@mohasinac/appkit 4.10.0 → 4.11.1

package/dist/features/admin/hooks/useAdminListingData.d.ts

@@ -15,6 +15,14 @@ interface UseAdminListingDataOptions<TResponse, TRow extends {
     sorts?: string;
     filters?: string;
     q?: string;
+    /**
+     * Extra query-string params appended verbatim, for listing endpoints whose
+     * filter isn't expressible as a Sieve string (e.g. the admin orders
+     * payment-review queue, which keys off the *absence* of a field). Keys with
+     * an `undefined` value are dropped. Participates in the react-query key, so
+     * changing one refetches rather than serving another mode's cached page.
+     */
+    extraParams?: Record<string, string | undefined>;
     mapRows: (response: TResponse) => TRow[];
     getTotal?: (response: TResponse, rows: TRow[]) => number;
 }
@@ -29,7 +37,7 @@ export interface UseAdminListingDataResult<TRow extends {
 }
 export declare function useAdminListingData<TResponse, TRow extends {
     id: string;
-}>({ queryKey, endpoint, page, pageSize, sorts, filters, q, mapRows, getTotal, }: UseAdminListingDataOptions<TResponse, TRow>): UseAdminListingDataResult<TRow>;
+}>({ queryKey, endpoint, page, pageSize, sorts, filters, q, extraParams, mapRows, getTotal, }: UseAdminListingDataOptions<TResponse, TRow>): UseAdminListingDataResult<TRow>;
 export declare function toRecordArray(value: unknown): ListingItemRecord[];
 export declare function toStringValue(value: unknown, fallback?: string): string;
 export declare function toCurrency(value: unknown): string;

package/dist/features/admin/hooks/useAdminListingData.js

@@ -7,7 +7,7 @@ function withQueryParams(endpoint, params) {
     const query = new URLSearchParams(params).toString();
     return `${endpoint}${hasQuery ? "&" : "?"}${query}`;
 }
-export function useAdminListingData({ queryKey, endpoint, page = 1, pageSize = 25, sorts = "-createdAt", filters, q, mapRows, getTotal, }) {
+export function useAdminListingData({ queryKey, endpoint, page = 1, pageSize = 25, sorts = "-createdAt", filters, q, extraParams, mapRows, getTotal, }) {
     const params = {
         page: String(page),
         pageSize: String(pageSize),
@@ -17,8 +17,15 @@ export function useAdminListingData({ queryKey, endpoint, page = 1, pageSize = 2
         params.filters = filters;
     if (q)
         params.q = q;
+    const extraEntries = Object.entries(extraParams ?? {})
+        .filter((entry) => entry[1] !== undefined && entry[1] !== "")
+        .sort(([a], [b]) => a.localeCompare(b));
+    for (const [key, value] of extraEntries)
+        params[key] = value;
     const query = useQuery({
-        queryKey: [...queryKey, page, pageSize, sorts, filters ?? "", q ?? ""],
+        // extraEntries is sorted so an identical param set always produces an
+        // identical key regardless of object insertion order.
+        queryKey: [...queryKey, page, pageSize, sorts, filters ?? "", q ?? "", extraEntries],
         queryFn: () => apiClient.get(withQueryParams(endpoint, params)),
         staleTime: 60000,
     });

package/dist/features/admin/repository/site-settings.repository.d.ts

@@ -103,6 +103,11 @@ export declare class SiteSettingsRepository extends BaseRepository<SiteSettingsD
         fromName: string;
         fromEmail: string;
         replyTo: string;
+        dailyDigest?: {
+            enabled: boolean;
+            recipients: string[];
+            ccRecipients: string[];
+        };
     }>;
     /**
      * Check if site settings exist

package/dist/features/admin/schemas/firestore.d.ts

@@ -407,6 +407,18 @@ export interface SiteSettingsDocument extends BaseDocument {
         fromName: string;
         fromEmail: string;
         replyTo: string;
+        /**
+         * Daily ops digest — the previous 24h of order activity, emailed to the
+         * team. Its arrival doubles as the platform health signal (if it stops
+         * landing, Firestore/Functions/Resend needs a look).
+         */
+        dailyDigest?: {
+            enabled: boolean;
+            /** Primary recipients (TO). */
+            recipients: string[];
+            /** Optional additional recipients (CC) — admin-extendable. */
+            ccRecipients: string[];
+        };
     };
     seo: {
         defaultTitle: string;

