fix: the cart keeps only its items, never the customer's details

The browser put the CNPJ, WhatsApp, e-mail, CEP and address back after a
reload without telling the page, which then showed them but could not pay
until they were typed again. The fields are now emptied on load and marked
autocomplete="off", and the saved cart holds only the items: the details and
address are typed again after a reload or a closed tab. The payment page
already takes them from the server.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/browser_test.mjs

@@ -93,6 +93,12 @@ try{
   assert.deepEqual(await site.eval(`({items:pedido.length,empty:!$('carrVazio').hidden||document.documentElement.hasAttribute('data-sem-itens'),undo:!$('desfazer').hidden})`),{items:0,empty:true,undo:true});
   await site.click('#desfazerBtn');
   assert.equal(await site.eval('pedido.length===1 && pedido[0].total===21.89 && $("desfazer").hidden'),true);
+  // The items come back after a reload; the customer's details do not.
+  assert.deepEqual(await site.eval(`['fCnpj','fZap','fMail'].map(id=>$(id).value)`),['','','']);
+  assert.equal(await site.eval('document.getElementById("bPagar").disabled'),true);
+  await site.fill('#fCnpj','11222333000181');
+  await site.fill('#fZap','11999999999');
+  await site.fill('#fMail','local-browser@example.test');
   assert.equal(await site.eval('pedido[0].localFiles[0].name'),'local-test.cdr');
   assert.equal(await site.eval('pedido[0].total'),21.89);
   assert.equal(await site.eval('document.getElementById("bPagar").disabled'),false);

web/cart.js

@@ -1,5 +1,11 @@
-/* Browser-local cart recovery. Files are stored only for an unfinished cart, for 24h. */
+/* Browser-local cart recovery. Files are stored only for an unfinished cart, for 24h.
+   Only the items are kept: the customer's details and address are typed again
+   after a reload or a closed tab, so nothing personal stays in the browser. */
 (() => {
+  // A browser may put back what was typed before the reload without telling
+  // the page, which then shows values it does not know and cannot pay with.
+  const CAMPOS=['fCnpj','fZap','fMail','cepIn','eNome','eRua','eNum','eComp','eBairro','eCidade','eUf'];
+  for(const id of CAMPOS)if($(id))$(id).value='';
   let database,scope,timer,restoring=true;
   let signedOut=false;
   window.addEventListener('dtf-private-data-cleared',()=>{signedOut=true;clearTimeout(timer);pedido=[];itemAtual=null;folhas=[];artes=[];});
@@ -11,7 +17,7 @@
     const items=[...pedido,...(itemAtual?[itemAtual]:[])];
     try{
       if(!items.length){await transaction('readwrite',store=>store.delete(scope));return;}
-      await transaction('readwrite',store=>store.put({items,customer:{...cliente},delivery:{...entrega},expires:Date.now()+86400000},scope));
+      await transaction('readwrite',store=>store.put({items,expires:Date.now()+86400000},scope));
       notice.textContent='Carrinho salvo neste navegador por 24 horas. Você pode remover itens e adicionar outros após recarregar.';
     }catch(error){notice.textContent='Não foi possível salvar o carrinho neste navegador. Mantenha esta página aberta até enviar o pedido.';}
   }
@@ -30,16 +36,8 @@
       for(const key of records){const value=await transaction('readonly',store=>store.get(key));if(value.expires<Date.now())await transaction('readwrite',store=>store.delete(key));}
       const saved=await transaction('readonly',store=>store.get(scope));
       if(saved && !pedido.length && !itemAtual){
-        pedido=saved.items;cliente=saved.customer;entrega=saved.delivery;
+        pedido=saved.items;
-        // Freight must be quoted again; restored browser values are never final.
-        if(entrega.tipo==='frete'){entrega.cotado=false;entrega.valor=0;entrega.dias=null;}
-        for(const [id,key] of [['fCnpj','cnpj'],['fZap','zap'],['fMail','mail']])$(id).value=cliente[key];
-        $('cepIn').value=fmtCep(entrega.cep);
-        entrega.end=entrega.end||{};
-        for(const [id,key] of [['eNome','nome'],['eRua','rua'],['eNum','num'],['eComp','comp'],
-                               ['eBairro','bairro'],['eCidade','cidade'],['eUf','uf']])$(id).value=entrega.end[key]||'';
         $('atual').style.display='none';pintaEntrega();
-        if(entrega.tipo==='frete' && entrega.cep.length===8 && window.dtfFreight) window.dtfFreight();
         notice.textContent='Carrinho recuperado. Remova e adicione novamente um item se precisar alterar sua montagem.';
       }else{
         const account=await window.dtfApi('/account/me');

