diff --git a/tests/ActivationTest.php b/tests/ActivationTest.php
new file mode 100644
index 0000000..19b3bf4
--- /dev/null
+++ b/tests/ActivationTest.php
@@ -0,0 +1,64 @@
+<?php
+
+use PHPUnit\Framework\TestCase;
+
+final class ActivationTest extends TestCase {
+    protected function setUp(): void {
+        spiff_test_reset();
+    }
+
+    private function addAdmin() {
+        $GLOBALS['spiff_test_users'][] = (object) array(
+            'ID' => 7,
+            'data' => (object) array('user_email' => 'admin@shop.test'),
+        );
+        $GLOBALS['spiff_test_user_meta'][7] = array(
+            'billing_phone' => '0400 000 000',
+            'first_name' => 'Jamie',
+            'last_name' => 'Smith',
+        );
+    }
+
+    public function testFirstActivationNotifiesSpiff() {
+        $this->addAdmin();
+
+        spiff_activation_hook();
+
+        $this->assertCount(1, $GLOBALS['spiff_test_requests']);
+        $request = $GLOBALS['spiff_test_requests'][0];
+        $this->assertSame(SPIFF_TEST_AP_BASE . '/graphql', $request['url']);
+        $body = json_decode($request['args']['body'], true);
+        $this->assertSame('InstallNotify', $body['operationName']);
+        $this->assertSame(array(
+            'type' => 'WooCommerce',
+            'shopName' => 'https://shop.test',
+            'owner' => 'Jamie Smith',
+            'email' => 'admin@shop.test',
+            'phone' => '0400 000 000',
+        ), $body['variables']['input']);
+    }
+
+    public function testFirstActivationIsRecorded() {
+        $this->addAdmin();
+
+        spiff_activation_hook();
+
+        $this->assertSame('1', get_option('spiff_plugin_was_activated'));
+    }
+
+    public function testLaterActivationsDoNotNotifySpiff() {
+        $this->addAdmin();
+        $GLOBALS['spiff_test_options']['spiff_plugin_was_activated'] = '1';
+
+        spiff_activation_hook();
+
+        $this->assertCount(0, $GLOBALS['spiff_test_requests']);
+    }
+
+    public function testActivationWithoutAdminsDoesNotNotifySpiff() {
+        spiff_activation_hook();
+
+        $this->assertCount(0, $GLOBALS['spiff_test_requests']);
+        $this->assertSame('1', get_option('spiff_plugin_was_activated'));
+    }
+}
diff --git a/tests/AdminTest.php b/tests/AdminTest.php
new file mode 100644
index 0000000..7b95aef
--- /dev/null
+++ b/tests/AdminTest.php
@@ -0,0 +1,81 @@
+<?php
+
+use PHPUnit\Framework\TestCase;
+
+final class AdminTest extends TestCase {
+    protected function setUp(): void {
+        spiff_test_reset();
+    }
+
+    public function testCreatesAdminMenuPage() {
+        spiff_create_admin_menu();
+
+        $this->assertSame(array(array(
+            'page_title' => 'Spiff Connect',
+            'menu_title' => 'Spiff Connect',
+            'capability' => 'administrator',
+            'menu_slug' => 'spiff-connect',
+            'callback' => 'spiff_admin_menu_html',
+        )), $GLOBALS['spiff_test_menu_pages']);
+        $this->assertTrue(spiff_test_has_action('admin_init', 'spiff_register_admin_settings'));
+    }
+
+    public function testRegistersSettings() {
+        spiff_register_admin_settings();
+
+        $this->assertSame(array(
+            'spiff_application_key',
+            'spiff_infrastructure',
+            'spiff_show_customer_selections_in_cart',
+            'spiff_show_preview_images_in_cart',
+            'spiff_non_bulk_text',
+            'spiff_font_size',
+            'spiff_font_weight',
+            'spiff_text_color',
+            'spiff_background_color',
+            'spiff_width',
+            'spiff_height',
+            'spiff_customer_portal_button_text',
+            'spiff_customer_portal_button_font_size',
+            'spiff_customer_portal_button_font_weight',
+            'spiff_customer_portal_button_text_color',
+            'spiff_customer_portal_button_background_color',
+            'spiff_customer_portal_button_width',
+            'spiff_customer_portal_button_height',
+        ), $GLOBALS['spiff_test_settings']['spiff-settings-group']);
+    }
+
+    public function testAddsProductFields() {
+        spiff_create_admin_product_fields();
+
+        $fields = $GLOBALS['spiff_test_product_fields'];
+        $this->assertCount(2, $fields);
+        $this->assertSame('checkbox', $fields[0]['type']);
+        $this->assertSame('spiff_enabled', $fields[0]['id']);
+        $this->assertSame('text', $fields[1]['type']);
+        $this->assertSame('spiff_integration_product_id', $fields[1]['id']);
+    }
+
+    public function testSavesEnabledProductFields() {
+        $product = new Spiff_Test_Product(42);
+        $GLOBALS['spiff_test_products'][42] = $product;
+        $_POST = array('spiff_enabled' => 'yes', 'spiff_integration_product_id' => ' integration-product-1 ');
+
+        spiff_save_admin_product_fields(42);
+
+        $this->assertSame('yes', $product->meta['spiff_enabled']);
+        $this->assertSame('integration-product-1', $product->meta['spiff_integration_product_id']);
+        $this->assertTrue($product->saved);
+    }
+
+    public function testSavesDisabledProductFieldsWhenCheckboxIsUnticked() {
+        $product = new Spiff_Test_Product(42, array('spiff_enabled' => 'yes'));
+        $GLOBALS['spiff_test_products'][42] = $product;
+        $_POST = array('spiff_integration_product_id' => 'integration-product-1');
+
+        spiff_save_admin_product_fields(42);
+
+        $this->assertSame('no', $product->meta['spiff_enabled']);
+        $this->assertTrue($product->saved);
+    }
+}
diff --git a/tests/CartTest.php b/tests/CartTest.php
new file mode 100644
index 0000000..b9e862d
--- /dev/null
+++ b/tests/CartTest.php
@@ -0,0 +1,191 @@
+<?php
+
+use PHPUnit\Framework\TestCase;
+
+final class CartTest extends TestCase {
+    protected function setUp(): void {
+        spiff_test_reset();
+        $GLOBALS['spiff_test_options']['spiff_application_key'] = 'test-application-key';
+    }
+
+    private function queueTransaction() {
+        spiff_test_queue_response(array('data' => array('transactions' => array(array(
+            'priceModifierTotal' => 250,
+            'product' => array(
+                'basePrice' => 1000,
+                'integrationProducts' => array(array('id' => 'integration-product-1')),
+            ),
+        )))));
+    }
+
+    private function postCartItemDetails($details) {
+        // WordPress adds slashes to request data, which the plugin strips.
+        $_POST['spiff_create_cart_item_details'] = addslashes(json_encode($details));
+    }
+
+    // Adding designs to the cart.
+
+    public function testAddsDesignToCart() {
+        $this->queueTransaction();
+        $this->postCartItemDetails(array(
+            'transactionId' => 'transaction-1',
+            'wooProductId' => '42',