package/dist/features/analytics/types.d.ts

@@ -2,5 +2,5 @@
  * page-views.repository.ts (server-only, imports firebase-admin) so the
  * client-side tracker component can import just this without pulling
  * firebase-admin into the client bundle. */
-export declare const PAGE_VIEW_ENTITY_TYPES: readonly ["product", "store", "category", "homepage", "auction", "review", "user-profile"];
+export declare const PAGE_VIEW_ENTITY_TYPES: readonly ["product", "store", "category", "homepage", "auction", "review", "user-profile", "blog", "event", "pre-order", "prize-draw", "classified", "digital-code", "live", "bundle"];
 export type PageViewEntityType = (typeof PAGE_VIEW_ENTITY_TYPES)[number];

package/dist/features/analytics/types.js

@@ -10,4 +10,12 @@ export const PAGE_VIEW_ENTITY_TYPES = [
     "auction",
     "review",
     "user-profile",
+    "blog",
+    "event",
+    "pre-order",
+    "prize-draw",
+    "classified",
+    "digital-code",
+    "live",
+    "bundle",
 ];

package/dist/features/auctions/schemas/index.d.ts

@@ -28,6 +28,7 @@ export declare const auctionItemSchema: z.ZodObject<{
         thumbnailUrl: z.ZodOptional<z.ZodString>;
         source: z.ZodOptional<z.ZodEnum<["upload", "youtube", "external"]>>;
         youtubeId: z.ZodOptional<z.ZodString>;
+        duration: z.ZodOptional<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
         type: "video" | "image" | "file";
         url: string;
@@ -35,6 +36,7 @@ export declare const auctionItemSchema: z.ZodObject<{
         alt?: string | undefined;
         thumbnailUrl?: string | undefined;
         youtubeId?: string | undefined;
+        duration?: number | undefined;
     }, {
         type: "video" | "image" | "file";
         url: string;
@@ -42,6 +44,7 @@ export declare const auctionItemSchema: z.ZodObject<{
         alt?: string | undefined;
         thumbnailUrl?: string | undefined;
         youtubeId?: string | undefined;
+        duration?: number | undefined;
     }>, "many">>;
     currency: z.ZodString;
     price: z.ZodNumber;
@@ -84,6 +87,7 @@ export declare const auctionItemSchema: z.ZodObject<{
         alt?: string | undefined;
         thumbnailUrl?: string | undefined;
         youtubeId?: string | undefined;
+        duration?: number | undefined;
     }[] | undefined;
     storeSlug?: string | undefined;
 }, {
@@ -113,6 +117,7 @@ export declare const auctionItemSchema: z.ZodObject<{
         alt?: string | undefined;
         thumbnailUrl?: string | undefined;
         youtubeId?: string | undefined;
+        duration?: number | undefined;
     }[] | undefined;
     storeSlug?: string | undefined;
 }>;

package/dist/features/audit-log/repository/audit-log.repository.d.ts

@@ -0,0 +1,45 @@
+/**
+ * AdminAuditLogRepository — thin wrapper over the `adminAuditLog` collection.
+ * See `appkit/src/features/audit-log/schemas/firestore.ts` for the doc shape.
+ */
+import { BaseRepository, parseSieveDateValue, type SieveModel, type FirebaseSieveResult } from "../../../providers/db-firebase";
+import { type AdminAuditLogDocument } from "../schemas/firestore";
+export declare class AdminAuditLogRepository extends BaseRepository<AdminAuditLogDocument> {
+    constructor();
+    static readonly SIEVE_FIELDS: {
+        id: {
+            canFilter: boolean;
+            canSort: boolean;
+        };
+        actorUid: {
+            canFilter: boolean;
+            canSort: boolean;
+        };
+        actorName: {
+            canFilter: boolean;
+            canSort: boolean;
+        };
+        action: {
+            canFilter: boolean;
+            canSort: boolean;
+        };
+        targetType: {
+            canFilter: boolean;
+            canSort: boolean;
+        };
+        targetId: {
+            canFilter: boolean;
+            canSort: boolean;
+        };
+        createdAt: {
+            canFilter: boolean;
+            canSort: boolean;
+            parseValue: typeof parseSieveDateValue;
+        };
+    };
+    /**
+     * Paginated, Firestore-native audit-log list (admin use).
+     */
+    list(model: SieveModel): Promise<FirebaseSieveResult<AdminAuditLogDocument>>;
+}
+export declare const adminAuditLogRepository: AdminAuditLogRepository;

