDeltas: { productIds: [], productQtys: [], variantIds: [], variantQtys: [] },
     })
   })
 
@@ -281,3 +285,334 @@ describe('cart-price-order', () => {
     expect(toBilling.regional.destination).toMatchObject({ countryCode: 'RO' })
   })
 })
+
+// How the buyer pays is the store's to decide, not the browser's: the method
+// a checkout names is checked against the methods the store was exported
+// with, and an order nobody pays for is never placed as cash on delivery.
+describe('cart-price-order payment method', () => {
+  const rows = { teleport_products: [product('p1')] }
+  const items = [{ productId: 'p1', quantity: 1 }]
+  const codStore = {
+    ...baseSettings,
+    paymentMethods: { cashOnDelivery: true, providers: ['stripe'] },
+  }
+
+  it('refuses cash on delivery on a store that only takes online payment', async () => {
+    const result = await price({ items, paymentMethod: 'cash_on_delivery' }, rows)
+    expect(result).toMatchObject({ priced: false, lines: [] })
+    expect(result.reason).toMatch(/payment on delivery/)
+    expect(result.paymentMethod).toBeUndefined()
+  })
+
+  it('refuses an empty method instead of reading it as cash on delivery', async () => {
+    for (const settings of [baseSettings, codStore]) {
+      const result = await price({ items, paymentMethod: '' }, rows, settings)
+      expect(result).toMatchObject({ priced: false, lines: [] })
+      expect(result.reason).toMatch(/Choose a payment method/)
+    }
+  })
+
+  it('refuses a provider the store has not enabled', async () => {
+    const result = await price({ items, paymentMethod: 'paypal' }, rows)
+    expect(result).toMatchObject({ priced: false, lines: [] })
+    expect(result.reason).toMatch(/isn't available/)
+  })
+
+  it('refuses a checkout that does not name its method, and a store snapshot without methods', async () => {
+    const handler = loadHandler('cart-price-order', { cartPricingSettings: baseSettings })
+    const api = withDataApi(rows)
+    try {
+      expect(await handler({ items }, { __baseUrl: 'http://store.test' })).toMatchObject({
+        priced: false,
+        lines: [],
+      })
+    } finally {
+      api.restore()
+    }
+    const { paymentMethods: _dropped, ...withoutMethods } = baseSettings
+    expect(await price({ items, paymentMethod: 'stripe' }, rows, withoutMethods)).toMatchObject({
+      priced: false,
+    })
+  })
+
+  it('accepts cash on delivery where the store takes it, and an enabled provider, and says which', async () => {
+    const cod = await price({ items, paymentMethod: 'cash_on_delivery' }, rows, codStore)
+    expect(cod).toMatchObject({ priced: true, paymentMethod: 'cash_on_delivery' })
+    const online = await price({ items, paymentMethod: ' stripe ' }, rows)
+    expect(online).toMatchObject({ priced: true, paymentMethod: 'stripe' })
+  })
+})
+
+// The address the order is priced for is the address it records: the step
+// hands back the form and the ship-to-different flag it priced.
+describe('cart-price-order priced address', () => {
+  it('echoes the form and the flag it priced, and nothing for an order it refused', async () => {
+    const form = {
+      addressLine1: '1 Billing Street',
+      billingCountry: 'Canada',
+      shippingCountry: 'Germany',
+    }
+    const result = await price(
+      { items: [{ productId: 'p1', quantity: 1 }], form, shipToDifferent: 'true' },
+      { teleport_products: [product('p1')] }
+    )
+    expect(result).toMatchObject({ priced: true, pricedForm: form, pricedShipToDifferent: 'true' })
+    const refused = await price({ items: [{ productId: 'gone', quantity: 1 }], form }, {})
+    expect(refused.pricedForm).toBeUndefined()
+  })
+})
+
+// What the order takes from stock, read off the lines priced here: the
+// statement that reserves stock with the order binds these four arrays.
