cabloy 5.1.131 → 5.1.133

package/e2e/specs/a-commerce/commerce.spec.ts

@@ -11,8 +11,13 @@ const passportTestActivateCurrentPath = '/api/home/user/passportTest/activateCur
 
 interface IAddressFixture {
   addressLine1: string;
+  addressLine2: string;
   city: string;
+  countryCode: string;
+  phone: string;
+  postalCode: string;
   recipientName: string;
+  region: string;
   updatedCity: string;
 }
 
@@ -48,7 +53,7 @@ function waitForAddressMine(page: Page) {
 }
 
 async function getAdminOrderRow(page: Page, orderId: number): Promise<Locator> {
-  const row = page.locator(`tr:has(td:first-child:text-is("${orderId}"))`);
+  const row = page.locator(`tr:has(td a:text-is("${orderId}"))`);
   await expect(row).toHaveCount(1);
   return row;
 }
@@ -123,21 +128,26 @@ function createAddressFixture(testInfo: TestInfo): IAddressFixture {
   const id = `${testInfo.workerIndex}-${testInfo.parallelIndex ?? testInfo.retry}-${Date.now()}`;
   return {
     recipientName: `E2E Address ${id}`,
-    addressLine1: `1 Test Street ${id}`,
+    phone: '15555550123',
+    countryCode: 'US',
+    region: 'California',
     city: `Original City ${id}`,
+    postalCode: '94105',
+    addressLine1: `1 Test Street ${id}`,
+    addressLine2: 'Suite E2E',
     updatedCity: `Updated City ${id}`,
   };
 }
 
 async function fillAddressForm(page: Page, fixture: IAddressFixture) {
   await page.getByPlaceholder('Recipient name').fill(fixture.recipientName);
-  await page.getByPlaceholder('Phone').fill('15555550123');
-  await page.getByPlaceholder('Country code').fill('US');
-  await page.getByPlaceholder('Region').fill('California');
+  await page.getByPlaceholder('Phone').fill(fixture.phone);
+  await page.getByPlaceholder('Country code').fill(fixture.countryCode);
+  await page.getByPlaceholder('Region').fill(fixture.region);
   await page.getByPlaceholder('City').fill(fixture.city);
-  await page.getByPlaceholder('Postal code').fill('94105');
+  await page.getByPlaceholder('Postal code').fill(fixture.postalCode);
   await page.getByPlaceholder('Address line 1').fill(fixture.addressLine1);
-  await page.getByPlaceholder('Address line 2').fill('Suite E2E');
+  await page.getByPlaceholder('Address line 2').fill(fixture.addressLine2);
 }
 
 async function createAddressThroughCustomerPage(
@@ -186,6 +196,7 @@ test(
   async ({ page, request }) => {
     const response = await request.get('/commerce');
     expect(response.ok()).toBeTruthy();
+    expect(response.headers()['cache-control']).toBe('public, max-age=600');
     const html = await response.text();
     const normalizedHtml = html.toLowerCase();
     expect(normalizedHtml).not.toContain('data-zova-hydrated');
@@ -292,15 +303,18 @@ test(
 );
 
 test(
-  'Commerce Address: cookie-disabled SSR renders a neutral protected entry',
+  'Commerce Address: session SSR protects an anonymous document request',
   { tag: ['@web', '@cart'] },
   async ({ page, request }) => {
     const path = '/commerce/address';
     const routePath = '/address';
     const response = await request.get(path, { maxRedirects: 0 });
-    expect(response.status()).toBe(200);
-    expect(response.headers().location).toBeUndefined();
-    expect((await response.text()).toLowerCase()).not.toContain('data-zova-hydrated');
+    expect(response.status()).toBe(302);
+    expect(response.headers()['cache-control']).toBe('private, no-store');
+    const html = await response.text();
+    expect(html).not.toContain('ssr-body-ready-observer');
+    expect(html).not.toContain('__leftDrawerOpenJS');
+    expect(response.headers().location).toMatch(/^\/commerce\/login\?(?:.*&)?returnTo=/);
 
     const pageErrors = collectPageErrors(page);
