@mohasinac/appkit 2.7.43 → 2.7.45

package/dist/_internal/server/features/checkout/actions.js

@@ -14,7 +14,7 @@ import { sendOrderConfirmationEmail } from "../../../../features/contact/server"
 import { splitCartIntoOrderGroups } from "../../../../features/orders/index";
 import { resolveDate } from "../../../../utils";
 import { getAdminDb, getAdminRealtimeDb, RTDB_PATHS, } from "../../../../providers/db-firebase";
-import { PRODUCT_COLLECTION } from "../../../../features/products/schemas/firestore";
+import { PRODUCT_COLLECTION, PRODUCT_CODES_SUBCOLLECTION } from "../../../../features/products/schemas/firestore";
 import { CART_COLLECTION } from "../../../../features/cart/schemas/index";
 // S-SBUNI-RULES 2026-05-13 — bundle cart-line stock fan-out helpers.
 import { getCartItemMemberIds, getExpandedDecrements, validateCartItemStock, } from "./bundle-expansion";
@@ -27,6 +27,47 @@ import { formatShippingAddress } from "./data";
 import { enforceMaxPerUserForCart, computePrizeRevealDeadline, } from "./prize-bundle-gates";
 import { getListingRule, runSyncPreflight, } from "../../../shared/checkout/rules";
 import { cartIsDigitalOnly } from "../../../shared/listing-types/cart-shipping";
+/**
+ * SB-UNI-N — Atomically claim the next available digital code for a confirmed
+ * order. Pre-fetches a candidate code outside the transaction then locks and
+ * verifies in a micro-transaction. Fire-and-forget safe (logs on exhaustion
+ * but never fails the already-created order).
+ */
+async function claimDigitalCodeForOrder(db, productId, orderId, userId, opts) {
+    const codesRef = db
+        .collection(PRODUCT_COLLECTION)
+        .doc(productId)
+        .collection(PRODUCT_CODES_SUBCOLLECTION);
+    const snap = await codesRef.where("status", "==", "available").limit(1).get();
+    if (snap.empty) {
+        serverLogger.warn("claimDigitalCode: code pool exhausted", { productId, orderId });
+        return;
+    }
+    const codeRef = snap.docs[0].ref;
+    let claimed = false;
+    await db.runTransaction(async (tx) => {
+        const latest = await tx.get(codeRef);
+        if (!latest.exists || latest.data()?.status !== "available")
+            return;
+        tx.update(codeRef, {
+            status: "claimed",
+            orderId,
+            claimedByUserId: userId,
+            claimedAt: new Date(),
+            updatedAt: new Date(),
+        });
+        claimed = true;
+    });
+    if (claimed && opts?.userEmail) {
+        const { sendDigitalCodeClaimedEmail } = await import("../../../../features/contact/server");
+        sendDigitalCodeClaimedEmail({
+            to: opts.userEmail,
+            userName: opts.userName ?? "there",
+            productTitle: opts.productTitle ?? "your product",
+            orderId,
+        }).catch((e) => serverLogger.error("claimDigitalCode: email failed", e));
+    }
+}
 /**
  * SB-UNI-O — Live-item jurisdiction guard.
  * Throws ValidationError if any live cart item's allowed states don't include
@@ -470,6 +511,15 @@ export async function createCheckoutOrderAction(input) {
             ...extraOrderFields,
         });
         orderIds.push(order.id);
+        // SB-UNI-N — claim a digital code for digital-code orders (fire-and-forget,
+        // order is already persisted so a claim failure is logged, not thrown).
+        if ((group[0]?.product?.listingType ?? "standard") === "digital-code") {
+            claimDigitalCodeForOrder(getAdminDb(), firstItem.productId, order.id, uid, {
+                userEmail: userEmail || undefined,
+                userName,
+                productTitle: firstItem.productTitle,
+            }).catch((e) => serverLogger.error("claimDigitalCode", e));
+        }
         for (const code of groupCouponCodes) {
             const entry = couponUsageAccumulator.get(code);
             if (entry)
@@ -840,6 +890,15 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
             ...extraOrderFields,
         });
         orderIds.push(order.id);
+        // SB-UNI-N — claim a digital code for digital-code orders (fire-and-forget,
+        // order is already persisted so a claim failure is logged, not thrown).
+        if ((group[0]?.product?.listingType ?? "standard") === "digital-code") {
+            claimDigitalCodeForOrder(getAdminDb(), firstItem.productId, order.id, uid, {
+                userEmail: userEmail || undefined,
+                userName,
+                productTitle: firstItem.productTitle,
+            }).catch((e) => serverLogger.error("claimDigitalCode", e));
+        }
         if (userEmail) {
             emailsToSend.push({
                 to: userEmail,