+            'exportedData' => array('Name' => array('value' => 'Jamie')),
+        ));
+
+        spiff_create_cart_item();
+
+        $this->assertSame(array(array(
+            'product_id' => '42',
+            'quantity' => 1,
+            'variation_id' => '',
+            'variation' => '',
+            'cart_item_data' => array(
+                'spiff_exported_data' => array('Name' => 'Jamie'),
+                'spiff_transaction_id' => 'transaction-1',
+                'spiff_item_price' => 12.5,
+            ),
+        )), $GLOBALS['woocommerce']->cart->added);
+        $this->assertSame(1, $GLOBALS['spiff_test_wp_die_calls']);
+    }
+
+    public function testRequestsTransactionFromSpiff() {
+        $this->queueTransaction();
+        $this->postCartItemDetails(array(
+            'transactionId' => 'transaction-1',
+            'wooProductId' => '42',
+            'exportedData' => array(),
+        ));
+
+        spiff_create_cart_item();
+
+        $request = $GLOBALS['spiff_test_requests'][0];
+        $this->assertSame(SPIFF_TEST_AP_BASE . '/graphql', $request['url']);
+        $this->assertSame('test-application-key', $request['args']['headers']['X-Application-Key']);
+        $this->assertStringContainsString('transaction-1', json_decode($request['args']['body'], true)['query']);
+    }
+
+    public function testFindsProductFromIntegrationProductWhenProductIdIsMissing() {
+        $GLOBALS['spiff_test_products'] = array(
+            41 => new Spiff_Test_Product(41, array('spiff_integration_product_id' => 'integration-product-other')),
+            42 => new Spiff_Test_Product(42, array('spiff_integration_product_id' => 'integration-product-1')),
+        );
+        $this->queueTransaction();
+        $this->postCartItemDetails(array(
+            'transactionId' => 'transaction-1',
+            'exportedData' => array(),
+        ));
+
+        spiff_create_cart_item();
+
+        $this->assertSame('42', $GLOBALS['woocommerce']->cart->added[0]['product_id']);
+    }
+
+    public function testSanitisesCustomerSelections() {
+        $this->queueTransaction();
+        $this->postCartItemDetails(array(
+            'transactionId' => 'transaction-1',
+            'wooProductId' => '42',
+            'exportedData' => array('<b>Name</b>' => array('value' => ' <i>Jamie</i> ')),
+        ));
+
+        spiff_create_cart_item();
+
+        $this->assertSame(
+            array('Name' => 'Jamie'),
+            $GLOBALS['woocommerce']->cart->added[0]['cart_item_data']['spiff_exported_data']
+        );
+    }
+
+    public function testDoesNothingWithoutCartItemDetails() {
+        spiff_create_cart_item();
+
+        $this->assertCount(0, $GLOBALS['spiff_test_requests']);
+        $this->assertCount(0, $GLOBALS['woocommerce']->cart->added);
+        $this->assertSame(1, $GLOBALS['spiff_test_wp_die_calls']);
+    }
+
+    // Cart prices.
+
+    public function testSetsPriceOfSpiffItems() {
+        $spiff_product = new Spiff_Test_Product(42);
+        $other_product = new Spiff_Test_Product(43);
+        $GLOBALS['woocommerce']->cart->items = array(
+            array('data' => $spiff_product, 'spiff_item_price' => 12.5),
+            array('data' => $other_product),
+        );
+
+        spiff_handle_cart_item_price($GLOBALS['woocommerce']->cart);
+
+        $this->assertSame(12.5, $spiff_product->price);
+        $this->assertNull($other_product->price);
+    }
+
+    // Customer selections in cart.
+
+    public function testShowsCustomerSelectionsInCart() {
+        $cart_data = array(array('name' => 'Colour', 'value' => 'Red'));
+        $cart_item = array('spiff_exported_data' => array('Name' => 'Jamie', 'Message' => '<b>Hi</b>'));
+
+        $this->assertSame(array(
+            array('name' => 'Colour', 'value' => 'Red'),
+            array('name' => 'Name', 'value' => 'Jamie'),
+            array('name' => 'Message', 'value' => '&lt;b&gt;Hi&lt;/b&gt;'),
+        ), spiff_show_metadata_in_cart($cart_data, $cart_item));
+    }
+
+    // Preview images in cart.
+
+    public function testShowsPreviewImageForSpiffItems() {
+        spiff_test_queue_response(array('data' => array('transactions' => array(array(
+            'previewImageLink' => 'https://images.spiff.test/preview.png',
+        )))));
+
+        $image = spiff_show_preview_image_in_cart('<img src="product.png" />', array('spiff_transaction_id' => 'transaction-1'), 'key');
+
+        $this->assertSame('<img src="https://images.spiff.test/preview.png" alt="preview" />', $image);
+        $body = json_decode($GLOBALS['spiff_test_requests'][0]['args']['body'], true);
+        $this->assertSame(array('ids' => array('transaction-1')), $body['variables']);
+    }
+
+    public function testKeepsProductImageWhenSpiffHasNoPreview() {
+        spiff_test_queue_response(array('data' => array('transactions' => array(array('previewImageLink' => null)))));
+
+        $image = spiff_show_preview_image_in_cart('<img src="product.png" />', array('spiff_transaction_id' => 'transaction-1'), 'key');
+
+        $this->assertSame('<img src="product.png" />', $image);
+    }
+
+    public function testKeepsProductImageWhenSpiffRequestFails() {
+        spiff_test_queue_response(array('errors' => array(array('message' => 'Unauthorised'))), 401);
+
+        $image = spiff_show_preview_image_in_cart('<img src="product.png" />', array('spiff_transaction_id' => 'transaction-1'), 'key');
+
+        $this->assertSame('<img src="product.png" />', $image);
+    }
+
+    public function testKeepsProductImageForOtherItems() {
+        $image = spiff_show_preview_image_in_cart('<img src="product.png" />', array(), 'key');
+
+        $this->assertSame('<img src="product.png" />', $image);
+        $this->assertCount(0, $GLOBALS['spiff_test_requests']);
+    }
+
+    // Checkout.
+
+    public function testCopiesTransactionIdToOrderItem() {
+        $order_item = new Spiff_Test_Order_Item(array(), 1);
+
+        spiff_add_cart_item_attributes_to_order_item($order_item, 'key', array('spiff_transaction_id' => 'transaction-1'), null);
+
+        $this->assertSame('transaction-1', $order_item->get_meta('spiff_transaction_id'));
+    }
+
+    public function testLeavesOtherOrderItemsAlone() {
+        $order_item = new Spiff_Test_Order_Item(array(), 1);
+
+        spiff_add_cart_item_attributes_to_order_item($order_item, 'key', array(), null);
+
+        $this->assertSame(array(), $order_item->meta);
+    }
+}
diff --git a/tests/CreateOrderTest.php b/tests/CreateOrderTest.php
index e143da2..ab69c9d 100644
--- a/tests/CreateOrderTest.php
+++ b/tests/CreateOrderTest.php
@@ -96,6 +96,71 @@ public function testNoRequestIsSentWithoutSpiffItems() {
         $this->assertCount(0, $GLOBALS['spiff_test_requests']);
     }
 
