@mohasinac/appkit 4.18.0 → 4.19.0

package/dist/features/admin/schemas/site-settings-form.js

@@ -0,0 +1,159 @@
+/*
+ * WHY: `AdminSiteSettingsView` is 1826 lines with **21 `<Form>` tags and no
+ *      schema on any of them**. All 21 are tabs over one document and save
+ *      through a single `buildFullPayload()` → one PUT, so this is one form
+ *      wearing twenty-one hats, entirely unvalidated.
+ *
+ *      Live consequences already documented for this exact payload:
+ *        · `announcementBar` was saved under the key `text` until 2026-08-24 —
+ *          a key no renderer has ever read — so admin-authored announcements
+ *          saved successfully and never appeared.
+ *        · `adSettings`, `integrations`, `platformLimits`, `tagline` and
+ *          `favicon` were written here while undeclared on
+ *          `SiteSettingsDocument`, which is how an unmasked ad-credentials
+ *          blob reached anonymous callers (Recurrent Root Cause #70).
+ *
+ * WHAT: A schema that validates the fields with real rules and **passes the
+ *       rest through untouched**.
+ *
+ * ## 🛑 This one is `.passthrough()`, deliberately, and that is the whole point
+ *
+ * Everywhere else in this rework an update schema is `.strict()`. Here that
+ * would be actively dangerous. `buildFullPayload()` demonstrably writes keys
+ * the TypeScript interface does not declare, and a closed schema would SILENTLY
+ * STRIP every one of them on the next save — turning a validation improvement
+ * into the largest single act of data loss in the codebase. That is the
+ * `productBaseSchema` failure, aimed at the site's entire configuration.
+ *
+ * So: constrain what can be reasoned about (percentages that must be 0–100,
+ * money that must be non-negative, a contact email that must be an email), and
+ * let the rest pass. Tightening any group is a separate, evidence-led change —
+ * per the data-integrity protocol, only after a full-collection round-trip
+ * diff proves the schema is a superset of what is stored.
+ *
+ * EXPORTS: siteSettingsFormSchema, type SiteSettingsFormValues
+ *
+ * @tag domain:admin
+ * @tag layer:schema
+ * @tag pattern:none
+ * @tag access:isomorphic
+ * @tag consumers:AdminSiteSettingsView
+ * @tag sideEffects:none
+ */
+import { z } from "zod";
+/** A percentage a human types into a settings box. */
+const percent = (label) => z.coerce
+    .number({ invalid_type_error: `${label} must be a number.` })
+    .min(0, `${label} cannot be negative.`)
+    .max(100, `${label} cannot exceed 100%.`)
+    .optional();
+/** A non-negative rupee amount. */
+const money = (label) => z.coerce
+    .number({ invalid_type_error: `${label} must be a number.` })
+    .min(0, `${label} cannot be negative.`)
+    .optional();
+/** An optional email box — blank is allowed, malformed is not. */
+const optionalEmail = z
+    .string()
+    .trim()
+    .toLowerCase()
+    .email("That doesn't look like an email address.")
+    .optional()
+    .or(z.literal(""));
+/** An optional URL box — blank is allowed, malformed is not. */
+const optionalUrl = z
+    .string()
+    .trim()
+    .url("Enter a full URL, including https://.")
+    .optional()
+    .or(z.literal(""));
+export const siteSettingsFormSchema = z
+    .object({
+    /*
+     * 🛑 `message` is the canonical key. Naming it here is what stops the
+     * `text` mistake recurring: a payload carrying `text` still passes (the
+     * schema is open), but the one key a renderer reads is now declared, and
+     * the form is typed against it.
+     */
+    announcementBar: z
+        .object({
+        message: z.string().trim().max(300, "Keep the announcement under 300 characters.").optional(),
+        enabled: z.boolean().optional(),
+        link: optionalUrl,
+    })
+        .passthrough()
+        .optional(),
+    contact: z
+        .object({
+        email: optionalEmail,
+        supportEmail: optionalEmail,
+        phone: z.string().trim().max(40).optional(),
+    })
+        .passthrough()
+        .optional(),
+    /*
+     * The commission block. Every one of these is a percentage or an amount
+     * that multiplies against real orders, and all were free text — a stray
+     * keystroke in `platformFeePercent` changes what every seller is charged.
