Checkout Flow (checkout-flow)

Summary

Synthetic shopper path: product → add to cart → cart verification → checkout page (B2B-aware).

Classification

• Category: ECOMMERCE
• Plugin id: checkout-flow
• Version: 2.3.0
• Target types: WEBSHOP
• Weight class: MEDIUM
• Risk level: not set on plugin object
• Browser required: Yes (Playwright)
• Tier / group: Tier 3 — E-commerce / flows (Playwright)

Schedule

• scheduleHints: { defaultInterval: '0 */6 * * *', priority: 8 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
productUrl	Zod field in inputSchema — see source for defaults, min/max, and .describe().
cartUrl	Zod field in inputSchema — see source for defaults, min/max, and .describe().
checkoutUrl	Zod field in inputSchema — see source for defaults, min/max, and .describe().
timeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().
stepTimeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().

Runtime / injected config

• _secrets — LOGIN_EMAIL / LOGIN_PASSWORD (or lowercase variants) for B2B login before the flow.
• _fingerprint / _requiresLoginForPurchase — B2B detection and skip or login path.
• _hasEverPassed — first-run heuristics for suspected B2B (_suspectedB2B in metrics).
• _recordVideo — flow recording when enabled by the worker.

What it does

• Runs as part of the worker test execution pipeline; results become Run rows and may create Finding records.
• Synthetic shopper path: product → add to cart → cart verification → checkout page (B2B-aware). Navigation uses gotoDocumentReady (domcontentloaded + best-effort load); it does not wait for Playwright networkidle.
• Kaduno demo tenant only (demo.preview.kaduno.com, exact host — not *.preview.kaduno.com): HTML document GET of / and /checkout with Accept: text/html. Fails on HTTP 404 / preview-not-configured (title, body, x-middleware-rewrite) before any Magento selector. Magento chrome and missing Kjøp/Handlekurv/Kasse apply only on a mapped 200 shop page. Pia cut: also GET public tRPC payment.methods.list, GET /login, GET /cart, and an isolated GET /checkout with the same HTML Accept (no */*, no pay, no payment intents, no POST). FAIL if unmapped/error/empty, or invoice/Faktura listed without worldline/card/sandbox_card. PASS only if card/Worldline is listed. /login FAIL if unmapped/preview-not-configured, Magento chrome, or no login form; PASS only if a Kaduno login form is present on HTML. /cart FAIL if unmapped/preview-not-configured, Magento chrome, or no Kaduno cart; PASS only if a Kaduno cart is present on HTML. Isolated /checkout FAIL if unmapped/preview-not-configured, Magento chrome, or missing Kaduno checkout (Kasse / checkout chrome); PASS only if a Kaduno checkout is present on HTML. An HTML 404 does not skip the list, /login, /cart, isolated /checkout, guest cart API, or shipping.methods.list — that is an honest fail. Pia cut: also GET public tRPC shipping.methods.list with Accept: application/json (no */*, no HTML-as-pass, no pay). FAIL if unmapped/error/empty/missing, Magento /rest/V1/guest-carts/:id/shipping-methods answering, invoice-style list without bring/postnord/posten/fedex/gordon, or any item.storeConfigId of sc_idt / sc_stolsvidda / sc_vikingvask (and close variants) on demo.preview.kaduno.com — that is a tenant leak, not a carrier pass. Tenant leak outranks carrier-present pass. PASS only if an expected carrier is listed and no owner storeConfigId leaked. Pia cut: also GET public tRPC catalog.products.list with Accept: application/json (no wildcard Accept, no HTML-as-pass, no pay). Live products.list / product.search / catalog.search are missing; catalog.products.list is the procedure that 200s. FAIL if unmapped/error/empty/missing/store-context, Magento /rest/V1/products answering, or other-store SKUs/slugs/storeConfigId (sc_idt / sc_stolsvidda / sc_vikingvask) on demo.preview.kaduno.com. Empty catalog is an honest fail. Tenant leak outranks a non-empty catalog. HTML 404 does not skip this check. Other *.preview.kaduno.com hosts (e.g. idtsports.preview.kaduno.com): same HTTP/tRPC probes, but multilingual chrome is allowed (no Kjøp/Kasse requirement), any listed payment/shipping method is a pass, and owner storeConfigId on that tenant is not a leak. Staging basic-auth / /staging-login is a CRITICAL fail until KADUNO_PREVIEW_BASIC_AUTH or vault HTTP_BASIC_* is applied. Other non-preview hosts keep the Magento/Shopify Playwright path.
• For finding titles, metrics, and artifacts specific to this plugin, refer to the implementation linked below.