package/dist/_internal/server/features/products/actions.js

@@ -63,6 +63,13 @@ export async function setProductStatusAction(input) {
         throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
     const product = await assertProductOwnership(parsed.data.productId, user.uid);
     assertStatusTransition(product.status, parsed.data.status);
+    // SB-UNI-O — live listings must be admin-verified before a seller can publish them.
+    if (parsed.data.status === "published" &&
+        (product.listingType ?? "standard") === "live" &&
+        !product.liveItem?.vendorVerified &&
+        user.role !== "admin") {
+        throw new ValidationError("Live listings require admin verification before publishing. Contact support to request verification.");
+    }
     return productRepository.update(parsed.data.productId, { status: parsed.data.status });
 }
 export async function setProductFeaturedAction(input) {

package/dist/_internal/server/features/refunds/actions.js

@@ -17,7 +17,10 @@ import { randomUUID } from "crypto";
 import { getProviders } from "../../../../contracts/registry";
 import { orderRepository } from "../../../..";
 import { NotFoundError, ValidationError } from "../../../../errors";
+import { serverLogger } from "../../../../monitoring";
 import { applyRefundDeductionAction } from "../payouts/actions";
+import { getAdminDb } from "../../../../providers/db-firebase";
+import { PRODUCT_COLLECTION, PRODUCT_CODES_SUBCOLLECTION, } from "../../../../features/products/schemas/firestore";
 export async function processRefundAction(input) {
     const order = await orderRepository.findById(input.orderId);
     if (!order)
@@ -31,6 +34,26 @@ export async function processRefundAction(input) {
     if (order.isNonRefundable) {
         throw new ValidationError("This order is marked non-refundable and cannot be refunded.");
     }
+    // SB-UNI-N — digital-code refund gate: block if code is already claimed (revealed).
+    const digitalCodeItems = (order.items ?? []).filter((i) => (i.listingType ?? "standard") === "digital-code");
+    if (digitalCodeItems.length > 0) {
+        const db = getAdminDb();
+        for (const item of digitalCodeItems) {
+            const codesSnap = await db
+                .collection(PRODUCT_COLLECTION)
+                .doc(item.productId)
+                .collection(PRODUCT_CODES_SUBCOLLECTION)
+                .where("orderId", "==", input.orderId)
+                .limit(1)
+                .get();
+            if (!codesSnap.empty) {
+                const codeStatus = codesSnap.docs[0].data()?.status;
+                if (codeStatus === "claimed") {
+                    throw new ValidationError("The digital code for this order has already been revealed and cannot be refunded automatically. Please contact support.");
+                }
+            }
+        }
+    }
     const refundId = randomUUID();
     const now = new Date();
     let razorpayRefundId;
@@ -62,6 +85,27 @@ export async function processRefundAction(input) {
             : {}),
     };
     await orderRepository.postRefundEvent(input.orderId, event, isFull);
+    // SB-UNI-N — revoke any available (unclaimed) digital codes linked to this order.
+    if (digitalCodeItems.length > 0) {
+        const db = getAdminDb();
+        for (const item of digitalCodeItems) {
+            db.collection(PRODUCT_COLLECTION)
+                .doc(item.productId)
+                .collection(PRODUCT_CODES_SUBCOLLECTION)
+                .where("orderId", "==", input.orderId)
+                .where("status", "==", "available")
+                .limit(1)
+                .get()
+                .then((snap) => {
+                if (!snap.empty) {
+                    snap.docs[0].ref
+                        .update({ status: "revoked", updatedAt: new Date() })
+                        .catch((e) => serverLogger.error("refund: code revoke failed", e));
+                }
+            })
+                .catch((e) => serverLogger.error("refund: code query failed", e));
+        }
+    }
     // Fire-and-forget: deduct from the store's pending payout if one exists.
     // Failure here must not roll back the already-posted refund event.
     if (order.storeId) {

package/dist/features/contact/email.d.ts

@@ -49,6 +49,14 @@ export declare function sendContactEmail(params: {
     success: boolean;
     data?: unknown;
 }>;
+export declare function sendDigitalCodeClaimedEmail(params: {
+    to: string;
+    userName: string;
+    productTitle: string;
+    orderId: string;
+}): Promise<{
+    success: boolean;
+}>;
 export declare function sendSiteSettingsChangedEmail(params: {
     adminEmails: string[];
     changedByEmail: string;

