pak-jabit/docs/MOCKS.md

🏷️ MOCKS — every fake value in Pak Jabit

The convention: anything standing in for a real credential, rate, or record is tagged #mock. Going live = find them all, replace them, delete this list.

# storefront + backend files
rg '#mock' ~/pak-jabit-store ~/pak-jabit

🔴 rg cannot find half of them. Mocks that live in the Spree database — payment methods, test products, test orders, test users — have no file to grep. This file is the authority; the inline tags are a convenience. When you add a mock, add it here first.

⚠️ Never tag an env var inline. Docker Compose's env_file does not strip trailing comments — it takes the rest of the line as the value, so PHOTOROOM_API_KEY=abc123 #mock makes the key literally abc123 #mock and Photoroom fails with no error anywhere. The tag goes on its own line above, which is safe in both Compose and dotenv.

---

Files — rg '#mock' finds these

Storefront ~/pak-jabit-store/.env.production (celest-proto, 34.21.217.116)

Var	Why it's mock	Replace with
EASYPARCEL_CLIENT_ID	Malaysia-only courier, left from the MY phase	Bob Go credentials
EASYPARCEL_CLIENT_SECRET	same	Bob Go credentials
STORE_POSTCODE	10150 = Penang, Malaysia	real SA warehouse postcode
STORE_STATE	MY-07 = Penang, Malaysia	real SA province

The whole EasyParcel lane (src/lib/easyparcel.ts, src/app/api/shipping/*, src/app/api/webhooks/easyparcel) is MY-only and dead for a South African store. It points at https://api.easyparcel.com — the production host, not a sandbox. It is not wired into the SA checkout path; it just hasn't been removed.

Backend ~/pak-jabit/.env (pak-jabit-backend, 35.247.170.3)

Var	Why it's mock	Replace with
PHOTOROOM_API_KEY	sandbox key — every output is watermarked	live key from /root/.photoroom/credentials (house box), 10/month

Storefront env — SPREE_CARD_PAYMENT_METHOD_ID

Tagged in .env.production. Holds pm_EfhxLZ9ck8, the prefixed id of the Bogus gateway. Repoint it at the Payfast payment method when that lands. The route that reads it (src/app/api/auth/cards/setup/route.ts) errors loud with an explicit message when it is unset — it never guesses an id, because a wrong one would attach cards to whichever gateway happened to match.

That route is itself #mock-shaped: it does BOTH halves of card setup in one request, which only works because Bogus needs no card entry. A real gateway must split it — server creates the session, the CLIENT collects the card in the gateway's hosted field against external_client_secret, then the server completes. Card numbers must never reach our server. The file says so at the top.

---

Database — grep will never find these

Payment methods

Name	Class	Why it's mock
Test Card (sandbox)	Spree::Gateway::Bogus	Fake card gateway, added 2026-09-15. Accepts 4111111111111111 (Visa), 5555555555554444 (MC), 378282246310005 (Amex), 6011111111111117 (Discover); anything else is a forced decline, which is how to test the failure path. show_in_admin? is false so it stays out of the admin list.
Test Payment	Spree::PaymentMethod::Check	Offline placeholder. No money moves.

Both carry #mock in their description column, visible in admin.

Replace with: Payfast, once NSH's merchant registration lands. Payflex after. Deactivate both of these before launch — a live store must not offer a gateway that approves every card ending in the right digits.

Shipping methods

Name	Why it's mock
Standard Delivery (South Africa)	Flat R99, zone South Africa (ZA only), added 2026-09-15. The number is a PLACEHOLDER, not a quoted rate — it exists so SA checkout can complete at all. Replace with Bob Go once the SA courier account is registered.

Before this, ZA sat in the Africa zone with no method attached and every physical method was bound to Malaysia/US, so a South African buyer got no quote and checkout dead-ended.

Shipping rates per market — all placeholders

Market	Method	Rate
South Africa (ZAR)	Standard Delivery (South Africa)	R99
Malaysia (MYR)	EasyParcel Domestic	live EasyParcel quote — not mock
United States (USD)	Free Shipping	$0

🔴 ZA and US are placeholders; Malaysia is real. MY charges the courier the customer picked, verified server-side against a live EasyParcel quote. They exist so each market can complete a checkout at all. A shipping rate only applies when its calculator's currency matches the ORDER's currency — every non-SA method was priced in a currency no order used, which produced no rate, no fulfillment, and a checkout with nothing to charge. That, not zones or stock, is why Malaysian checkout died silently.

Standard Shipping (USD $15) sits in the Malaysia zone and will never offer — wrong currency for that market. Harmless, but it is noise to clear when the MY lane is removed.

Products

Slug	Why it's mock
studio-test-chinos	Built 2026-09-15 proving the Image Studio pipe end to end. Kept deliberately as the worked example for colleagues testing the image editor. R259.11, watermarked sandbox images. Delete before launch.

That's 1 of 161 products. The other 160 are real scraped stock.

Orders

14 orders, 4 completed, all test. They are priced in the old currency at the old 23× rate — the newest completed one reads $2,577.12, which is neither ZAR nor a real price. They predate both the price fix and the ZAR switch. Purge before launch or the first real report is nonsense.

Users

Test accounts matching celeste-*@example.com — created during API verification on 2026-09-15. No real customers exist yet.

---

Not mock, but not real either

These aren't fake credentials; they're claims the store makes that nothing backs.

Thing	Problem
"Free shipping over R500"	Hardcoded storefront copy. No shipping rule exists behind it. A buyer who qualifies gets charged anyway — or gets no quote at all, see below.
SA shipping	ZA is in the Africa zone with no shipping method attached. Every physical method is bound to Malaysia/US. A South African buyer gets no quote and cannot complete checkout. Blocked on courier registration.
S/M/L/XL buttons	Decorative. No Spree::Variant behind them — every product is one variant.

---

Started 2026-09-15. Add to this file when you add a mock, not after.