rune-ext-ecommerce

Derive the idempotency key from the cart, such as checkout-{cartId}-v{version}, rather than a timestamp, and check for an existing succeeded intent before creating a new one. Always calculate the amount server-side from the verified cart.

Use express.raw({ type: 'application/json' }) on the webhook route so req.body is the raw Buffer, then call stripe.webhooks.constructEvent with that raw body. Store each event.id in the database and skip already-processed events to keep handling idempotent.

Use optimistic locking with a version field on the variant row, retrying the decrement a few times on conflict, and create time-limited reservations at checkout. Run an expiry job every few minutes to release stock from abandoned checkouts.

Yes, it includes integration patterns for SePay QR bank transfers with HMAC-verified webhooks, VNPay redirect payments with HMAC-SHA512 signed parameters, and MoMo or ZaloPay e-wallets, alongside Stripe and PayPal.

This happens when guest and authenticated carts are stored separately with no merge step. Implement a cart merge in the auth callback that posts the guest cart ID to a server endpoint and treats the merged server cart as the source of truth.

Define a typed state machine such as pending to confirmed to processing to shipped to delivered, with cancelled and refunded as terminal states. Reject invalid transitions and attach side effects like stock release on cancellation and inventory return on refund.