Reject cart and discount mutations while checkout session is active.

Prevent cart cookie changes during payment so nav counts and checkout snapshots stay aligned until cancel or completion.

backend/src/modules/storefrontCart/controllers/StorefrontCartController.ts

@@ -1,4 +1,4 @@
-import { Body, Controller, Get, HttpStatus, Post, Req, Res, UseFilters } from '@nestjs/common';
+import { BadRequestException, Body, Controller, Get, HttpStatus, Post, Req, Res, UseFilters } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { Throttle } from '@nestjs/throttler';
 import type { Request, Response } from 'express';
@@ -89,6 +89,10 @@ export class StorefrontCartController {
         @Res() res: Response,
         @Body() { variantId, qty }: AddToCartDto
     ): Promise<void> {
+        if (this.checkoutSessionCookieService.getSessionId(req, res)) {
+            throw new BadRequestException('Finish or cancel checkout before changing your cart.');
+        }
+
         const cart = this.cartCookieService.getCart(req, res);
 
         const cartMutation = await this.cartService.addToCart(cart, variantId, qty);
@@ -109,6 +113,10 @@ export class StorefrontCartController {
         @Res() res: Response,
         @Body() { variantId, qty }: UpdateCartQtyDto
     ): Promise<void> {
+        if (this.checkoutSessionCookieService.getSessionId(req, res)) {
+            throw new BadRequestException('Finish or cancel checkout before changing your cart.');
+        }
+
         const cart = this.cartCookieService.getCart(req, res);
 
         const cartMutation = await this.cartService.updateCartQty(cart, variantId, qty);
@@ -125,6 +133,10 @@ export class StorefrontCartController {
 
     @Post('shop/cart/product/remove')
     removeFromCart(@Req() req: Request, @Res() res: Response, @Body() { variantId }: RemoveFromCartDto): void {
+        if (this.checkoutSessionCookieService.getSessionId(req, res)) {
+            throw new BadRequestException('Finish or cancel checkout before changing your cart.');
+        }
+
         const cart = this.cartCookieService.getCart(req, res);
 
         const cartMutation = this.cartService.removeFromCart(cart, variantId);
@@ -143,6 +155,10 @@ export class StorefrontCartController {
         @Res() res: Response,
         @Body() { code }: ApplyDiscountCodeDto
     ): Promise<void> {
+        if (this.checkoutSessionCookieService.getSessionId(req, res)) {
+            throw new BadRequestException('Finish or cancel checkout before changing your cart.');
+        }
+
         const cart = this.cartCookieService.getCart(req, res);
         const discountCodes = this.discountCookieService.getDiscountCodes(req, res);
 
@@ -160,6 +176,10 @@ export class StorefrontCartController {
 
     @Post('shop/cart/discount/remove')
     removeDiscount(@Req() req: Request, @Res() res: Response, @Body() { code }: RemoveDiscountCodeDto): void {
+        if (this.checkoutSessionCookieService.getSessionId(req, res)) {
+            throw new BadRequestException('Finish or cancel checkout before changing your cart.');
+        }
+
         const discountCodes = this.discountCookieService.getDiscountCodes(req, res);
         const discountMutation = this.discountService.removeDiscountCode(discountCodes, code);