+    public function testSendsCustomerDetailsInExternalData() {
+        $GLOBALS['spiff_test_orders'][123] = new Spiff_Test_Order(123, 'VEG-1042', array($this->spiffItem('transaction-1')), true, array(
+            'billing_email' => 'jamie@example.test',
+            'billing_phone' => '0400 000 000',
+            'customer_note' => 'Leave at the door',
+            'coupon_codes' => array('SAVE10'),
+            'billing_first_name' => 'Jamie',
+            'billing_city' => 'Melbourne',
+            'shipping_address_1' => '1 Example St',
+            'shipping_state' => 'VIC',
+            'shipping_postcode' => '3000',
+            'shipping_country' => 'AU',
+        ));
+
+        spiff_create_order(123);
+
+        $external_data = $this->sentVariables()['externalData'];
+        $this->assertSame('jamie@example.test', $external_data['customerEmail']);
+        $this->assertSame('0400 000 000', $external_data['customerPhone']);
+        $this->assertSame('Leave at the door', $external_data['note']);
+        $this->assertSame(array('SAVE10'), $external_data['discountCodes']);
+        $this->assertSame('Jamie', $external_data['billingAddress']['firstName']);
+        $this->assertSame('Melbourne', $external_data['billingAddress']['city']);
+        $this->assertSame('1 Example St', $external_data['shippingAddress']['address1']);
+        $this->assertSame('VIC', $external_data['shippingAddress']['province']);
+        $this->assertSame('VIC', $external_data['shippingAddress']['provinceCode']);
+        $this->assertSame('3000', $external_data['shippingAddress']['zip']);
+        $this->assertSame('AU', $external_data['shippingAddress']['country']);
+        $this->assertSame('AU', $external_data['shippingAddress']['countryCode']);
+    }
+
+    public function testSendsOrderCreateMutationToAustraliaByDefault() {
+        $this->addOrder(123, 'VEG-1042', array($this->spiffItem('transaction-1')));
+
+        spiff_create_order(123);
+
+        $request = $GLOBALS['spiff_test_requests'][0];
+        $this->assertSame(SPIFF_TEST_AP_BASE . '/graphql', $request['url']);
+        $this->assertSame('OrderCreate', json_decode($request['args']['body'], true)['operationName']);
+    }
+
+    public function testSendsOrderToUnitedStatesWhenConfigured() {
+        $GLOBALS['spiff_test_options']['spiff_infrastructure'] = 'US';
+        $this->addOrder(123, 'VEG-1042', array($this->spiffItem('transaction-1')));
+
+        spiff_create_order(123);
+
+        $this->assertSame(SPIFF_TEST_US_BASE . '/graphql', $GLOBALS['spiff_test_requests'][0]['url']);
+    }
+
+    public function testFailedRequestDoesNotStopCheckout() {
+        spiff_test_queue_response(array('errors' => array(array('message' => 'Unauthorised'))), 401);
+        $this->addOrder(123, 'VEG-1042', array($this->spiffItem('transaction-1')));
+        $log = ini_get('error_log');
+        ini_set('error_log', '/dev/null');
+
+        try {
+            spiff_create_order(123);
+        } finally {
+            ini_set('error_log', $log);
+        }
+
+        $this->assertCount(1, $GLOBALS['spiff_test_requests']);
+    }
+
     public function testSendsPaidFlagAndApplicationKey() {
         $this->addOrder(123, 'VEG-1042', array($this->spiffItem('transaction-1')), false);
 