package/dist/features/audit-log/repository/audit-log.repository.js

@@ -0,0 +1,30 @@
+/**
+ * AdminAuditLogRepository — thin wrapper over the `adminAuditLog` collection.
+ * See `appkit/src/features/audit-log/schemas/firestore.ts` for the doc shape.
+ */
+import { BaseRepository, parseSieveDateValue, } from "../../../providers/db-firebase";
+import { ADMIN_AUDIT_LOG_COLLECTION } from "../schemas/firestore";
+export class AdminAuditLogRepository extends BaseRepository {
+    constructor() {
+        super(ADMIN_AUDIT_LOG_COLLECTION);
+    }
+    /**
+     * Paginated, Firestore-native audit-log list (admin use).
+     */
+    async list(model) {
+        return this.sieveQuery(model, AdminAuditLogRepository.SIEVE_FIELDS, {
+            defaultPageSize: 50,
+            maxPageSize: 200,
+        });
+    }
+}
+AdminAuditLogRepository.SIEVE_FIELDS = {
+    id: { canFilter: true, canSort: false },
+    actorUid: { canFilter: true, canSort: false },
+    actorName: { canFilter: true, canSort: false },
+    action: { canFilter: true, canSort: true },
+    targetType: { canFilter: true, canSort: false },
+    targetId: { canFilter: true, canSort: false },
+    createdAt: { canFilter: true, canSort: true, parseValue: parseSieveDateValue },
+};
+export const adminAuditLogRepository = new AdminAuditLogRepository();

package/dist/features/audit-log/schemas/firestore.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Admin Audit Log Firestore Document Types & Constants
+ *
+ * Collection: adminAuditLog
+ * Document ID: Firestore auto-ID (no slug prefix — see CLAUDE.md "True
+ * Firestore auto-IDs" list, same convention as `notifications`/`sessions`/`jobs`).
+ *
+ * A queryable record of high-value privileged admin actions — bans, checkout
+ * bypass, coupon edits, payout mark-paid, store status changes, role changes.
+ * This is deliberately an MVP scope (instrumenting existing high-value call
+ * sites), not an exhaustive every-write-path audit trail — see CLAUDE.md's
+ * "Admin Audit Log" section for the full instrumented-action list.
+ */
+import type { BaseDocument } from "../../../_internal/shared/types/base-document";
+import type { JsonValue } from "../../../schemas/types";
+export declare const ADMIN_AUDIT_LOG_COLLECTION = "adminAuditLog";
+export declare const AdminAuditActionValues: {
+    readonly USER_HARD_BAN: "user_hard_ban";
+    readonly USER_SOFT_BAN: "user_soft_ban";
+    readonly USER_UNBAN: "user_unban";
+    readonly CHECKOUT_BYPASS: "checkout_bypass";
+    readonly COUPON_UPDATE: "coupon_update";
+    readonly PAYOUT_MARK_PAID: "payout_mark_paid";
+    readonly STORE_STATUS_CHANGE: "store_status_change";
+    readonly USER_ROLE_CHANGE: "user_role_change";
+};
+export type AdminAuditAction = (typeof AdminAuditActionValues)[keyof typeof AdminAuditActionValues];
+export interface AdminAuditLogDocument extends BaseDocument {
+    actorUid: string;
+    actorName?: string;
+    action: AdminAuditAction;
+    /** e.g. "user" | "store" | "coupon" | "payout" — the kind of entity affected. */
+    targetType: string;
+    targetId: string;
+    /** Denormalized human-readable label (display name, coupon code, etc.) so the log list never needs a join. */
+    targetLabel?: string;
+    reason?: string;
+    metadata?: Record<string, JsonValue>;
+}
+export declare const ADMIN_AUDIT_LOG_FIELDS: {
+    readonly ACTOR_UID: "actorUid";
+    readonly ACTOR_NAME: "actorName";
+    readonly ACTION: "action";
+    readonly TARGET_TYPE: "targetType";
+    readonly TARGET_ID: "targetId";
+    readonly TARGET_LABEL: "targetLabel";
+    readonly REASON: "reason";
+    readonly CREATED_AT: "createdAt";
+    readonly ACTION_VALUES: {
+        readonly USER_HARD_BAN: "user_hard_ban";
+        readonly USER_SOFT_BAN: "user_soft_ban";
+        readonly USER_UNBAN: "user_unban";
+        readonly CHECKOUT_BYPASS: "checkout_bypass";
+        readonly COUPON_UPDATE: "coupon_update";
+        readonly PAYOUT_MARK_PAID: "payout_mark_paid";
+        readonly STORE_STATUS_CHANGE: "store_status_change";
+        readonly USER_ROLE_CHANGE: "user_role_change";
+    };
+};

