@mohasinac/appkit 4.0.3 → 4.1.1

package/dist/next/api/routeHandler.js

@@ -30,9 +30,10 @@ import { normalizeError } from "../../errors/normalize";
  */
 import { NextResponse } from "next/server.js";
 import { getProviders } from "../../contracts";
-import { isAdminUser } from "../../features/auth/role-predicates";
+import { isEffectiveAdminUser } from "../../features/auth/role-predicates";
 import { mapToHttpError, HTTP_ERROR_CODES } from "../../errors/error-mapping";
 import { serverErrorsRepository } from "../../features/server-errors/repository/server-errors.repository";
+import { userRepository } from "../../repositories";
 import { SCHEMAS } from "../../schemas/registry";
 function buildPublicCacheControl(policy) {
     const maxAge = policy?.maxAge ?? 30;
@@ -138,6 +139,20 @@ function errorJson(status, code, message, requestId, issues) {
         headers: { "X-Request-Id": requestId, "Cache-Control": "no-store" },
     });
 }
+/**
+ * A tester explicitly flagged for admin testing (isTester && canTestAdmin) gets the
+ * same access as "admin" on routes that allow it. isTester/canTestAdmin never appear
+ * in the session-cookie JWT claims (only `role` does), so this requires one live
+ * Firestore read — paid only on the role-mismatch rejection path, never on the common
+ * case (matching role, or a real admin whose JWT role already says "admin").
+ */
+async function isTesterEligibleForAdminRoute(user, effectiveRoles) {
+    if (!user || !effectiveRoles.includes("admin"))
+        return false;
+    const profile = await userRepository.findById(user.uid);
+    return Boolean(profile?.isTester &&
+        profile?.canTestAdmin);
+}
 export function createRouteHandler(options) {
     if (options.bodyOptional && options.bodyRequired) {
         throw new Error("createRouteHandler: bodyOptional and bodyRequired are mutually exclusive");
@@ -173,13 +188,16 @@ export function createRouteHandler(options) {
                 : options.permission
                     ? ["admin", "employee"]
                     : [];
-            if (effectiveRoles.length > 0) {
-                if (!user || !effectiveRoles.includes(user.role ?? "")) {
+            if (effectiveRoles.length > 0 && (!user || !effectiveRoles.includes(user.role ?? ""))) {
+                const testerEligible = await isTesterEligibleForAdminRoute(user, effectiveRoles);
+                if (!testerEligible || !user) {
                     return errorJson(403, HTTP_ERROR_CODES.FORBIDDEN, "Insufficient permissions", requestId);
                 }
+                user.isTester = true;
+                user.canTestAdmin = true;
             }
             // -- Permission check (employee fine-grained) --------------------------
-            if (options.permission && user && !isAdminUser(user)) {
+            if (options.permission && user && !isEffectiveAdminUser(user)) {
                 const { rbac } = getProviders();
                 if (!rbac) {
                     return errorJson(503, HTTP_ERROR_CODES.UNAVAILABLE, "RBAC provider not configured", requestId);

package/dist/react/contexts/SessionContext.d.ts

@@ -31,6 +31,8 @@ export interface SessionUser {
     storeId?: string;
     /** Tester program flag — orthogonal to `role`. Unlocks the Tester Hub nav item/page. */
     isTester?: boolean;
+    /** Orthogonal to isTester — unlocks admin-only checklist items and real /admin/** RBAC access. */
+    canTestAdmin?: boolean;
     publicProfile?: FirestoreDocument;
     stats?: FirestoreDocument;
     metadata?: FirestoreDocument;

package/dist/react/contexts/SessionContext.js

@@ -64,6 +64,7 @@ function buildSessionUser(authUser, serverData) {
         phoneVerified: serverData.phoneVerified,
         storeId: serverData.storeId,
         isTester: serverData.isTester,
+        canTestAdmin: serverData.canTestAdmin,
         avatarMetadata: serverData.avatarMetadata?.url
             ? {
                 url: serverData.avatarMetadata.url,
@@ -134,6 +135,7 @@ export function SessionProvider({ children, initialUser, endpoints: endpointOver
                 phoneVerified: data.phoneVerified,
                 storeId: data.storeId,
                 isTester: data.isTester,
+                canTestAdmin: data.canTestAdmin,
                 avatarMetadata: data.avatarMetadata?.url
                     ? {
                         url: data.avatarMetadata.url,

