@mohasinac/appkit 3.0.4 → 3.1.0

package/dist/features/auth/repository/__tests__/user.repository.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/features/auth/repository/__tests__/user.repository.test.js

@@ -0,0 +1,352 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { makeMockDb, makeSnap, makeQuerySnap } from "../../../../../tests/helpers/mock-firestore";
+const { db, mockDocRef, mockCollection, mockQuery, mockTxn } = makeMockDb();
+vi.mock("../../../../providers/db-firebase/admin", () => ({
+    getAdminDb: () => db,
+}));
+vi.mock("../../../../providers/db-firebase", async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        prepareForFirestore: (d) => d,
+        getFirestoreCount: vi.fn().mockResolvedValue(0),
+    };
+});
+vi.mock("../../../../contracts/field-ops", () => ({
+    serverTimestamp: () => new Date(),
+    increment: (n) => n,
+    arrayUnion: (...args) => args,
+    arrayRemove: (...args) => args,
+    deleteField: () => null,
+    registerFieldOps: vi.fn(),
+}));
+vi.mock("../../../../security", () => ({
+    encryptPiiFields: (d) => d,
+    decryptPiiFields: (d) => d,
+    addPiiIndices: (d) => d,
+    piiBlindIndex: (v) => `blind:${v}`,
+    encryptPayoutDetails: (d) => d,
+    decryptPayoutDetails: (d) => d,
+    encryptShippingConfig: (d) => d,
+    decryptShippingConfig: (d) => d,
+    USER_PII_FIELDS: [],
+    TOKEN_PII_FIELDS: [],
+    TOKEN_PII_INDEX_MAP: {},
+}));
+vi.mock("../../../../errors/normalize", () => ({ normalizeError: vi.fn() }));
+vi.mock("../../../../monitoring", () => ({
+    serverLogger: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() },
+}));
+import { UserRepository } from "../user.repository";
+import { getFirestoreCount } from "../../../../providers/db-firebase";
+const repo = new UserRepository();
+function makeUserDoc(overrides = {}) {
+    return {
+        id: "user-ravi-kumar",
+        displayName: "Ravi Kumar",
+        email: "ravi@example.com",
+        emailVerified: false,
+        role: "user",
+        disabled: false,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        ...overrides,
+    };
+}
+beforeEach(() => {
+    vi.clearAllMocks();
+    db.collection.mockReturnValue(mockCollection);
+    mockCollection.doc.mockReturnValue(mockDocRef);
+    mockCollection.where.mockReturnValue(mockQuery);
+    mockCollection.orderBy = vi.fn().mockReturnValue(mockQuery);
+    mockCollection.get = vi.fn().mockResolvedValue(makeQuerySnap([]));
+    mockQuery.where.mockReturnValue(mockQuery);
+    mockQuery.orderBy.mockReturnValue(mockQuery);
+    mockQuery.limit.mockReturnValue(mockQuery);
+    mockQuery.offset = vi.fn().mockReturnValue(mockQuery);
+    mockQuery.count = vi.fn().mockReturnValue({
+        get: vi.fn().mockResolvedValue({ data: () => ({ count: 0 }) }),
+    });
+    mockQuery.get.mockResolvedValue(makeQuerySnap([]));
+    mockDocRef.get.mockResolvedValue(makeSnap(makeUserDoc(), "user-ravi-kumar"));
+    mockDocRef.set.mockResolvedValue(undefined);
+    mockDocRef.update.mockResolvedValue(undefined);
+    mockDocRef.delete.mockResolvedValue(undefined);
+    db.runTransaction.mockImplementation(async (cb) => cb(mockTxn));
+    mockTxn.get.mockResolvedValue(makeSnap(makeUserDoc(), "user-ravi-kumar"));
+    mockTxn.update.mockReturnValue(undefined);
+    getFirestoreCount.mockResolvedValue(0);
+});
+// ---------------------------------------------------------------------------
+// create
+// ---------------------------------------------------------------------------
+describe("UserRepository.create", () => {
+    it("generates a human-readable ID from displayName + email", async () => {
+        await repo.create({
+            displayName: "Ravi Kumar",
+            email: "ravi@example.com",
+            role: "user",
+        });
+        // ID should be based on first/last name — check it was passed to .doc()
