[BUG-PB-001][FR-08][POST /api/checkout] JSON array body creates an order with null total and address

[AkiraTomori]

Summary

The Checkout endpoint accepts a JSON array body and creates a persistent order whose total and shipping address are null.

• Severity: Medium
• Environment: Local Docker eshop-sut-backend-1
• HW06 Pool: Pool B / FR-08
• Test case: FR08-DOM-007

Preconditions

A disposable authenticated user has a valid token and a non-empty fixture cart. The collection-level script supplies X-Student-Id.

Steps to reproduce

1. Send POST /api/checkout with valid bearer authorization, Content-Type: application/json, and raw body [].
2. Record the response.
3. Inspect only the disposable user's order row through the restricted SQLite snapshot.

Expected result

Reject the non-object JSON envelope with a 4xx response and create no order. Exact status/schema is unspecified.

Actual result

The endpoint returned HTTP 200 with a Checkout-success response. The after-state contained a created order with orderTotal: null and shippingAddress: null.

Impact

Authenticated clients can create malformed persistent financial records.

Evidence

• 23127379_Homework/HW6/Pool-B_FR08_Checkout/postman/newman/Pool-B_FR08_full_report.json
• 23127379_Homework/HW6/Pool-B_FR08_Checkout/postman/newman/Pool-B_FR08_full_report.html
• 23127379_Homework/HW6/Pool-B_FR08_Checkout/evidence/Pool-B_FR08_full_db-after.json
• Screenshot generated from the FR08-DOM-007 failure with MSSV 23127379.

Requirement source: API specification §4.3 and the confirmed object-envelope oracle
Suggested labels: bug, validation, data-integrity, FR-08, api

[AkiraTomori]

HW06 screenshot evidence — MSSV 23127379

Repository source: BUG-PB-001_23127379.png

The screenshot summarizes the redacted Newman/fixture evidence recorded in the HW06 Pool artifacts; it does not expose OTPs, passwords, tokens, or personal email addresses.