package/dist/seed/index.d.ts

@@ -79,7 +79,7 @@ export { conversationsSeedData } from "./conversations-seed-data";
 export { groupedListingsSeedData } from "./grouped-listings-seed-data";
 export { scammersSeedData } from "./scammers-seed-data";
 export { supportTicketsSeedData } from "./support-tickets-seed-data";
-export { testerChecklistSeedData, storesTesterSeedData, categoriesTesterSeedData, productsTesterSeedData, blogTesterSeedData, eventsTesterSeedData, } from "../features/tester/seed-data";
+export { testerChecklistSeedData, storesTesterSeedData, categoriesTesterSeedData, productsTesterSeedData, blogTesterSeedData, eventsTesterSeedData, couponsTesterSeedData, bidsTesterSeedData, ordersTesterSeedData, } from "../features/tester/seed-data";
 export { productFeaturesSeedData } from "./product-features-seed-data";
 export { offersSeedData } from "./offers-seed-data";
 export { payoutMethodsSeedData, shippingConfigsSeedData, analyticsCardsSeedData, analyticsAlertsSeedData, storeCategoriesSeedData, listingTemplatesSeedData, moderationQueueSeedData, reportsSeedData, itemRequestsSeedData, storeWhatsAppConfigSeedData, storeGoogleConfigSeedData, } from "./store-extensions-seed-data";

package/dist/seed/index.js

@@ -70,7 +70,7 @@ export { scammersSeedData } from "./scammers-seed-data";
 export { supportTicketsSeedData } from "./support-tickets-seed-data";
 // Tester sandbox seed fixtures live in ../features/tester/seed-data (isolated from this
 // folder on purpose) — re-exported here so every other seed consumer keeps one import surface.
-export { testerChecklistSeedData, storesTesterSeedData, categoriesTesterSeedData, productsTesterSeedData, blogTesterSeedData, eventsTesterSeedData, } from "../features/tester/seed-data";
+export { testerChecklistSeedData, storesTesterSeedData, categoriesTesterSeedData, productsTesterSeedData, blogTesterSeedData, eventsTesterSeedData, couponsTesterSeedData, bidsTesterSeedData, ordersTesterSeedData, } from "../features/tester/seed-data";
 export { productFeaturesSeedData } from "./product-features-seed-data";
 export { offersSeedData } from "./offers-seed-data";
 // S-STORE Extensions (Tier S-STORE) — 11 new collections

package/dist/seed/manifest.js

@@ -51,7 +51,7 @@ import { offersSeedData } from "./offers-seed-data";
 import { couponUsageSeedData } from "./coupon-usage-seed-data";
 import { claimedCouponsSeedData } from "./claimed-coupons-seed-data";
 // Tester sandbox seed fixtures live in ../features/tester/seed-data (isolated on purpose).
-import { testerChecklistSeedData, storesTesterSeedData, categoriesTesterSeedData, productsTesterSeedData, blogTesterSeedData, eventsTesterSeedData, } from "../features/tester/seed-data";
+import { testerChecklistSeedData, storesTesterSeedData, categoriesTesterSeedData, productsTesterSeedData, blogTesterSeedData, eventsTesterSeedData, couponsTesterSeedData, bidsTesterSeedData, ordersTesterSeedData, } from "../features/tester/seed-data";
 function asArr(items) {
     return items ?? [];
 }
@@ -104,10 +104,10 @@ export const SEED_MANIFEST = {
             ? "bundle"
             : LISTING_TYPE_TO_MANIFEST_TAG[p.listingType ?? "standard"],
     })), "title"),
-    orders: pick(asArr(ordersSeedData)),
+    orders: pick([...asArr(ordersSeedData), ...asArr(ordersTesterSeedData)]),
     reviews: pick(asArr(reviewsSeedData), "title"),
-    bids: pick(asArr(bidsSeedData)),
-    coupons: pick(asArr(couponsSeedData).map((c) => ({
+    bids: pick([...asArr(bidsSeedData), ...asArr(bidsTesterSeedData)]),
+    coupons: pick([...asArr(couponsSeedData), ...asArr(couponsTesterSeedData)].map((c) => ({
         ...c,
         name: c.code ?? c.id,
     }))),

package/dist/seed/orders-seed-data.js

@@ -239,21 +239,25 @@ const productPool = [
 ];
 const statuses = [
     "pending",
+    "confirmed",
     "processing",
     "shipped",
     "delivered",
     "cancelled",
     "refunded",
     "return_requested",
+    "returned",
 ];
 const paymentStatuses = {
     pending: "pending",
+    confirmed: "paid",
     processing: "processing",
     shipped: "paid",
     delivered: "paid",
     cancelled: "refunded",
     refunded: "refunded",
     return_requested: "paid",
+    returned: "refunded",
 };
 const buyerStoreMatrix = [
     { userId: "user-yugi-muto", storeId: "store-kaiba-corp-cards", addressId: "addr-yugi-home" },