+        const docCall = mockCollection.doc.mock.calls[0][0];
+        expect(docCall).toMatch(/ravi/i);
+    });
+    it("ID does not contain raw email address (no PII in document ID)", async () => {
+        await repo.create({
+            displayName: "Ravi Kumar",
+            email: "ravi@example.com",
+            role: "user",
+        });
+        const docCall = mockCollection.doc.mock.calls[0][0];
+        expect(docCall).not.toContain("ravi@example.com");
+        expect(docCall).not.toContain("@");
+    });
+    it("sets createdAt and updatedAt timestamps on the document", async () => {
+        await repo.create({ displayName: "Ravi Kumar", email: "ravi@example.com", role: "user" });
+        const setArg = mockDocRef.set.mock.calls[0][0];
+        expect(setArg.createdAt).toBeInstanceOf(Date);
+        expect(setArg.updatedAt).toBeInstanceOf(Date);
+    });
+    it("stores the role from input", async () => {
+        await repo.create({ displayName: "Admin", email: "admin@example.com", role: "admin" });
+        const setArg = mockDocRef.set.mock.calls[0][0];
+        expect(setArg.role).toBe("admin");
+    });
+    it("returns the document with the generated ID", async () => {
+        const result = await repo.create({
+            displayName: "Ravi Kumar",
+            email: "ravi@example.com",
+            role: "user",
+        });
+        expect(result.id).toBeTruthy();
+        expect(result.displayName).toBe("Ravi Kumar");
+    });
+    it("uses 'user' as firstName fallback when displayName is missing", async () => {
+        await repo.create({ email: "ravi@example.com", role: "user" });
+        const docCall = mockCollection.doc.mock.calls[0][0];
+        expect(docCall).toMatch(/user/i);
+    });
+});
+// ---------------------------------------------------------------------------
+// findByEmail — blind index lookup
+// ---------------------------------------------------------------------------
+describe("UserRepository.findByEmail", () => {
+    it("queries emailIndex field using HMAC blind index, not plaintext email", async () => {
+        mockQuery.get.mockResolvedValue(makeQuerySnap([]));
+        await repo.findByEmail("ravi@example.com");
+        expect(mockCollection.where).toHaveBeenCalledWith("emailIndex", "==", "blind:ravi@example.com");
+    });
+    it("does NOT use raw email in the Firestore query", async () => {
+        mockQuery.get.mockResolvedValue(makeQuerySnap([]));
+        await repo.findByEmail("ravi@example.com");
+        const calls = mockCollection.where.mock.calls;
+        for (const [, , value] of calls) {
+            expect(value).not.toBe("ravi@example.com");
+        }
+    });
+    it("returns the user document when found", async () => {
+        const user = makeUserDoc();
+        mockQuery.get.mockResolvedValue(makeQuerySnap([{ id: user.id, data: user }]));
+        const result = await repo.findByEmail("ravi@example.com");
+        expect(result).not.toBeNull();
+        expect(result?.displayName).toBe("Ravi Kumar");
+    });
+    it("returns null when email is not registered", async () => {
+        mockQuery.get.mockResolvedValue(makeQuerySnap([]));
+        const result = await repo.findByEmail("unknown@example.com");
+        expect(result).toBeNull();
+    });
+});
+// ---------------------------------------------------------------------------
+// isEmailRegistered
+// ---------------------------------------------------------------------------
+describe("UserRepository.isEmailRegistered", () => {
+    it("returns true when a user with that email exists", async () => {
+        const user = makeUserDoc();
+        mockQuery.get.mockResolvedValue(makeQuerySnap([{ id: user.id, data: user }]));
+        const result = await repo.isEmailRegistered("ravi@example.com");
+        expect(result).toBe(true);