+     */
+    commissions: z
+        .object({
+        platformFeePercent: percent("Platform fee"),
+        gatewayFeePercent: percent("Gateway fee"),
+        platformFeeMax: money("Platform fee cap"),
+        minPayoutAmount: money("Minimum payout"),
+        payoutHoldDays: z.coerce.number().int().min(0).max(365).optional(),
+        codHandlingFee: money("COD handling fee"),
+        codDepositPercent: percent("COD deposit"),
+    })
+        .passthrough()
+        .optional(),
+    laborRate: z
+        .object({ hourlyRate: money("Hourly rate") })
+        .passthrough()
+        .optional(),
+    emi: z
+        .object({
+        surchargePercent: percent("EMI surcharge"),
+        surchargeSellerSharePercent: percent("Seller share"),
+        minOrderAmount: money("Minimum EMI order"),
+    })
+        .passthrough()
+        .optional(),
+    gst: z
+        .object({
+        // 15 characters, the statutory format. A wrong GSTIN appears on every
+        // invoice the platform issues.
+        gstin: z
+            .string()
+            .trim()
+            .toUpperCase()
+            .regex(/^\d{2}[A-Z]{5}\d{4}[A-Z]\d[A-Z\d][A-Z\d]$/, "That is not a valid 15-character GSTIN.")
+            .optional()
+            .or(z.literal("")),
+        ratePercent: percent("GST rate"),
+    })
+        .passthrough()
+        .optional(),
+    auctionConfig: z
+        .object({
+        minBidIncrement: money("Minimum bid increment"),
+        extensionMinutes: z.coerce.number().int().min(0).max(1440).optional(),
+    })
+        .passthrough()
+        .optional(),
+    seo: z
+        .object({
+        title: z.string().trim().max(70, "Search engines truncate titles past ~70 characters.").optional(),
+        description: z
+            .string()
+            .trim()
+            .max(160, "Search engines truncate descriptions past ~160 characters.")
+            .optional(),
+    })
+        .passthrough()
+        .optional(),
+})
+    // See the header: OPEN on purpose. `buildFullPayload()` writes keys the
+    // document interface does not declare, and closing this would delete them.
+    .passthrough();

package/dist/features/auctions/components/PlaceBidFormClient.js

@@ -13,6 +13,7 @@ import { useLiveAuctionBid } from "../hooks/useLiveAuctionBid";
 import { AUCTION_BUYOUT_WINDOW_MINUTES } from "../../../_internal/shared/checkout/lanes";
 import { BID_PRESET_MULTIPLIERS, isBuyNowAvailable, resolveMinBid, resolveMinBidIncrement, } from "../../../_internal/shared/features/auctions/config";
 import { normalizeError } from "../../../errors/normalize";
+import { FormErrorSummary } from "../../../ui/forms/FormErrorSummary";
 const __P = {
     p5: "p-[var(--appkit-space-5)]",
 };
@@ -179,10 +180,10 @@ export function PlaceBidFormClient({ productId, currentBid: ssrCurrentBid, start
             }
         });
     }
-    return (_jsxs(Stack, { className: `${__P.p5}`, border: "subtle", gap: "md", rounded: "xl", surface: "muted", children: [_jsxs(Stack, { gap: "xs", children: [_jsxs(Row, { justify: "between", align: "center", children: [_jsx(Text, { size: "xs", color: "muted", children: hasBids ? "Current bid" : "Starting bid" }), _jsx(Text, { size: "xs", color: "muted", children: hasBids ? "Starting bid" : "Minimum bid" })] }), _jsxs(Row, { justify: "between", align: "baseline", children: [_jsx(Span, { size: "xl", weight: "bold", className: "text-primary-600 dark:text-primary-400", children: formatCurrency(currentBid, currency) }), _jsx(Span, { size: "sm", color: "muted", children: formatCurrency(hasBids ? startingBid : minBid, currency) })] }), _jsxs(Text, { size: "xs", color: "faint", children: [bidCount, " ", bidCount === 1 ? "bid" : "bids", " \u00B7 min increment", " ", formatCurrency(minBidIncrement, currency)] })] }), _jsx(LoginRequiredModal, { isOpen: showLoginModal, onClose: () => setShowLoginModal(false), message: "You need to be signed in to place a bid. Please log in or create an account to continue." }), _jsx(Form, { onSubmit: (e) => {
