Checkout rules

Decide allow, review or block for every checkout with your own logic, next to ShopFast's fraud checks.

Checkout rules run as a risk check before every checkout, with the store’s blocklists and velocity limits. The strictest verdict wins.

function plugin.validate_cart(ctx, input)
  local cart = input.cart
  local limit = tonumber(ctx.settings.review_above) or 20000
  if cart.totalMinor > limit and not cart.signedIn then
    return { action = "review", reason = "guest order over " .. money.format(limit, cart.currency), points = 30 }
  end
  if cart.country ~= cart.ipCountry and cart.proxy then
    return { action = "block", message = "We could not confirm this order. Contact the store.", reason = "proxy and country mismatch", points = 60 }
  end
  return { action = "allow" }
end

input.cart: productIds, totalMinor, currency, emailDomain, country (the buyer’s choice), ipCountry, proxy (VPN or hosting network) and signedIn. Plugins never see full emails, card details or the IP address.

`action`	Effect
`allow`	Nothing (add `points` and a `reason` to log a signal anyway)
`review`	The buyer confirms their email with a code before paying, and the check is flagged
`block`	The checkout stops with your `message` (keep it neutral: never say which rule matched)

Every verdict is logged in Settings → Security & Fraud with the plugin’s name and your reason.

Checkout rules fail open: a plugin that errors or runs out of budget is skipped (and its run is marked failed), so a bug never stops every sale. They get the smallest budget (2M instructions, 200 ms CPU, one HTTP request) because the buyer is waiting. Plugins decide; they cannot change prices or the cart.