Hand a real nominee vote to central checkout

Use campaign_id and the actual participant_id selected from the campaign. Validate a supported integer vote_count and required voter contact fields without treating client checks as authorization.

Respect opening/closing dates and category activity. Never expose hidden counts or infer approval just because a profile exists.

POST /api/public/vote is the existing start route; the Web client uses fetchPublicFlow("/vote", ...). Existing Storm preparation supplies browser context required by Server.

This is a repository-only example, not a universal cross-origin SDK. External callers without approved protection must use the actual campaign URL or approved Organization integration; random device identifiers are not a setup instruction.

Supply one immutable request and client_attempt_id from the validated form. The exported function is inert until explicitly called with approved test input; it is not a vote simulator or permission grant.

Open only the server-returned central checkout URL. Server confirms payment and votes; a query, browser return or initialized session must never increment counts. Add no frontend verification or polling.

'use client';
import { fetchPublicFlow } from '@/lib/server-backend/public-api';
type Input = { campaign_id: string; participant_id: string; vote_count: number; phone_number: string; email?: string; client_attempt_id: string; return_path: string };
let requestStarted = false;
export async function initializeApprovedTest(input: Input, approvedTest: boolean) {
  if (!approvedTest || requestStarted) return null;
  requestStarted = true;
    const response = await fetchPublicFlow('/vote', {
      method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(input)
    });
    const result = await response.json();
    if (!response.ok || result.success !== true) throw new Error(result.error || 'Checkout unavailable');
    if (typeof result.data?.authorization_url !== 'string') throw new Error('No paid checkout URL returned');
    const target = new URL(result.data.authorization_url);
    if (target.origin !== 'https://checkout.sparkglim.net' || target.username || target.password) throw new Error('Invalid checkout URL');
    window.location.assign(target.href);
    return target.href;
}