     const documentResponse = await page.goto(path, { waitUntil: 'load' });
@@ -324,6 +338,33 @@ test(
       testInfo,
     );
     try {
+      const addressResponse = await context.request.get('/commerce/address');
+      expect(addressResponse.ok()).toBeTruthy();
+      expect(addressResponse.headers()['cache-control']).toBe('private, no-store');
+      const addressHtml = await addressResponse.text();
+      expect(addressHtml.toLowerCase()).not.toContain('data-zova-hydrated');
+      expect(addressHtml).not.toContain('ssr-body-ready-observer');
+      expect(addressHtml).not.toContain('__leftDrawerOpenJS');
+      expect(addressHtml).toContain(fixture.recipientName);
+      expect(addressHtml).toContain(fixture.addressLine1);
+
+      const coldPage = await context.newPage();
+      try {
+        const coldPageErrors = collectPageErrors(coldPage);
+        const coldResponse = await coldPage.goto('/commerce/address', { waitUntil: 'load' });
+        expect(coldResponse?.ok()).toBeTruthy();
+        await expect(coldPage.locator('html')).toHaveAttribute('data-zova-hydrated', 'commerce');
+        await expect(coldPage.getByRole('heading', { name: 'Addresses' })).toBeVisible();
+        const coldCard = coldPage
+          .locator('article')
+          .filter({ has: coldPage.getByRole('heading', { name: fixture.recipientName }) });
+        await expect(coldCard).toContainText(fixture.addressLine1);
+        await expect(coldPage.getByRole('alert')).toHaveCount(0);
+        expect(coldPageErrors).toEqual([]);
+      } finally {
+        await coldPage.close();
+      }
+
       const card = page
         .locator('article')
         .filter({ has: page.getByRole('heading', { name: fixture.recipientName }) });
@@ -483,6 +524,27 @@ test(
         );
         const orderRow = await getAdminOrderRow(adminPage, checkout.orderId);
         await expect(orderRow).toBeVisible();
+        await expect(orderRow.locator('td')).toHaveCount(6);
+        await expect(orderRow).toContainText('Paid');
+        await expect(orderRow).toContainText('45.99');
+        await expect(orderRow).not.toContainText(fixture.recipientName);
+        const orderViewResponse = waitForApiResponse(
+          adminPage,
+          'GET',
+          `/api/commerce/trade/order/${checkout.orderId}`,
+        );
+        await orderRow.getByRole('link', { name: String(checkout.orderId), exact: true }).click();
+        expect((await orderViewResponse).ok()).toBeTruthy();
+        await expect(adminPage.getByText('Money summary').first()).toBeVisible();
+        await expect(adminPage.getByText('Delivery address').first()).toBeVisible();
+        await expect(adminPage.getByText('Purchased lines').first()).toBeVisible();
+        await expect(adminPage.getByText('addressSnapshot').first()).toBeVisible();
+        await expect(adminPage.getByText('couponSnapshot').first()).toBeVisible();
+        await expect(adminPage.getByText('Pour-Over Coffee Set')).toBeVisible();
+        await expect(adminPage.getByText('COF-SET-01')).toBeVisible();
+        await expect(adminPage.getByRole('button', { name: 'Submit', exact: true })).toHaveCount(0);
+        await adminPage.getByRole('button', { name: 'Back', exact: true }).click();
+        await expect(orderRow).toBeVisible();
         const carrierInput = orderRow.getByPlaceholder('Carrier');
         const trackingNumberInput = orderRow.getByPlaceholder('Tracking number');
         const confirmationCheckbox = orderRow.getByRole('checkbox');
@@ -499,7 +561,7 @@ test(
         );
         await orderRow.getByRole('button', { name: 'Ship order', exact: true }).click();
