Updated checkout to wait for backend confirmation before advancing, added a “Processing payment…” state with retry/ refresh fallback, and now use Paddle totals/currency for purchase records + confirmation emails (with new email translations).

tests/Feature/Checkout/CheckoutAuthTest.php

@@ -67,6 +67,28 @@ class CheckoutAuthTest extends TestCase
         ]);
     }
 
+    public function test_checkout_login_marks_pending_purchase_when_package_provided(): void
+    {
+        $user = User::factory()->create(['pending_purchase' => false]);
+        $package = Package::factory()->create();
+
+        $response = $this->postJson(route('checkout.login'), [
+            'identifier' => $user->email,
+            'password' => 'password',
+            'remember' => false,
+            'locale' => 'de',
+            'package_id' => $package->id,
+        ]);
+
+        $response->assertStatus(200)
+            ->assertJsonPath('user.pending_purchase', true);
+
+        $this->assertDatabaseHas('users', [
+            'id' => $user->id,
+            'pending_purchase' => true,
+        ]);
+    }
+
     public function test_checkout_login_returns_validation_errors_with_invalid_credentials()
     {
         $response = $this->postJson(route('checkout.login'), [

tests/Feature/Checkout/CheckoutFreeActivationTest.php

@@ -0,0 +1,91 @@
+<?php
+
+namespace Tests\Feature\Checkout;
+
+use App\Models\CheckoutSession;
+use App\Models\Package;
+use App\Models\Tenant;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\Notification;
+use Tests\TestCase;
+
+class CheckoutFreeActivationTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        Mail::fake();
+        Notification::fake();
+    }
+
+    public function test_free_checkout_activation_completes_session_and_assigns_package(): void
+    {
+        $tenant = Tenant::factory()->create();
+        $user = User::factory()->for($tenant)->create();
+        $package = Package::factory()->create([
+            'price' => 0,
+        ]);
+
+        $this->actingAs($user);
+
+        $response = $this->postJson(route('checkout.free-activate'), [
+            'package_id' => $package->id,
+            'accepted_terms' => true,
+            'accepted_waiver' => true,
+            'locale' => 'de',
+        ]);
+
+        $response->assertOk()
+            ->assertJsonPath('status', 'completed');
+
+        $this->assertDatabaseHas('checkout_sessions', [
+            'package_id' => $package->id,
+            'user_id' => $user->id,
+            'provider' => CheckoutSession::PROVIDER_FREE,
+            'status' => CheckoutSession::STATUS_COMPLETED,
+        ]);
+
+        $this->assertDatabaseHas('tenant_packages', [
+            'tenant_id' => $tenant->id,
+            'package_id' => $package->id,
+            'active' => true,
+        ]);
+
+        $this->assertDatabaseHas('package_purchases', [
+            'tenant_id' => $tenant->id,
+            'package_id' => $package->id,
+            'provider' => CheckoutSession::PROVIDER_FREE,
+        ]);
+    }
+
+    public function test_free_checkout_requires_waiver_when_package_activates_immediately(): void
+    {
+        $tenant = Tenant::factory()->create();
+        $user = User::factory()->for($tenant)->create();
+        $package = Package::factory()->create([
+            'price' => 0,
+        ]);
+
+        $this->actingAs($user);
+
+        $response = $this->postJson(route('checkout.free-activate'), [
+            'package_id' => $package->id,
+            'accepted_terms' => true,
+            'accepted_waiver' => false,
+            'locale' => 'de',
+        ]);
+
+        $response->assertStatus(422)
+            ->assertJsonValidationErrors(['accepted_waiver']);
+
+        $this->assertDatabaseMissing('package_purchases', [
+            'tenant_id' => $tenant->id,
+            'package_id' => $package->id,
+        ]);
+    }
+}