package/dist/features/audit-log/schemas/firestore.js

@@ -0,0 +1,35 @@
+/**
+ * Admin Audit Log Firestore Document Types & Constants
+ *
+ * Collection: adminAuditLog
+ * Document ID: Firestore auto-ID (no slug prefix — see CLAUDE.md "True
+ * Firestore auto-IDs" list, same convention as `notifications`/`sessions`/`jobs`).
+ *
+ * A queryable record of high-value privileged admin actions — bans, checkout
+ * bypass, coupon edits, payout mark-paid, store status changes, role changes.
+ * This is deliberately an MVP scope (instrumenting existing high-value call
+ * sites), not an exhaustive every-write-path audit trail — see CLAUDE.md's
+ * "Admin Audit Log" section for the full instrumented-action list.
+ */
+export const ADMIN_AUDIT_LOG_COLLECTION = "adminAuditLog";
+export const AdminAuditActionValues = {
+    USER_HARD_BAN: "user_hard_ban",
+    USER_SOFT_BAN: "user_soft_ban",
+    USER_UNBAN: "user_unban",
+    CHECKOUT_BYPASS: "checkout_bypass",
+    COUPON_UPDATE: "coupon_update",
+    PAYOUT_MARK_PAID: "payout_mark_paid",
+    STORE_STATUS_CHANGE: "store_status_change",
+    USER_ROLE_CHANGE: "user_role_change",
+};
+export const ADMIN_AUDIT_LOG_FIELDS = {
+    ACTOR_UID: "actorUid",
+    ACTOR_NAME: "actorName",
+    ACTION: "action",
+    TARGET_TYPE: "targetType",
+    TARGET_ID: "targetId",
+    TARGET_LABEL: "targetLabel",
+    REASON: "reason",
+    CREATED_AT: "createdAt",
+    ACTION_VALUES: AdminAuditActionValues,
+};

package/dist/features/auth/actions/index.d.ts

@@ -1,3 +1,2 @@
 export * from "./profile-actions";
 export * from "./realtime-token-actions";
-export * from "./password-change-otp-actions";

package/dist/features/auth/actions/index.js

@@ -1,3 +1,2 @@
 export * from "./profile-actions";
 export * from "./realtime-token-actions";
-export * from "./password-change-otp-actions";

