Skip to content

fix(rest/nodejs): block completion when fulfillment methods array is empty - #155

Merged
damaz91 merged 1 commit into
Universal-Commerce-Protocol:mainfrom
XiaolongZhang-TT:fix/nodejs-empty-fulfillment-methods-block-completion
Jul 31, 2026
Merged

fix(rest/nodejs): block completion when fulfillment methods array is empty#155
damaz91 merged 1 commit into
Universal-Commerce-Protocol:mainfrom
XiaolongZhang-TT:fix/nodejs-empty-fulfillment-methods-block-completion

Conversation

@XiaolongZhang-TT

Copy link
Copy Markdown
Contributor

Description

The Node.js completion gate used checkout.fulfillment?.methods?.every(...), which is vacuously true when methods is an empty array. A checkout created with fulfillment: { methods: [] } therefore passed the "fulfillment selected" check and could be completed (order placed) with no fulfillment at all — while a checkout with no fulfillment field is correctly rejected.

Repro: POST /checkout-sessions with fulfillment: { methods: [] } returns 201, then POST /checkout-sessions/{id}/complete currently returns 200 (order placed, no fulfillment).

Root causerest/nodejs/src/api/checkout.ts, completeCheckout:

const hasFulfillment = checkout.fulfillment?.methods?.every(
  (method) =>
    method.selected_destination_id &&
    method.groups?.every((group) => group.selected_option_id)
);

[].every(fn) evaluates to true, so an empty methods array satisfies the gate.

Fix: require the methods array to be non-empty before applying .every(...) (Array.isArray(methods) && methods.length > 0 && methods.every(...)). This matches the Python sample, whose complete_checkout blocks completion when methods is empty.

Category (Required)

  • Samples / Conformance: Maintaining samples and the conformance suite. (Requires Maintainer approval)

Related Issues

None — newly identified bug in the Node.js sample server.

Checklist

  • I have followed the Contributing Guide (Conventional Commits title requirements and ! for breaking changes).
  • I have updated the documentation (if applicable). — N/A, no documentation changes.
  • My changes pass all local linting and formatting checks. (tsc --noEmit clean; prettier clean.)
  • I have added tests that prove my fix is effective or that my feature works. (empty fulfillment methods array blocks completion.)
  • New and existing unit tests pass locally with my changes. (Node.js suite: 29 passed.)
  • (For Core/Capability) I have included/updated the relevant JSON schemas. — N/A, no schema changes.
  • I have regenerated Python Pydantic models by running generate_models.sh under python_sdk. — N/A, no schema changes.

Screenshots / Logs (if applicable)

Before/after — completing a checkout created with fulfillment: { methods: [] }:

Before (bug):

POST /checkout-sessions/{id}/complete -> 200   # order placed, no fulfillment

After (fix):

POST /checkout-sessions/{id}/complete -> 400   # "Fulfillment address and option must be selected"

Full Node.js suite:

# tests 29
# pass 29
# fail 0

…empty

The completion gate used `checkout.fulfillment?.methods?.every(...)`, which
is vacuously true when `methods` is an empty array. A checkout created with
`fulfillment: { methods: [] }` therefore passed the "fulfillment selected"
check and could be completed (order placed) with no fulfillment at all,
while a checkout with no fulfillment field was correctly rejected.

Require the methods array to be non-empty before applying `.every(...)`,
matching the Python sample, which blocks completion when methods is empty.

Adds a regression test that creates a checkout with
`fulfillment: { methods: [] }` and asserts the complete call is rejected
with 400.
@damaz91 damaz91 added status:needs-triage Signal that the PR is ready for human triage status:under-review and removed status:needs-triage Signal that the PR is ready for human triage labels Jul 31, 2026
@damaz91
damaz91 merged commit 2e5b77c into Universal-Commerce-Protocol:main Jul 31, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants