fix(sca): fix stuff the review commented on

* fix(products): update pricing on products

* fix(test): pin coffee price in cart-limit fixture

TestConvertCartLimit's quantities and expected totals were keyed to
the original 500-cent latte price. After the product price bump in
1ce63fb, coffee_id=4 became 2500 cents, so under_cap/at_cap subtests
overshot the $200 cap and over_cap's expected total magnitude was
wrong by 5x. Override coffee_id=4's price to 500 in test setup so the
cap math stays stable regardless of seed changes.

api/handlers/addresses.go

@@ -42,7 +42,7 @@ func (h *AddressHandler) GetAddresses(w http.ResponseWriter, r *http.Request) {
 	var addresses []models.Address
 	db.Where("user_id = ?", userID).Order("is_default DESC, created_at DESC").Find(&addresses)
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"addresses": addresses,
 	})
 }
@@ -154,7 +154,7 @@ func (h *AddressHandler) CreateAddress(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	utils.RespondSuccess(w, http.StatusCreated, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusCreated, map[string]any{
 		"address": address,
 	})
 }
@@ -183,7 +183,7 @@ func (h *AddressHandler) DeleteAddress(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"message": "address successfully deleted",
 	})
 }
@@ -218,7 +218,7 @@ func (h *AddressHandler) SetDefaultAddress(w http.ResponseWriter, r *http.Reques
 		return
 	}
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"address": address,
 	})
 }

api/handlers/addresses_test.go

@@ -58,7 +58,7 @@ func TestGetAddressesEmpty(t *testing.T) {
 	var resp struct {
 		Success bool `json:"success"`
 		Data    struct {
-			Addresses []interface{} `json:"addresses"`
+			Addresses []any `json:"addresses"`
 		} `json:"data"`
 	}
 	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {

api/handlers/auth.go

@@ -108,7 +108,7 @@ func (h *AuthHandler) GetToken(w http.ResponseWriter, r *http.Request) {
 	}
 
 	middleware.RecordAuthAttempt("success")
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"access_token": token,
 		"token_type":   "Bearer",
 		"expires_in":   1800, // 30 minutes in seconds
@@ -146,7 +146,7 @@ func (h *AuthHandler) RegisterWithSSHKey(w http.ResponseWriter, r *http.Request)
 	}
 
 	if len(errors) > 0 {
-		utils.RespondError(w, http.StatusBadRequest, "VALIDATION_ERROR", "validation failed", map[string]interface{}{
+		utils.RespondError(w, http.StatusBadRequest, "VALIDATION_ERROR", "validation failed", map[string]any{
 			"errors": errors,
 		})
 		return
@@ -173,7 +173,7 @@ func (h *AuthHandler) RegisterWithSSHKey(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	utils.RespondSuccess(w, http.StatusCreated, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusCreated, map[string]any{
 		"user": user.ToPublic(),
 	})
 }
@@ -195,7 +195,7 @@ func (h *AuthHandler) GetUserBySSHKey(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"user": user.ToPublic(),
 	})
 }

api/handlers/cards.go

@@ -89,12 +89,12 @@ func (h *CardHandler) GetCards(w http.ResponseWriter, r *http.Request) {
 		userID, time.Now(),
 	).Order("is_default DESC, created_at DESC").Find(&cards)
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"cards": cards,
 	})
 }
 
-// func utils.RespondError(w http.ResponseWriter, statusCode int, code string, message string, details map[string]interface{})
+// func utils.RespondError(w http.ResponseWriter, statusCode int, code string, message string, details map[string]any)
 
 // GetCard returns a single saved card by ID.
 func (h *CardHandler) GetCard(w http.ResponseWriter, r *http.Request) {
@@ -114,7 +114,7 @@ func (h *CardHandler) GetCard(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"card": card,
 	})
 }
@@ -156,7 +156,7 @@ func (h *CardHandler) SetDefaultCard(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"card": card,
 	})
 }
@@ -197,7 +197,7 @@ func (h *CardHandler) CollectCard(w http.ResponseWriter, r *http.Request) {
 		utils.RespondError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "failed to generate redirect token", nil)
 		return
 	}
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"url": fmt.Sprintf("%s/pay/%s", h.appURL, token),
 	})
 }
@@ -302,7 +302,7 @@ func (h *CardHandler) SaveCard(w http.ResponseWriter, r *http.Request) {
 
 	audit.CardAdded(userID, card.ID, card.Brand, card.Last4)
 
-	utils.RespondSuccess(w, http.StatusCreated, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusCreated, map[string]any{
 		"card": card,
 	})
 }
@@ -347,7 +347,7 @@ func (h *CardHandler) DeleteCard(w http.ResponseWriter, r *http.Request) {
 
 	audit.CardDeleted(userID, card.ID)
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"message": "card deleted",
 	})
 }

api/handlers/cart.go

@@ -55,18 +55,18 @@ func getOrCreateCart(ctx context.Context, userID uint) (*models.Cart, error) {
 	return &cart, nil
 }
 
-func cartResponse(ctx context.Context, cart *models.Cart) map[string]interface{} {
+func cartResponse(ctx context.Context, cart *models.Cart) map[string]any {
 	db := database.GetDB().WithContext(ctx)
 
 	var items []models.CartItem
 	db.Where("cart_id = ? AND quantity > 0", cart.ID).Preload("Coffee").Find(&items)
 
 	subtotal := 0
-	itemsData := make([]map[string]interface{}, 0, len(items))
+	itemsData := make([]map[string]any, 0, len(items))
 	for _, item := range items {
 		lineTotal := item.Coffee.Price * item.Quantity
 		subtotal += lineTotal
-		itemsData = append(itemsData, map[string]interface{}{
+		itemsData = append(itemsData, map[string]any{
 			"id":        item.ID,
 			"coffee_id": item.CoffeeID,
 			"quantity":  item.Quantity,
@@ -75,7 +75,7 @@ func cartResponse(ctx context.Context, cart *models.Cart) map[string]interface{}
 		})
 	}
 
-	return map[string]interface{}{
+	return map[string]any{
 		"items":            itemsData,
 		"subtotal":         subtotal,
 		"address_id":       cart.AddressID,
@@ -94,7 +94,7 @@ func (h *CartHandler) GetCart(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"cart": cartResponse(r.Context(), cart),
 	})
 }
@@ -157,7 +157,7 @@ func (h *CartHandler) SetItem(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"cart": cartResponse(r.Context(), cart),
 	})
 }
@@ -193,7 +193,7 @@ func (h *CartHandler) SetAddress(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"message": "address set",
 	})
 }
@@ -238,7 +238,7 @@ func (h *CartHandler) SetCard(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"message": "card set",
 	})
 }
@@ -258,7 +258,7 @@ func (h *CartHandler) ClearCart(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"message": "cart cleared",
 	})
 }
@@ -386,7 +386,7 @@ func (h *CartHandler) ConvertCart(w http.ResponseWriter, r *http.Request) {
 		middleware.RecordCartConversion("validation_over_limit")
 		utils.RespondError(w, http.StatusBadRequest, "CART_OVER_LIMIT",
 			fmt.Sprintf("order total must be at most $%.2f", float64(h.maxOrderCents)/100),
-			map[string]interface{}{
+			map[string]any{
 				"total_cents": total,
 				"limit_cents": h.maxOrderCents,
 			})
@@ -507,7 +507,7 @@ func (h *CartHandler) ConvertCart(w http.ResponseWriter, r *http.Request) {
 		if err := tx.Where("cart_id = ?", cart.ID).Delete(&models.CartItem{}).Error; err != nil {
 			return err
 		}
-		return tx.Model(cart).Updates(map[string]interface{}{
+		return tx.Model(cart).Updates(map[string]any{
 			"address_id": nil,
 			"card_id":    nil,
 		}).Error
@@ -534,14 +534,15 @@ func (h *CartHandler) ConvertCart(w http.ResponseWriter, r *http.Request) {
 	}
 	go notify.SlackOrderPaid(&order)
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"order": order,
 	})
 }
 
-// respondRequiresAction handles a PaymentIntent that needs 3DS auth
-// The order stays pending. the webhook flips it to paid once the customer
-// completes the bank-hosted challenge, the tui polls /api/v1/orders/{id}/status
+// respondRequiresAction handles a PaymentIntent that needs 3DS auth. The order
+// transitions to requires_action (see caveat #20 in sca-psd2-compliance.md);
+// the payment_intent.succeeded webhook flips it to paid once the customer
+// completes the bank-hosted challenge. The TUI polls /api/v1/orders/{id}/status.
 func (h *CartHandler) respondRequiresAction(w http.ResponseWriter, order *models.Order, paymentMethodID string, pi *stripe.PaymentIntent) {
 	db := database.GetDB()
 
@@ -568,13 +569,15 @@ func (h *CartHandler) respondRequiresAction(w http.ResponseWriter, order *models
 		return
 	}
 
-	// Persist the paymentIntent id AND reset status to pending. The
-	// payment_intent.payment_failed webhook from the initial off-session decline
-	// often arrives before this response and flips the order to failed —
-	// override it back so the 3DS-in-flight order shows the correct state.
+	// Persist the paymentIntent id AND set status to requires_action so list
+	// UIs can distinguish "charging" from "awaiting customer 3DS". The
+	// payment_intent.payment_failed webhook from the initial off-session
+	// decline often arrives before this response and flips the order to
+	// failed - override it back so the 3DS-in-flight order shows the
+	// correct state
 	if err := db.Model(order).Updates(map[string]any{
 		"stripe_payment_id": pi.ID,
-		"status":            models.OrderStatusPending,
+		"status":            models.OrderStatusRequiresAction,
 	}).Error; err != nil {
 		utils.RespondError(w, http.StatusInternalServerError, "DATABASE_ERROR", "failed to save payment id", nil)
 		return
@@ -658,10 +661,14 @@ func (h *CartHandler) RetryAuth(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Only pending (initial attempt mid-flight) and failed (webhook flipped it
-	// after a non-recoverable error) are retryable. paid, refundedn shipped,
-	// delivered, cancelled are terminal - refuse
-	if order.Status != models.OrderStatusPending && order.Status != models.OrderStatusFailed {
+	// Retryable source states:
+	//	pending 		- initial attempt mid-flight (pre-PI confirm page)
+	//	requires_action - customer abandoned or failed the 3DS challenge
+	//	failed 			- webhook flipped after a non-recoverable error
+	// terminal states (paid, shipped, delivered, cancelled, refunded) refuse.
+	if order.Status != models.OrderStatusPending &&
+		order.Status != models.OrderStatusRequiresAction &&
+		order.Status != models.OrderStatusFailed {
 		utils.RespondError(w, http.StatusConflict, "INVALID_STATE", "order is already finalized", nil)
 		return
 	}

api/handlers/cart_test.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5"
+	"github.com/stripe/stripe-go/v78"
 
 	"terminalShop/api/middleware"
 	"terminalShop/pkg/audit"
@@ -83,8 +84,8 @@ func TestGetCartEmpty(t *testing.T) {
 		Success bool `json:"success"`
 		Data    struct {
 			Cart struct {
-				Items    []interface{} `json:"items"`
-				Subtotal int           `json:"subtotal"`
+				Items    []any `json:"items"`
+				Subtotal int   `json:"subtotal"`
 			} `json:"cart"`
 		} `json:"data"`
 	}
@@ -110,7 +111,7 @@ func TestSetItemAndGetCart(t *testing.T) {
 	handler := NewCartHandler("", "", 0)
 
 	// Add item (CoffeeID=1, Quantity=2)
-	body, _ := json.Marshal(map[string]interface{}{
+	body, _ := json.Marshal(map[string]any{
 		"coffee_id": 1,
 		"quantity":  2,
 	})
@@ -166,13 +167,13 @@ func TestSetItemUpdateQuantity(t *testing.T) {
 	handler := NewCartHandler("", "", 0)
 
 	// Add item
-	body, _ := json.Marshal(map[string]interface{}{"coffee_id": 1, "quantity": 2})
+	body, _ := json.Marshal(map[string]any{"coffee_id": 1, "quantity": 2})
 	req := authRequest("PUT", "/api/v1/cart/item", body, user.ID)
 	w := httptest.NewRecorder()
 	handler.SetItem(w, req)
 
 	// Update quantity
-	body, _ = json.Marshal(map[string]interface{}{"coffee_id": 1, "quantity": 5})
+	body, _ = json.Marshal(map[string]any{"coffee_id": 1, "quantity": 5})
 	req = authRequest("PUT", "/api/v1/cart/item", body, user.ID)
 	w = httptest.NewRecorder()
 	handler.SetItem(w, req)
@@ -211,13 +212,13 @@ func TestSetItemRemove(t *testing.T) {
 	handler := NewCartHandler("", "", 0)
 
 	// Add item
-	body, _ := json.Marshal(map[string]interface{}{"coffee_id": 1, "quantity": 3})
+	body, _ := json.Marshal(map[string]any{"coffee_id": 1, "quantity": 3})
 	req := authRequest("PUT", "/api/v1/cart/item", body, user.ID)
 	w := httptest.NewRecorder()
 	handler.SetItem(w, req)
 
 	// Remove item (quantity 0)
-	body, _ = json.Marshal(map[string]interface{}{"coffee_id": 1, "quantity": 0})
+	body, _ = json.Marshal(map[string]any{"coffee_id": 1, "quantity": 0})
 	req = authRequest("PUT", "/api/v1/cart/item", body, user.ID)
 	w = httptest.NewRecorder()
 	handler.SetItem(w, req)
@@ -231,7 +232,7 @@ func TestSetItemRemove(t *testing.T) {
 		Success bool `json:"success"`
 		Data    struct {
 			Cart struct {
-				Items []interface{} `json:"items"`
+				Items []any `json:"items"`
 			} `json:"cart"`
 		} `json:"data"`
 	}
@@ -249,7 +250,7 @@ func TestSetItemInvalidProduct(t *testing.T) {
 
 	handler := NewCartHandler("", "", 0)
 
-	body, _ := json.Marshal(map[string]interface{}{"coffee_id": 999, "quantity": 1})
+	body, _ := json.Marshal(map[string]any{"coffee_id": 999, "quantity": 1})
 	req := authRequest("PUT", "/api/v1/cart/item", body, user.ID)
 	w := httptest.NewRecorder()
 	handler.SetItem(w, req)
@@ -266,7 +267,7 @@ func TestSetItemMissingCoffeeID(t *testing.T) {
 
 	handler := NewCartHandler("", "", 0)
 
-	body, _ := json.Marshal(map[string]interface{}{"quantity": 1})
+	body, _ := json.Marshal(map[string]any{"quantity": 1})
 	req := authRequest("PUT", "/api/v1/cart/item", body, user.ID)
 	w := httptest.NewRecorder()
 	handler.SetItem(w, req)
@@ -285,7 +286,7 @@ func TestClearCart(t *testing.T) {
 
 	// Add two items
 	for _, coffeeID := range []uint{1, 2} {
-		body, _ := json.Marshal(map[string]interface{}{"coffee_id": coffeeID, "quantity": 1})
+		body, _ := json.Marshal(map[string]any{"coffee_id": coffeeID, "quantity": 1})
 		req := authRequest("PUT", "/api/v1/cart/item", body, user.ID)
 		w := httptest.NewRecorder()
 		handler.SetItem(w, req)
@@ -309,7 +310,7 @@ func TestClearCart(t *testing.T) {
 		Success bool `json:"success"`
 		Data    struct {
 			Cart struct {
-				Items []interface{} `json:"items"`
+				Items []any `json:"items"`
 			} `json:"cart"`
 		} `json:"data"`
 	}
@@ -339,7 +340,7 @@ func TestSetAddress(t *testing.T) {
 
 	handler := NewCartHandler("", "", 0)
 
-	body, _ := json.Marshal(map[string]interface{}{"address_id": addr.ID})
+	body, _ := json.Marshal(map[string]any{"address_id": addr.ID})
 	req := authRequest("PUT", "/api/v1/cart/address", body, user.ID)
 	w := httptest.NewRecorder()
 	handler.SetAddress(w, req)
@@ -393,7 +394,7 @@ func TestSetAddressWrongUser(t *testing.T) {
 
 	handler := NewCartHandler("", "", 0)
 
-	body, _ := json.Marshal(map[string]interface{}{"address_id": addr.ID})
+	body, _ := json.Marshal(map[string]any{"address_id": addr.ID})
 	req := authRequest("PUT", "/api/v1/cart/address", body, user.ID)
 	w := httptest.NewRecorder()
 	handler.SetAddress(w, req)
@@ -421,7 +422,7 @@ func TestSetCard(t *testing.T) {
 
 	handler := NewCartHandler("", "", 0)
 
-	body, _ := json.Marshal(map[string]interface{}{"card_id": card.ID})
+	body, _ := json.Marshal(map[string]any{"card_id": card.ID})
 	req := authRequest("PUT", "/api/v1/cart/card", body, user.ID)
 	w := httptest.NewRecorder()
 	handler.SetCard(w, req)
@@ -473,7 +474,7 @@ func TestSetCardWrongUser(t *testing.T) {
 
 	handler := NewCartHandler("", "", 0)
 
-	body, _ := json.Marshal(map[string]interface{}{"card_id": card.ID})
+	body, _ := json.Marshal(map[string]any{"card_id": card.ID})
 	req := authRequest("PUT", "/api/v1/cart/card", body, user.ID)
 	w := httptest.NewRecorder()
 	handler.SetCard(w, req)
@@ -491,7 +492,7 @@ func TestConvertCartMissingAddress(t *testing.T) {
 	handler := NewCartHandler("", "", 0)
 
 	// Add item but no address or card
-	body, _ := json.Marshal(map[string]interface{}{"coffee_id": 1, "quantity": 1})
+	body, _ := json.Marshal(map[string]any{"coffee_id": 1, "quantity": 1})
 	req := authRequest("PUT", "/api/v1/cart/item", body, user.ID)
 	w := httptest.NewRecorder()
 	handler.SetItem(w, req)
@@ -515,14 +516,14 @@ func TestConvertCartMissingCard(t *testing.T) {
 	db := database.GetDB()
 
 	// Add item and address
-	body, _ := json.Marshal(map[string]interface{}{"coffee_id": 1, "quantity": 1})
+	body, _ := json.Marshal(map[string]any{"coffee_id": 1, "quantity": 1})
 	req := authRequest("PUT", "/api/v1/cart/item", body, user.ID)
 	w := httptest.NewRecorder()
 	handler.SetItem(w, req)
 
 	addr := models.Address{UserID: user.ID, Name: "Test", Street: "123 St", City: "PDX", State: "OR", Zip: "97201", Country: "US"}
 	db.Create(&addr)
-	body, _ = json.Marshal(map[string]interface{}{"address_id": addr.ID})
+	body, _ = json.Marshal(map[string]any{"address_id": addr.ID})
 	req = authRequest("PUT", "/api/v1/cart/address", body, user.ID)
 	w = httptest.NewRecorder()
 	handler.SetAddress(w, req)
@@ -563,7 +564,7 @@ func TestMultipleItems(t *testing.T) {
 
 	// Add three different items
 	for i := uint(1); i <= 3; i++ {
-		body, _ := json.Marshal(map[string]interface{}{"coffee_id": i, "quantity": int(i)})
+		body, _ := json.Marshal(map[string]any{"coffee_id": i, "quantity": int(i)})
 		req := authRequest("PUT", "/api/v1/cart/item", body, user.ID)
 		w := httptest.NewRecorder()
 		handler.SetItem(w, req)
@@ -581,8 +582,8 @@ func TestMultipleItems(t *testing.T) {
 		Success bool `json:"success"`
 		Data    struct {
 			Cart struct {
-				Items    []interface{} `json:"items"`
-				Subtotal int           `json:"subtotal"`
+				Items    []any `json:"items"`
+				Subtotal int   `json:"subtotal"`
 			} `json:"cart"`
 		} `json:"data"`
 	}
@@ -614,13 +615,13 @@ func TestCartIsolation(t *testing.T) {
 	r.Get("/cart", handler.GetCart)
 
 	// User 1 adds item
-	body, _ := json.Marshal(map[string]interface{}{"coffee_id": 1, "quantity": 5})
+	body, _ := json.Marshal(map[string]any{"coffee_id": 1, "quantity": 5})
 	req := authRequest("PUT", "/cart/item", body, user1.ID)
 	w := httptest.NewRecorder()
 	r.ServeHTTP(w, req)
 
 	// User 2 adds different item
-	body, _ = json.Marshal(map[string]interface{}{"coffee_id": 2, "quantity": 3})
+	body, _ = json.Marshal(map[string]any{"coffee_id": 2, "quantity": 3})
 	req = authRequest("PUT", "/cart/item", body, user2.ID)
 	w = httptest.NewRecorder()
 	r.ServeHTTP(w, req)
@@ -709,9 +710,17 @@ func TestConvertCartLimit(t *testing.T) {
 				t.Fatalf("seed card: %v", err)
 			}
 
+			// Pin coffee_id=4's price so cart-cap math stays stable across
+			// seed-price changes. The cap test is about (price * quantity)
+			// vs cap, not which coffee or what the menu currently charges.
+			const pinnedPrice = 500
+			if err := db.Model(&models.Coffee{}).Where("id = ?", 4).Update("price", pinnedPrice).Error; err != nil {
+				t.Fatalf("pin coffee price: %v", err)
+			}
+
 			handler := NewCartHandler("", "", tc.capCents)
 
-			body, _ := json.Marshal(map[string]interface{}{"coffee_id": 4, "quantity": tc.quantity})
+			body, _ := json.Marshal(map[string]any{"coffee_id": 4, "quantity": tc.quantity})
 			req := authRequest("PUT", "/api/v1/cart/item", body, user.ID)
 			w := httptest.NewRecorder()
 			handler.SetItem(w, req)
@@ -720,7 +729,7 @@ func TestConvertCartLimit(t *testing.T) {
 			}
 
 			// set address
-			body, _ = json.Marshal(map[string]interface{}{"address_id": addr.ID})
+			body, _ = json.Marshal(map[string]any{"address_id": addr.ID})
 			req = authRequest("PUT", "/api/v1/cart/address", body, user.ID)
 			w = httptest.NewRecorder()
 			handler.SetAddress(w, req)
@@ -729,7 +738,7 @@ func TestConvertCartLimit(t *testing.T) {
 			}
 
 			// set card
-			body, _ = json.Marshal(map[string]interface{}{"card_id": card.ID})
+			body, _ = json.Marshal(map[string]any{"card_id": card.ID})
 			req = authRequest("PUT", "/api/v1/cart/card", body, user.ID)
 			w = httptest.NewRecorder()
 			handler.SetCard(w, req)
@@ -745,9 +754,9 @@ func TestConvertCartLimit(t *testing.T) {
 			var resp struct {
 				Success bool `json:"success"`
 				Error   struct {
-					Code    string                 `json:"code"`
-					Message string                 `json:"message"`
-					Details map[string]interface{} `json:"details"`
+					Code    string         `json:"code"`
+					Message string         `json:"message"`
+					Details map[string]any `json:"details"`
 				} `json:"error"`
 			}
 			_ = json.NewDecoder(w.Body).Decode(&resp)
@@ -760,8 +769,8 @@ func TestConvertCartLimit(t *testing.T) {
 				if got, _ := resp.Error.Details["limit_cents"].(float64); int(got) != tc.capCents {
 					t.Errorf("limit_cents in details: want %d, got %v", tc.capCents, resp.Error.Details["limit_cents"])
 				}
-				if got, _ := resp.Error.Details["total_cents"].(float64); int(got) != tc.quantity*500 {
-					t.Errorf("total_cents in details: want %d, got %v", tc.quantity*500, resp.Error.Details["total_cents"])
+				if got, _ := resp.Error.Details["total_cents"].(float64); int(got) != tc.quantity*pinnedPrice {
+					t.Errorf("total_cents in details: want %d, got %v", tc.quantity*pinnedPrice, resp.Error.Details["total_cents"])
 				}
 			}
 		})
@@ -787,7 +796,7 @@ func TestSetCard_ExpiredReturns410(t *testing.T) {
 	}
 
 	handler := NewCartHandler("", "", 0)
-	body, _ := json.Marshal(map[string]interface{}{"card_id": card.ID})
+	body, _ := json.Marshal(map[string]any{"card_id": card.ID})
 	req := authRequest("PUT", "/api/v1/cart/card", body, user.ID)
 	w := httptest.NewRecorder()
 	handler.SetCard(w, req)
@@ -824,7 +833,7 @@ func TestConvertCart_ExpiredReturns410(t *testing.T) {
 
 	db := database.GetDB()
 
-	body, _ := json.Marshal(map[string]interface{}{"coffee_id": 1, "quantity": 1})
+	body, _ := json.Marshal(map[string]any{"coffee_id": 1, "quantity": 1})
 	req := authRequest("PUT", "/api/v1/vart/item", body, user.ID)
 	w := httptest.NewRecorder()
 	NewCartHandler("", "", 0).SetItem(w, req)
@@ -834,7 +843,7 @@ func TestConvertCart_ExpiredReturns410(t *testing.T) {
 		City: "PDX", State: "OR", Zip: "97201", Country: "US",
 	}
 	db.Create(&addr)
-	body, _ = json.Marshal(map[string]interface{}{"address_id": addr.ID})
+	body, _ = json.Marshal(map[string]any{"address_id": addr.ID})
 	req = authRequest("PUT", "/api/v1/cart/address", body, user.ID)
 	w = httptest.NewRecorder()
 	NewCartHandler("", "", 0).SetAddress(w, req)
@@ -911,6 +920,12 @@ func TestRetryAuth(t *testing.T) {
 			seedPayment: "pi_test_refunded", seedEvents: 1,
 			wantStatus: http.StatusConflict, wantErrCode: "INVALID_STATE",
 		},
+		{
+			name:        "requires_action honors retry cap",
+			ownedByUser: true, seedStatus: models.OrderStatusRequiresAction,
+			seedPayment: "pi_test_req_action_cap", seedEvents: maxAuthIssuances,
+			wantStatus: http.StatusTooManyRequests, wantErrCode: "RETRY_LIMIT",
+		},
 		{
 			name:        "retry cap reached returns 429",
 			ownedByUser: true, seedStatus: models.OrderStatusFailed,
@@ -1014,3 +1029,137 @@ func TestRetryAuth_OrderNotFound(t *testing.T) {
 		t.Fatalf("want 404, got %d body=%s", w.Code, w.Body.String())
 	}
 }
+
+func TestRespondRequiresAction_SetStatusRequiresAction(t *testing.T) {
+	testDB, user := setupCartTestDB(t)
+	defer func() { _ = os.Remove(testDB) }()
+	defer database.ResetForTesting()
+
+	db := database.GetDB()
+	card := models.Card{
+		UserID: user.ID, StripePaymentID: "pm_test_req_action",
+		Last4: "4242", Brand: "Visa", ExpMonth: 12, ExpYear: 2030,
+	}
+	if err := db.Create(&card).Error; err != nil {
+		t.Fatalf("seed card: %v", err)
+	}
+
+	order := models.Order{
+		UserID: user.ID, CardID: card.ID,
+		Status:   models.OrderStatusPending,
+		Subtotal: 500, Total: 500,
+		ShippingName: "Test", ShippingStreet: "1 Main St",
+		ShippingCity: "PDX", ShippingState: "OR",
+		ShippingZip: "97201", ShippingCountry: "US",
+	}
+	if err := db.Create(&order).Error; err != nil {
+		t.Fatalf("seed order: %v", err)
+	}
+
+	pi := &stripe.PaymentIntent{
+		ID: "pi_test_action_set",
+		NextAction: &stripe.PaymentIntentNextAction{
+			RedirectToURL: &stripe.PaymentIntentNextActionRedirectToURL{
+				URL: "https://hooks.stripe.com/redirect/test/test_3ds",
+			},
+		},
+	}
+
+	handler := NewCartHandler("", "http://localhost", 0)
+	w := httptest.NewRecorder()
+	handler.respondRequiresAction(w, &order, card.StripePaymentID, pi)
+
+	if w.Code != http.StatusAccepted {
+		t.Fatalf("want 202, got %d body=%s", w.Code, w.Body.String())
+	}
+
+	var resp struct {
+		Data struct {
+			OrderID         uint   `json:"order_id"`
+			PaymentIntentID string `json:"payment_intent_id"`
+			Status          string `json:"status"`
+			RedirectURL     string `json:"redirect_url"`
+		} `json:"data"`
+	}
+	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if resp.Data.Status != "requires_action" {
+		t.Fatalf("response status: %q, got %q", "requires_action", resp.Data.Status)
+	}
+	if resp.Data.RedirectURL == "" {
+		t.Fatalf("expected redirect url, got empty")
+	}
+	if resp.Data.PaymentIntentID != pi.ID {
+		t.Fatalf("payment intent id: want %q, got %q", pi.ID, resp.Data.PaymentIntentID)
+	}
+
+	var reloaded models.Order
+	if err := db.First(&reloaded, order.ID).Error; err != nil {
+		t.Fatalf("reload order: %v", err)
+	}
+	if reloaded.Status != models.OrderStatusRequiresAction {
+		t.Fatalf("order.Status: want %q, got %q", models.OrderStatusRequiresAction, reloaded.Status)
+	}
+	if reloaded.StripePaymentID != pi.ID {
+		t.Fatalf("order.StripePaymentID: want %q, got %q", pi.ID, reloaded.StripePaymentID)
+	}
+}
+
+// TestRespondRequiresAction_OverridesFailedFromWebhookRace simulates the race
+// described in sca-psd2-compliance.md note #3 / caveat #4: the
+// payment_intent.payment_failed webhook arrives BEFORE respondRequiresAction
+// returns and flips the row to OrderStatusFailed. The helper must override
+// that back to OrderStatusRequiresAction so the in-flight 3DS state surfaces
+// correctly to the TUI.
+func TestRespondRequiresAction_OverridesFailedFromWebhookRace(t *testing.T) {
+	testDB, user := setupCartTestDB(t)
+	defer func() { _ = os.Remove(testDB) }()
+	defer database.ResetForTesting()
+
+	db := database.GetDB()
+	card := models.Card{
+		UserID: user.ID, StripePaymentID: "pm_test_race",
+		Last4: "4242", Brand: "Visa", ExpMonth: 12, ExpYear: 2030,
+	}
+	if err := db.Create(&card).Error; err != nil {
+		t.Fatalf("seed card: %v", err)
+	}
+
+	order := models.Order{
+		UserID: user.ID, CardID: card.ID,
+		Status:   models.OrderStatusFailed,
+		Subtotal: 500, Total: 500,
+		ShippingName: "Test", ShippingStreet: "1 Main St",
+		ShippingCity: "PDX", ShippingState: "OR",
+		ShippingZip: "97201", ShippingCountry: "US",
+	}
+	if err := db.Create(&order).Error; err != nil {
+		t.Fatalf("seed order: %v", err)
+	}
+
+	pi := &stripe.PaymentIntent{
+		ID: "pi_test_race",
+		NextAction: &stripe.PaymentIntentNextAction{
+			RedirectToURL: &stripe.PaymentIntentNextActionRedirectToURL{
+				URL: "https://hooks.stripe.com/redirect/test_race",
+			},
+		},
+	}
+
+	handler := NewCartHandler("", "http://localhost", 0)
+	w := httptest.NewRecorder()
+	handler.respondRequiresAction(w, &order, card.StripePaymentID, pi)
+
+	if w.Code != http.StatusAccepted {
+		t.Fatalf("want 202, got %d body=%s", w.Code, w.Body.String())
+	}
+
+	var reloaded models.Order
+	if err := db.First(&reloaded, order.ID).Error; err != nil {
+		t.Fatalf("reload order: %v", err)
+	}
+	if reloaded.Status != models.OrderStatusRequiresAction {
+		t.Fatalf("override failed: want %q, got %q", models.OrderStatusRequiresAction, reloaded.Status)
+	}
+}

api/handlers/orders.go

@@ -221,7 +221,7 @@ func (h *OrderHandler) RefundOrder(w http.ResponseWriter, r *http.Request) {
 
 	audit.OrderRefunded(userID, order.ID, order.Total, rf.ID)
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"refund_id": rf.ID,
 		"status":    "refunded",
 	})
@@ -287,7 +287,7 @@ func (h *OrderHandler) UpdateTracking(w http.ResponseWriter, r *http.Request) {
 
 	audit.OrderShipped(order.UserID, order.ID, req.Carrier, req.TrackingNumber)
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"order_id":        order.ID,
 		"carrier":         req.Carrier,
 		"tracking_number": req.TrackingNumber,

api/handlers/products.go

@@ -30,7 +30,7 @@ func (h *ProductHandler) GetProducts(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"products": products,
 	})
 }
@@ -53,7 +53,7 @@ func (h *ProductHandler) GetProduct(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"product": product,
 	})
 }

api/handlers/reconcile.go

@@ -49,7 +49,7 @@ func ReconcileOrders(stripeKey string) {
 				"order_id", order.ID, "pi", pi.ID)
 
 			txErr := db.Transaction(func(tx *gorm.DB) error {
-				if err := tx.Model(&order).Updates(map[string]interface{}{
+				if err := tx.Model(&order).Updates(map[string]any{
 					"status":            models.OrderStatusPaid,
 					"stripe_payment_id": pi.ID,
 				}).Error; err != nil {
@@ -62,7 +62,7 @@ func ReconcileOrders(stripeKey string) {
 				if err := tx.Where("cart_id = ?", cart.ID).Delete(&models.CartItem{}).Error; err != nil {
 					return err
 				}
-				return tx.Model(&cart).Updates(map[string]interface{}{
+				return tx.Model(&cart).Updates(map[string]any{
 					"address_id": nil,
 					"card_id":    nil,
 				}).Error

api/handlers/view.go

@@ -54,7 +54,7 @@ func (h *ViewHandler) GetViewInit(w http.ResponseWriter, r *http.Request) {
 		db.Where("cart_id = ? AND quantity > 0", cart.ID).Preload("Coffee").Find(&cartItems)
 	}
 
-	utils.RespondSuccess(w, http.StatusOK, map[string]interface{}{
+	utils.RespondSuccess(w, http.StatusOK, map[string]any{
 		"user":      user.ToPublic(),
 		"products":  products,
 		"cart":      cartItems,

api/handlers/webhook.go

@@ -125,7 +125,7 @@ func (h *WebhookHandler) handlePaymentIntentSucceeded(ctx context.Context, event
 	}
 
 	txErr := db.Transaction(func(tx *gorm.DB) error {
-		if err := tx.Model(&order).Updates(map[string]interface{}{
+		if err := tx.Model(&order).Updates(map[string]any{
 			"status":            models.OrderStatusPaid,
 			"stripe_payment_id": pi.ID,
 		}).Error; err != nil {
@@ -139,7 +139,7 @@ func (h *WebhookHandler) handlePaymentIntentSucceeded(ctx context.Context, event
 		if err := tx.Where("cart_id = ?", cart.ID).Delete(&models.CartItem{}).Error; err != nil {
 			return fmt.Errorf("failed to delete cart item: %w", err)
 		}
-		return tx.Model(&cart).Updates(map[string]interface{}{
+		return tx.Model(&cart).Updates(map[string]any{
 			"address_id": nil,
 			"card_id":    nil,
 		}).Error
@@ -184,7 +184,7 @@ func (h *WebhookHandler) handlePaymentIntentFailed(ctx context.Context, event st
 	}
 
 	db := database.GetDB().WithContext(ctx)
-	if err := db.Model(&models.Order{}).Where("id = ? AND status = ?", orderIDStr, models.OrderStatusPending).
+	if err := db.Model(&models.Order{}).Where("id = ? AND status IN (?, ?)", orderIDStr, models.OrderStatusPending, models.OrderStatusRequiresAction).
 		Update("status", models.OrderStatusFailed).Error; err != nil {
 		webhookLog().Error("failed to mark order failed", "order_id", orderIDStr, "error", err)
 	}

api/handlers/webhook_test.go

@@ -0,0 +1,224 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/stripe/stripe-go/v78"
+
+	"terminalShop/pkg/database"
+	"terminalShop/pkg/models"
+)
+
+// buildPaymentFailedEvent constructs a stripe.Event whose Data.Raw decodes to
+// a PaymentIntent referencing the given order via metadata. errCode is set on
+// last_payment_error to drive the authentication_required short-circuit
+// branch in handlePaymentIntentFailed (pass "" to omit the error block).
+func buildPaymentFailedEvent(t *testing.T, piID string, orderID uint, errCode string) stripe.Event {
+	t.Helper()
+	pi := map[string]any{
+		"id":       piID,
+		"metadata": map[string]string{"order_id": fmt.Sprintf("%d", orderID)},
+	}
+	if errCode != "" {
+		pi["last_payment_error"] = map[string]any{"code": errCode}
+	}
+	raw, err := json.Marshal(pi)
+	if err != nil {
+		t.Fatalf("marshal pi: %v", err)
+	}
+	return stripe.Event{
+		Type: "payment_intent.payment_failed",
+		Data: &stripe.EventData{Raw: raw},
+	}
+}
+
+func seedOrderForWebhook(t *testing.T, userID uint, status models.OrderStatus, piID string) models.Order {
+	t.Helper()
+	db := database.GetDB()
+	card := models.Card{
+		UserID:          userID,
+		StripePaymentID: fmt.Sprintf("pm_test_%s", piID),
+		Last4:           "4242", Brand: "Visa", ExpMonth: 12, ExpYear: 2030,
+	}
+	if err := db.Create(&card).Error; err != nil {
+		t.Fatalf("seed card: %v", err)
+	}
+	order := models.Order{
+		UserID: userID, CardID: card.ID,
+		StripePaymentID: piID,
+		Status:          status,
+		Subtotal:        500, Total: 500,
+		ShippingName: "Test", ShippingStreet: "1 Main St",
+		ShippingCity: "PDX", ShippingState: "OR",
+		ShippingZip: "97201", ShippingCountry: "US",
+	}
+	if err := db.Create(&order).Error; err != nil {
+		t.Fatalf("seed order: %v", err)
+	}
+	return order
+}
+
+// TestHandlePaymentIntentFailed_RequiresActionFlipsToFailed verifies the
+// widened predicate (IN (pending, requires_action)) catches a row in the new
+// requires_action state. Without this case, a card_declined webhook arriving
+// after respondRequiresAction wrote requires_action would leave the row
+// stuck forever.
+func TestHandlePaymentIntentFailed_RequiresActionFlipsToFailed(t *testing.T) {
+	testDB, user := setupCartTestDB(t)
+	defer func() { _ = os.Remove(testDB) }()
+	defer database.ResetForTesting()
+
+	order := seedOrderForWebhook(t, user.ID, models.OrderStatusRequiresAction, "pi_test_req_action_failed")
+
+	h := NewWebhookHandler("", "", "")
+	evt := buildPaymentFailedEvent(t, order.StripePaymentID, order.ID, "card_declined")
+	h.handlePaymentIntentFailed(context.Background(), evt)
+
+	db := database.GetDB()
+	var reloaded models.Order
+	if err := db.First(&reloaded, order.ID).Error; err != nil {
+		t.Fatalf("reload order: %v", err)
+	}
+	if reloaded.Status != models.OrderStatusFailed {
+		t.Fatalf("status: want %q, got %q", models.OrderStatusFailed, reloaded.Status)
+	}
+}
+
+// TestHandlePaymentIntentFailed_RequiresActionAuthRequiredShortCircuits
+// verifies the existing short-circuit (note #3 in sca-psd2-compliance.md)
+// still fires when the row is in requires_action and the error code is
+// authentication_required. Without the short-circuit, the recovery flow
+// would race the webhook and surface a momentarily-failed state to the TUI.
+func TestHandlePaymentIntentFailed_RequiresActionAuthRequiredShortCircuits(t *testing.T) {
+	testDB, user := setupCartTestDB(t)
+	defer func() { _ = os.Remove(testDB) }()
+	defer database.ResetForTesting()
+
+	order := seedOrderForWebhook(t, user.ID, models.OrderStatusRequiresAction, "pi_test_req_action_authreq")
+
+	h := NewWebhookHandler("", "", "")
+	evt := buildPaymentFailedEvent(t, order.StripePaymentID, order.ID, "authentication_required")
+	h.handlePaymentIntentFailed(context.Background(), evt)
+
+	db := database.GetDB()
+	var reloaded models.Order
+	if err := db.First(&reloaded, order.ID).Error; err != nil {
+		t.Fatalf("reload order: %v", err)
+	}
+	if reloaded.Status != models.OrderStatusRequiresAction {
+		t.Fatalf("auth_required must not flip requires_action; got %q", reloaded.Status)
+	}
+}
+
+// TestHandlePaymentIntentFailed_PendingStillFlips guards the pre-existing
+// pending -> failed transition against a regression where the widened
+// predicate accidentally dropped pending from the source set.
+func TestHandlePaymentIntentFailed_PendingStillFlips(t *testing.T) {
+	testDB, user := setupCartTestDB(t)
+	defer func() { _ = os.Remove(testDB) }()
+	defer database.ResetForTesting()
+
+	order := seedOrderForWebhook(t, user.ID, models.OrderStatusPending, "pi_test_pending_failed")
+
+	h := NewWebhookHandler("", "", "")
+	evt := buildPaymentFailedEvent(t, order.StripePaymentID, order.ID, "card_declined")
+	h.handlePaymentIntentFailed(context.Background(), evt)
+
+	db := database.GetDB()
+	var reloaded models.Order
+	if err := db.First(&reloaded, order.ID).Error; err != nil {
+		t.Fatalf("reload order: %v", err)
+	}
+	if reloaded.Status != models.OrderStatusFailed {
+		t.Fatalf("status: want %q, got %q", models.OrderStatusFailed, reloaded.Status)
+	}
+}
+
+// TestHandlePaymentIntentFailed_PaidNotTouched locks the upper boundary of
+// the predicate: a paid row must NEVER be flipped to failed by a stale
+// payment_failed webhook. Without this guard, a future maintainer could
+// widen the IN clause to include paid (e.g. for some refund-retry flow)
+// and silently break idempotency.
+func TestHandlePaymentIntentFailed_PaidNotTouched(t *testing.T) {
+	testDB, user := setupCartTestDB(t)
+	defer func() { _ = os.Remove(testDB) }()
+	defer database.ResetForTesting()
+
+	order := seedOrderForWebhook(t, user.ID, models.OrderStatusPaid, "pi_test_paid_untouched")
+
+	h := NewWebhookHandler("", "", "")
+	evt := buildPaymentFailedEvent(t, order.StripePaymentID, order.ID, "card_declined")
+	h.handlePaymentIntentFailed(context.Background(), evt)
+
+	db := database.GetDB()
+	var reloaded models.Order
+	if err := db.First(&reloaded, order.ID).Error; err != nil {
+		t.Fatalf("reload order: %v", err)
+	}
+	if reloaded.Status != models.OrderStatusPaid {
+		t.Fatalf("paid order was modified by payment_failed webhook: got %q", reloaded.Status)
+	}
+}
+
+// TestHandlePaymentIntentFailed_MissingMetadataNoOp covers the no-order
+// short-circuit so the test file exercises every early-return branch in
+// handlePaymentIntentFailed touched by the predicate work.
+func TestHandlePaymentIntentFailed_MissingMetadataNoOp(t *testing.T) {
+	testDB, _ := setupCartTestDB(t)
+	defer func() { _ = os.Remove(testDB) }()
+	defer database.ResetForTesting()
+
+	pi := map[string]any{"id": "pi_test_no_meta"}
+	raw, err := json.Marshal(pi)
+	if err != nil {
+		t.Fatalf("marshal pi: %v", err)
+	}
+	evt := stripe.Event{
+		Type: "payment_intent.payment_failed",
+		Data: &stripe.EventData{Raw: raw},
+	}
+
+	h := NewWebhookHandler("", "", "")
+	h.handlePaymentIntentFailed(context.Background(), evt) // must not panic
+}
+
+func TestHandlePaymentIntentSucceeded_RequiresActionFlipsToPaid(t *testing.T) {
+	testDB, user := setupCartTestDB(t)
+	defer func() { _ = os.Remove(testDB) }()
+	defer database.ResetForTesting()
+
+	order := seedOrderForWebhook(t, user.ID, models.OrderStatusRequiresAction, "pi_test_req_action_paid")
+
+	pi := map[string]any{
+		"id":       order.StripePaymentID,
+		"amount":   order.Total,
+		"metadata": map[string]string{"order_id": fmt.Sprintf("%d", order.ID)},
+	}
+	raw, err := json.Marshal(pi)
+	if err != nil {
+		t.Fatalf("marshal pi: %v", err)
+	}
+	evt := stripe.Event{
+		Type: "payment_intent.succeeded",
+		Data: &stripe.EventData{Raw: raw},
+	}
+
+	h := NewWebhookHandler("", "", "")
+	h.handlePaymentIntentSucceeded(context.Background(), evt)
+
+	db := database.GetDB()
+	var reloaded models.Order
+	if err := db.First(&reloaded, order.ID).Error; err != nil {
+		t.Fatalf("reload order: %v", err)
+	}
+	if reloaded.Status != models.OrderStatusPaid {
+		t.Fatalf("status: want %q, got %q", models.OrderStatusPaid, reloaded.Status)
+	}
+	if reloaded.StripePaymentID != order.StripePaymentID {
+		t.Fatalf("stripe_payment_id: want %q, got %q", order.StripePaymentID, reloaded.StripePaymentID)
+	}
+}