diff --git a/tests/ProductPageTest.php b/tests/ProductPageTest.php
new file mode 100644
index 0000000..06dfec8
--- /dev/null
+++ b/tests/ProductPageTest.php
@@ -0,0 +1,149 @@
+<?php
+
+use PHPUnit\Framework\TestCase;
+
+final class ProductPageTest extends TestCase {
+    const ADD_TO_CART_BUTTON = '<a href="?add-to-cart=42" data-quantity="1" class="button add_to_cart_button ajax_add_to_cart" aria-label="Add to your cart" rel="nofollow">Add to cart</a>';
+
+    protected function setUp(): void {
+        spiff_test_reset();
+        $GLOBALS['spiff_test_options']['spiff_application_key'] = 'test-application-key';
+    }
+
+    private function enabledProduct() {
+        return new Spiff_Test_Product(42, array(
+            'spiff_enabled' => 'yes',
+            'spiff_integration_product_id' => 'integration-product-1',
+        ));
+    }
+
+    private function renderCreateDesignButton() {
+        ob_start();
+        spiff_append_create_design_button_on_product_page();
+        return ob_get_clean();
+    }
+
+    // Product list.
+
+    public function testLeavesListButtonAloneWhenSpiffIsDisabled() {
+        $product = new Spiff_Test_Product(42, array('spiff_enabled' => 'no'));
+
+        $this->assertSame(self::ADD_TO_CART_BUTTON, spiff_replace_default_button_on_product_list(self::ADD_TO_CART_BUTTON, $product));
+    }
+
+    public function testReplacesListButtonWithLinkToProductWhenSpiffIsEnabled() {
+        $button = spiff_replace_default_button_on_product_list(self::ADD_TO_CART_BUTTON, $this->enabledProduct());
+
+        $xml = simplexml_load_string($button);
+        $this->assertSame('https://shop.test/product/42/', (string) $xml['href']);
+        $this->assertSame('View details', (string) $xml['aria-label']);
+        $this->assertSame('View details', (string) $xml);
+        $this->assertStringNotContainsString('ajax_add_to_cart', (string) $xml['class']);
+        $this->assertStringContainsString('add_to_cart_button', (string) $xml['class']);
+    }
+
+    // Single product page.
+
+    public function testSwapsAddToCartForSpiffButtonWhenSpiffIsEnabled() {
+        add_action('woocommerce_single_product_summary', 'woocommerce_template_single_add_to_cart', 30);
+        $GLOBALS['product'] = $this->enabledProduct();
+
+        spiff_replace_default_element_on_product_page();
+
+        $this->assertFalse(spiff_test_has_action('woocommerce_single_product_summary', 'woocommerce_template_single_add_to_cart', 30));
+        $this->assertTrue(spiff_test_has_action('woocommerce_single_product_summary', 'spiff_append_create_design_button_on_product_page', 35));
+    }
+
+    public function testKeepsAddToCartWhenSpiffIsDisabled() {
+        add_action('woocommerce_single_product_summary', 'woocommerce_template_single_add_to_cart', 30);
+        $GLOBALS['product'] = new Spiff_Test_Product(42, array('spiff_enabled' => 'no'));
+
+        spiff_replace_default_element_on_product_page();
+
+        $this->assertTrue(spiff_test_has_action('woocommerce_single_product_summary', 'woocommerce_template_single_add_to_cart', 30));
+        $this->assertFalse(spiff_test_has_action('woocommerce_single_product_summary', 'spiff_append_create_design_button_on_product_page', 35));
+    }
+
+    public function testRendersCreateDesignButton() {
+        $GLOBALS['product'] = $this->enabledProduct();
+
+        $html = $this->renderCreateDesignButton();
+
+        $this->assertStringContainsString('<div class="spiff-button-integration-product-integration-product-1"></div>', $html);
+        $this->assertStringContainsString('window.spiffAppendCreateDesignButton(', $html);
+        $this->assertStringContainsString('"42"', $html);
+        $this->assertStringContainsString('"integration-product-1"', $html);
+        $this->assertStringContainsString('"AUD"', $html);
+        $this->assertStringContainsString('"https://shop.test/cart/"', $html);
+        $this->assertStringContainsString('"test-application-key"', $html);
+    }
+
+    public function testCreateDesignButtonUsesDefaultStyles() {
+        $GLOBALS['product'] = $this->enabledProduct();
+
+        $html = $this->renderCreateDesignButton();
+
+        $this->assertStringContainsString(json_encode(array(
+            'personalizeButtonText' => 'Personalize',
+            'size' => '20px',
+            'weight' => '700',
+            'textColor' => '#fff',
+            'backgroundColor' => '#da1c5c',
+            'width' => '100%',
+            'height' => '50px',
+        )), $html);
+    }
+
+    public function testCreateDesignButtonUsesConfiguredStyles() {
+        $GLOBALS['product'] = $this->enabledProduct();
+        $GLOBALS['spiff_test_options'] += array(
+            'spiff_non_bulk_text' => 'Customise',
+            'spiff_font_size' => '16px',
+            'spiff_font_weight' => '400',
+            'spiff_text_color' => '#000',
+            'spiff_background_color' => '#ff0',
+            'spiff_width' => '50%',
+            'spiff_height' => '40px',
+        );
+
+        $html = $this->renderCreateDesignButton();
+
+        $this->assertStringContainsString(json_encode(array(
+            'personalizeButtonText' => 'Customise',
+            'size' => '16px',
+            'weight' => '400',
+            'textColor' => '#000',
+            'backgroundColor' => '#ff0',
+            'width' => '50%',
+            'height' => '40px',
+        )), $html);
+    }
+
+    public function testDoesNotRenderCreateDesignButtonWhenSpiffIsDisabled() {
+        $GLOBALS['product'] = new Spiff_Test_Product(42, array('spiff_enabled' => 'no'));
+
+        $this->assertSame('', $this->renderCreateDesignButton());
+    }
+
+    // Scripts.
+
+    public function testEnqueuesScripts() {
+        spiff_enqueue_ecommerce_client();
+
+        $this->assertSame(array(
+            'spiff-ecommerce-client' => 'https://shop.test/wp-content/plugins/spiff-connect/public/js/api.js',
+            'spiff-create-design-button' => 'https://shop.test/wp-content/plugins/spiff-connect/public/js/create-design-button.js',
+        ), $GLOBALS['spiff_test_scripts']);
+    }
+
+    public function testPassesAjaxUrlAndRegionToScript() {
+        $GLOBALS['spiff_test_options']['spiff_infrastructure'] = 'US';
+
+        spiff_enqueue_ecommerce_client();
+
+        $this->assertSame(array(
+            'ajax_url' => 'https://shop.test/wp-admin/admin-ajax.php',
+            'region_code' => 'us',
+        ), $GLOBALS['spiff_test_localized_scripts']['spiff-create-design-button']['ajax_object']);
+    }
+}
diff --git a/tests/RequestsTest.php b/tests/RequestsTest.php
index a4c8a24..a7788d7 100644
--- a/tests/RequestsTest.php
+++ b/tests/RequestsTest.php
@@ -3,7 +3,46 @@
 use PHPUnit\Framework\TestCase;
 