         expect((await shipmentResponse).ok()).toBeTruthy();
-        await expect(orderRow).toContainText('shipped');
+        await expect(orderRow).toContainText('Shipped');
         expect(adminPageErrors).toEqual([]);
       } finally {
         await adminContext.close().catch(() => {});
@@ -545,6 +607,233 @@ test(
   },
 );
 
+test(
+  'Payment callback: authenticated direct route reconciles after hydration',
+  { tag: ['@web', '@flow', '@payment'] },
+  async ({ browser, request }, testInfo) => {
+    test.setTimeout(60_000);
+    const { context, fixture, page, pageErrors } = await createAddressThroughCustomerPage(
+      browser,
+      request,
+      testInfo,
+    );
+    try {
+      await page.goto('/commerce', { waitUntil: 'load' });
+      const productLink = page.getByRole('link', { name: 'Pour-Over Coffee Set', exact: true });
+      await expect(productLink).toBeVisible();
+      await productLink.click();
+      await expect(page).toHaveURL(/\/commerce\/product\/\d+(?:\/|$)/);
+      await expect(page.locator('html')).toHaveAttribute('data-zova-hydrated', 'commerce');
+      await expect(page.getByRole('heading', { name: 'Pour-Over Coffee Set' })).toBeVisible();
+      await expect(page.getByText('COF-SET-01')).toBeVisible();
+      const addToCartButton = page.getByRole('button', { name: 'Add to cart', exact: true });
+      await expect(addToCartButton).toBeEnabled();
+      const addResponse = waitForApiResponse(page, 'POST', '/api/commerce/trade/cart/items');
+      await addToCartButton.click();
+      expect((await addResponse).ok()).toBeTruthy();
+      await page.getByRole('link', { name: /^Cart/ }).click();
+      await page.getByRole('link', { name: 'Checkout', exact: true }).click();
+      const addressChoice = page.getByRole('radio', { name: new RegExp(fixture.recipientName) });
+      await expect(addressChoice).toBeVisible();
+      await addressChoice.check();
+      await page.getByRole('radio', { name: 'No coupon', exact: true }).check();
+      const checkoutResponse = waitForApiResponse(page, 'POST', '/api/commerce/trade/checkout');
+      await page.getByRole('button', { name: 'Create order', exact: true }).click();
+      const checkoutResponseValue = await checkoutResponse;
+      expect(checkoutResponseValue.ok()).toBeTruthy();
+      const checkout = (await checkoutResponseValue.json()).data;
+      expectTableIdentity(checkout.orderId);
+      expectTableIdentity(checkout.paymentSessionId);
+      const startResponse = waitForApiResponse(
+        page,
+        'POST',
+        new RegExp(`/api/pay/payment-session/${checkout.paymentSessionId}/start$`),
+      );
+      await page.getByRole('button', { name: 'Start payment', exact: true }).click();
+      expect((await startResponse).ok()).toBeTruthy();
+      await expect(page.getByRole('heading', { name: 'Mock payment simulator' })).toBeVisible();
+      const completeResponse = waitForApiResponse(
+        page,
+        'POST',
+        new RegExp(`/api/pay/mock/payment-session/${checkout.paymentSessionId}/complete$`),
+      );
+      await page.getByRole('button', { name: 'Payment succeeded', exact: true }).click();
+      expect((await completeResponse).ok()).toBeTruthy();
+      await expect(page).toHaveURL(new RegExp(`/commerce/order/${checkout.orderId}(?:/|$)`), {
+        timeout: 40_000,
+      });
+
+      const callbackPath = `/commerce/payment/${checkout.paymentSessionId}/${checkout.orderId}?providerResult=return`;
+      await page.evaluate(() => {
+        localStorage.clear();
+        sessionStorage.clear();
+      });
+      const callbackResponse = await context.request.get(callbackPath);
+      expect(callbackResponse.ok()).toBeTruthy();
