Fraud Protection: Stub form.submit globally in JS test setup

package.json

@@ -40,6 +40,9 @@
 	"jest": {
 		"testMatch": [
 			"**/tests/js/**/*.test.js"
+		],
+		"setupFilesAfterEnv": [
+			"./tests/js/setup.js"
 		]
 	}
 }

tests/js/add-payment-method.test.js

@@ -88,11 +88,6 @@ describe( 'add-payment-method', () => {
 		setupFraudProtection();
 		loadScript();
 
-		// Mock form.submit to prevent jsdom from incorrectly firing
-		// another submit event (real browsers don't fire submit on form.submit()).
-		const nativeSubmitSpy = jest.fn();
-		form.submit = nativeSubmitSpy;
-
 		// First pass: blocks submission.
 		const notCancelled = dispatchSubmit();
 		expect( notCancelled ).toBe( false );
@@ -109,24 +104,21 @@ describe( 'add-payment-method', () => {
 
 		// Re-dispatch reached bubble phase, then native submit fallback fired.
 		expect( bubbleSubmitSpy ).toHaveBeenCalledTimes( 1 );
-		expect( nativeSubmitSpy ).toHaveBeenCalledTimes( 1 );
+		expect( form.submit ).toHaveBeenCalledTimes( 1 );
 	} );
 
 	it( 'skips native submit when a gateway handler calls preventDefault', async () => {
 		setupFraudProtection();
 		loadScript();
 
-		const nativeSubmitSpy = jest.fn();
-		form.submit = nativeSubmitSpy;
-
 		// Simulate a gateway handler (e.g. Stripe) that prevents default
 		// to handle submission itself (tokenize, then submit).
 		form.addEventListener( 'submit', ( e ) => e.preventDefault() );
 
 		dispatchSubmit();
 		await flushPromises();
 
-		expect( nativeSubmitSpy ).not.toHaveBeenCalled();
+		expect( form.submit ).not.toHaveBeenCalled();
 	} );
 
 	it( 'stops other handlers via stopImmediatePropagation on first submission', () => {

tests/js/pay-for-order.test.js

@@ -88,11 +88,6 @@ describe( 'pay-for-order', () => {
 		setupFraudProtection();
 		loadScript();
 
-		// Mock form.submit to prevent jsdom from incorrectly firing
-		// another submit event (real browsers don't fire submit on form.submit()).
-		const nativeSubmitSpy = jest.fn();
-		form.submit = nativeSubmitSpy;
-
 		// First pass: blocks submission.
 		const notCancelled = dispatchSubmit();
 		expect( notCancelled ).toBe( false );
@@ -109,24 +104,21 @@ describe( 'pay-for-order', () => {
 
 		// Re-dispatch reached bubble phase, then native submit fallback fired.
 		expect( bubbleSubmitSpy ).toHaveBeenCalledTimes( 1 );
-		expect( nativeSubmitSpy ).toHaveBeenCalledTimes( 1 );
+		expect( form.submit ).toHaveBeenCalledTimes( 1 );
 	} );
 
 	it( 'skips native submit when a gateway handler calls preventDefault', async () => {
 		setupFraudProtection();
 		loadScript();
 
-		const nativeSubmitSpy = jest.fn();
-		form.submit = nativeSubmitSpy;
-
 		// Simulate a gateway handler (e.g. Stripe) that prevents default
 		// to handle submission itself (tokenize, then submit).
 		form.addEventListener( 'submit', ( e ) => e.preventDefault() );
 
 		dispatchSubmit();
 		await flushPromises();
 
-		expect( nativeSubmitSpy ).not.toHaveBeenCalled();
+		expect( form.submit ).not.toHaveBeenCalled();
 	} );
 
 	it( 'stops other handlers via stopImmediatePropagation on first submission', () => {

tests/js/setup.js

@@ -0,0 +1,7 @@
+// Stub HTMLFormElement.prototype.submit to prevent jsdom "Not implemented" errors.
+// Individual tests can override form.submit with their own spy when they need to assert on it.
+if ( typeof HTMLFormElement !== 'undefined' ) {
+	beforeEach( () => {
+		HTMLFormElement.prototype.submit = jest.fn();
+	} );
+}

tests/js/shortcode-checkout.test.js

@@ -25,17 +25,10 @@ let $;
 let $form;
 let mockAcquireSessionId;
 let mockReset;
-let submitSpy;
 
 beforeEach( () => {
 	document.body.innerHTML = '<form class="checkout"></form>';
 
-	// Stub native submit on this specific form element — jsdom doesn't
-	// implement it and jQuery's trigger('submit') calls it after firing
-	// jQuery handlers.
-	submitSpy = jest.fn();
-	document.querySelector( 'form.checkout' ).submit = submitSpy;
-
 	$ = require( 'jquery' );
 	window.jQuery = $;
 	$form = $( 'form.checkout' );
@@ -84,7 +77,7 @@ describe( 'shortcode-checkout', () => {
 		const result = $form.triggerHandler( 'checkout_place_order' );
 		expect( result ).toBe( false );
 		expect( mockAcquireSessionId ).toHaveBeenCalledTimes( 1 );
-		expect( submitSpy ).not.toHaveBeenCalled();
+		expect( document.querySelector( 'form.checkout' ).submit ).not.toHaveBeenCalled();
 
 		// Wait for the acquireSessionId promise to resolve.
 		await flushPromises();
@@ -95,7 +88,7 @@ describe( 'shortcode-checkout', () => {
 		expect( $field.val() ).toBe( 'sess-shortcode' );
 
 		// Form re-submitted.
-		expect( submitSpy ).toHaveBeenCalled();
+		expect( document.querySelector( 'form.checkout' ).submit ).toHaveBeenCalled();
 	} );
 
 	it( 'allows through on second pass when hidden field exists', () => {