+describe('cart-price-order stock deltas', () => {
+  it('sums lines per product and per variant, a variant line never counting for its product', async () => {
+    const result = await price(
+      {
+        items: [
+          { productId: 'p1', quantity: 2 },
+          { productId: 'p1', quantity: 3 },
+          { productId: 'p2', variantId: 'v1', quantity: 1 },
+          { productId: 'p2', variantId: 'v1', quantity: 4 },
+          { productId: 'p2', variantId: 'v2', quantity: 0 },
+        ],
+      },
+      {
+        teleport_products: [product('p1'), product('p2')],
+        teleport_product_variants: [
+          { id: 'v1', product_id: 'p2', price: 10 },
+          { id: 'v2', product_id: 'p2', price: 10 },
+        ],
+      }
+    )
+    expect(result.priced).toBe(true)
+    expect(result.stockDeltas).toEqual({
+      productIds: ['p1'],
+      productQtys: [5],
+      variantIds: ['v1', 'v2'],
+      variantQtys: [5, 1],
+    })
+  })
+
+  it('takes nothing from stock for an order it refused', async () => {
+    const result = await price({ items: [{ productId: 'gone', quantity: 1 }] }, {})
+    expect(result.stockDeltas).toEqual({
+      productIds: [],
+      productQtys: [],
+      variantIds: [],
+      variantQtys: [],
+    })
+  })
+})
+
+// Orders that reserved stock but never reached a payment page get no provider
+// event: the checkout's server step releases them itself, at most once per
+// instance every five minutes, in the background where the runtime allows.
+describe('cart-price-order releases stalled reservations', () => {
+  const rows = { teleport_products: [product('p1')] }
+  const items = [{ productId: 'p1', quantity: 1 }]
+  const scope = globalThis as any
+  const vercel = process.env.VERCEL
+  const RECORD = JSON.stringify({ stockReservation: [{ kind: 'product', id: 'p1', qty: 1 }] })
+  afterEach(() => {
+    delete scope.__tqReservationSweepAt
+    delete scope.__tqWaitUntil
+    delete scope.__tqUnreadableReservations
+    if (vercel === undefined) {
+      delete process.env.VERCEL
+    } else {
+      process.env.VERCEL = vercel
+    }
+  })
+
+  const run = async (
+    settings: unknown,
+    pass?: () => Promise<unknown>,
+    refuse?: (query: string) => string | undefined,
+    candidates: Array<{ id: string; metadata: string }> = [{ id: 'o-1', metadata: RECORD }]
+  ) => {
+    const handler = loadHandler('cart-price-order', { cartPricingSettings: settings })
+    const original = scope.fetch
+    const sent: Array<{ url: string; body: any }> = []
+    scope.fetch = async (url: string, init: { body: string }) => {
+      const body = JSON.parse(init.body)
+      sent.push({ url, body })
+      if (/\/raw-query$/.test(url)) {
+        const code = refuse ? refuse(body.query) : undefined
+        if (code) {
+          return { ok: false, status: 500, json: async () => ({ error: 'Raw query failed', code }) }
+        }
+        if (/^SELECT o\.id::text AS id, o\.metadata/.test(body.query)) {
+          return { ok: true, json: async () => ({ rows: candidates }) }
+        }
+        const released = pass ? await pass() : undefined
+        return { ok: true, json: async () => ({ rows: [{ released: String(released || 0) }] }) }
+      }
+      const result = (rows as any)[body.tableName] || []
+      return { ok: true, json: async () => ({ rows: result }) }
+    }
+    try {
+      const result: any = await handler(
+        { items, paymentMethod: 'stripe' },
+        { __baseUrl: 'http://store.test' }
+      )
+      return {
+        result,
+        passes: sent.filter(
+          (call) => /\/raw-query$/.test(call.url) && /^WITH stale AS \(/.test(call.body.query)
+        ),
+        listings: sent.filter(
+          (call) => /\/raw-query$/.test(call.url) && /^SELECT o\.id::text/.test(call.body.query)
+        ),
+      }
+    } finally {