+    return (_jsxs(Stack, { className: `${__P.p5}`, border: "subtle", gap: "md", rounded: "xl", surface: "muted", children: [_jsxs(Stack, { gap: "xs", children: [_jsxs(Row, { justify: "between", align: "center", children: [_jsx(Text, { size: "xs", color: "muted", children: hasBids ? "Current bid" : "Starting bid" }), _jsx(Text, { size: "xs", color: "muted", children: hasBids ? "Starting bid" : "Minimum bid" })] }), _jsxs(Row, { justify: "between", align: "baseline", children: [_jsx(Span, { size: "xl", weight: "bold", className: "text-primary-600 dark:text-primary-400", children: formatCurrency(currentBid, currency) }), _jsx(Span, { size: "sm", color: "muted", children: formatCurrency(hasBids ? startingBid : minBid, currency) })] }), _jsxs(Text, { size: "xs", color: "faint", children: [bidCount, " ", bidCount === 1 ? "bid" : "bids", " \u00B7 min increment", " ", formatCurrency(minBidIncrement, currency)] })] }), _jsx(LoginRequiredModal, { isOpen: showLoginModal, onClose: () => setShowLoginModal(false), message: "You need to be signed in to place a bid. Please log in or create an account to continue." }), _jsx(Form, { schema: schema, onSubmit: (e) => {
                     // handler wired through render-prop below — keeps setFieldError in scope
                     e.preventDefault();
-                }, children: ({ setFieldError, clearErrors }) => (_jsxs(Stack, { gap: "sm", children: [_jsxs(Row, { gap: "xs", wrap: true, role: "radiogroup", "aria-label": "Bid amount preset", children: [BID_PRESET_MULTIPLIERS.map((n) => {
+                }, children: ({ setFieldError, clearErrors }) => (_jsxs(Stack, { gap: "sm", children: [_jsx(FormErrorSummary, {}), _jsxs(Row, { gap: "xs", wrap: true, role: "radiogroup", "aria-label": "Bid amount preset", children: [BID_PRESET_MULTIPLIERS.map((n) => {
                                     const amount = presetAmount(n);
                                     const delta = amount - currentBid;
                                     // `delta` is 0 only for the opening preset on a bid-free

package/dist/features/whatsapp-bot/components/SellerWhatsAppSettingsView.js

@@ -16,6 +16,8 @@ import { apiClient } from "../../../http";
 import { WHATSAPP_SELLER_ENDPOINTS } from "../../../constants/api-endpoints";
 import { ACTIONS } from "../../../_internal/shared/actions/action-registry";
 import { buildPurchaseAnnouncementMessage } from "../helpers/whatsapp";
+import { whatsappSettingsSchema } from "../../admin/schemas/admin-user-form";
+import { FormErrorSummary } from "../../../ui/forms/FormErrorSummary";
 // ---------------------------------------------------------------------------
 // Sub-components
 // ---------------------------------------------------------------------------
@@ -187,10 +189,10 @@ export function SellerWhatsAppSettingsView({ hasCapability }) {
                                     ? cfg?.connected === true
                                     : Boolean(cfg?.[step.checkKey]);
                             return (_jsxs(Row, { gap: "sm", align: "start", children: [_jsx(Row, { textWeight: "bold", textSize: "xs", className: `flex-shrink-0 w-6 h-6 mt-0.5 ${done ? "bg-[var(--appkit-color-success)] text-white" : "bg-[var(--appkit-color-surface-elevated)] text-[var(--appkit-color-text-muted)] dark:text-[var(--appkit-color-text-faint)]"}`, align: "center", justify: "center", rounded: "full", children: done ? "✓" : step.n }), _jsxs(Div, { children: [_jsx(Text, { size: "sm", weight: "medium", color: "primary", children: step.title }), _jsx(Text, { className: "mt-0.5", color: "muted", size: "xs", children: step.body })] })] }, step.n));
-                        }) })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsxs(Row, { justify: "between", align: "center", className: "mb-4", children: [_jsx(Heading, { level: 2, size: "sm", weight: "semibold", color: "primary", children: "Connection" }), isLoading ? null : cfg?.connected ? (_jsx(Badge, { variant: "success", children: "Connected" })) : (_jsx(Badge, { variant: "default", children: "Not configured" }))] }), _jsxs(Form, { onSubmit: (e) => {