package/dist/seed/products-classifieds-seed-data.js

@@ -1,10 +1,12 @@
 /*
- * WHY: Classified listings are out of scope for the minimal Beyblade-focused demo catalog.
- * WHAT: Exports an empty array — kept as a stub so seed/index.ts and the seed API route's
- *       SEED_DATA_MAP.products concatenation keep working without a code change elsewhere.
+ * WHY: Real (non-tester-sandbox) classified listing so testers and shoppers can exercise
+ *      the classified contact-seller flow (no checkout, chat/phone only) against permanent
+ *      catalog content. Previously an empty stub — "out of scope for the minimal
+ *      Beyblade-focused demo catalog" — now populated with one seller-run local listing.
+ * WHAT: Exports 1 classified listing on Beyblade Arena — local meetup, negotiable.
  *
  * EXPORTS:
- *   productsClassifiedsSeedData — empty array
+ *   productsClassifiedsSeedData — Array of 1 Partial<ProductDocument> with listingType:"classified"
  *
  * @tag domain:products,classifieds
  * @tag layer:seed
@@ -13,4 +15,45 @@
  * @tag consumers:seed/index.ts,seed/runner.ts
  * @tag sideEffects:none
  */
-export const productsClassifiedsSeedData = [];
+import { PRODUCT_FIELDS } from "../constants/field-names";
+import { buildSearchTokens } from "../utils/search-tokens";
+import { seedExtMedia } from "./_helpers/media";
+export const productsClassifiedsSeedData = [
+    {
+        id: "classified-beyblade-stadium-set",
+        slug: "classified-beyblade-stadium-set",
+        title: "Used Beyblade Stadium Set — Local Pickup Only",
+        description: "Well-loved Beyblade stadium with 6 tops and 2 launchers, sold as-is. Meet up locally or arrange your own shipping — price is negotiable.",
+        categorySlugs: ["category-spinning-tops"],
+        categoryNames: ["Spinning Tops"],
+        brandSlug: "brand-beyblade",
+        brand: "Beyblade",
+        price: 1200,
+        currency: "INR",
+        stockQuantity: 1,
+        availableQuantity: 1,
+        isSold: false,
+        mainImage: seedExtMedia("https://picsum.photos/seed/classified-image-beyblade-stadium-set-1-20260101/900/900"),
+        images: [seedExtMedia("https://picsum.photos/seed/classified-image-beyblade-stadium-set-1-20260101/900/900")],
+        status: PRODUCT_FIELDS.STATUS_VALUES.PUBLISHED,
+        condition: PRODUCT_FIELDS.CONDITION_VALUES.USED,
+        listingType: "classified",
+        storeId: "store-beyblade-arena",
+        storeName: "Beyblade Arena",
+        classified: {
+            meetupArea: { city: "Mumbai", locality: "Andheri West", pincode: "400058" },
+            contactMethod: "both",
+            acceptsShipping: false,
+            negotiable: true,
+        },
+        customFields: [],
+        customSections: [],
+        featured: false,
+        isPromoted: false,
+        isOnSale: false,
+        tags: ["classified", "local-pickup"],
+        createdAt: new Date("2026-05-05"),
+        updatedAt: new Date("2026-05-05"),
+        searchTokens: buildSearchTokens("Used Beyblade Stadium Set — Local Pickup Only", "Well-loved Beyblade stadium with 6 tops and 2 launchers.", "Beyblade", "brand-beyblade", ["Spinning Tops"], ["classified", "local-pickup"]),
+    },
+];

