Updated checkout to wait for backend confirmation before advancing, added a “Processing payment…” state with retry/ refresh fallback, and now use Paddle totals/currency for purchase records + confirmation emails (with new email translations).

tests/Feature/Checkout/CheckoutSessionStatusTest.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace Tests\Feature\Checkout;
+
+use App\Models\CheckoutSession;
+use App\Models\Package;
+use App\Models\Tenant;
+use App\Models\User;
+use App\Services\Checkout\CheckoutSessionService;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class CheckoutSessionStatusTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_user_can_fetch_checkout_session_status(): void
+    {
+        $tenant = Tenant::factory()->create();
+        $user = User::factory()->for($tenant)->create();
+        $package = Package::factory()->create();
+
+        /** @var CheckoutSessionService $sessions */
+        $sessions = app(CheckoutSessionService::class);
+        $session = $sessions->createOrResume($user, $package, [
+            'tenant' => $tenant,
+        ]);
+        $sessions->markCompleted($session, now());
+
+        $this->actingAs($user);
+
+        $response = $this->getJson(route('checkout.session.status', $session));
+
+        $response->assertOk()
+            ->assertJsonPath('status', CheckoutSession::STATUS_COMPLETED);
+    }
+
+    public function test_user_cannot_fetch_other_users_checkout_session_status(): void
+    {
+        $tenant = Tenant::factory()->create();
+        $owner = User::factory()->for($tenant)->create();
+        $otherUser = User::factory()->create();
+        $package = Package::factory()->create();
+
+        /** @var CheckoutSessionService $sessions */
+        $sessions = app(CheckoutSessionService::class);
+        $session = $sessions->createOrResume($owner, $package, [
+            'tenant' => $tenant,
+        ]);
+
+        $this->actingAs($otherUser);
+
+        $response = $this->getJson(route('checkout.session.status', $session));
+
+        $response->assertForbidden();
+    }
+}