web/index.html

@@ -1097,13 +1097,13 @@ footer a:hover{color:var(--laranja2)}
           e é por ele que suas artes ficam guardadas para o próximo pedido.</p>
         <div class="campos">
           <div class="cp"><label>CNPJ</label>
-            <input id="fCnpj" inputmode="numeric" maxlength="18" placeholder="00.000.000/0000-00">
+            <input id="fCnpj" autocomplete="off" inputmode="numeric" maxlength="18" placeholder="00.000.000/0000-00">
             <span class="err" id="eCnpj"></span></div>
           <div class="cp"><label>WhatsApp</label>
-            <input id="fZap" inputmode="numeric" maxlength="15" placeholder="(16) 99999-9999">
+            <input id="fZap" autocomplete="off" inputmode="numeric" maxlength="15" placeholder="(16) 99999-9999">
             <span class="err" id="eZap"></span></div>
           <div class="cp larga"><label>E-mail para a nota</label>
-            <input id="fMail" type="email" placeholder="voce@empresa.com.br">
+            <input id="fMail" autocomplete="off" type="email" placeholder="voce@empresa.com.br">
             <span class="err" id="eMail"></span></div>
         </div>
       </div>
@@ -1131,24 +1131,24 @@ footer a:hover{color:var(--laranja2)}
           <div class="cep" id="cep">
             <label>CEP de entrega</label>
             <div class="cepL">
-              <input id="cepIn" inputmode="numeric" maxlength="9" placeholder="00000-000" autocomplete="postal-code">
+              <input id="cepIn" autocomplete="off" inputmode="numeric" maxlength="9" placeholder="00000-000">
             </div>
             <p id="cepMsg"></p>
             <div class="campos endereco" id="endereco">
               <div class="cp larga"><label>Quem recebe</label>
-                <input id="eNome" maxlength="120" autocomplete="name" placeholder="Nome ou empresa"></div>
+                <input id="eNome" autocomplete="off" maxlength="120" placeholder="Nome ou empresa"></div>
               <div class="cp larga"><label>Rua / avenida</label>
-                <input id="eRua" maxlength="160" autocomplete="address-line1"></div>
+                <input id="eRua" autocomplete="off" maxlength="160"></div>
               <div class="cp"><label>Número</label>
-                <input id="eNum" maxlength="20" placeholder="123 ou S/N"></div>
+                <input id="eNum" autocomplete="off" maxlength="20" placeholder="123 ou S/N"></div>
               <div class="cp"><label>Complemento (opcional)</label>
-                <input id="eComp" maxlength="80" autocomplete="address-line2"></div>
+                <input id="eComp" autocomplete="off" maxlength="80"></div>
               <div class="cp"><label>Bairro</label>
-                <input id="eBairro" maxlength="80"></div>
+                <input id="eBairro" autocomplete="off" maxlength="80"></div>
               <div class="cp"><label>Cidade</label>
-                <input id="eCidade" maxlength="80" autocomplete="address-level2"></div>
+                <input id="eCidade" autocomplete="off" maxlength="80"></div>
               <div class="cp"><label>UF</label>
-                <input id="eUf" maxlength="2" autocomplete="address-level1" placeholder="SP"></div>
+                <input id="eUf" autocomplete="off" maxlength="2" placeholder="SP"></div>
             </div>
             <p class="dicaEnd" id="eEnd"></p>
           </div>