+      const callbackHtml = (await callbackResponse.text()).toLowerCase();
+      expect(callbackHtml).not.toContain('data-zova-hydrated');
+      expect(callbackHtml).not.toContain('mock payment simulator');
+
+      const reconcilePath = new RegExp(
+        `/api/pay/payment-session/${checkout.paymentSessionId}/reconcile$`,
+      );
+      const paymentViewPath = new RegExp(`/api/pay/payment-session/${checkout.paymentSessionId}$`);
+      const orderViewPath = new RegExp(`/api/commerce/trade/order/viewMine/${checkout.orderId}$`);
+      let reconcileCount = 0;
+      let paymentViewCount = 0;
+      let orderViewCount = 0;
+      page.on('request', request => {
+        const url = new URL(request.url());
+        if (request.method() !== 'GET') {
+          if (request.method() === 'POST' && reconcilePath.test(url.pathname)) reconcileCount++;
+          return;
+        }
+        if (paymentViewPath.test(url.pathname)) paymentViewCount++;
+        if (orderViewPath.test(url.pathname)) orderViewCount++;
+      });
+      const reconcileResponse = waitForApiResponse(page, 'POST', reconcilePath);
+      const documentResponse = await page.goto(callbackPath, { waitUntil: 'load' });
+      expect(documentResponse?.ok()).toBeTruthy();
+      expect((await reconcileResponse).ok()).toBeTruthy();
+      await expect(page.locator('html')).toHaveAttribute('data-zova-hydrated', 'commerce');
+      await expect(page).toHaveURL(new RegExp(`/commerce/order/${checkout.orderId}(?:/|$)`));
+      expect(reconcileCount).toBe(1);
+      expect(paymentViewCount).toBeLessThanOrEqual(10);
+      expect(orderViewCount).toBeLessThanOrEqual(5);
+      await expect(page.getByText('paid · $45.99')).toBeVisible();
+      await expect(page.getByRole('alert')).toHaveCount(0);
+      expect(pageErrors).toEqual([]);
+    } finally {
+      await context.close().catch(() => {});
+    }
+  },
+);
+
+test(
+  'PayPal browser cancel: customer can continue payment or open an awaiting order',
+  { tag: ['@web', '@flow', '@payment'] },
+  async ({ browser, request }, testInfo) => {
+    test.setTimeout(60_000);
+    const { context, fixture, page, pageErrors } = await createAddressThroughCustomerPage(
+      browser,
+      request,
+      testInfo,
+    );
+    try {
+      await page.goto('/commerce', { waitUntil: 'load' });
+      const productLink = page.getByRole('link', { name: 'Pour-Over Coffee Set', exact: true });
+      await expect(productLink).toBeVisible();
+      await productLink.click();
+      await expect(page).toHaveURL(/\/commerce\/product\/\d+(?:\/|$)/);
+      await expect(page.locator('html')).toHaveAttribute('data-zova-hydrated', 'commerce');
+      await expect(page.getByRole('heading', { name: 'Pour-Over Coffee Set' })).toBeVisible();
+      await expect(page.getByText('COF-SET-01')).toBeVisible();
+      const addToCartButton = page.getByRole('button', { name: 'Add to cart', exact: true });
+      await expect(addToCartButton).toBeEnabled();
+      const addResponse = waitForApiResponse(page, 'POST', '/api/commerce/trade/cart/items');
+      await addToCartButton.click();
+      expect((await addResponse).ok()).toBeTruthy();
+      await page.getByRole('link', { name: /^Cart/ }).click();
+      await page.getByRole('link', { name: 'Checkout', exact: true }).click();
+      const addressChoice = page.getByRole('radio', { name: new RegExp(fixture.recipientName) });
+      await expect(addressChoice).toBeVisible();
+      await addressChoice.check();
+      await page.getByRole('radio', { name: 'No coupon', exact: true }).check();
+      const checkoutResponse = waitForApiResponse(page, 'POST', '/api/commerce/trade/checkout');
