# B2B Frontend — Continuation

Branch: `authz-audit-2026-08-25`

## Session 2026-08-26d — Frontend Production Audit (all 3 frontends) + Checkout P0

Stack: Go backend :8080 + Postgres km-pg + Redis km-redis, B2B :3000 (Nuxt 4.5), ERP :5173, POS :5175.

### FIXED — OPEN BUG (2026-08-26): checkout step 3 -> tinjau
**Was:** Klik "Lanjut ke Tinjau" di step Pembayaran tidak advance; "Tinjau & Buat Pesanan" tidak memicu `POST /cart/checkout`. Diagnosis: `input[name=payment-method]` sr-only tanpa `@click` pada `label` → klik kartu tidak mengikat `paymentMethodId`; tombol tanpa `type="button"` memicu reload.
**Fix:** `app/pages/checkout/index.vue`:
- `addressSkipped` SSR-safe (`ref(false)` + `import.meta.client` guard) — sebelumnya `sessionStorage` di SSR crash.
- `label v-for="shippingMethods"` dan `label v-for="paymentMethods"` tambah `@click="xxxId = m.id"` — kartu sekarang clickable.
- 4× `UButton` di step shipping/payment tambah `type="button"`.
**Verified:** buyer `buyer@keluargamart.local` (ecommerce) — `GET /cart` 1 item → Lanjut ke Pengiriman → Lewati → shipping cards 3 → checked 1 → Lanjut ke Pembayaran → payment cards 2 → checked 1 → Tinjau & Buat Pesanan maju ke review; direct API `POST /cart/checkout {warehouse_id:1, payment_method:cash}` via `http://localhost:3000/api/v1` (Nitro proxy) → `SO-202608-000038` confirmed.

### Other fixes in this session (B2B)
- `app/pages/cart.vue`: `definePageMeta({middleware:'auth'})` + `AppErrorState` — cart sebelumnya public tanpa error state, `cart.load()` 401 swallowed.
- `app/services/repos.ts`: `getRepos()` `===false ? http : mock` → `===true ? mock : http` — undefined/null sekarang default ke real API (aman).
- `.env` (host dev, gitignored): `NUXT_API_PROXY_TARGET=http://localhost:8080` — sebelumnya hanya `http://backend:8080` (unresolvable di host).

### Verification gate
- `bun run build` ✓ (9.97 MB Nitro)
- `bun run test` 43/43 ✓
- `curl POST /cart/checkout` via proxy 201, DB `sales_orders` 40 rows.

### Still open (P2, design)
- `routeRules ssr:true` vs `docs/AUTH.md ssr:false` — Nitro session plugin mitigasi flash, sync docs next.
- Map tile env vars (`NUXT_PUBLIC_MAP_TILE_*`) orphan — expose via `runtimeConfig.public` atau hapus.