 final class RequestsTest extends TestCase {
-    public function testDummy() {
-        $this->assertEquals(true, true);
+    protected function setUp(): void {
+        spiff_test_reset();
+    }
+
+    public function testRequestHeadersIncludeApplicationKeyAndJsonContentType() {
+        $headers = spiff_request_headers('test-application-key', '{}', SPIFF_GRAPHQL_PATH);
+
+        $this->assertSame('test-application-key', $headers['X-Application-Key']);
+        $this->assertSame('application/json', $headers['Content-Type']);
+    }
+
+    public function testRequestHeadersIncludeGmtDate() {
+        $headers = spiff_request_headers('test-application-key', '{}', SPIFF_GRAPHQL_PATH);
+
+        $this->assertMatchesRegularExpression('/^[A-Z][a-z]{2}, \d{2} [A-Z][a-z]{2} \d{4} \d{2}:\d{2}:\d{2} GMT$/', $headers['Date']);
+    }
+
+    public function testHexToBase64() {
+        $this->assertSame(base64_encode('Hello'), spiff_hex_to_base64('48656c6c6f'));
+    }
+
+    public function testGraphqlUrlDefaultsToAustralia() {
+        $this->assertSame(SPIFF_TEST_AP_BASE . '/graphql', spiff_get_graphql_url());
+    }
+
+    public function testGraphqlUrlForAustralia() {
+        $GLOBALS['spiff_test_options']['spiff_infrastructure'] = 'AP';
+
+        $this->assertSame(SPIFF_TEST_AP_BASE . '/graphql', spiff_get_graphql_url());
+    }
+
+    public function testGraphqlUrlForUnitedStates() {
+        $GLOBALS['spiff_test_options']['spiff_infrastructure'] = 'US';
+
+        $this->assertSame(SPIFF_TEST_US_BASE . '/graphql', spiff_get_graphql_url());
+    }
+
+    public function testLegacyAustraliaInfrastructureFallsBackToAustralia() {
+        $GLOBALS['spiff_test_options']['spiff_infrastructure'] = 'AU';
+
+        $this->assertSame(SPIFF_TEST_AP_BASE . '/graphql', spiff_get_graphql_url());
     }
 }
diff --git a/tests/ShortcodeTest.php b/tests/ShortcodeTest.php
new file mode 100644
index 0000000..d57248a
--- /dev/null
+++ b/tests/ShortcodeTest.php
@@ -0,0 +1,60 @@
+<?php
+
+use PHPUnit\Framework\TestCase;
+
+final class ShortcodeTest extends TestCase {
+    protected function setUp(): void {
+        spiff_test_reset();
+        $GLOBALS['spiff_test_options']['spiff_application_key'] = 'test-application-key';
+    }
+
+    public function testCustomerPortalButtonLaunchesPortal() {
+        $html = spiff_customer_portal_button_shortcode_handler(array());
+
+        $this->assertStringContainsString('class="spiff-customer-portal-button"', $html);
+        $this->assertStringContainsString("window.spiffLaunchCustomerPortal('test-application-key', 'https://shop.test/cart/')", $html);
+    }
+
+    public function testCustomerPortalButtonUsesDefaults() {
+        $html = spiff_customer_portal_button_shortcode_handler(array());
+
+        $this->assertStringContainsString('Customer Portal', $html);
+        $this->assertStringContainsString('font-size: 20px;', $html);
+        $this->assertStringContainsString('background: #da1c5c;', $html);
+        $this->assertStringContainsString('color: #fff;', $html);
+        $this->assertStringContainsString('font-weight: 700;', $html);
+        $this->assertStringContainsString('width: 100%;', $html);
+        $this->assertStringContainsString('height: 50px;', $html);
+    }
+
+    public function testCustomerPortalButtonUsesConfiguredStyles() {
+        $GLOBALS['spiff_test_options'] += array(
+            'spiff_customer_portal_button_text' => 'My Designs',
+            'spiff_customer_portal_button_font_size' => '16px',
+            'spiff_customer_portal_button_background_color' => '#000',
+            'spiff_customer_portal_button_text_color' => '#ff0',
+            'spiff_customer_portal_button_font_weight' => '400',
+            'spiff_customer_portal_button_width' => '50%',
+            'spiff_customer_portal_button_height' => '40px',
+        );
+
+        $html = spiff_customer_portal_button_shortcode_handler(array());
+
+        $this->assertStringContainsString('My Designs', $html);
+        $this->assertStringContainsString('font-size: 16px;', $html);
+        $this->assertStringContainsString('background: #000;', $html);
+        $this->assertStringContainsString('color: #ff0;', $html);
+        $this->assertStringContainsString('font-weight: 400;', $html);
+        $this->assertStringContainsString('width: 50%;', $html);
+        $this->assertStringContainsString('height: 40px;', $html);
+        $this->assertStringNotContainsString('Customer Portal', $html);
+    }
+
+    public function testCustomerPortalButtonEscapesConfiguredText() {
+        $GLOBALS['spiff_test_options']['spiff_customer_portal_button_text'] = '<script>alert(1)</script>';
+
+        $html = spiff_customer_portal_button_shortcode_handler(array());
+
+        $this->assertStringNotContainsString('<script>', $html);
+    }
+}
diff --git a/tests/bootstrap.php b/tests/bootstrap.php
index 325938c..b62d531 100644
--- a/tests/bootstrap.php
+++ b/tests/bootstrap.php
@@ -4,16 +4,49 @@
  * Minimal WordPress and WooCommerce stand-ins so the plugin can be loaded and exercised outside of WordPress.
  */
 