tests/Feature/Checkout/CheckoutSessionStatusTest.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace Tests\Feature\Checkout;
+
+use App\Models\CheckoutSession;
+use App\Models\Package;
+use App\Models\Tenant;
+use App\Models\User;
+use App\Services\Checkout\CheckoutSessionService;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class CheckoutSessionStatusTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_user_can_fetch_checkout_session_status(): void
+    {
+        $tenant = Tenant::factory()->create();
+        $user = User::factory()->for($tenant)->create();
+        $package = Package::factory()->create();
+
+        /** @var CheckoutSessionService $sessions */
+        $sessions = app(CheckoutSessionService::class);
+        $session = $sessions->createOrResume($user, $package, [
+            'tenant' => $tenant,
+        ]);
+        $sessions->markCompleted($session, now());
+
+        $this->actingAs($user);
+
+        $response = $this->getJson(route('checkout.session.status', $session));
+
+        $response->assertOk()
+            ->assertJsonPath('status', CheckoutSession::STATUS_COMPLETED);
+    }
+
+    public function test_user_cannot_fetch_other_users_checkout_session_status(): void
+    {
+        $tenant = Tenant::factory()->create();
+        $owner = User::factory()->for($tenant)->create();
+        $otherUser = User::factory()->create();
+        $package = Package::factory()->create();
+
+        /** @var CheckoutSessionService $sessions */
+        $sessions = app(CheckoutSessionService::class);
+        $session = $sessions->createOrResume($owner, $package, [
+            'tenant' => $tenant,
+        ]);
+
+        $this->actingAs($otherUser);
+
+        $response = $this->getJson(route('checkout.session.status', $session));
+
+        $response->assertForbidden();
+    }
+}

tests/Feature/Packages/PackageSoftDeleteTest.php

@@ -9,6 +9,8 @@ use App\Models\TenantPackage;
 use App\Services\Checkout\CheckoutAssignmentService;
 use App\Services\Checkout\CheckoutSessionService;
 use App\Services\Checkout\CheckoutWebhookService;
+use App\Services\Coupons\CouponRedemptionService;
+use App\Services\GiftVouchers\GiftVoucherService;
 use App\Services\Paddle\PaddleSubscriptionService;
 use Carbon\Carbon;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -80,11 +82,15 @@ class PackageSoftDeleteTest extends TestCase
         $sessionService = Mockery::mock(CheckoutSessionService::class);
         $assignmentService = Mockery::mock(CheckoutAssignmentService::class);
         $subscriptionService = Mockery::mock(PaddleSubscriptionService::class);
+        $couponRedemptions = Mockery::mock(CouponRedemptionService::class);
+        $giftVouchers = Mockery::mock(GiftVoucherService::class);
 
         $service = new CheckoutWebhookService(
             $sessionService,
             $assignmentService,
-            $subscriptionService
+            $subscriptionService,
+            $couponRedemptions,
+            $giftVouchers
         );
 
         Carbon::setTestNow(now());
@@ -94,7 +100,7 @@ class PackageSoftDeleteTest extends TestCase
             'data' => [
                 'id' => 'sub_123',
                 'status' => 'active',
-                'metadata' => [
+                'custom_data' => [
                     'tenant_id' => $tenant->id,
                     'package_id' => $package->id,
                 ],

tests/Feature/PaddleCheckoutControllerTest.php

@@ -80,10 +80,15 @@ class PaddleCheckoutControllerTest extends TestCase
         $response = $this->postJson(route('paddle.checkout.create'), [
             'package_id' => $package->id,
             'coupon_code' => 'SAVE15',
+            'accepted_terms' => true,
+            'accepted_waiver' => true,
         ]);
 
         $response->assertOk()
-            ->assertJsonPath('checkout_url', 'https://example.com/checkout/test');
+            ->assertJsonPath('checkout_url', 'https://example.com/checkout/test')
+            ->assertJsonStructure([
+                'checkout_session_id',
+            ]);
 
         $this->assertDatabaseHas('checkout_sessions', [
             'package_id' => $package->id,

tests/Feature/PaddleWebhookControllerTest.php

@@ -30,7 +30,16 @@ class PaddleWebhookControllerTest extends TestCase
                 'id' => 'txn_123',
                 'status' => 'completed',
                 'checkout_id' => 'chk_456',
-                'metadata' => [
+                'details' => [
+                    'totals' => [
+                        'subtotal' => ['amount' => '10000'],
+                        'discount' => ['amount' => '1000'],
+                        'tax' => ['amount' => '1900'],
+                        'total' => ['amount' => '10900'],
+                        'currency_code' => 'EUR',
+                    ],
+                ],
+                'custom_data' => [
                     'checkout_session_id' => $session->id,
                     'tenant_id' => (string) $tenant->id,
                     'package_id' => (string) $package->id,
@@ -66,6 +75,17 @@ class PaddleWebhookControllerTest extends TestCase
                 ->where('provider', 'paddle')
                 ->exists()
         );
+
+        $purchase = PackagePurchase::query()
+            ->where('tenant_id', $tenant->id)
+            ->where('package_id', $package->id)
+            ->first();
+
+        $this->assertNotNull($purchase);
+        $this->assertSame(109.0, (float) $purchase->price);
+        $this->assertSame('EUR', Arr::get($purchase->metadata, 'currency'));
+        $this->assertSame(109.0, (float) Arr::get($purchase->metadata, 'paddle_totals.total'));
+        $this->assertSame(109.0, (float) $session->amount_total);
     }
 