+      await page.getByRole('button', { name: 'Create order', exact: true }).click();
+      const checkoutResponseValue = await checkoutResponse;
+      expect(checkoutResponseValue.ok()).toBeTruthy();
+      const checkout = (await checkoutResponseValue.json()).data;
+      expectTableIdentity(checkout.orderId);
+      expectTableIdentity(checkout.paymentSessionId);
+      expect(checkout.state).toBe('awaiting_payment');
+
+      const callbackPath = `/commerce/payment/${checkout.paymentSessionId}/${checkout.orderId}?providerResult=cancel`;
+      const paymentSessionPath = new RegExp(
+        `/api/pay/payment-session/${checkout.paymentSessionId}$`,
+      );
+      const reconcilePath = new RegExp(
+        `/api/pay/payment-session/${checkout.paymentSessionId}/reconcile$`,
+      );
+      const requiresActionSession = {
+        id: checkout.paymentSessionId,
+        state: 'requires_action',
+        providerName: 'pay-paypal:paypal',
+        nextAction: { kind: 'redirect', url: 'https://example.test/paypal-approval' },
+        amountMinor: 4599,
+        currency: 'USD',
+      };
+      const callbackResponse = await context.request.get(callbackPath);
+      expect(callbackResponse.ok()).toBeTruthy();
+      const callbackHtml = await callbackResponse.text();
+      expect(callbackHtml).toContain('Start payment');
+      expect(callbackHtml).not.toContain(
+        'You returned from the payment provider without completing payment.',
+      );
+
+      let reconcileCount = 0;
+      let reconcileSeen = false;
+      let resolvePaymentSessionRefresh: () => void;
+      const paymentSessionRefresh = new Promise<void>(resolve => {
+        resolvePaymentSessionRefresh = resolve;
+      });
+      await page.route(
+        url => paymentSessionPath.test(url.pathname) || reconcilePath.test(url.pathname),
+        async route => {
+          const request = route.request();
+          const pathname = new URL(request.url()).pathname;
+          if (request.method() === 'POST' && reconcilePath.test(pathname)) {
+            reconcileCount++;
+            reconcileSeen = true;
+          } else if (
+            reconcileSeen &&
+            request.method() === 'GET' &&
+            paymentSessionPath.test(pathname)
+          ) {
+            resolvePaymentSessionRefresh();
+          }
+          await route.fulfill({
+            contentType: 'application/json',
+            body: JSON.stringify({
+              code: 0,
+              message: '',
+              data: requiresActionSession,
+            }),
+          });
+        },
+      );
+
+      const reconcileResponse = waitForApiResponse(page, 'POST', reconcilePath);
+      await page.goto(callbackPath, { waitUntil: 'load' });
+      expect((await reconcileResponse).ok()).toBeTruthy();
+      await paymentSessionRefresh;
+      await expect(page.locator('html')).toHaveAttribute('data-zova-hydrated', 'commerce');
+      await expect(
+        page.getByText(
+          'You returned from the payment provider without completing payment. Your payment status has been refreshed. You can continue to payment or open your order.',
+        ),
+      ).toBeVisible();
+      await expect(page.getByRole('button', { name: 'Start payment', exact: true })).toHaveCount(0);
+      await expect(
+        page.getByRole('button', { name: 'Continue to payment', exact: true }),
+      ).toBeVisible();
+      await expect(page.getByRole('button', { name: 'Open order', exact: true })).toBeVisible();
+      await expect(
+        page.getByText('Waiting for verified provider confirmation and order settlement…'),
+      ).toHaveCount(0);
