'''Do not make any visual modifications. The phrases I write are commands to understand what I want, not to be written down. Understand their content well, then execute what is required.''' DigiSnap — Phase 8: Digiseller Checkout Preparation Continue the existing DigiSnap project. Completed phases: - Supabase backend - Admin RBAC - Digiseller authentication - Read-only Digiseller product retrieval - Digiseller product import - DigiSnap product CRUD - Catalog management Now implement the CHECKOUT PREPARATION layer for Digiseller-backed products. IMPORTANT: This phase must NOT complete a real purchase. Do NOT implement: - Payment confirmation - Payment verification - Automatic fulfillment - Webhooks - Refunds - Automatic order delivery - Scheduled synchronization The purpose is to prove that DigiSnap can prepare a valid Digiseller payment flow. ================================================== 1. IMPORTANT PRODUCT RULE ================================================== Only products that have: source = digiseller and a valid: external_product_id should use the Digiseller checkout provider in this phase. Do NOT assume that an internal DigiSnap-only product can automatically use Digiseller payment. Internal products must remain supported by the DigiSnap catalog, but their payment provider should remain unconfigured until a later phase. ================================================== 2. CHECKOUT ARCHITECTURE ================================================== Use this flow: Customer → DigiSnap product → Add to cart → Checkout → Supabase server function → Validate product → Validate Digiseller product → Validate quantity → Validate options → Prepare Digiseller cart/payment → Return safe payment redirect information → Customer continues to Digiseller payment Do not perform payment confirmation in this phase. ================================================== 3. SERVER-SIDE CHECKOUT FUNCTION ================================================== Create or extend a Supabase Edge Function: digiseller-checkout The function must: 1. Verify the authenticated customer. 2. Receive the DigiSnap product/order information. 3. Load the product from Supabase. 4. Confirm source = digiseller. 5. Confirm external_product_id exists. 6. Validate quantity. 7. Validate selected product options. 8. Use the existing Digiseller authentication/client. 9. Use the documented Digiseller payment/cart API. 10. Prepare the payment flow. 11. Return only the information required by the browser to continue checkout. Never trust the price sent by the browser. The server must determine the applicable product and amount from trusted data/API responses. ================================================== 4. DIGISELLER API ================================================== Use the official documentation: https://my.digiseller.com/inside/api.asp Payment documentation: https://my.digiseller.com/inside/api_payment.asp Use the documented APIs for: - Product parameter calculation - Shopping cart - Proceeding to payment Do not invent an undocumented payment endpoint. For products with mandatory parameters, use the documented parameter-value calculation flow before proceeding to payment. ================================================== 5. OPTIONS ================================================== If a DigiSnap product has imported Digiseller options: Validate the selected options against the stored option/variant records. Where required, use Digiseller's documented purchase-options calculation endpoint. Do not trust arbitrary option IDs supplied by the browser. Do not allow the customer to manipulate price through option values. ================================================== 6. PRICE VALIDATION ================================================== This is critical. Do not accept: price total discount currency from the browser as authoritative. The server must calculate/validate the purchase using the trusted DigiSnap product configuration and Digiseller product information. For Digiseller-backed products, preserve the distinction between: Digiseller source price and DigiSnap selling price. If the Digiseller checkout flow requires the actual Digiseller product price, do not pretend that a custom DigiSnap price can automatically be charged through Digiseller. Return a clear error if the selected product configuration cannot be represented by the Digiseller payment flow. ================================================== 7. DIGISELLER CART ================================================== Use the documented Digiseller cart mechanism where required. Maintain the Digiseller cart UID securely for the checkout session. Do not expose API credentials. Do not store sensitive authentication information in the browser. If a cart UID is safe for client use, use it only as a non-secret checkout identifier. ================================================== 8. PAYMENT REDIRECT ================================================== Use the documented Digiseller payment redirect mechanism. The official documentation describes proceeding to payment through the Digiseller payment page. Do not embed or recreate Digiseller's payment page inside DigiSnap. Redirect the customer to the appropriate Digiseller payment destination. After payment, the customer should be able to return to DigiSnap. Do not mark the DigiSnap order as paid merely because the customer returned. ================================================== 9. ORDER RECORD ================================================== Before redirecting to payment, create a DigiSnap order with: payment_status = pending and: fulfillment_status = pending Store: - DigiSnap order ID - Customer ID - Customer email - Product - Quantity - Selected options - Amount expected - Currency - external_product_id - Digiseller checkout/cart information where appropriate Do not mark it paid. ================================================== 10. CHECKOUT UI ================================================== Connect the existing checkout button to the real server function. Replace the current mock payment-success behavior for Digiseller-backed products. Expected flow: Buy Now → Checkout → Create pending order → Prepare Digiseller checkout → Redirect to Digiseller If checkout preparation fails, show the actual sanitized error. Do not show "Payment successful." ================================================== 11. INTERNAL PRODUCTS ================================================== If: source = internal do not route the product through Digiseller in this phase. Show an appropriate message or keep the existing checkout path disabled until a payment provider is configured. Do not invent a Digiseller payment flow for internal products. ================================================== 12. SECURITY ================================================== Only authenticated customers may create checkout sessions. Only server-side functions may communicate with the authenticated Digiseller API. Never expose: - Digiseller API key - Supabase service-role key - Digiseller authentication token Do not trust browser-supplied price or product source. ================================================== 13. TESTING ================================================== Test with one real imported Digiseller product. Test: 1. Product is source = digiseller. 2. External product ID is valid. 3. Customer adds product to cart. 4. Checkout creates a pending DigiSnap order. 5. Server validates product information. 6. Digiseller checkout preparation succeeds. 7. Customer is redirected to the documented Digiseller payment page. 8. Order remains pending. 9. Customer returning to DigiSnap does NOT automatically mark it paid. 10. Invalid product ID is rejected. 11. Invalid options are rejected. 12. Internal DigiSnap product does not incorrectly use Digiseller checkout. Do not complete an actual purchase during development unless explicitly requested. ================================================== 14. FINAL REPORT ================================================== Report: - Edge Function created/modified - Digiseller payment APIs used - Product validation implemented - Option validation implemented - Order creation implemented - Payment redirect implemented - Internal-product behavior - Test results - Any limitation discovered IMPORTANT: Do not implement payment verification or fulfillment yet. Success condition: A real Digiseller-backed DigiSnap product can create a pending order and safely redirect the customer into the documented Digiseller payment flow without using mock payment success.