-$GLOBALS['spiff_test_options'] = array();
+define('SPIFF_TEST_AP_BASE', 'https://ap.spiff.test');
+define('SPIFF_TEST_US_BASE', 'https://us.spiff.test');
+putenv('SPIFF_API_AP_BASE=' . SPIFF_TEST_AP_BASE);
+putenv('SPIFF_API_US_BASE=' . SPIFF_TEST_US_BASE);
+
 $GLOBALS['spiff_test_filters'] = array();
-$GLOBALS['spiff_test_requests'] = array();
-$GLOBALS['spiff_test_orders'] = array();
 
 function spiff_test_reset() {
     $GLOBALS['spiff_test_options'] = array();
     $GLOBALS['spiff_test_requests'] = array();
+    $GLOBALS['spiff_test_responses'] = array();
     $GLOBALS['spiff_test_orders'] = array();
-    unset($GLOBALS['spiff_test_filters']['spiff_order_external_id']);
+    $GLOBALS['spiff_test_products'] = array();
+    $GLOBALS['spiff_test_users'] = array();
+    $GLOBALS['spiff_test_user_meta'] = array();
+    $GLOBALS['spiff_test_menu_pages'] = array();
+    $GLOBALS['spiff_test_settings'] = array();
+    $GLOBALS['spiff_test_product_fields'] = array();
+    $GLOBALS['spiff_test_scripts'] = array();
+    $GLOBALS['spiff_test_localized_scripts'] = array();
+    $GLOBALS['spiff_test_wp_die_calls'] = 0;
+    $GLOBALS['woocommerce'] = (object) array('cart' => new Spiff_Test_Cart());
+    $GLOBALS['product'] = null;
+    $_POST = array();
+    // Restore the hooks the plugin registered when it was loaded, dropping any added by tests.
+    $GLOBALS['spiff_test_filters'] = $GLOBALS['spiff_test_initial_filters'];
+}
+
+// Queue a response for the next wp_remote_post call.
+function spiff_test_queue_response($data, $code = 200) {
+    $GLOBALS['spiff_test_responses'][] = array(
+        'response' => array('code' => $code),
+        'body' => json_encode($data),
+    );
+}
+
+function spiff_test_has_action($tag, $callback, $priority = 10) {
+    foreach ($GLOBALS['spiff_test_filters'][$tag][$priority] ?? array() as $registered) {
+        if ($registered[0] === $callback) {
+            return true;
+        }
+    }
+    return false;
 }
 