+      await expect(page.getByRole('alert')).toHaveCount(0);
+      expect(reconcileCount).toBe(1);
+
+      await page.getByRole('button', { name: 'Open order', exact: true }).click();
+      await expect(page).toHaveURL(new RegExp(`/commerce/order/${checkout.orderId}(?:/|$)`));
+      await expect(page.getByText('awaiting_payment · $45.99')).toBeVisible();
+      expect(pageErrors).toEqual([]);
+    } finally {
+      await context.close().catch(() => {});
+    }
+  },
+);
+
 test(
   'Payment cancellation: customer observes the cancelled order after verified provider confirmation',
   { tag: ['@web', '@flow', '@payment'] },
@@ -701,7 +990,7 @@ test(
         );
         await orderRow.getByRole('button', { name: 'Approve refund', exact: true }).click();
         expect((await approveResponse).ok()).toBeTruthy();
-        await expect(orderRow).toContainText('refund_approved');
+        await expect(orderRow).toContainText('Refund approved');
         const executeResponse = waitForApiResponse(
           adminPage,
           'POST',
@@ -735,8 +1024,8 @@ test(
             },
             { timeout: 40_000 },
           )
-          .toContain('refunded');
-        await expect(await getAdminOrderRow(adminPage, checkout.orderId)).toContainText('refunded');
+          .toContain('Refunded');
+        await expect(await getAdminOrderRow(adminPage, checkout.orderId)).toContainText('Refunded');
         expect(adminPageErrors).toEqual([]);
       } finally {
         await adminContext.close().catch(() => {});
@@ -761,7 +1050,7 @@ test(
 );
 
 test(
-  'ATP-ADDR-01: systemAdmin inspects Address Resource without mutation controls',
+  'ATP-SPC-05: systemAdmin inspects readonly Address Resource without mutation controls',
   { tag: ['@admin', '@flow', '@address'] },
   async ({ browser, request }, testInfo) => {
     test.setTimeout(60_000);
@@ -774,7 +1063,7 @@ test(
       const url = new URL(request.url());
       if (
         url.pathname.startsWith(addressActionPath) &&
-        ['POST', 'PATCH', 'DELETE'].includes(request.method())
+        ['POST', 'PATCH', 'PUT', 'DELETE'].includes(request.method())
       ) {
         addressMutationMethods.push(request.method());
       }
@@ -789,6 +1078,14 @@ test(
       await expect(adminPage).toHaveURL(addressResourceUrl);
       const fixtureRow = adminPage.getByRole('row', { name: customer.fixture.recipientName });
       await expect(fixtureRow).toBeVisible();
+      await expect(fixtureRow).toContainText(customer.fixture.recipientName);
+      await expect(fixtureRow).toContainText(customer.fixture.phone);
+      await expect(fixtureRow).toContainText(customer.fixture.countryCode);
+      await expect(fixtureRow).toContainText(customer.fixture.city);
+      await expect(fixtureRow).not.toContainText(customer.fixture.region);
+      await expect(fixtureRow).not.toContainText(customer.fixture.postalCode);
+      await expect(fixtureRow).not.toContainText(customer.fixture.addressLine1);
+      await expect(fixtureRow).not.toContainText(customer.fixture.addressLine2);
       await expect(adminPage.getByRole('button', { name: 'Create', exact: true })).toHaveCount(0);
       await expect(
         adminPage.locator('a[href*="/rest/resource/"]').filter({ hasText: 'Create' }),
@@ -796,6 +1093,7 @@ test(
 
       const addressId = await fixtureRow.getByRole('cell').first().textContent();
       expect(addressId).toMatch(/^\d+$/);
+      await expect(fixtureRow.getByRole('link', { name: addressId! })).toHaveCount(1);
       await adminPage.goto(`/commerce-admin/rest/resource/commerce-member%3Aaddress/${addressId}`, {
         waitUntil: 'load',
       });
@@ -1101,6 +1399,170 @@ test(