package/dist/features/auth/hooks/useAuth.d.ts

@@ -21,10 +21,6 @@ export interface RegisterData {
     displayName?: string;
     acceptTerms: boolean;
 }
-export interface ChangePasswordData {
-    currentPassword: string;
-    newPassword: string;
-}
 export interface ChangeEmailData {
     currentPassword: string;
     newEmail: string;
@@ -91,38 +87,15 @@ export declare function useResetPassword(options?: {
     onError?: (error: Error) => void;
 }): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, ResetPasswordData, unknown>;
 /**
- * Password change is now a 3-step flow (root-caused 2026-08-20 — see
- * appkit/src/features/auth/password-change-otp.ts): the old single-step
- * reauthenticateAndChangePassword() applied the new password immediately
- * client-side, before any server-verified identity check beyond the
- * session cookie. Step order:
- *   1. useRequestPasswordChangeOtp — verifies currentPassword via Firebase
- *      reauth (proves the caller actually knows it, without changing
- *      anything yet), then emails a 6-digit code.
- *   2. useVerifyPasswordChangeOtp — verifies the code server-side.
- *   3. useChangePassword — only now actually applies newPassword; the API
- *      route rejects this call unless step 2 already succeeded.
+ * Password change is Firebase-only (no custom OTP code, no Resend) — the
+ * "Change Password" settings action sends the exact same reset-link email
+ * as "Forgot Password" (see useForgotPassword above), to the signed-in
+ * user's own address. Completing the link requires access to that inbox,
+ * which a stolen session cookie alone can't provide — closing the same gap
+ * the older OTP-code system existed for, through inbox possession instead
+ * of a typed code. There is no separate hook for this: consumers call
+ * useForgotPassword({ email: user.email }) directly from the settings page.
  */
-export declare function useRequestPasswordChangeOtp(options?: {
-    onSuccess?: (data: {
-        maskedEmail: string;
-    }) => void;
-    onError?: (error: Error) => void;
-}): import("@tanstack/react-query").UseMutationResult<{
-    maskedEmail: string;
-}, Error, {
-    currentPassword: string;
-}, unknown>;
-export declare function useVerifyPasswordChangeOtp(options?: {
-    onSuccess?: (data: JsonValue) => void;
-    onError?: (error: Error) => void;
-}): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, {
-    code: string;
-}, unknown>;
-export declare function useChangePassword(options?: {
-    onSuccess?: (data: JsonValue) => void;
-    onError?: (error: Error) => void;
-}): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, ChangePasswordData, unknown>;
 export declare function useChangeEmail(options?: {
     onSuccess?: (data: JsonValue) => void;
     onError?: (error: Error) => void;

package/dist/features/auth/hooks/useAuth.js

@@ -7,7 +7,7 @@ import { getClientSessionAdapter } from "../../../contracts/client-session";
 import { apiClient } from "../../../http";
 import { useAuthEvent } from "./useAuthEvent";
 import { RealtimeEventStatus } from "../../../react/hooks/useRealtimeEvent";
-import { AUTH_ENDPOINTS, ACCOUNT_ENDPOINTS, } from "../../../constants/api-endpoints";
+import { AUTH_ENDPOINTS, } from "../../../constants/api-endpoints";
 export function useCurrentUser(opts) {
     const query = useQuery({
         queryKey: ["auth", "me"],
@@ -307,7 +307,18 @@ export function useRegister(options) {
             // `auth.currentUser` is populated for client-side Firebase usage
             // (RTDB presence, etc) — do NOT call /api/auth/session again here,
             // that would create a second, orphaned session document.
-            await getClientAuthProvider().signInWithEmailAndPassword(data.email.trim(), data.password);
+            const authProvider = getClientAuthProvider();
+            await authProvider.signInWithEmailAndPassword(data.email.trim(), data.password);
+            // Verification email is Firebase-native only (no Resend) — see project
+            // policy on "profile related auth changes". Deliberately non-fatal:
+            // the account already exists at this point, so a send failure must not
+            // fail registration — the user can re-request verification later.
+            try {
+                await authProvider.sendEmailVerification();
+            }
+            catch (err) {
+                void normalizeError(err);
+            }
             return { success: true, ...response };
         },
         onSuccess: options?.onSuccess,
@@ -354,42 +365,15 @@ export function useResetPassword(options) {
     });
 }
 /**
- * Password change is now a 3-step flow (root-caused 2026-08-20 — see
- * appkit/src/features/auth/password-change-otp.ts): the old single-step
- * reauthenticateAndChangePassword() applied the new password immediately
- * client-side, before any server-verified identity check beyond the
- * session cookie. Step order:
- *   1. useRequestPasswordChangeOtp — verifies currentPassword via Firebase
- *      reauth (proves the caller actually knows it, without changing
- *      anything yet), then emails a 6-digit code.
- *   2. useVerifyPasswordChangeOtp — verifies the code server-side.
- *   3. useChangePassword — only now actually applies newPassword; the API
- *      route rejects this call unless step 2 already succeeded.
+ * Password change is Firebase-only (no custom OTP code, no Resend) — the
+ * "Change Password" settings action sends the exact same reset-link email
+ * as "Forgot Password" (see useForgotPassword above), to the signed-in
+ * user's own address. Completing the link requires access to that inbox,
+ * which a stolen session cookie alone can't provide — closing the same gap
+ * the older OTP-code system existed for, through inbox possession instead
+ * of a typed code. There is no separate hook for this: consumers call
+ * useForgotPassword({ email: user.email }) directly from the settings page.
  */
-export function useRequestPasswordChangeOtp(options) {
-    return useMutation({
-        mutationFn: async ({ currentPassword }) => {
-            await getClientAuthProvider().reauthenticateOnly(currentPassword);
-            return apiClient.post(ACCOUNT_ENDPOINTS.CHANGE_PASSWORD_OTP_REQUEST, {});
-        },
-        onSuccess: options?.onSuccess,
-        onError: options?.onError,
-    });
-}
-export function useVerifyPasswordChangeOtp(options) {
-    return useMutation({
-        mutationFn: async ({ code }) => apiClient.post(ACCOUNT_ENDPOINTS.CHANGE_PASSWORD_OTP_VERIFY, { code }),
-        onSuccess: options?.onSuccess,
-        onError: options?.onError,
-    });
-}
-export function useChangePassword(options) {
-    return useMutation({
-        mutationFn: async (data) => apiClient.post(ACCOUNT_ENDPOINTS.CHANGE_PASSWORD, data),
-        onSuccess: options?.onSuccess,
-        onError: options?.onError,
-    });
-}
 export function useChangeEmail(options) {
     return useMutation({
         mutationFn: async (data) => {