 // Hooks.
@@ -27,6 +60,16 @@ function add_action($tag, $callback, $priority = 10, $accepted_args = 1) {
     return add_filter($tag, $callback, $priority, $accepted_args);
 }
 
+function remove_action($tag, $callback, $priority = 10) {
+    foreach ($GLOBALS['spiff_test_filters'][$tag][$priority] ?? array() as $index => $registered) {
+        if ($registered[0] === $callback) {
+            unset($GLOBALS['spiff_test_filters'][$tag][$priority][$index]);
+            return true;
+        }
+    }
+    return false;
+}
+
 function apply_filters($tag, $value, ...$args) {
     if (empty($GLOBALS['spiff_test_filters'][$tag])) {
         return $value;
@@ -44,20 +87,103 @@ function apply_filters($tag, $value, ...$args) {
 function register_activation_hook($file, $callback) {}
 function add_shortcode($tag, $callback) {}
 
-// Options.
+// Options and admin.
 
 function get_option($name, $default = false) {
     return array_key_exists($name, $GLOBALS['spiff_test_options']) ? $GLOBALS['spiff_test_options'][$name] : $default;
 }
 
+function add_option($name, $value) {
+    if (array_key_exists($name, $GLOBALS['spiff_test_options'])) {
+        return false;
+    }
+    $GLOBALS['spiff_test_options'][$name] = $value;
+    return true;
+}
+
+function register_setting($group, $name) {
+    $GLOBALS['spiff_test_settings'][$group][] = $name;
+}
+
+function add_menu_page($page_title, $menu_title, $capability, $menu_slug, $callback) {
+    $GLOBALS['spiff_test_menu_pages'][] = compact('page_title', 'menu_title', 'capability', 'menu_slug', 'callback');
+}
+
+function get_home_url() {
+    return 'https://shop.test';
+}
+
+function get_users($args) {
+    return $GLOBALS['spiff_test_users'];
+}
+
+function get_user_meta($user_id, $key, $single = false) {
+    return $GLOBALS['spiff_test_user_meta'][$user_id][$key] ?? '';
+}
+
+// URLs and scripts.
+
 function plugin_dir_path($file) {
     return dirname($file) . '/';
 }
 