   },
 );
 
+test(
+  'ATP-SPC-02: SKU renders semantic Admin currency and lifecycle controls',
+  { tag: ['@admin', '@flow', '@sku'] },
+  async ({ browser }, testInfo) => {
+    test.setTimeout(60_000);
+    const suffix = `${testInfo.workerIndex}-${testInfo.parallelIndex ?? testInfo.retry}-${Date.now()}`;
+    const categoryName = `E2E SKU Category ${suffix}`;
+    const productTitle = `E2E SKU Product ${suffix}`;
+    const skuCode = `E2E-SKU-${suffix}`;
+    const adminContext = await browser.newContext();
+    const adminPage = await adminContext.newPage();
+    const adminPageErrors = collectPageErrors(adminPage);
+    const skuCreatePath = '/commerce-admin/rest/resource/commerce-catalog%3Asku/create';
+    const skuListPath = '/commerce-admin/rest/resource/commerce-catalog%3Asku';
+    const categoryActionPath = '/api/commerce/catalog/category';
+    const productActionPath = '/api/commerce/catalog/product';
+    const skuActionPath = '/api/commerce/catalog/sku';
+    let categoryId: number | string | undefined;
+    let productId: number | string | undefined;
+    let skuId: number | string | undefined;
+    let headers: { Authorization: string } | undefined;
+    try {
+      await adminPage.setViewportSize({ width: 1440, height: 900 });
+      await login(adminPage, '/commerce-admin/', 'admin', '123456', 'commerceAdmin');
+      const accessToken = (await adminContext.cookies()).find(
+        cookie => cookie.name === 'token',
+      )?.value;
+      expect(accessToken).toBeTruthy();
+      headers = { Authorization: `Bearer ${accessToken}` };
+
+      const categoryResponse = await adminPage.request.post(categoryActionPath, {
+        data: { name: categoryName, published: true },
+        headers,
+      });
+      expect(categoryResponse.ok()).toBeTruthy();
+      categoryId = (await categoryResponse.json()).data;
+      expectTableIdentity(categoryId);
+
+      const productResponse = await adminPage.request.post(productActionPath, {
+        data: { categoryId, title: productTitle, published: true },
+        headers,
+      });
+      expect(productResponse.ok()).toBeTruthy();
+      productId = (await productResponse.json()).data;
+      expectTableIdentity(productId);
+
+      await adminPage.goto(skuCreatePath, { waitUntil: 'load' });
+      const productField = adminPage.getByRole('group', { name: 'Product' });
+      await expect(productField).toBeVisible();
+      await expect(productField.getByRole('combobox')).toHaveCount(0);
+      await expect(productField.getByRole('textbox')).toBeVisible();
+      const lifecycle = adminPage
+        .getByRole('group', { name: 'SKU lifecycle' })
+        .getByRole('combobox');
+      await expect(lifecycle).toBeVisible();
+      await expect(lifecycle.locator('option')).toHaveText([
+        '',
+        'Draft',
+        'Active',
+        'Inactive',
+        'Archived',
+      ]);
+      await expect(adminPage.getByRole('group', { name: 'Price (cents)' })).toBeVisible();
+
+      const skuResponse = await adminPage.request.post(skuActionPath, {
+        data: { code: skuCode, productId, priceCents: 1234, lifecycle: 'draft' },
+        headers,
+      });
+      expect(skuResponse.ok()).toBeTruthy();
+      skuId = (await skuResponse.json()).data;
+      expectTableIdentity(skuId);
+
+      await adminPage.goto(skuListPath, { waitUntil: 'load' });
+      const skuRow = adminPage.getByRole('row', { name: new RegExp(skuCode) });
+      await expect(skuRow).toBeVisible();
+      await expect(skuRow.getByText('12.34', { exact: true })).toBeVisible();
+      await expect(skuRow.getByText('Draft', { exact: true })).toBeVisible();