+    });
+    it("returns false when no user with that email exists", async () => {
+        mockQuery.get.mockResolvedValue(makeQuerySnap([]));
+        const result = await repo.isEmailRegistered("unknown@example.com");
+        expect(result).toBe(false);
+    });
+    it("delegates to findByEmail (uses blind index, not plaintext)", async () => {
+        mockQuery.get.mockResolvedValue(makeQuerySnap([]));
+        await repo.isEmailRegistered("ravi@example.com");
+        expect(mockCollection.where).toHaveBeenCalledWith("emailIndex", "==", "blind:ravi@example.com");
+    });
+});
+// ---------------------------------------------------------------------------
+// updateLoginMetadata
+// ---------------------------------------------------------------------------
+describe("UserRepository.updateLoginMetadata", () => {
+    it("uses a Firestore transaction (runTransaction called)", async () => {
+        mockTxn.get.mockResolvedValue(makeSnap(makeUserDoc(), "user-ravi-kumar"));
+        await repo.updateLoginMetadata("user-ravi-kumar");
+        expect(db.runTransaction).toHaveBeenCalledOnce();
+    });
+    it("increments loginCount by 1 from current value of 0", async () => {
+        mockTxn.get.mockResolvedValue(makeSnap(makeUserDoc({ metadata: { loginCount: 0 } }), "user-ravi-kumar"));
+        await repo.updateLoginMetadata("user-ravi-kumar");
+        expect(mockTxn.update).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ "metadata.loginCount": 1 }));
+    });
+    it("increments loginCount by 1 from existing count of 5", async () => {
+        mockTxn.get.mockResolvedValue(makeSnap(makeUserDoc({ metadata: { loginCount: 5 } }), "user-ravi-kumar"));
+        await repo.updateLoginMetadata("user-ravi-kumar");
+        expect(mockTxn.update).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ "metadata.loginCount": 6 }));
+    });
+    it("sets lastSignInTime to current timestamp", async () => {
+        mockTxn.get.mockResolvedValue(makeSnap(makeUserDoc(), "user-ravi-kumar"));
+        await repo.updateLoginMetadata("user-ravi-kumar");
+        expect(mockTxn.update).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ "metadata.lastSignInTime": expect.any(Date) }));
+    });
+    it("sets updatedAt to current timestamp", async () => {
+        mockTxn.get.mockResolvedValue(makeSnap(makeUserDoc(), "user-ravi-kumar"));
+        await repo.updateLoginMetadata("user-ravi-kumar");
+        expect(mockTxn.update).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ updatedAt: expect.any(Date) }));
+    });
+});
+// ---------------------------------------------------------------------------
+// updateProfileWithVerificationReset
+// ---------------------------------------------------------------------------
+describe("UserRepository.updateProfileWithVerificationReset", () => {
+    it("sets emailVerified: false when email changes", async () => {
+        const user = makeUserDoc({ email: "old@example.com", emailVerified: true });
+        mockDocRef.get.mockResolvedValue(makeSnap(user, "user-ravi-kumar"));
+        await repo.updateProfileWithVerificationReset("user-ravi-kumar", {
+            email: "new@example.com",
+        });
+        expect(mockDocRef.update).toHaveBeenCalledWith(expect.objectContaining({ emailVerified: false }));
+    });
+    it("does NOT reset emailVerified when email is unchanged", async () => {
+        const user = makeUserDoc({ email: "ravi@example.com", emailVerified: true });
+        mockDocRef.get.mockResolvedValue(makeSnap(user, "user-ravi-kumar"));
+        await repo.updateProfileWithVerificationReset("user-ravi-kumar", {
+            email: "ravi@example.com",
+        });
+        const updateArg = mockDocRef.update.mock.calls[0][0];
+        expect(updateArg.emailVerified).toBeUndefined();
+    });
+    it("sets phoneVerified: false when phone number changes", async () => {
