1) GET /?outlet=O01 -> 200
B2953 B2949 B2948 
2) GET /?outlet=O01' OR '1'='1 -> 200
&#x27;O01&#x27; OR &#x27;1&#x27;=&#x27;1&#x27; is not an outlet id.
3) GET /NewBill -> antiforgery token of 155 characters
4) POST /NewBill (5 kg, cash Rp 20.000) -> 302 http://127.0.0.1:9501/Bill?id=B2954
5) GET /Bill?id=B2954 ->
Bill B2954 created. 
Bill B2954 
Customer Nabila Rahman 
Service 5 x Wash, dry &amp; fold (per kg) 
Arrived 2026-09-30 21:00:00 at outlet O01 
Status queued 
Charged Rp 40.000 
Paid Rp 20.000 
Balance Rp 20.000 
6) POST /NewBill (cash Rp 50.000 on a Rp 40.000 bill) -> 200 
A first payment must be between Rp 0 and the charge, Rp 40.000.
7) POST /NewBill (PayMethod=gopay, crafted by hand) -> 200 
Payment method &#x27;gopay&#x27; is not one of: cash, qris, transfer, credit.
8) POST /NewBill without the token -> 400
9) GET /?outlet=O01 -> first bills now: B2954 B2953 
10) GET /Bill?id=B2956 -> 404