package/dist/features/contact/email.js

@@ -220,6 +220,66 @@ export async function sendContactEmail(params) {
         return { success: false };
     }
 }
+export async function sendDigitalCodeClaimedEmail(params) {
+    const siteName = getSiteName();
+    const siteUrl = getSiteUrl();
+    const { to, userName, productTitle, orderId } = params;
+    const orderUrl = `${siteUrl}/user/orders/view/${orderId}`;
+    try {
+        const { error } = await sendConfiguredEmail({
+            to,
+            subject: `Your digital code for "${productTitle}" is ready`,
+            html: `
+        <!DOCTYPE html><html>
+        <head><meta charset="utf-8"><title>Digital Code Ready</title></head>
+        <body style="margin:0;padding:0;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;background-color:#f5f5f5;">
+          <table width="100%" cellpadding="0" cellspacing="0" border="0" style="background-color:#f5f5f5;padding:40px 0;">
+            <tr><td align="center">
+              <table width="600" cellpadding="0" cellspacing="0" border="0" style="background-color:#ffffff;border-radius:8px;overflow:hidden;box-shadow:0 2px 8px rgba(0,0,0,0.1);">
+                <tr><td style="background:linear-gradient(135deg,#6366f1 0%,#4f46e5 100%);padding:40px;text-align:center;">
+                  <p style="font-size:48px;margin:0 0 12px;">&#x1F511;</p>
+                  <h1 style="color:#ffffff;margin:0;font-size:26px;font-weight:600;">Your Digital Code Is Ready</h1>
+                </td></tr>
+                <tr><td style="padding:40px;">
+                  <p style="color:#333;font-size:16px;line-height:1.6;margin:0 0 16px;">Hi ${userName},</p>
+                  <p style="color:#333;font-size:16px;line-height:1.6;margin:0 0 24px;">
+                    Your digital code for <strong>${productTitle}</strong> has been assigned to your order and is ready to reveal.
+                  </p>
+                  <table width="100%" cellpadding="12" cellspacing="0" border="0" style="background:#f8f9fa;border-radius:8px;margin-bottom:24px;">
+                    <tr><td style="color:#666;font-size:14px;width:40%;">Order ID</td>
+                        <td style="color:#333;font-size:14px;font-weight:600;">${orderId}</td></tr>
+                    <tr><td style="color:#666;font-size:14px;">Product</td>
+                        <td style="color:#333;font-size:14px;">${productTitle}</td></tr>
+                  </table>
+                  <table width="100%" cellpadding="0" cellspacing="0" border="0" style="margin:24px 0;">
+                    <tr><td align="center">
+                      <a href="${orderUrl}" style="display:inline-block;padding:14px 40px;background:linear-gradient(135deg,#6366f1 0%,#4f46e5 100%);color:#ffffff;text-decoration:none;border-radius:6px;font-size:15px;font-weight:600;">
+                        Reveal Your Code
+                      </a>
+                    </td></tr>
+                  </table>
+                  <p style="color:#999;font-size:13px;line-height:1.6;margin:0;">For security, the code is only shown inside your ${siteName} account.</p>
+                </td></tr>
+                <tr><td style="background-color:#f8f9fa;padding:24px;text-align:center;border-top:1px solid #eee;">
+                  <p style="color:#9ca3af;font-size:12px;margin:0;">&#169; ${currentYear()} ${siteName}. All rights reserved.</p>
+                </td></tr>
+              </table>
+            </td></tr>
+          </table>
+        </body></html>`,
+            text: `Hi ${userName},\n\nYour digital code for "${productTitle}" (Order: ${orderId}) is ready to reveal.\n\nVisit your order: ${orderUrl}\n\nFor security, the code is only shown inside your ${siteName} account.\n\n© ${currentYear()} ${siteName}`,
+        });
+        if (error) {
+            serverLogger.error("Failed to send digital code claimed email", { error });
+            return { success: false };
+        }
+        return { success: true };
+    }
+    catch (error) {
+        serverLogger.error("Error sending digital code claimed email", { error });
+        return { success: false };
+    }
+}
 export async function sendSiteSettingsChangedEmail(params) {
     const siteName = getSiteName();
     const siteUrl = getSiteUrl();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "2.7.43",
+  "version": "2.7.45",
   "license": "MIT",
   "publishConfig": {
     "access": "public"