Guest checkout option available without account creation

Forcing account creation before checkout is the single highest-impact abandonment driver in e-commerce — Baymard Institute's research consistently places mandatory registration at the top of checkout usability failures. OWASP A01:2021 (Broken Access Control) applies when auth middleware blocks a business-critical flow without a bypass: it is a misapplication of access control that excludes legitimate paying customers. CWE-306 (Missing Authentication for Critical Function) names the inverse failure — but the cart-checkout direction is an over-application, not an absence. Requiring signup before payment costs conversions directly and measurably.

Add a guest bypass at the checkout entry point in src/components/CheckoutInitiation.tsx (or src/app/checkout/page.tsx) that skips auth middleware when the user selects guest mode. Remove any unconditional redirect('/login') guards from src/app/checkout/layout.tsx and replace with a conditional:

// src/app/checkout/layout.tsx
if (!session && !searchParams.get('guest')) {
  redirect('/login?redirect=/checkout')
}

Then render both options at the checkout entry:

// src/components/CheckoutInitiation.tsx
<button onClick={() => router.push('/checkout?guest=1')}>Continue as Guest</button>
<button onClick={() => router.push('/login?redirect=/checkout')}>Sign In</button>

Ensure the guest path collects only the fields required to complete the order (email for receipt, shipping address, payment) without creating a password.