     public function test_duplicate_transaction_is_idempotent(): void
@@ -80,7 +100,7 @@ class PaddleWebhookControllerTest extends TestCase
                 'id' => 'txn_dup',
                 'status' => 'completed',
                 'checkout_id' => 'chk_dup',
-                'metadata' => [
+                'custom_data' => [
                     'checkout_session_id' => $session->id,
                     'tenant_id' => (string) $tenant->id,
                     'package_id' => (string) $package->id,
@@ -107,6 +127,60 @@ class PaddleWebhookControllerTest extends TestCase
         $this->assertEquals('txn_dup', Arr::get($session->provider_metadata, 'paddle_transaction_id'));
     }
 
+    public function test_transaction_completed_updates_tenant_status_for_one_time_package(): void
+    {
+        config(['paddle.webhook_secret' => 'test_secret']);
+
+        $user = User::factory()->create(['email_verified_at' => now()]);
+        $tenant = Tenant::factory()->create([
+            'user_id' => $user->id,
+            'subscription_status' => 'free',
+        ]);
+        $user->forceFill(['tenant_id' => $tenant->id])->save();
+
+        $package = Package::factory()->create([
+            'type' => 'endcustomer',
+            'price' => 49,
+            'paddle_price_id' => 'price_one_time',
+        ]);
+
+        /** @var CheckoutSessionService $sessions */
+        $sessions = app(CheckoutSessionService::class);
+        $session = $sessions->createOrResume($user, $package, ['tenant' => $tenant]);
+        $sessions->selectProvider($session, CheckoutSession::PROVIDER_PADDLE);
+
+        $payload = [
+            'event_type' => 'transaction.completed',
+            'data' => [
+                'id' => 'txn_one_time',
+                'status' => 'completed',
+                'details' => [
+                    'totals' => [
+                        'total' => ['amount' => '4900'],
+                        'currency_code' => 'EUR',
+                    ],
+                ],
+                'custom_data' => [
+                    'checkout_session_id' => $session->id,
+                    'tenant_id' => (string) $tenant->id,
+                    'package_id' => (string) $package->id,
+                ],
+            ],
+        ];
+
+        $signature = hash_hmac('sha256', json_encode($payload), 'test_secret');
+
+        $response = $this->withHeader('Paddle-Webhook-Signature', $signature)
+            ->postJson('/paddle/webhook', $payload);
+
+        $response->assertOk()->assertJson(['status' => 'processed']);
+
+        $tenant->refresh();
+
+        $this->assertSame('active', $tenant->subscription_status);
+        $this->assertNotNull($tenant->subscription_expires_at);
+    }
+
     public function test_rejects_invalid_signature(): void
     {
         config(['paddle.webhook_secret' => 'secret']);
@@ -152,7 +226,7 @@ class PaddleWebhookControllerTest extends TestCase
                 'customer_id' => 'cus_123',
                 'created_at' => Carbon::now()->subDay()->toIso8601String(),
                 'next_billing_date' => Carbon::now()->addMonth()->toIso8601String(),
-                'metadata' => [
+                'custom_data' => [
                     'tenant_id' => (string) $tenant->id,
                     'package_id' => (string) $package->id,
                 ],
@@ -212,7 +286,7 @@ class PaddleWebhookControllerTest extends TestCase
                 'id' => 'sub_cancel',
                 'status' => 'cancelled',
                 'customer_id' => 'cus_cancel',
-                'metadata' => [
+                'custom_data' => [
                     'tenant_id' => (string) $tenant->id,
                     'package_id' => (string) $package->id,
                 ],

tests/Feature/Tenant/EventAddonWebhookTest.php

@@ -58,7 +58,7 @@ class EventAddonWebhookTest extends TenantTestCase
             'event_type' => 'transaction.completed',
             'data' => [
                 'id' => 'txn_addon_1',
-                'metadata' => [
+                'custom_data' => [
                     'addon_intent' => 'intent-123',
                     'addon_key' => 'extra_guests',
                 ],