package/dist/features/auth/permissions/constants.d.ts

@@ -11,7 +11,7 @@
  * Permission naming: admin:resource:action
  * Ban action naming: plain verb phrase — write_reviews, place_bids, etc.
  */
-export type Permission = "admin:dashboard:view" | "admin:users:read" | "admin:users:write" | "admin:users:delete" | "admin:user-bans:read" | "admin:user-bans:write" | "admin:products:read" | "admin:products:write" | "admin:products:delete" | "admin:orders:read" | "admin:orders:write" | "admin:returns:read" | "admin:returns:write" | "admin:stores:read" | "admin:stores:write" | "admin:store-addresses:read" | "admin:addresses:read" | "admin:addresses:write" | "admin:analytics:view" | "admin:payouts:read" | "admin:payouts:write" | "admin:categories:read" | "admin:categories:write" | "admin:categories:delete" | "admin:brands:read" | "admin:brands:write" | "admin:brands:delete" | "admin:coupons:read" | "admin:coupons:write" | "admin:coupons:delete" | "admin:deals:read" | "admin:deals:write" | "admin:featured:read" | "admin:featured:write" | "admin:reviews:read" | "admin:reviews:write" | "admin:reviews:delete" | "admin:blog:read" | "admin:blog:write" | "admin:blog:delete" | "admin:blog:publish" | "admin:bids:read" | "admin:bids:write" | "admin:media:read" | "admin:media:write" | "admin:media:delete" | "admin:site:read" | "admin:site:write" | "admin:settings:write" | "admin:navigation:read" | "admin:navigation:write" | "admin:sections:read" | "admin:sections:write" | "admin:carousel:read" | "admin:carousel:write" | "admin:carousel:delete" | "admin:ads:read" | "admin:ads:write" | "admin:ads:delete" | "admin:faqs:read" | "admin:faqs:write" | "admin:faqs:delete" | "admin:tester-checklist:read" | "admin:tester-checklist:write" | "admin:tester-checklist:delete" | "admin:tester-feedback:read" | "admin:tester-feedback:write" | "admin:newsletter:read" | "admin:newsletter:write" | "admin:contact:read" | "admin:events:read" | "admin:events:write" | "admin:events:delete" | "admin:event-entries:read" | "admin:event-entries:write" | "admin:support-tickets:read" | "admin:support-tickets:write" | "admin:shipments:read" | "admin:shipments:write" | "admin:catalogue:read" | "admin:catalogue:write" | "admin:support-tickets:assign" | "admin:support-tickets:close" | "admin:scammers:read" | "admin:scammers:write" | "admin:scammers:verify" | "admin:scammers:delete" | "admin:sessions:read" | "admin:sessions:delete" | "admin:notifications:read" | "admin:notifications:write" | "admin:carts:read" | "admin:wishlists:read" | "admin:feature-flags:read" | "admin:feature-flags:write" | "admin:copilot:view" | "admin:team:read" | "admin:team:write" | "admin:maintenance:view-server-errors" | "admin:maintenance:view-client-errors" | "admin:maintenance:view-function-errors" | "admin:maintenance:view-cloud-logs" | "admin:maintenance:view-payment-rollbacks" | "admin:maintenance:run-analysis" | "admin:maintenance:purge-errors";
