Practitionist / Practitionist/elluminar_web
🔴 Free ₹0 courses unenrollable + coupon tenant-scope leak
Open
Nobody has claimed this yet.
payments
- Dominant language
- TypeScript
- Stars
- 1
- Forks
- 0
- Avg merge
- 17h 2m
- Merged PRs (30d)
- 18
Description
Audit findings P0-4 + P1-7.
- Pricing allows ₹0 ("₹0 allowed", course.ts:387) but checkout throws "Total must be greater than zero" (checkout.ts:41) → FREE courses cannot be enrolled.
- $0 path: skip Razorpay, call fulfillPaidOrder({provider:"FREE", ref:
free:${orderId}}), keep idempotency
- $0 path: skip Razorpay, call fulfillPaidOrder({provider:"FREE", ref:
- Coupons unusable by learners: no cart/checkout input (checkout-button.tsx:94 executes
{}); and resolveCartPricing ignores appliesTo.tenantIds (commerce/pricing.ts:172-183) → cross-tenant coupon discounting = money-math defect.- Coupon input + preview action in cart/checkout
- Tenant filter in pricing resolution + regression tests
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with course.ts:387 and checkout.ts:41 to trace the ₹0 enrollment path, then inspect checkout-button.tsx:94 and commerce/pricing.ts:172-183 for coupon input and tenant filtering. Run the existing checkout and pricing tests, adding regression coverage where appropriate; done means free courses enroll without Razorpay and coupons apply only to permitted tenants.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- backend, frontend, payments
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100