@mohasinac/appkit 3.6.1 → 3.6.2

package/dist/_internal/server/features/auth/permissions.js

@@ -21,7 +21,6 @@ export async function getServerPermissions(uid) {
         return { isAdmin: false, permissions: [] };
     // userRepository.findById is cached per request in BaseRepository
     const user = await userRepository.findById(uid);
-    console.error("[PERM-DIAG] uid:", uid, "user:", user ? JSON.stringify(user) : "null");
     if (!user)
         return { isAdmin: false, permissions: [] };
     if (user.role === "admin")

package/dist/features/auth/repository/user.repository.js

@@ -38,7 +38,15 @@ export class UserRepository extends BaseRepository {
         return this.decryptUser(raw);
     }
     async createWithId(id, data) {
-        const encrypted = this.encryptUserData(data);
+        // `uid` is a required UserDocument field read directly off the mapped
+        // object (SessionUser.uid, getServerPermissions(uid), etc.) — mapDoc()
+        // only auto-populates `.id` from the Firestore doc ID, not `.uid`. A
+        // caller passing `data` without `uid` silently produces a user record
+        // that authenticates fine but fails every downstream role/permission
+        // check with no error anywhere (found via a live RBAC bug where an
+        // admin account created this way couldn't access /admin).
+        const withUid = { uid: id, ...data };
+        const encrypted = this.encryptUserData(withUid);
         return super.createWithId(id, encrypted);
     }
     async create(input) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "3.6.1",
+  "version": "3.6.2",
   "license": "MIT",
   "publishConfig": {
     "access": "public"