james
2136a48fbe
Archive the three completed changes behind replace-mock-api-wave-1/2/3. Each merge applied cleanly to the main specs: - catalog gains the Public product browse requirement (subtree filtering and price sort) - frontend-mall picks up the per-domain adapter, the pinned home page, the discovery-page changes, the live auth panels and the live transaction flows - cart's Server-side cart requirement now documents the shop and stock carried by every line Also replace the TBD Purpose placeholder in all eleven specs with a one-line description of what each capability covers. Those placeholders predate this work and were the only reason `openspec validate --all --strict` reported 0 passed / 11 failed; it now reports 11 passed / 0 failed.
1.6 KiB
1.6 KiB
order Specification
Purpose
Checkout splitting a cart into per-shop orders, plus order lifecycle and ownership.
Requirements
Requirement: Checkout splits by shop
POST /api/orders/checkout SHALL create one order per distinct shop in the cart, in a single database transaction: stock decrement, order + item insert with price snapshots, cart clear. All amounts use the cart's SKU currencies converted into the buyer-chosen display currency at checkout time.
Scenario: two shops → two orders
- WHEN the cart contains SKUs from shops A and B
- THEN two orders are created, each with only its shop's items, and the cart is empty
Scenario: insufficient stock
- WHEN any line's qty exceeds SKU stock
- THEN the whole checkout returns 409 and no order is created and stock is unchanged
Requirement: Order lifecycle
Status transitions SHALL be: pending_payment → paid → fulfilling → shipped → completed; cancellable only from pending_payment, which MUST restore stock.
Scenario: cancel restores stock
- WHEN a customer cancels a pending_payment order
- THEN stock of each SKU increases by the ordered qty and status is cancelled
Scenario: illegal transition rejected
- WHEN cancelling a paid order via the customer endpoint
- THEN the API returns 409
Requirement: Order ownership
Customers SHALL see only their own orders; shop roles only their shop's orders; platform_admin sees all.
Scenario: cross-customer read denied
- WHEN customer X requests customer Y's order id
- THEN the API returns 404