+      scope.fetch = original
+    }
+  }
+
+  it('runs one release pass, then none for five minutes', async () => {
+    const settings = { ...baseSettings, releaseStalledReservations: true }
+    const first = await run(settings)
+    expect(first.result.priced).toBe(true)
+    expect(first.passes).toHaveLength(1)
+    expect(first.passes[0].url).toBe('http://store.test/api/data/ds-1/raw-query')
+    expect(first.passes[0].body.query).toMatch(/^WITH stale AS \(/)
+    expect(first.passes[0].body.query).toContain('FOR UPDATE SKIP LOCKED')
+    expect((await run(settings)).passes).toHaveLength(0)
+    scope.__tqReservationSweepAt = Date.now() - 5 * 60 * 1000 - 1
+    expect((await run(settings)).passes).toHaveLength(1)
+  })
+
+  it('never waits for the pass on a long-running server', async () => {
+    delete process.env.VERCEL
+    const stuck = await run(
+      { ...baseSettings, releaseStalledReservations: true },
+      () => new Promise(() => undefined)
+    )
+    expect(stuck.result.priced).toBe(true)
+    expect(stuck.passes).toHaveLength(1)
+  })
+
+  it('on Vercel hands the pass to waitUntil when the app has one, else waits for it', async () => {
+    process.env.VERCEL = '1'
+    const kept: unknown[] = []
+    scope.__tqWaitUntil = (promise: unknown) => kept.push(promise)
+    const stuck = await run(
+      { ...baseSettings, releaseStalledReservations: true },
+      () => new Promise(() => undefined)
+    )
+    expect(stuck.result.priced).toBe(true)
+    expect(kept).toHaveLength(1)
+
+    delete scope.__tqWaitUntil
+    delete scope.__tqReservationSweepAt
+    let finished = false
+    const waited = await run({ ...baseSettings, releaseStalledReservations: true }, async () => {
+      await new Promise((resolve) => setTimeout(resolve, 5))
+      finished = true
+    })
+    expect(waited.passes).toHaveLength(1)
+    expect(finished).toBe(true)
+  })
+
+  it('runs the next pass at once while a pass releases a full batch', async () => {
+    process.env.VERCEL = '1'
+    const settings = { ...baseSettings, releaseStalledReservations: true }
+    expect((await run(settings, async () => 10)).passes).toHaveLength(1)
+    expect((await run(settings, async () => 3)).passes).toHaveLength(1)
+    expect((await run(settings)).passes).toHaveLength(0)
+  })
+
+  it("logs each released order, and still releases where the store's ledger is older or missing", async () => {
+    process.env.VERCEL = '1'
+    const settings = { ...baseSettings, releaseStalledReservations: true }
+    const logged = await run(settings)
+    expect(logged.passes).toHaveLength(1)
+    expect(logged.passes[0].body.query).toContain(
+      'INSERT INTO teleport_events (event_type, dedupe_key, order_id, entity_type'
+    )
+
+    delete scope.__tqReservationSweepAt
+    const older = await run(settings, undefined, (query) =>
+      query.includes('entity_type') ? '42703' : undefined
+    )
+    expect(older.passes).toHaveLength(2)
+    expect(older.passes[1].body.query).toContain(
+      'INSERT INTO teleport_events (event_type, dedupe_key, order_id, payload'
+    )
+
+    delete scope.__tqReservationSweepAt
+    const missing = await run(settings, undefined, (query) =>
+      query.includes('teleport_events') ? '42P01' : undefined
+    )
+    expect(missing.passes).toHaveLength(3)
+    expect(missing.passes[2].body.query).not.toContain('teleport_events')
+
+    // Any other failure (a deadlock victim, a timeout) waits for the next pass.
+    delete scope.__tqReservationSweepAt
+    expect(
+      (await run(settings, undefined, (query) => (/^WITH stale/.test(query) ? '40P01' : undefined)))
+        .passes
+    ).toHaveLength(1)
+  })
+
+  it('releases only orders whose metadata it could read, and logs each unreadable one once', async () => {
+    process.env.VERCEL = '1'