package/dist/seed/products-digital-codes-seed-data.js

@@ -1,10 +1,12 @@
 /*
- * WHY: Digital-code listings are out of scope for the minimal Beyblade-focused demo catalog.
- * WHAT: Exports an empty array — kept as a stub so seed/index.ts and the seed API route's
- *       SEED_DATA_MAP.products concatenation keep working without a code change elsewhere.
+ * WHY: Real (non-tester-sandbox) digital-code listing so testers and shoppers can exercise
+ *      the auto-claim digital delivery flow against permanent catalog content. Previously an
+ *      empty stub — "out of scope for the minimal Beyblade-focused demo catalog" — now
+ *      populated with one companion-app unlock code, on-theme for the spinning-tops catalog.
+ * WHAT: Exports 1 digital-code listing on Beyblade Arena — auto-claim delivery.
  *
  * EXPORTS:
- *   productsDigitalCodesSeedData — empty array
+ *   productsDigitalCodesSeedData — Array of 1 Partial<ProductDocument> with listingType:"digital-code"
  *
  * @tag domain:products,digital-codes
  * @tag layer:seed
@@ -13,4 +15,45 @@
  * @tag consumers:seed/index.ts,seed/runner.ts
  * @tag sideEffects:none
  */
-export const productsDigitalCodesSeedData = [];
+import { PRODUCT_FIELDS } from "../constants/field-names";
+import { buildSearchTokens } from "../utils/search-tokens";
+import { seedExtMedia } from "./_helpers/media";
+export const productsDigitalCodesSeedData = [
+    {
+        id: "digitalcode-beyblade-x-app-unlock",
+        slug: "digitalcode-beyblade-x-app-unlock",
+        title: "Beyblade X Companion App — Premium Unlock Code",
+        description: "Digital unlock code for the Beyblade X companion app's premium tournament tracker and battle-log features. Delivered instantly after payment.",
+        categorySlugs: ["category-spinning-tops"],
+        categoryNames: ["Spinning Tops"],
+        brandSlug: "brand-takara-tomy",
+        brand: "Takara-Tomy",
+        price: 199,
+        currency: "INR",
+        stockQuantity: 25,
+        availableQuantity: 25,
+        isSold: false,
+        mainImage: seedExtMedia("https://picsum.photos/seed/digitalcode-image-beyblade-x-app-unlock-1-20260101/900/900"),
+        images: [seedExtMedia("https://picsum.photos/seed/digitalcode-image-beyblade-x-app-unlock-1-20260101/900/900")],
+        status: PRODUCT_FIELDS.STATUS_VALUES.PUBLISHED,
+        condition: PRODUCT_FIELDS.CONDITION_VALUES.NEW,
+        listingType: "digital-code",
+        storeId: "store-beyblade-arena",
+        storeName: "Beyblade Arena",
+        digitalCode: {
+            codeDeliveryMethod: "auto-claim",
+            codePoolSize: 25,
+            codesAvailable: 25,
+            redemptionInstructions: "Open the Beyblade X companion app, go to Settings → Redeem Code, and enter your code to unlock premium features.",
+        },
+        customFields: [],
+        customSections: [],
+        featured: false,
+        isPromoted: false,
+        isOnSale: false,
+        tags: ["digital-code", "app-unlock"],
+        createdAt: new Date("2026-05-05"),
+        updatedAt: new Date("2026-05-05"),
+        searchTokens: buildSearchTokens("Beyblade X Companion App — Premium Unlock Code", "Digital unlock code for the Beyblade X companion app.", "Takara-Tomy", "brand-takara-tomy", ["Spinning Tops"], ["digital-code", "app-unlock"]),
+    },
+];

package/dist/seed/products-live-items-seed-data.js

@@ -1,5 +1,10 @@
 /*
- * WHY: Live-item listings are out of scope for the minimal Beyblade-focused demo catalog.
+ * WHY: `listingType: "live"` is schema-specific to animals/plants (ProductLiveItemMeta:
+ *      species, ageMonths, sex, jurisdictionAllowed, vendor verification, CITES permit) —
+ *      genuinely inapplicable to this catalog's spinning-tops/collectibles theme, so left
+ *      deliberately empty in the real seed rather than forcing a nonsensical example.
+ *      Testers can still exercise the live-item buyer flow against the disposable
+ *      tester-sandbox fixture in appkit/src/features/tester/seed-data/products-tester-seed-data.ts.
  * WHAT: Exports an empty array — kept as a stub so seed/index.ts and the seed API route's
  *       SEED_DATA_MAP.products concatenation keep working without a code change elsewhere.
  *

