# QA + Launch Checklist (Speed + Ecommerce)

## 1) Database

- Run `database/schema.sql` for fresh setup or `database/migrations/2026_05_04_ecommerce_upgrade.sql` for existing DB.
- Verify new `orders` columns exist: `payment_authority`, `gateway`, `tracking_code`, `shipping_amount`, `discount_amount`.
- Verify indexes were created for product search/order tracking fields.

## 2) Payment Configuration

- Set `PAYMENT_GATEWAY_MODE` in `app/config/config.php` (`sandbox` for test, `production` for live).
- Set `ZARINPAL_MERCHANT_ID`.
- Ensure callback path matches `ZARINPAL_CALLBACK_PATH` and is publicly reachable.

## 3) Regression Flow

- Home -> add product to cart.
- Cart -> update quantity/remove product.
- Checkout -> submit valid customer info.
- Confirm redirect to gateway URL.
- Callback success -> order `payment_status=paid`, cart cleared.
- Callback failure/cancel -> order `payment_status=failed`.

## 4) Admin Flow

- Admin login works.
- Product create works with CSRF token.
- Orders list shows authority/ref/tracking.
- Admin can update order status and tracking code.

## 5) Performance Validation

- Compare `X-Response-Time-Ms` header before/after for `public/home.php`, `public/products.php`, `public/search.php`.
- Verify CSS/JS query versioning is present (`?v=`).
- Verify slow requests are logged in `storage/logs/slow-requests.log`.

## 6) Security Validation

- Submit checkout/admin forms without CSRF token -> must fail.
- Verify checkout ignores any client-side total and recalculates on server.
- Verify callback cannot mark unrelated order paid (authority mapping check).