+        const user = makeUserDoc({ phoneNumber: "+911234567890", phoneVerified: true });
+        mockDocRef.get.mockResolvedValue(makeSnap(user, "user-ravi-kumar"));
+        await repo.updateProfileWithVerificationReset("user-ravi-kumar", {
+            phoneNumber: "+910987654321",
+        });
+        expect(mockDocRef.update).toHaveBeenCalledWith(expect.objectContaining({ phoneVerified: false }));
+    });
+    it("does NOT reset phoneVerified when phone is unchanged", async () => {
+        const user = makeUserDoc({ phoneNumber: "+911234567890", phoneVerified: true });
+        mockDocRef.get.mockResolvedValue(makeSnap(user, "user-ravi-kumar"));
+        await repo.updateProfileWithVerificationReset("user-ravi-kumar", {
+            phoneNumber: "+911234567890",
+        });
+        const updateArg = mockDocRef.update.mock.calls[0][0];
+        expect(updateArg.phoneVerified).toBeUndefined();
+    });
+    it("changing only displayName does NOT reset email or phone verification", async () => {
+        const user = makeUserDoc({ emailVerified: true, phoneVerified: true });
+        mockDocRef.get.mockResolvedValue(makeSnap(user, "user-ravi-kumar"));
+        await repo.updateProfileWithVerificationReset("user-ravi-kumar", {
+            displayName: "Ravi K",
+        });
+        const updateArg = mockDocRef.update.mock.calls[0][0];
+        expect(updateArg.emailVerified).toBeUndefined();
+        expect(updateArg.phoneVerified).toBeUndefined();
+    });
+    it("throws DatabaseError when user does not exist", async () => {
+        mockDocRef.get.mockResolvedValue(makeSnap(null));
+        await expect(repo.updateProfileWithVerificationReset("nonexistent-user", { displayName: "X" })).rejects.toThrow(/User not found/);
+    });
+});
+// ---------------------------------------------------------------------------
+// countByRole
+// ---------------------------------------------------------------------------
+describe("UserRepository.countByRole", () => {
+    it("queries role field with the specified role value", async () => {
+        getFirestoreCount.mockResolvedValue(3);
+        await repo.countByRole("seller");
+        expect(mockCollection.where).toHaveBeenCalledWith("role", "==", "seller");
+    });
+    it("returns the count from getFirestoreCount", async () => {
+        getFirestoreCount.mockResolvedValue(7);
+        const count = await repo.countByRole("admin");
+        expect(count).toBe(7);
+    });
+    it("returns 0 when no users have that role", async () => {
+        getFirestoreCount.mockResolvedValue(0);
+        const count = await repo.countByRole("moderator");
+        expect(count).toBe(0);
+    });
+});
+// ---------------------------------------------------------------------------
+// findByRole
+// ---------------------------------------------------------------------------
+describe("UserRepository.findByRole", () => {
+    it("queries users with the specified role", async () => {
+        mockQuery.get.mockResolvedValue(makeQuerySnap([]));
+        await repo.findByRole("seller");
+        expect(mockCollection.where).toHaveBeenCalledWith("role", "==", "seller");
+    });
+    it("returns only users matching the requested role", async () => {
+        const seller = makeUserDoc({ id: "user-seller", role: "seller" });
+        mockQuery.get.mockResolvedValue(makeQuerySnap([{ id: "user-seller", data: seller }]));
+        const results = await repo.findByRole("seller");
+        expect(results).toHaveLength(1);
+        expect(results[0].role).toBe("seller");
+    });
+    it("returns empty array when no users have the role", async () => {
+        mockQuery.get.mockResolvedValue(makeQuerySnap([]));
+        const results = await repo.findByRole("moderator");
+        expect(results).toEqual([]);
+    });
+});