pkg/api/client.go

@@ -104,16 +104,16 @@ func (c *Client) RefreshToken(fingerprint, clientSecret string) (string, error)
 
 // APIResponse represents the standard API response format
 type APIResponse struct {
-	Success bool                   `json:"success"`
-	Data    map[string]interface{} `json:"data"`
-	Error   *APIError              `json:"error,omitempty"`
+	Success bool           `json:"success"`
+	Data    map[string]any `json:"data"`
+	Error   *APIError      `json:"error,omitempty"`
 }
 
 // APIError represents an error from the API
 type APIError struct {
-	Code    string                 `json:"code"`
-	Message string                 `json:"message"`
-	Details map[string]interface{} `json:"details,omitempty"`
+	Code    string         `json:"code"`
+	Message string         `json:"message"`
+	Details map[string]any `json:"details,omitempty"`
 }
 
 // ProductsResponse represents the products API response
@@ -339,7 +339,7 @@ func (c *Client) GetCart() (*CartData, error) {
 func (c *Client) SetCartItem(coffeeID uint, quantity int) (*CartData, error) {
 	url := fmt.Sprintf("%s/api/v1/cart/item", c.BaseURL)
 
-	body := map[string]interface{}{
+	body := map[string]any{
 		"coffee_id": coffeeID,
 		"quantity":  quantity,
 	}
@@ -379,7 +379,7 @@ func (c *Client) SetCartItem(coffeeID uint, quantity int) (*CartData, error) {
 func (c *Client) SetCartAddress(addressID uint) error {
 	url := fmt.Sprintf("%s/api/v1/cart/address", c.BaseURL)
 
-	body := map[string]interface{}{
+	body := map[string]any{
 		"address_id": addressID,
 	}
 	jsonData, err := json.Marshal(body)
@@ -418,7 +418,7 @@ func (c *Client) SetCartAddress(addressID uint) error {
 func (c *Client) SetCartCard(cardID uint) error {
 	url := fmt.Sprintf("%s/api/v1/cart/card", c.BaseURL)
 
-	body := map[string]interface{}{
+	body := map[string]any{
 		"card_id": cardID,
 	}
 	jsonData, err := json.Marshal(body)

pkg/auth/jwt.go

@@ -53,7 +53,7 @@ func (m *JWTManager) GenerateToken(userID uint, email, username string) (string,
 