+    const settings = { ...baseSettings, releaseStalledReservations: true }
+    const candidates = [
+      { id: 'o-1', metadata: RECORD },
+      { id: 'o-2', metadata: '{"stockReservation": [{"kind": "product"' },
+      { id: 'o-3', metadata: JSON.stringify({ billingDetails: { stockReservation: 'yes' } }) },
+      { id: 'o-4', metadata: RECORD },
+    ]
+    const warn = jest.spyOn(console, 'warn').mockImplementation(() => undefined)
+    try {
+      const first = await run(settings, undefined, undefined, candidates)
+      expect(first.listings).toHaveLength(1)
+      expect(first.listings[0].body.query).toContain('LIMIT 50')
+      expect(first.listings[0].body.query).not.toContain('FOR UPDATE')
+      expect(first.passes).toHaveLength(1)
+      expect(first.passes[0].body.params).toEqual([['o-1', 'o-4']])
+      expect(warn).toHaveBeenCalledTimes(1)
+      expect(String(warn.mock.calls[0][0])).toContain(
+        'order o-2 has metadata that is not valid JSON'
+      )
+
+      delete scope.__tqReservationSweepAt
+      await run(settings, undefined, undefined, candidates)
+      expect(warn).toHaveBeenCalledTimes(1)
+
+      delete scope.__tqReservationSweepAt
+      const none = await run(settings, undefined, undefined, [candidates[1], candidates[2]])
+      expect(none.passes).toHaveLength(0)
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
+  it('never runs the pass where stock is not reserved', async () => {
+    expect((await run(baseSettings)).passes).toHaveLength(0)
+  })
+
+  it('still prices the order when the pass fails', async () => {
+    const handler = loadHandler('cart-price-order', {
+      cartPricingSettings: { ...baseSettings, releaseStalledReservations: true },
+    })
+    const original = scope.fetch
+    scope.fetch = async (url: string, init: { body: string }) => {
+      if (/\/raw-query$/.test(url)) {
+        throw new Error('connection reset')
+      }
+      const body = JSON.parse(init.body)
+      return { ok: true, json: async () => ({ rows: (rows as any)[body.tableName] || [] }) }
+    }
+    try {
+      const result: any = await handler(
+        { items, paymentMethod: 'stripe' },
+        { __baseUrl: 'http://store.test' }
+      )
+      expect(result.priced).toBe(true)
+    } finally {
+      scope.fetch = original
+    }
+  })
+})

package/__tests__/code-lookup-rate-limit-route.test.ts

@@ -0,0 +1,189 @@
+import * as nodeCrypto from 'crypto'
+import * as net from 'net'
+import { generateServerSegmentAPIRoute } from '../src/api-route-generator'
+import { generateSecurityRuntimeCode } from '../src/security-runtime'
+import type { WorkflowSegment } from '../src/types'
+import { loadServerRuntime } from './_helpers/load-server-runtime'
+
+// The checkout's public steps carry the per-visitor limits the editor declares
+// on them (apps/gui/.../ecommerce/code-lookup-rate-limit.ts):
+//   - the voucher / gift-card code lookup: 30 every 15 minutes, then SKIPPED
+//     (the code reads as not valid — a 429 would leave the Apply button
+//     checking);
+//   - the order INSERT: 30 every 15 minutes, then REFUSED with a 429 that
+//     carries the step's own public message.
+// These run the GENERATED segment route for each step, called directly the way
+// a crafted client would, with the real shared security runtime (no database:
+// it counts per instance).
+
+const VOUCHER_LOOKUP = {
+  id: 'lookup',
+  type: 'data-raw-query',
+  label: 'Look Up Voucher By Code',
+  stepNumber: 1,
+  executionEnv: 'server',
+  config: {
+    dataSourceId: 'ds-1',
+    query: 'SELECT v.id FROM teleport_vouchers v WHERE v.code = $1::text LIMIT 1',
+    params: ['SAVE10'],
+    visitorLimit: { limit: 30, windowSeconds: 900, onLimit: 'skip' },
+  },
+}
+const ORDER_LIMIT_MESSAGE =
+  'Too many orders were placed from your network in the last few minutes. Please wait a little and try again.'