+// ---------------------------------------------------------------------------
+// update — encrypts PII before writing
+// ---------------------------------------------------------------------------
+describe("UserRepository.update", () => {
+    it("calls encryptPiiFields before super.update (passthrough in test = fields unchanged)", async () => {
+        const user = makeUserDoc();
+        mockDocRef.get.mockResolvedValue(makeSnap(user, "user-ravi-kumar"));
+        await repo.update("user-ravi-kumar", { displayName: "New Name" });
+        expect(mockDocRef.update).toHaveBeenCalledWith(expect.objectContaining({ displayName: "New Name" }));
+    });
+    it("sets updatedAt on every update", async () => {
+        const user = makeUserDoc();
+        mockDocRef.get.mockResolvedValue(makeSnap(user, "user-ravi-kumar"));
+        await repo.update("user-ravi-kumar", { displayName: "New Name" });
+        expect(mockDocRef.update).toHaveBeenCalledWith(expect.objectContaining({ updatedAt: expect.any(Date) }));
+    });
+});
+// ---------------------------------------------------------------------------
+// markEmailAsVerified
+// ---------------------------------------------------------------------------
+describe("UserRepository.markEmailAsVerified", () => {
+    it("sets emailVerified: true on the user document", async () => {
+        const user = makeUserDoc({ emailVerified: false });
+        mockDocRef.get.mockResolvedValue(makeSnap(user, "user-ravi-kumar"));
+        await repo.markEmailAsVerified("user-ravi-kumar");
+        expect(mockDocRef.update).toHaveBeenCalledWith(expect.objectContaining({ emailVerified: true }));
+    });
+});
+// ---------------------------------------------------------------------------
+// disable / enable
+// ---------------------------------------------------------------------------
+describe("UserRepository.disable", () => {
+    it("sets disabled: true on the user document", async () => {
+        const user = makeUserDoc({ disabled: false });
+        mockDocRef.get.mockResolvedValue(makeSnap(user, "user-ravi-kumar"));
+        await repo.disable("user-ravi-kumar");
+        expect(mockDocRef.update).toHaveBeenCalledWith(expect.objectContaining({ disabled: true }));
+    });
+});
+describe("UserRepository.enable", () => {
+    it("sets disabled: false on the user document", async () => {
+        const user = makeUserDoc({ disabled: true });
+        mockDocRef.get.mockResolvedValue(makeSnap(user, "user-ravi-kumar"));
+        await repo.enable("user-ravi-kumar");
+        expect(mockDocRef.update).toHaveBeenCalledWith(expect.objectContaining({ disabled: false }));
+    });
+});

package/dist/features/auth/repository/__tests__/user.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/features/auth/repository/__tests__/user.test.js

@@ -0,0 +1,226 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+// Mock security before importing the repo
+vi.mock("../../../../security", () => ({
+    USER_PII_FIELDS: ["email", "phoneNumber"],
+    encryptPiiFields: (data) => data,
+    decryptPiiFields: (data) => data,
+    encryptPayoutDetails: (d) => d,
+    decryptPayoutDetails: (d) => d,
+    encryptShippingConfig: (d) => d,
+    decryptShippingConfig: (d) => d,
+    piiBlindIndex: (v) => `idx:${v}`,
+}));
+vi.mock("../../../../contracts/field-ops", async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        increment: (n) => n,
+        serverTimestamp: () => new Date(),
+        arrayUnion: (...a) => a,
+        arrayRemove: (...a) => a,
+        deleteField: () => null,
+    };
+});
+const mockDocGet = vi.fn();
+const mockDocSet = vi.fn();
+const mockDocUpdate = vi.fn();
+const mockDocRef = { get: mockDocGet, set: mockDocSet, update: mockDocUpdate };
+const mockWhere = vi.fn();
+const mockOrderBy = vi.fn();
+const mockLimit = vi.fn();
+const mockQueryGet = vi.fn();