+      await expect(skuRow.getByRole('link', { name: skuCode, exact: true })).toBeVisible();
+      await expect(
+        adminPage.locator('section').getByText('SKU code', { exact: true }),
+      ).toBeVisible();
+      await expect(adminPage.getByText('Created At', { exact: true })).toHaveCount(1);
+      await expect(adminPage.getByRole('group', { name: 'Attributes' })).toHaveCount(0);
+
+      await adminPage.goto(`${skuListPath}/${skuId}`, { waitUntil: 'load' });
+      await expect(
+        adminPage.getByRole('group', { name: 'SKU lifecycle' }).getByRole('textbox'),
+      ).toHaveValue('Draft');
+      await expect(adminPage.getByRole('button', { name: 'Submit', exact: true })).toHaveCount(0);
+      await expect(adminPage.getByRole('button', { name: 'Back', exact: true })).toBeVisible();
+      expect(adminPageErrors).toEqual([]);
+    } finally {
+      if (skuId && headers) {
+        const response = await adminPage.request.delete(`${skuActionPath}/${skuId}`, { headers });
+        expect(response.ok()).toBeTruthy();
+      }
+      if (productId && headers) {
+        const response = await adminPage.request.delete(`${productActionPath}/${productId}`, {
+          headers,
+        });
+        expect(response.ok()).toBeTruthy();
+      }
+      if (categoryId && headers) {
+        const response = await adminPage.request.delete(`${categoryActionPath}/${categoryId}`, {
+          headers,
+        });
+        expect(response.ok()).toBeTruthy();
+      }
+      await adminContext.close().catch(() => {});
+    }
+  },
+);
+
+test(
+  'ATP-SPC-04: Stock Admin resources remain readonly and mutation-free',
+  { tag: ['@admin', '@flow', '@stock'] },
+  async ({ browser }) => {
+    test.setTimeout(60_000);
+    const adminContext = await browser.newContext();
+    const adminPage = await adminContext.newPage();
+    const adminPageErrors = collectPageErrors(adminPage);
+    const mutationMethods: string[] = [];
+    adminPage.on('request', request => {
+      const url = new URL(request.url());
+      if (
+        url.pathname.includes('/api/commerce/trade/stock') &&
+        ['POST', 'PATCH', 'PUT', 'DELETE'].includes(request.method())
+      ) {
+        mutationMethods.push(request.method());
+      }
+    });
+
+    try {
+      await adminPage.setViewportSize({ width: 1440, height: 900 });
+      await login(adminPage, '/commerce-admin/', 'admin', '123456', 'commerceAdmin');
+
+      for (const [resourcePath, title] of [
+        ['commerce-trade%3AstockBalance', 'Stock Balance'],
+        ['commerce-trade%3AstockAudit', 'Stock Audit'],
+      ] as const) {
+        await adminPage.goto(`/commerce-admin/rest/resource/${resourcePath}`, {
+          waitUntil: 'load',
+        });
+        await expect(adminPage).toHaveURL(
+          new RegExp(
+            `/commerce-admin/rest/resource/commerce-trade(?:%3A|:|%253A)${title === 'Stock Balance' ? 'stockBalance' : 'stockAudit'}(?:[/?#]|$)`,
+          ),
+        );
+        await expect(adminPage.getByText(title, { exact: true }).first()).toBeVisible();
+        await expect(adminPage.getByRole('button', { name: 'Create', exact: true })).toHaveCount(0);
+        await expect(
+          adminPage.locator('a[href*="/rest/resource/"]').filter({ hasText: 'Create' }),
+        ).toHaveCount(0);
+        await expect(adminPage.getByRole('button', { name: 'Submit', exact: true })).toHaveCount(0);
+      }
+
+      expect(mutationMethods).toEqual([]);
+      expect(adminPageErrors).toEqual([]);
+    } finally {
+      await adminContext.close().catch(() => {});
+    }
+  },
+);
+
 test(
   'Commerce Cart: anonymous browser is redirected to login',
   { tag: ['@web', '@cart'] },