Fix Logic Flow Bypass in Cuba

Cuba.define do
  on "checkout" do
    on "payment" do
      # VULNERABILITY: No server-side verification that the cart is valid
      # A user can jump directly to /checkout/payment
      res.write "Processing payment for: #{req.params['amount']}"
    end
on "complete" do
  # Bypass: This block executes if the user hits /checkout/complete
  # even if they skipped the payment step.
  res.write "Order Confirmed!"
end
end
end

Cuba.define do
  on "checkout" do
    on "payment" do
      # SECURE: Validate state machine and halt on failure
      unless session[:cart_total] && session[:cart_total] > 0
        res.status = 400
        res.write "Invalid Cart State"
        halt(res.finish)
      end
  res.write "Processing payment..."
  session[:paid] = true
end

on "complete" do
  # SECURE: Explicitly check the previous step's completion
  if session[:paid]
    res.write "Order Confirmed!"
    session[:paid] = false # Reset state
  else
    res.redirect "/checkout/payment"
    halt(res.finish)
  end
end
end
end