+const mockTxGet = vi.fn();
+const mockTxUpdate = vi.fn();
+const mockTxSet = vi.fn();
+const mockRunTransaction = vi.fn();
+const mockDoc = vi.fn(() => mockDocRef);
+const mockCollectionChain = {};
+const txn = { get: mockTxGet, update: mockTxUpdate, set: mockTxSet };
+function makeQueryChain(docs = []) {
+    const snap = {
+        docs: docs.map((d) => ({ data: () => d, id: d.id ?? "doc-id", exists: true })),
+        size: docs.length,
+        empty: docs.length === 0,
+    };
+    const chain = {
+        where: vi.fn(() => chain),
+        orderBy: vi.fn(() => chain),
+        limit: vi.fn(() => chain),
+        get: vi.fn().mockResolvedValue(snap),
+    };
+    return chain;
+}
+const db = {
+    collection: vi.fn((name) => {
+        if (!mockCollectionChain[name]) {
+            const chain = makeQueryChain();
+            chain.doc = mockDoc;
+            mockCollectionChain[name] = chain;
+        }
+        return mockCollectionChain[name];
+    }),
+    runTransaction: mockRunTransaction,
+};
+vi.mock("../../../../providers/db-firebase/admin", () => ({
+    getAdminDb: () => db,
+}));
+vi.mock("../../../../providers/db-firebase", async () => {
+    const actual = await vi.importActual("../../../../providers/db-firebase");
+    return {
+        ...actual,
+        getFirestoreCount: vi.fn().mockResolvedValue(0),
+        prepareForFirestore: (d) => d,
+    };
+});
+import { UserRepository } from "../user.repository";
+let repo;
+beforeEach(() => {
+    vi.clearAllMocks();
+    // Reset collection chains
+    for (const k of Object.keys(mockCollectionChain)) {
+        delete mockCollectionChain[k];
+    }
+    mockRunTransaction.mockImplementation(async (fn) => {
+        await fn(txn);
+    });
+    repo = new UserRepository();
+});
+describe("UserRepository.isEmailRegistered", () => {
+    it("returns true when blind-index matches an existing document", async () => {
+        const chain = makeQueryChain([{ id: "user-1", email: "enc:test@test.com", emailIndex: "idx:test@test.com", role: "user" }]);
+        chain.doc = mockDoc;
+        db.collection.mockReturnValue(chain);
+        const result = await repo.isEmailRegistered("test@test.com");
+        expect(result).toBe(true);
+    });
+    it("returns false when no match", async () => {
+        const chain = makeQueryChain([]);
+        chain.doc = mockDoc;
+        db.collection.mockReturnValue(chain);
+        const result = await repo.isEmailRegistered("noone@test.com");
+        expect(result).toBe(false);
+    });
+    it("uses HMAC blind index not plaintext for the query", async () => {
+        const chain = makeQueryChain([]);
+        chain.doc = mockDoc;
+        db.collection.mockReturnValue(chain);
+        await repo.isEmailRegistered("user@example.com");
+        // The where clause must use 'idx:user@example.com' (blind index), not the raw email
+        expect(chain.where).toHaveBeenCalledWith("emailIndex", "==", "idx:user@example.com");
+    });
+});
+describe("UserRepository.updateLoginMetadata", () => {
+    it("uses a Firestore transaction", async () => {
+        const chain = makeQueryChain();
+        chain.doc = mockDoc;
+        db.collection.mockReturnValue(chain);
+        mockDocGet.mockResolvedValue({ data: () => ({ metadata: { loginCount: 3 } }), exists: true });
+        mockTxGet.mockResolvedValue({ data: () => ({ metadata: { loginCount: 3 } }), exists: true });
+        await repo.updateLoginMetadata("user-1");
+        expect(mockRunTransaction).toHaveBeenCalled();
+    });
+    it("increments loginCount by 1 inside the transaction", async () => {
+        const chain = makeQueryChain();
+        chain.doc = mockDoc;
+        db.collection.mockReturnValue(chain);
+        mockTxGet.mockResolvedValue({ data: () => ({ metadata: { loginCount: 5 } }), exists: true });
