Checkout Flow (checkout-flow)

Summary

Runs a synthetic shopper path from product page through add-to-cart, cart verification, and checkout (B2B-aware).

Classification

• Category: ECOMMERCE
• Plugin id: checkout-flow
• Version: 2.0.0
• Target types: WEBSHOP
• Weight class: MEDIUM
• Escalation policy: FULL (recurrence + age escalation per team/target thresholds)
• Risk level: not set on plugin object
• Browser required: Yes (Playwright)
• Tier / group: Tier 3 — E-commerce / flows (Playwright)

Schedule

• scheduleHints: { defaultInterval: '0 */6 * * *', priority: 8 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
productUrl	Zod field in inputSchema — see source for defaults, min/max, and .describe().
cartUrl	Zod field in inputSchema — see source for defaults, min/max, and .describe().
checkoutUrl	Zod field in inputSchema — see source for defaults, min/max, and .describe().
timeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().
stepTimeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().

Runtime / injected config

• _secrets — LOGIN_EMAIL / LOGIN_PASSWORD (or lowercase variants) for B2B login before the flow.
• _fingerprint / _requiresLoginForPurchase — B2B detection and skip or login path.
• _hasEverPassed — first-run heuristics for suspected B2B (_suspectedB2B in metrics).
• _recordVideo — flow recording when enabled by the worker.

Checks that produce findings

These checks run inside this plugin during a single test run. They are not separate tests in the database — each becomes a Finding linked to the Run for checkout-flow.

B2B/login-gated shops without credentials skip the flow (no findings). Discovery-step failures stay WARNING on every run. Only cart/checkout steps downgrade to INFO on first run when the suspected-B2B heuristic fires.

Check	Typical severity	Why
B2B shop — no LOGIN_EMAIL/LOGIN_PASSWORD configured	(none — run skipped)	Returns skipped: true, findings: [], skipReason explains credential setup; not a pass/fail.
B2B login failed (bad credentials or missing form)	WARNING	Cannot validate checkout for wholesale/B2B sites without a working test login.
Failed discovery step (Visit product page or Add to cart)	WARNING	Heuristic selectors missed the PDP or buy button — always WARNING (first run and regression).
Failed cart/checkout step (Navigate to cart/checkout or Checkout page loaded) after prior pass (_hasEverPassed)	CRITICAL	Real regression on a previously working purchase path — direct revenue impact.
Failed cart/checkout step on first run when suspectedB2B is true	INFO	Cart/checkout steps only — discovery failures stay WARNING. Often indicates login-gated commerce.
Possible B2B/login-gated shop detected (_suspectedB2B metric)	INFO	Worker may auto-set requiresLoginForPurchase and dispatch ACTION_REQUIRED notification.
JavaScript errors during flow (pageerror handler)	WARNING	Client-side exceptions during checkout can break payment widgets and cart AJAX.

How each check works

1. B2B gate — If _requiresLoginForPurchase or fingerprint says B2B: with secrets → performLogin via DOM finder; without secrets → return skipped: true, empty findings, and skipReason (no flow steps).
2. Step 1 — Product page — Navigates productUrl or discovers via product links / JSON-LD Product URL.
3. Step 2 — Add to cart — Dismisses overlays, finds button via CSS + Norwegian/English/Swedish text patterns, resilientClick (up to 3 attempts), waits for cart network response or 4s, checks cart badge/mini-cart/redirect heuristics.
4. Step 3 — Cart — Skipped if add-to-cart failed. Verifies cart not empty (Norwegian/English empty-cart phrases, price/quantity/line-item heuristics). Falls back to /cart, /handlekurv, etc.
5. Step 4 — Checkout — Skipped if cart unverified. Finds checkout link or tries /checkout, /kasse, /sveacheckout; requires body text length >100.
6. Severity logic — Visit product page and Add to cart always WARNING on failure (first run and regression). Navigate to cart/checkout and Checkout page loaded: INFO on first run when suspectedB2B; CRITICAL after a prior pass. B2B login-gated button issues stay WARNING. Skipped flow steps do not emit findings.
7. Defaults and score — timeout 30s, stepTimeout 15s. Score = passedSteps/totalSteps × 100.

Caveats and concerns

• Does not complete purchase — Stops at checkout page load; payment gateway errors after that are untested.
• Heuristic fragility — Custom themes, AJAX carts, and one-page checkout may fail discovery while manual checkout works.
• First-run B2B false positives/negatives — Auto-flagging requiresLoginForPurchase from failed first run can misclassify slow sites or odd layouts.
• Optimistic add-to-cart — Proceeds even when no cart indicator is found (“optimistically”).
• Video/evidence — _recordVideo / auto-record on failure captures .webm for debugging.

Source

packages/test-plugins/src/plugins/checkout-flow.ts