# Live WooCommerce test (mock-woo WC REST)

**Verdict: PASS**  
**Date:** 2026-08-04  
**Tenant:** `demo@descrybe.local` → **Local Demo Co** (plan **Enterprise**, 1,000,000 credits)  
**API:** `http://127.0.0.1:8080` (restarted with parallel list build)  
**Worker:** `worker.exe` claiming Woo jobs  
**Mock store:** `cmd/mock-woo` on `http://127.0.0.1:19090`

This proves the **real WooCommerce REST client** path (Basic auth → `/wp-json/wc/v3/*`), **not** `seed-woo-demo` DB inserts.

## Start mock-woo

```powershell
cd f:\laragon\www\_MY\descrybe-v2\apps\api
go run ./cmd/mock-woo -addr 127.0.0.1:19090
# defaults: consumer key ck_mock_local / secret cs_mock_local
```

Health: `GET http://127.0.0.1:19090/healthz` → `{"status":"ok","service":"mock-woo"}`.

## Point Local Demo Co at mock

Session login + CSRF, then:

| Step | HTTP | Evidence |
|------|-----:|----------|
| `PUT /api/woocommerce` | **200** | `store_url=http://127.0.0.1:19090`, `is_enabled=true`, `has_credentials=true` |
| Cap for proof (SQL) | — | `sync_options.sync_limit=5` (still uses live client/batches) |
| `POST /api/woocommerce/test` | **200** | `{"status":"ok","message":"connection successful"}` |
| `POST /api/woocommerce/sync` | **202** | `woocommerce sync queued` |
| `POST /api/woocommerce/sync-orders` | **202** | orders sync queued |
| `POST /api/woocommerce/sync-reviews` | **202** | reviews sync queued |

Worker drained pending flags within ~6s:

| Badge | Result |
|-------|--------|
| `last_test_status` | `ok` |
| `last_sync_status` | `success` |
| `last_orders_sync_status` | `success` |
| `last_reviews_sync_status` | `success` |

## Direct mock HTTP (fixture proof)

Auth: `Authorization: Basic` base64(`ck_mock_local:cs_mock_local`).

| Request | HTTP | Notes |
|---------|-----:|-------|
| `GET .../wp-json/wc/v3/products?per_page=1` | **200** | After product push, SKUs present (e.g. created id `1001`) |
| `GET .../wp-json/wc/v3/orders?page=1` | **200** | **3** fixture orders (`5001`–`5003`) |
| `GET .../wp-json/wc/v3/products/reviews?page=1` | **200** | **2** fixture reviews (`7001`–`7002`) |

## DB rows from sync (not seed)

```sql
-- Local Demo Co: mock external_ids only
SELECT count(*) FROM woo_orders WHERE external_id IN (5001,5002,5003);   -- 3
SELECT count(*) FROM product_reviews WHERE external_id IN (7001,7002); -- 2
```

`GET /api/woocommerce/orders?limit=10` → **200** with `cara.buyer@example.com` / external_id `5003`.  
`GET /api/woocommerce/reviews?limit=10` → **200** with reviewer `Ben Buyer` / external_id `7002`.

## What this is / is not

| Is | Is not |
|----|--------|
| Live Test Connection + product batch push + orders/reviews pull via `internal/woocommerce` client | WordPress/Woo docker |
| Loopback HTTP allowed by SSRF (`NormalizeStoreURL` + `SafeHTTPClient(allowLoopback=true)`) | Proof against a public merchant store |
| Suitable local staging gate for Woo connector | Substitute for production HTTPS Woo credentials |

Related: [woocommerce-demo.md](woocommerce-demo.md) (seed path), [store-connectors.md](store-connectors.md).