-// HTTP. Requests are recorded rather than sent.
+function plugin_dir_url($file) {
+    return 'https://shop.test/wp-content/plugins/spiff-connect/';
+}
+
+function admin_url($path = '') {
+    return 'https://shop.test/wp-admin/' . $path;
+}
+
+function wp_enqueue_script($handle, $src, $deps = array(), $ver = false) {
+    $GLOBALS['spiff_test_scripts'][$handle] = $src;
+}
+
+function wp_localize_script($handle, $name, $data) {
+    $GLOBALS['spiff_test_localized_scripts'][$handle][$name] = $data;
+}
+
+// Sanitising and escaping. Simplified versions of the WordPress functions.
+
+function sanitize_text_field($value) {
+    return trim(strip_tags((string) $value));
+}
+
+function rest_sanitize_boolean($value) {
+    return is_string($value) && strtolower($value) === 'false' ? false : (bool) $value;
+}
+
+function stripslashes_deep($value) {
+    return is_array($value) ? array_map('stripslashes_deep', $value) : stripslashes($value);
+}
+
+function esc_attr($value) {
+    return htmlspecialchars((string) $value, ENT_QUOTES);
+}
+
+function esc_html($value) {
+    return htmlspecialchars((string) $value, ENT_QUOTES);
+}
+
+function esc_js($value) {
+    return addslashes(htmlspecialchars((string) $value, ENT_COMPAT));
+}
+
+function esc_url($value) {
+    return (string) $value;
+}
+
+function wp_die() {
+    $GLOBALS['spiff_test_wp_die_calls']++;
+}
+
+// HTTP. Requests are recorded rather than sent, and answered from the response queue.
 
 function wp_remote_post($url, $args) {
     $GLOBALS['spiff_test_requests'][] = array('url' => $url, 'args' => $args);
+    if (!empty($GLOBALS['spiff_test_responses'])) {
+        return array_shift($GLOBALS['spiff_test_responses']);
+    }
     return array(
         'response' => array('code' => 200),
         'body' => json_encode(array('data' => array('orderCreate' => array('id' => 'spiff-order-id')))),
@@ -78,8 +204,85 @@ function wc_get_order($order_id) {
     return $GLOBALS['spiff_test_orders'][$order_id] ?? false;
 }
 
+function wc_get_product($product_id) {
+    return $GLOBALS['spiff_test_products'][$product_id] ?? false;
+}
+
+function wc_get_products($args) {
+    return array_values($GLOBALS['spiff_test_products']);
+}
+
+function wc_get_cart_url() {
+    return 'https://shop.test/cart/';
+}
+
+function wc_get_price_decimals() {
+    return 2;
+}
+
+function get_woocommerce_currency() {
+    return 'AUD';
+}
+
+function woocommerce_wp_checkbox($field) {
+    $GLOBALS['spiff_test_product_fields'][] = array('type' => 'checkbox') + $field;
+}
+
+function woocommerce_wp_text_input($field) {
+    $GLOBALS['spiff_test_product_fields'][] = array('type' => 'text') + $field;
+}
+
+class Spiff_Test_Product {
+    public $meta;
+    public $saved = false;
+    public $price = null;
+    private $id;
+
+    public function __construct($id, $meta = array()) {
+        $this->id = $id;
+        $this->meta = $meta;
+    }
+
+    public function get_id() {
+        return $this->id;
+    }
+
+    public function get_meta($key) {
+        return $this->meta[$key] ?? '';
+    }
+
+    public function update_meta_data($key, $value) {
+        $this->meta[$key] = $value;
+    }
+
+    public function save() {
+        $this->saved = true;
+    }
+
+    public function get_permalink() {
+        return 'https://shop.test/product/' . $this->id . '/';
+    }
+
+    public function set_price($price) {
+        $this->price = $price;
+    }
+}
+
+class Spiff_Test_Cart {
+    public $added = array();
+    public $items = array();
+
+    public function add_to_cart($product_id, $quantity, $variation_id, $variation, $cart_item_data) {
+        $this->added[] = compact('product_id', 'quantity', 'variation_id', 'variation', 'cart_item_data');
+    }
+
+    public function get_cart() {
+        return $this->items;
+    }
+}
+
 class Spiff_Test_Order_Item implements ArrayAccess {
-    private $meta;
+    public $meta;
     private $quantity;
 
     public function __construct($meta, $quantity) {
@@ -91,6 +294,10 @@ public function get_meta($key) {
         return $this->meta[$key] ?? '';
     }
 
+    public function update_meta_data($key, $value) {
+        $this->meta[$key] = $value;
+    }
+
     public function get_quantity() {
         return $this->quantity;
     }
@@ -113,12 +320,14 @@ class Spiff_Test_Order {
     private $order_number;
     private $items;
     private $paid;
+    private $fields;
 
-    public function __construct($id, $order_number, $items, $paid = true) {
+    public function __construct($id, $order_number, $items, $paid = true, $fields = array()) {
         $this->id = $id;
         $this->order_number = $order_number;
         $this->items = $items;
         $this->paid = $paid;
+        $this->fields = $fields;
     }
 
     public function get_id() {
@@ -138,13 +347,16 @@ public function is_paid() {
     }
 
     public function get_coupon_codes() {
-        return array();
+        return $this->fields['coupon_codes'] ?? array();
     }
 
-    // Remaining getters (addresses, email, phone, note) aren't under test, so return empty values.
+    // Remaining getters (addresses, email, phone, note) read from $fields, e.g. get_billing_city => 'billing_city'.
     public function __call($name, $arguments) {
-        return '';
+        return $this->fields[substr($name, strlen('get_'))] ?? '';
     }
 }
 
+$GLOBALS['spiff_test_options'] = array();
 require_once __DIR__ . '/../spiff-connect/spiff-connect.php';
+$GLOBALS['spiff_test_initial_filters'] = $GLOBALS['spiff_test_filters'];
+spiff_test_reset();