 // ValidateToken validates a JWT token and returns the claims
 func (m *JWTManager) ValidateToken(tokenString string) (*Claims, error) {
-	token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
+	token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (any, error) {
 		// Verify signing method
 		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
 			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])

pkg/database/seed.go

@@ -4,8 +4,9 @@ import (
 	"fmt"
 	"log"
 
-	"gorm.io/gorm"
 	"terminalShop/pkg/models"
+
+	"gorm.io/gorm"
 )
 
 // Seed populates the database with initial data
@@ -27,7 +28,7 @@ func Seed(db *gorm.DB) error {
 			RoastType:   "Dark Roast",
 			Ounces:      2,
 			BeanType:    "Arabica",
-			Price:       350, // $3.50
+			Price:       1800, // $18.00
 			Color:       "#8B4513",
 			Description: "Bold and intense coffee with a rich crema",
 		},
@@ -36,7 +37,7 @@ func Seed(db *gorm.DB) error {
 			RoastType:   "Medium Roast",
 			Ounces:      8,
 			BeanType:    "Arabica",
-			Price:       400, // $4.00
+			Price:       2200, // $22.00
 			Color:       "#A0522D",
 			Description: "Smooth and balanced espresso diluted with hot water",
 		},
@@ -45,7 +46,7 @@ func Seed(db *gorm.DB) error {
 			RoastType:   "Medium Roast",
 			Ounces:      6,
 			BeanType:    "Arabica",
-			Price:       450, // $4.50
+			Price:       2200, // $22.00
 			Color:       "#C4A574",
 			Description: "Espresso with steamed milk and a thick layer of foam",
 		},
@@ -54,7 +55,7 @@ func Seed(db *gorm.DB) error {
 			RoastType:   "Medium Roast",
 			Ounces:      12,
 			BeanType:    "Arabica",
-			Price:       500, // $5.00
+			Price:       2500, // $25.00
 			Color:       "#D2B48C",
 			Description: "Creamy espresso with plenty of steamed milk and a touch of foam",
 		},
@@ -63,7 +64,7 @@ func Seed(db *gorm.DB) error {
 			RoastType:   "Dark Roast",
 			Ounces:      12,
 			BeanType:    "Arabica",
-			Price:       550, // $5.50
+			Price:       3000, // $30.00
 			Color:       "#8B4513",
 			Description: "Chocolate and espresso combined with steamed milk. Sweet and indulgent.",
 		},
@@ -72,7 +73,7 @@ func Seed(db *gorm.DB) error {
 			RoastType:   "Dark Roast",
 			Ounces:      3,
 			BeanType:    "Robusta Blend",
-			Price:       425, // $4.25
+			Price:       1800, // $18.00
 			Color:       "#DAA520",
 			Description: "Espresso 'marked' with a dollop of foamed milk. Small but mighty, like a tiny caffeinated warrior.",
 		},

pkg/models/order.go

@@ -10,13 +10,14 @@ import (
 type OrderStatus string
 
 const (
-	OrderStatusPending   OrderStatus = "pending"
-	OrderStatusPaid      OrderStatus = "paid"
-	OrderStatusShipped   OrderStatus = "shipped"
-	OrderStatusDelivered OrderStatus = "delivered"
-	OrderStatusCancelled OrderStatus = "cancelled"
-	OrderStatusRefunded  OrderStatus = "refunded"
-	OrderStatusFailed    OrderStatus = "failed"
+	OrderStatusPending        OrderStatus = "pending"
+	OrderStatusRequiresAction OrderStatus = "requires_action"
+	OrderStatusPaid           OrderStatus = "paid"
+	OrderStatusShipped        OrderStatus = "shipped"
+	OrderStatusDelivered      OrderStatus = "delivered"
+	OrderStatusCancelled      OrderStatus = "cancelled"
+	OrderStatusRefunded       OrderStatus = "refunded"
+	OrderStatusFailed         OrderStatus = "failed"
 )
 
 type TrackingStatus string

pkg/models/order_display.go

@@ -35,6 +35,8 @@ func (order *Order) DisplayState() string {
 	switch order.Status {
 	case OrderStatusPending:
 		return "Awaiting payment"
+	case OrderStatusRequiresAction:
+		return "Awaiting authentication"
 	case OrderStatusPaid:
 		if order.TrackingNumber == "" {
 			return "Paid * awaiting label"
@@ -77,6 +79,8 @@ func (order *Order) DisplayKind() DisplayKind {
 	switch order.Status {
 	case OrderStatusPending:
 		return DisplayKindNeutral
+	case OrderStatusRequiresAction:
+		return DisplayKindNeutral
 	case OrderStatusPaid:
 		return DisplayKindAccent
 	case OrderStatusShipped:

pkg/models/order_display_test.go

@@ -14,6 +14,7 @@ func TestOrderDisplayState(t *testing.T) {
 		kind  DisplayKind
 	}{
 		{"pending", Order{Status: OrderStatusPending}, "Awaiting payment", DisplayKindNeutral},
+		{"requires_action", Order{Status: OrderStatusRequiresAction}, "Awaiting authentication", DisplayKindNeutral},
 		{"paid no tracking", Order{Status: OrderStatusPaid}, "Paid * awaiting label", DisplayKindAccent},
 		{"paid with tracking, no event", Order{Status: OrderStatusPaid, TrackingNumber: "12999"}, "Paid", DisplayKindAccent},
 		{"Paid pre-transit", Order{Status: OrderStatusPaid, TrackingNumber: "12999", TrackingStatus: TrackingStatusPreTransit}, "Paid * ready to ship", DisplayKindAccent},

pkg/utils/response.go

@@ -8,8 +8,8 @@ import (
 
 // SuccessResponse represents a successful API response
 type SuccessResponse struct {
-	Success bool        `json:"success"`
-	Data    interface{} `json:"data"`
+	Success bool `json:"success"`
+	Data    any  `json:"data"`
 }
 
 // ErrorResponse represents an error API response
@@ -20,13 +20,13 @@ type ErrorResponse struct {
 
 // Error contains error details
 type Error struct {
-	Code    string                 `json:"code"`
-	Message string                 `json:"message"`
-	Details map[string]interface{} `json:"details,omitempty"`
+	Code    string         `json:"code"`
+	Message string         `json:"message"`
+	Details map[string]any `json:"details,omitempty"`
 }
 
 // RespondSuccess sends a successful JSON response
-func RespondSuccess(w http.ResponseWriter, statusCode int, data interface{}) {
+func RespondSuccess(w http.ResponseWriter, statusCode int, data any) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(statusCode)
 
@@ -39,7 +39,7 @@ func RespondSuccess(w http.ResponseWriter, statusCode int, data interface{}) {
 }
 
 // RespondError sends an error JSON response
-func RespondError(w http.ResponseWriter, statusCode int, code, message string, details map[string]interface{}) {
+func RespondError(w http.ResponseWriter, statusCode int, code, message string, details map[string]any) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(statusCode)