Checks that produce findings

Check	Typical severity	Why
HTML 404 / preview-not-configured on / or /checkout (Kaduno demo tenant)	CRITICAL	Unmapped preview is not a shop. Must not be reported as a Magento add-to-cart miss. Wildcard Accept */* 200 is not a pass.
Magento chrome on a 200 shop page (Kaduno demo tenant)	CRITICAL	This tenant should serve Kaduno storefront/kasse, not Magento.
Missing Kjøp / Handlekurv / Kasse on mapped Kaduno HTML	CRITICAL	Checkout chrome gone on a configured storefront.
Public tRPC payment.methods.list unmapped/error/empty, or invoice/Faktura without worldline/card/sandbox_card (Kaduno demo tenant)	CRITICAL	Card/Worldline must be listed. HTML 404 preview-not-configured does not skip this check. No pay.
GET /login HTML 404 / preview-not-configured, Magento chrome, or no login form (Kaduno demo tenant)	CRITICAL	PASS only if a Kaduno login form is present. Wildcard Accept */* 200 is not a pass. Never POST credentials. HTML 404 does not skip /login.
GET /cart HTML 404 / preview-not-configured, Magento chrome, or no Kaduno cart (Kaduno demo tenant)	CRITICAL	PASS only if a Kaduno cart is present. Wildcard Accept */* 200 is not a pass. Never POST. HTML 404 does not skip /cart.
Isolated GET /checkout HTML 404 / preview-not-configured, Magento chrome, or missing Kaduno checkout (Kasse / checkout chrome) (Kaduno demo tenant)	CRITICAL	PASS only if a Kaduno checkout is present. Wildcard Accept */* 200 is not a pass. Never POST. HTML 404 does not skip this isolated /checkout check. Does not rewrite Validoria evaluateKadunoDemoCheckout.
Public tRPC shipping.methods.list unmapped/error/empty/missing, Magento guest-cart shipping-methods answering, owner storeConfigId leak (sc_idt / sc_stolsvidda / sc_vikingvask), or invoice-style list without bring/postnord/posten/fedex/gordon (Kaduno demo tenant)	CRITICAL	Expected carriers must be listed on the demo store only. Owner storeConfigId on demo.preview.kaduno.com is a tenant leak and outranks carrier-present pass. JSON Accept only. Magento /rest/V1/guest-carts/:id/shipping-methods answering is a fail, not a pass. HTML 404 preview-not-configured does not skip this check. No pay.
Public tRPC catalog.products.list unmapped/error/empty/missing/store-context, Magento /rest/V1/products answering, or other-store SKUs/slugs (sc_idt / sc_stolsvidda / sc_vikingvask) (Kaduno demo tenant)	CRITICAL	Demo catalog must list demo-store items only. JSON Accept only. Magento /rest/V1/products answering is a fail, not a pass. Empty is an honest fail. HTML 404 preview-not-configured does not skip this check. No pay.
Playwright checkout steps (other hosts)	CRITICAL / WARNING	Existing Magento/Shopify synthetic shopper path. Navigation uses gotoDocumentReady (domcontentloaded), never a hard networkidle wait — Magento shops with analytics/chat never go idle.
Playwright page.goto timeout (other hosts)	WARNING	Page-load timeout, not a missing selector and not a B2B login miss.
Staging basic-auth / /staging-login on *.preview.kaduno.com	CRITICAL	Pre-live store is gated. Set KADUNO_PREVIEW_BASIC_AUTH or vault HTTP_BASIC_* so TesteBot can scan before go-live.
Empty payment/shipping/catalog tRPC lists on a customer Kaduno preview host	CRITICAL	Go-live shop must list methods and products. Worldline/Bring/Norwegian chrome are demo-only requirements.

Source

packages/test-plugins/src/plugins/checkout-flow.ts