+        await repo.updateLoginMetadata("user-1");
+        const updateArgs = mockTxUpdate.mock.calls[0];
+        expect(updateArgs[1]["metadata.loginCount"]).toBe(6);
+    });
+    it("sets lastSignInTime in the transaction update", async () => {
+        const chain = makeQueryChain();
+        chain.doc = mockDoc;
+        db.collection.mockReturnValue(chain);
+        mockTxGet.mockResolvedValue({ data: () => ({ metadata: { loginCount: 0 } }), exists: true });
+        const before = new Date();
+        await repo.updateLoginMetadata("user-1");
+        const after = new Date();
+        const updateArgs = mockTxUpdate.mock.calls[0];
+        const signInTime = updateArgs[1]["metadata.lastSignInTime"];
+        expect(signInTime.getTime()).toBeGreaterThanOrEqual(before.getTime() - 10);
+        expect(signInTime.getTime()).toBeLessThanOrEqual(after.getTime() + 10);
+    });
+});
+describe("UserRepository.updateProfileWithVerificationReset", () => {
+    function setupFindById(userData) {
+        const chain = makeQueryChain();
+        chain.doc = mockDoc;
+        db.collection.mockReturnValue(chain);
+        mockDocGet.mockResolvedValue({
+            exists: true,
+            id: "user-1",
+            data: () => userData,
+        });
+        mockDocSet.mockResolvedValue(undefined);
+        mockDocUpdate.mockResolvedValue(undefined);
+    }
+    it("changing email sets emailVerified: false", async () => {
+        setupFindById({ email: "old@test.com", phoneNumber: "1111111111", emailVerified: true });
+        await repo.updateProfileWithVerificationReset("user-1", { email: "new@test.com" });
+        expect(mockDocUpdate).toHaveBeenCalledWith(expect.objectContaining({ emailVerified: false }));
+    });
+    it("changing phone sets phoneVerified: false", async () => {
+        setupFindById({ email: "same@test.com", phoneNumber: "1111111111", phoneVerified: true });
+        await repo.updateProfileWithVerificationReset("user-1", { phoneNumber: "2222222222" });
+        expect(mockDocUpdate).toHaveBeenCalledWith(expect.objectContaining({ phoneVerified: false }));
+    });
+    it("changing displayName does NOT reset email or phone verification", async () => {
+        setupFindById({ displayName: "Old Name", email: "same@test.com", phoneNumber: "1111111111", emailVerified: true });
+        await repo.updateProfileWithVerificationReset("user-1", { displayName: "New Name" });
+        const updateArgs = mockDocUpdate.mock.calls[0][0];
+        expect(updateArgs.emailVerified).toBeUndefined();
+        expect(updateArgs.phoneVerified).toBeUndefined();
+    });
+});
+describe("UserRepository.findByRole", () => {
+    it("queries where role == requested role", async () => {
+        const chain = makeQueryChain([]);
+        chain.doc = mockDoc;
+        db.collection.mockReturnValue(chain);
+        await repo.findByRole("seller");
+        expect(chain.where).toHaveBeenCalledWith("role", "==", "seller");
+    });
+});
+describe("UserRepository.countByRole", () => {
+    it("returns the Firestore count for the given role", async () => {
+        const { getFirestoreCount } = await import("../../../../providers/db-firebase");
+        getFirestoreCount.mockResolvedValue(7);
+        const chain = makeQueryChain([]);
+        chain.doc = mockDoc;
+        db.collection.mockReturnValue(chain);
+        const count = await repo.countByRole("seller");
+        expect(count).toBe(7);
+    });
+});
+describe("UserRepository.create", () => {
+    it("generates a human-readable slug ID from name + email", async () => {
+        const chain = makeQueryChain();
+        chain.doc = mockDoc;
+        db.collection.mockReturnValue(chain);
+        mockDocSet.mockResolvedValue(undefined);
+        const user = await repo.create({
+            uid: "uid-ravi-kumar",
+            displayName: "Ravi Kumar",