package/dist/seed/products-prize-draws-seed-data.js

@@ -1,10 +1,14 @@
 /*
- * WHY: Prize-draw listings are out of scope for the minimal Beyblade-focused demo catalog.
- * WHAT: Exports an empty array — kept as a stub so seed/index.ts and the seed API route's
- *       SEED_DATA_MAP.products concatenation keep working without a code change elsewhere.
+ * WHY: Real (non-tester-sandbox) prize-draw listing so testers and shoppers can exercise
+ *      the prize-draw buy → reveal flow against permanent catalog content, not just the
+ *      disposable 7-day tester sandbox item. Previously an empty stub — "out of scope for
+ *      the minimal Beyblade-focused demo catalog" — now populated with one platform-run
+ *      mystery-box draw, on-theme for the spinning-tops catalog.
+ * WHAT: Exports 1 prize-draw listing (classic reveal mode, 4 prizes) run by the platform's
+ *       own store, letitrip-official.
  *
  * EXPORTS:
- *   productsPrizeDrawsSeedData — empty array
+ *   productsPrizeDrawsSeedData — Array of 1 Partial<ProductDocument> with listingType:"prize-draw"
  *
  * @tag domain:products,prize-draws
  * @tag layer:seed
@@ -13,4 +17,53 @@
  * @tag consumers:seed/index.ts,seed/runner.ts
  * @tag sideEffects:none
  */
-export const productsPrizeDrawsSeedData = [];
+import { PRODUCT_FIELDS } from "../constants/field-names";
+import { buildSearchTokens } from "../utils/search-tokens";
+import { seedExtMedia } from "./_helpers/media";
+export const productsPrizeDrawsSeedData = [
+    {
+        id: "prizedraw-beyblade-mystery-box",
+        slug: "prizedraw-beyblade-mystery-box",
+        title: "Beyblade Mystery Box — Prize Draw",
+        description: "Buy an entry for ₹99 and reveal your prize instantly — win anything from a rare limited-edition Beyblade down to a spare launcher grip. 4 prizes available, revealed on a first-come basis.",
+        categorySlugs: ["category-spinning-tops"],
+        categoryNames: ["Spinning Tops"],
+        brandSlug: "brand-beyblade",
+        brand: "Beyblade",
+        price: 99,
+        currency: "INR",
+        stockQuantity: 4,
+        availableQuantity: 4,
+        isSold: false,
+        mainImage: seedExtMedia("https://picsum.photos/seed/prizedraw-image-beyblade-mystery-box-1-20260101/900/900"),
+        images: [seedExtMedia("https://picsum.photos/seed/prizedraw-image-beyblade-mystery-box-1-20260101/900/900")],
+        status: PRODUCT_FIELDS.STATUS_VALUES.PUBLISHED,
+        condition: PRODUCT_FIELDS.CONDITION_VALUES.NEW,
+        listingType: "prize-draw",
+        storeId: "store-letitrip-official",
+        storeName: "LetItRip Official",
+        prizeDrawMode: "reveal",
+        pricePerEntry: 99,
+        prizeMaxEntries: 4,
+        prizeCurrentEntries: 0,
+        prizeRevealWindowStart: new Date("2026-05-01"),
+        prizeRevealWindowEnd: new Date("2026-12-31"),
+        prizeRevealStatus: "open",
+        prizeRevealDeadlineDays: 7,
+        prizeDrawItems: [
+            { itemNumber: 1, title: "Limited-Edition Gold Dranzer S", description: "Rare gold-finish collector's edition.", images: [seedExtMedia("https://picsum.photos/seed/prizedraw-item-beyblade-1-20260101/600/600")], condition: "new", estimatedValue: 3499, isWon: false },
+            { itemNumber: 2, title: "Beyblade X Starter Set", description: "Full starter set with stadium.", images: [seedExtMedia("https://picsum.photos/seed/prizedraw-item-beyblade-2-20260101/600/600")], condition: "new", estimatedValue: 1999, isWon: false },
+            { itemNumber: 3, title: "Spare Parts Bundle", description: "Assorted spare tips, rings, and drivers.", images: [seedExtMedia("https://picsum.photos/seed/prizedraw-item-beyblade-3-20260101/600/600")], condition: "new", estimatedValue: 399, isWon: false },
+            { itemNumber: 4, title: "Spare Launcher Grip", description: "Standard replacement launcher grip.", images: [seedExtMedia("https://picsum.photos/seed/prizedraw-item-beyblade-4-20260101/600/600")], condition: "new", estimatedValue: 149, isWon: false },
+        ],
+        customFields: [],
+        customSections: [],
+        featured: false,
+        isPromoted: true,
+        isOnSale: false,
+        tags: ["prize-draw", "mystery-box"],
+        createdAt: new Date("2026-05-01"),
+        updatedAt: new Date("2026-05-01"),
+        searchTokens: buildSearchTokens("Beyblade Mystery Box — Prize Draw", "Buy an entry and reveal your prize instantly.", "Beyblade", "brand-beyblade", ["Spinning Tops"], ["prize-draw", "mystery-box"]),
+    },
+];