+export type Permission = "admin:dashboard:view" | "admin:users:read" | "admin:users:write" | "admin:users:delete" | "admin:user-bans:read" | "admin:user-bans:write" | "admin:products:read" | "admin:products:write" | "admin:products:delete" | "admin:orders:read" | "admin:orders:write" | "admin:returns:read" | "admin:returns:write" | "admin:stores:read" | "admin:stores:write" | "admin:store-addresses:read" | "admin:addresses:read" | "admin:addresses:write" | "admin:analytics:view" | "admin:payouts:read" | "admin:payouts:write" | "admin:audit-log:read" | "admin:categories:read" | "admin:categories:write" | "admin:categories:delete" | "admin:brands:read" | "admin:brands:write" | "admin:brands:delete" | "admin:coupons:read" | "admin:coupons:write" | "admin:coupons:delete" | "admin:deals:read" | "admin:deals:write" | "admin:featured:read" | "admin:featured:write" | "admin:reviews:read" | "admin:reviews:write" | "admin:reviews:delete" | "admin:blog:read" | "admin:blog:write" | "admin:blog:delete" | "admin:blog:publish" | "admin:bids:read" | "admin:bids:write" | "admin:media:read" | "admin:media:write" | "admin:media:delete" | "admin:site:read" | "admin:site:write" | "admin:settings:write" | "admin:navigation:read" | "admin:navigation:write" | "admin:sections:read" | "admin:sections:write" | "admin:carousel:read" | "admin:carousel:write" | "admin:carousel:delete" | "admin:ads:read" | "admin:ads:write" | "admin:ads:delete" | "admin:faqs:read" | "admin:faqs:write" | "admin:faqs:delete" | "admin:tester-checklist:read" | "admin:tester-checklist:write" | "admin:tester-checklist:delete" | "admin:tester-feedback:read" | "admin:tester-feedback:write" | "admin:newsletter:read" | "admin:newsletter:write" | "admin:contact:read" | "admin:events:read" | "admin:events:write" | "admin:events:delete" | "admin:event-entries:read" | "admin:event-entries:write" | "admin:support-tickets:read" | "admin:support-tickets:write" | "admin:shipments:read" | "admin:shipments:write" | "admin:catalogue:read" | "admin:catalogue:write" | "admin:support-tickets:assign" | "admin:support-tickets:close" | "admin:scammers:read" | "admin:scammers:write" | "admin:scammers:verify" | "admin:scammers:delete" | "admin:sessions:read" | "admin:sessions:delete" | "admin:notifications:read" | "admin:notifications:write" | "admin:carts:read" | "admin:wishlists:read" | "admin:feature-flags:read" | "admin:feature-flags:write" | "admin:copilot:view" | "admin:team:read" | "admin:team:write" | "admin:maintenance:view-server-errors" | "admin:maintenance:view-client-errors" | "admin:maintenance:view-function-errors" | "admin:maintenance:view-cloud-logs" | "admin:maintenance:view-payment-rollbacks" | "admin:maintenance:run-analysis" | "admin:maintenance:purge-errors";
 /**
  * Granular user actions that can be soft-banned individually.
  * A user may have multiple simultaneous soft bans of different types.

package/dist/features/auth/permissions/constants.js

@@ -148,6 +148,7 @@ export const PERMISSION_GROUPS = {
         "admin:payouts:write",
         "admin:orders:read",
         "admin:returns:read",
+        "admin:audit-log:read",
     ],
     data_analyst: [
         "admin:dashboard:view",
@@ -268,6 +269,7 @@ export const ROUTE_PERMISSION_MAP = {
     "/admin/store-addresses": "admin:store-addresses:read",
     "/admin/analytics": "admin:analytics:view",
     "/admin/payouts": "admin:payouts:read",
+    "/admin/audit-log": "admin:audit-log:read",
     "/admin/shipments": "admin:shipments:read",
     "/admin/catalogue-approvals": "admin:catalogue:read",
     "/admin/categories": "admin:categories:read",