+            email: "ravi@test.com",
+            phoneNumber: null,
+            photoURL: null,
+            role: "user",
+            emailVerified: false,
+            disabled: false,
+        });
+        // ID must contain a slug fragment from the name, not a raw UUID
+        expect(user.id).toMatch(/ravi/i);
+        // ID must NOT be the raw email address
+        expect(user.id).not.toContain("ravi@test.com");
+    });
+});
+describe("UserRepository.findByEmail", () => {
+    it("uses blind index (idx:email) not plaintext for lookup", async () => {
+        const chain = makeQueryChain([]);
+        chain.doc = mockDoc;
+        db.collection.mockReturnValue(chain);
+        await repo.findByEmail("user@example.com");
+        expect(chain.where).toHaveBeenCalledWith("emailIndex", "==", "idx:user@example.com");
+    });
+});

package/dist/features/auth/repository/session.repository.js

@@ -45,11 +45,20 @@ export class SessionRepository extends BaseRepository {
             // still holds the cookie. Firestore Admin throws `5 NOT_FOUND` in that
             // case — swallow it so the activity ping is best-effort, not a 500.
             // Any other error is rethrown so genuine failures still surface.
+            //
+            // BaseRepository.update() wraps Firestore errors in DatabaseError, so we
+            // must also inspect .data (the original cause) for the NOT_FOUND signal.
             const code = err?.code;
             const msg = err?.message ?? "";
+            const cause = err?.data;
+            const causeCode = cause?.code;
+            const causeMsg = cause?.message ?? "";
             const isNotFound = code === 5 ||
                 code === "not-found" ||
-                /No document to update|NOT_FOUND/i.test(msg);
+                causeCode === 5 ||
+                causeCode === "not-found" ||
+                /No document to update|NOT_FOUND/i.test(msg) ||
+                /No document to update|NOT_FOUND/i.test(causeMsg);
             if (!isNotFound)
                 throw err;
         }

package/dist/features/before-after/schemas/index.d.ts

@@ -22,8 +22,8 @@ export declare const beforeAfterItemSchema: z.ZodObject<{
     sortOrder: z.ZodDefault<z.ZodNumber>;
     createdAt: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    id: string;
     title: string;
+    id: string;
     sortOrder: number;
     isActive: boolean;
     createdAt?: string | undefined;
@@ -34,8 +34,8 @@ export declare const beforeAfterItemSchema: z.ZodObject<{
     afterImageUrl?: string | undefined;
     durationWeeks?: number | undefined;
 }, {
-    id: string;
     title: string;
+    id: string;
     createdAt?: string | undefined;
     description?: string | undefined;
     sortOrder?: number | undefined;

package/dist/features/blog/schemas/firestore.d.ts

@@ -3,14 +3,14 @@
  */
 import type { MediaFieldInput, MediaField } from "../../media/types";
 import type { BlogPostStatus, BlogPostCategory } from "../types";
+import type { BaseDocument } from "../../../_internal/shared/types/base-document";
 /** Runtime-accessible blog post status values — use instead of bare string literals. */
 export declare const BlogPostStatusValues: {
     readonly DRAFT: BlogPostStatus;
     readonly PUBLISHED: BlogPostStatus;
     readonly ARCHIVED: BlogPostStatus;
 };
-export interface BlogPostDocument {
-    id: string;
+export interface BlogPostDocument extends BaseDocument {
     title: string;
     slug: string;
     excerpt: string;
@@ -30,8 +30,6 @@ export interface BlogPostDocument {
     views: number;
     metaTitle?: string;
     metaDescription?: string;
-    createdAt: Date;
-    updatedAt: Date;
 }
 export declare const BLOG_POSTS_COLLECTION: "blogPosts";
 export declare const BLOG_POSTS_INDEXED_FIELDS: readonly ["status", "publishedAt", "isFeatured", "category", "slug"];