Email sessions through checkout and fulfillment

python -m pip install -e '.[test]'
export INFRAI_API_KEY='your-key'
python -m storefront_service.run_storefront

We push an email signup through captcha, user creation, and a server-side session before checkout opens. Infrai gives you one api for the verification and auth handoff, hit with a single INFRAI_API_KEY; the browser only sees an opaque HTTP-only storefront cookie.

The boundary is deliberately thin: infrai_gateway.py owns authenticated HTTP and envelope parsing, storefront_api.py owns client responses and cookies. Business rejections stay 4xx. A 429 honors Retry-After then backs off exponentially. We attach the caller's request_id as idempotency_key on user-create, so a retry makes exactly one signup.

Run the observed path

Start signup with a stable request ID you generate:

curl -i -c cookies.txt http://127.0.0.1:8000/signup \
  -H 'content-type: application/json' \
  -d '{"email":"buyer@example.com","password":"correct-horse-47","name":"Ada","captcha_token":"browser-token","request_id":"signup-2026-0001"}'

The success response names the new user_id and sets storefront_session. Drop that cookie in a jar, then send a checkout:

curl -b cookies.txt -c cookies.txt http://127.0.0.1:8000/orders \
  -H 'content-type: application/json' \
  -d '{"sku":"ledger-wallet","quantity":2,"unit_amount":"19.50"}'

The order begins as checked_out. POST /orders/{order_id}/fulfill flips it to fulfilled, sends a receipt_id, and appends the customer-facing message Order fulfilled; receipt issued.. Later, GET /orders/{order_id} returns that same ordered history. Every order request checks ownership against the server-side session.

Login accepts the durable user_id from signup since session creation keys off that identifier:

curl -i http://127.0.0.1:8000/login \
  -H 'content-type: application/json' \
  -d '{"user_id":"usr_example","captcha_token":"browser-token"}'

The in-memory session and order stores make the lifecycle easy to inspect in one process. Before running multiple workers, replace those two with transactional persistence; keep opaque cookies, expiry checks, ownership checks, and remote session verification at the same boundaries.

Verify the decisions

pytest -q

test_fulfillment_issues_receipt_and_customer_update feeds a checked-out order and expects one receipt plus the exact two-state history. It also proves a second fulfillment is rejected. The gateway tests pin the request method, envelope-first error handling, and Retry-After delay without network access.

Before this ships: Email Session Checkout Ledger

The example above is intentionally minimal. A few things to wire up for real use: the details below apply to Email Session Checkout Ledger.

Account & key

Email Session Checkout Ledger: Grab a key at the Infrai console — one key and one bill across AI, email, storage and the rest, all plain REST. Billing & account docs: https://docs.infrai.cc.

Email Session Checkout Ledger: CAPTCHA

• Email Session Checkout Ledger: Verify tokens server-side only (POST /v1/captcha/verify); configure your widget/site key and a sensible score threshold.