# Self-Service Signup Testbook

End-to-end verification of the Nimsforest self-service sign-up flow.
The scope of this testbook ends at the `tap.hetzner.provision` event being dropped on Wind.
Provisioning (server creation, DNS, health) is covered by the hetznertreehouse testbook.

Test org: slug=`acme`, name=`Acme Corp`, email=`admin@acme.test`

Server: land-shared-one (178.104.70.180)

## Pre-flight

```bash
# Landing page
curl -s -o /dev/null -w "%{http_code}" https://nimsforest.com/
# Expected: 200

# Signup page
curl -s -o /dev/null -w "%{http_code}" https://nimsforest.com/signup
# Expected: 200

# Ecommerce healthy
ssh root@178.104.70.180 'curl -s http://127.0.0.1:8094/health'
# Expected: {"status":"ok",...}

# Stripe healthy
ssh root@178.104.70.180 'curl -s http://127.0.0.1:8097/api/v1/health'
# Expected: {"status":"ok","stripe_healthy":true}

# Wind connected + checkout listener
ssh root@178.104.70.180 'docker logs nimsforestecommerce 2>&1 | grep -E "Wind connected|tap.stripe.checkout"'
# Expected: Wind connected + listening for tap.stripe.checkout.session.completed

ssh root@178.104.70.180 'docker logs nimsforeststripe 2>&1 | grep "Wind connected"'
# Expected: Wind connected
```

## Sign-up → Stripe redirect

```bash
# Submit signup and capture redirect URL (monthly plan)
CHECKOUT_URL=$(curl -s -X POST https://nimsforest.com/signup \
  -d "org_name=Acme+Corp&slug=acme&email=admin@acme.test&plan=monthly" \
  -D - -o /dev/null 2>&1 | grep -i location | awk '{print $2}' | tr -d '\r')
echo "$CHECKOUT_URL"
# Expected: https://checkout.stripe.com/c/pay/cs_test_...

# Test consultancy plan redirect
CHECKOUT_URL_PRO=$(curl -s -X POST https://nimsforest.com/signup \
  -d "org_name=Acme+Corp&slug=acme&email=admin@acme.test&plan=monthly-consultancy" \
  -D - -o /dev/null 2>&1 | grep -i location | awk '{print $2}' | tr -d '\r')
echo "$CHECKOUT_URL_PRO"
# Expected: https://checkout.stripe.com/c/pay/cs_test_... (different session)
```

## Stripe Checkout verification (headless Chromium)

```bash
# Screenshot the Stripe Checkout page
chromium --headless=new --no-sandbox --disable-gpu \
  --screenshot=$HOME/stripe-checkout.png --window-size=1280,900 \
  "$CHECKOUT_URL" 2>/dev/null

# Verify: screenshot should show:
#   - "Subscribe to Nimsforest Monthly"
#   - "€99.00 per month"
#   - Email prefilled with "admin@acme.test"
#   - Card/Klarna payment options
#   - "Nimsforest BV sandbox" merchant name
```

## Plan limits

```bash
# Verify plans show on signup page with availability
ssh root@178.104.70.180 'curl -s http://127.0.0.1:8094/signup | grep -E "remaining|Sold out|€99|€999"'
# Expected: €99/month, €999/month, "X of 10 spots remaining" for consultancy plan
```

## Cancel flow

```bash
# Verify cancelled banner
curl -s "https://nimsforest.com/signup?cancelled=true" | grep "Payment was cancelled"
# Expected: "Payment was cancelled. You can try again when you're ready."
```

## Status page states

```bash
# Unknown slug shows "Awaiting Payment"
curl -s https://nimsforest.com/api/status/nonexistent | grep "Awaiting Payment"
# Expected: Awaiting Payment
```

## Webhook → Provisioning trigger (simulated)

Since Stripe Checkout requires browser interaction for payment, simulate the
webhook event via NATS to test the Wind → provisioning chain.

```bash
# Simulate checkout.session.completed event
ssh root@178.104.70.180 'nats pub tap.stripe.checkout.session.completed \
  '"'"'{"subject":"tap.stripe.checkout.session.completed","data":{"id":"evt_test","type":"checkout.session.completed","data":{"object":{"id":"cs_test","metadata":{"org_slug":"acme","org_name":"Acme Corp","admin_email":"admin@acme.test"}}}},"source":"nimsforeststripe","ts":"2026-01-01T00:00:00Z"}'"'"' \
  -s nats://127.0.0.1:4222'
# Expected: Published N bytes to "tap.stripe.checkout.session.completed"

# Verify ecommerce caught it and provisioned
ssh root@178.104.70.180 'docker logs nimsforestecommerce 2>&1 | grep acme | tail -3'
# Expected:
#   [Checkout] payment completed for acme, starting provisioning
#   [Checkout] dropped tap.hetzner.provision for acme

# Verify Pantheon org created
ssh root@178.104.70.180 'curl -s -H "Authorization: Bearer <pantheon_admin_key>" \
  http://127.0.0.1:8093/organizations/acme'
# Expected: {"slug":"acme","name":"Acme Corp",...}

# Verify Land Registry entry created
ssh root@178.104.70.180 'curl -s -H "Authorization: Bearer <landregistry_token>" \
  http://127.0.0.1:8096/api/v1/lands/acme'
# Expected: {"org_slug":"acme","status":"pending"|"provisioning",...}
```

## Teardown

```bash
ssh root@178.104.70.180 'nats pub tap.hetzner.teardown \
  '"'"'{"subject":"tap.hetzner.teardown","data":{"org_slug":"acme"},"source":"testbook","ts":"2026-01-01T00:00:00Z"}'"'"' \
  -s nats://127.0.0.1:4222'
```