+const ORDER_INSERT = {
+  id: 'create-order',
+  type: 'data-create-item',
+  label: 'Create Order Record In Database',
+  stepNumber: 1,
+  executionEnv: 'server',
+  config: {
+    dataSourceId: 'ds-1',
+    tableName: 'teleport_orders',
+    columnMappings: [{ column: 'status', value: 'pending' }],
+    visitorLimit: {
+      limit: 30,
+      windowSeconds: 900,
+      onLimit: 'refuse',
+      message: ORDER_LIMIT_MESSAGE,
+    },
+  },
+}
+
+const segmentOf = (node: Record<string, unknown>): WorkflowSegment =>
+  ({
+    id: 'server-1',
+    env: 'server',
+    nodeIds: [node.id],
+    nodes: [node],
+    edges: [],
+    entryNodeIds: [node.id],
+  } as unknown as WorkflowSegment)
+
+function loadSecurityRuntime() {
+  const requireShim = (id: string): unknown => {
+    if (id === 'crypto') {
+      return nodeCrypto
+    }
+    if (id === 'net') {
+      return net
+    }
+    throw new Error("Cannot find module '" + id + "'")
+  }
+  const module = { exports: {} as any }
+  const quiet = { warn: (): undefined => undefined, error: (): undefined => undefined }
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval
+  new Function(
+    'module',
+    'exports',
+    'require',
+    'process',
+    'console',
+    'Buffer',
+    'Date',
+    generateSecurityRuntimeCode()
+  )(module, module.exports, requireShim, { env: {} }, quiet, Buffer, Date)
+  return module.exports
+}
+
+function bootRoute(segment: WorkflowSegment) {
+  const runtime = loadServerRuntime()
+  const security = loadSecurityRuntime()
+  const requireStub = (id: string) =>
+    id.endsWith('server-runtime') ? runtime : id.endsWith('security-runtime') ? security : {}
+  const routeModule: { exports: any } = { exports: {} }
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval
+  new Function(
+    'module',
+    'exports',
+    'require',
+    'console',
+    generateServerSegmentAPIRoute(segment, 'Checkout')
+  )(routeModule, routeModule.exports, requireStub, {
+    log: () => undefined,
+    warn: () => undefined,
+    error: () => undefined,
+  })
+  return async (address: string) => {
+    const reply = { status: 0, body: null as any, headers: {} as Record<string, string> }
+    await routeModule.exports(
+      {
+        method: 'POST',
+        body: { context: {} },
+        headers: { host: 'localhost:3000' },
+        socket: { remoteAddress: address },
+      },
+      {
+        setHeader(name: string, value: string) {
+          reply.headers[name] = value
+        },
+        status(code: number) {
+          reply.status = code
+          return this
+        },
+        json(payload: unknown) {
+          reply.body = payload
+          return this
+        },
+      }
+    )
+    return reply
+  }
+}
+
+describe('the public checkout steps behind their per-visitor limits', () => {
+  const savedSecret = process.env.NEXTAUTH_SECRET
+  const savedFetch = (globalThis as any).fetch
+  const dataCalls: string[] = []
+  beforeAll(() => {
+    process.env.NEXTAUTH_SECRET = 'checkout-limits-test-secret'
+    ;(globalThis as any).fetch = async (url: string) => {
+      dataCalls.push(url)
+      return {
+        ok: true,
+        status: 200,
+        json: async () => ({ rows: [{ id: 'v-1' }], success: true, item: { id: 'order-1' } }),
+      }
+    }
+  })
+  beforeEach(() => {
+    dataCalls.length = 0
+  })
+  afterAll(() => {
+    ;(globalThis as any).fetch = savedFetch
+    if (savedSecret === undefined) {
+      delete process.env.NEXTAUTH_SECRET
+    } else {
+      process.env.NEXTAUTH_SECRET = savedSecret
+    }
+  })
+
+  it('a code lookup past 30 in 15 minutes from one visitor is skipped, the route still answers', async () => {
+    const call = bootRoute(segmentOf(VOUCHER_LOOKUP))
+    for (let i = 0; i < 30; i++) {
+      expect((await call('203.0.113.7')).status).toBe(200)
+    }
+    expect(dataCalls).toHaveLength(30)
+    const limited = await call('203.0.113.7')
+    expect(limited.status).toBe(200)
+    expect(dataCalls).toHaveLength(30)
+    // Another visitor still gets an answer.
+    expect((await call('203.0.113.8')).status).toBe(200)
+    expect(dataCalls).toHaveLength(31)
+  })
+
+  it('a crafted client writing orders past 30 in 15 minutes is refused with a 429 and the order message, nothing written', async () => {
+    const call = bootRoute(segmentOf(ORDER_INSERT))
+    for (let i = 0; i < 30; i++) {
+      expect((await call('198.51.100.4')).status).toBe(200)
+    }
+    const writes = dataCalls.length
+    expect(writes).toBeGreaterThanOrEqual(30)
+    const refused = await call('198.51.100.4')
+    expect(refused.status).toBe(429)
+    expect(refused.body).toEqual({ error: ORDER_LIMIT_MESSAGE })
+    expect(Number(refused.headers['Retry-After'])).toBeGreaterThan(0)
+    expect(Number(refused.headers['Retry-After'])).toBeLessThanOrEqual(900)
+    expect(dataCalls).toHaveLength(writes)
+  })
+})