+                        }) })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsxs(Row, { justify: "between", align: "center", className: "mb-4", children: [_jsx(Heading, { level: 2, size: "sm", weight: "semibold", color: "primary", children: "Connection" }), isLoading ? null : cfg?.connected ? (_jsx(Badge, { variant: "success", children: "Connected" })) : (_jsx(Badge, { variant: "default", children: "Not configured" }))] }), _jsxs(Form, { schema: whatsappSettingsSchema, onSubmit: (e) => {
                             e.preventDefault();
                             saveMutation.mutate();
-                        }, spacing: "md", children: [_jsx(Input, { label: "WhatsApp Business Phone Number", value: phoneNumber, onChange: (e) => setPhoneNumber(e.target.value), placeholder: "919876543210", helperText: "Digits only, include country code (e.g. 91 for India)" }), _jsx(Input, { label: "WABA ID (WhatsApp Business Account ID)", value: wabaId, onChange: (e) => setWabaId(e.target.value), placeholder: "123456789012345", helperText: "From Meta Business Manager \u2192 WhatsApp Accounts" }), _jsx(Input, { label: "Catalog ID", value: catalogId, onChange: (e) => setCatalogId(e.target.value), placeholder: "987654321098765", helperText: "From Meta Commerce Manager \u2192 Catalogs" }), _jsx(MaskedTokenInput, { label: "System User Access Token", value: accessToken, onChange: setAccessToken, placeholder: "EAAxxxxxxxx\u2026", helperText: "Long-lived token with WhatsApp Business permissions" }), _jsx(FormActions, { align: "right", children: _jsx(Button, { type: "submit", isLoading: saveMutation.isPending, disabled: saveMutation.isPending, children: saveMutation.isPending ? "Saving…" : ACTIONS.STORE["whatsapp-connect"].label }) })] })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsx(Heading, { level: 2, className: "mb-4", color: "primary", size: "sm", weight: "semibold", children: "Catalog Sync" }), _jsxs(Row, { justify: "between", align: "center", className: "mb-4", children: [_jsxs(Div, { children: [_jsx(Text, { size: "sm", color: "muted", children: "Enable catalog sync" }), _jsx(Text, { size: "xs", color: "muted", children: "When enabled, your published standard products can be synced to WhatsApp." })] }), _jsx(Toggle, { checked: syncEnabled, onChange: setSyncEnabled, disabled: !cfg?.connected })] }), cfg?.lastCatalogSyncAt && (_jsxs(Row, { color: "muted", textSize: "xs", gap: "sm", align: "center", className: "mb-3", children: [_jsxs(Text, { children: ["Last sync: ", new Date(cfg.lastCatalogSyncAt).toLocaleString("en-IN")] }), cfg.lastSyncCount !== undefined && _jsxs(Text, { children: ["\u00B7 ", cfg.lastSyncCount, " products"] }), cfg.lastSyncStatus && (_jsx(Badge, { variant: STATUS_VARIANT[cfg.lastSyncStatus] ?? "default", children: cfg.lastSyncStatus }))] })), _jsx(Text, { className: "mb-3", color: "faint", size: "xs", children: "Only published standard products are synced. Auctions and pre-orders are excluded. Batches of up to 50 products per call." }), _jsxs(Row, { gap: "3", children: [_jsx(Button, { onClick: () => syncMutation.mutate(), isLoading: syncMutation.isPending, disabled: !cfg?.connected || !syncEnabled || syncMutation.isPending, variant: "secondary", children: syncMutation.isPending ? "Syncing…" : ACTIONS.STORE["whatsapp-catalog-sync"].label }), _jsx(Button, { onClick: () => void startImport(), isLoading: importing, disabled: !cfg?.connected || !syncEnabled || importing, variant: "secondary", children: importing ? "Importing…" : ACTIONS.STORE["whatsapp-catalog-import"].label })] }), _jsxs(Text, { className: "mt-3", color: "faint", size: "xs", children: [_jsx(Span, { weight: "bold", children: "Push" }), " sends your published standard products to WhatsApp.", " ", _jsx(Span, { weight: "bold", children: "Import" }), " creates draft products from your WhatsApp catalog. Products are matched by slug in the description field."] })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsx(Heading, { level: 2, className: "mb-2", color: "primary", size: "sm", weight: "semibold", children: "Purchase Announcement Preview" }), _jsx(Text, { className: "mb-3", color: "muted", size: "xs", children: "This message is sent automatically to your phone and the platform admin when a new order is placed." }), _jsx(Div, { textSize: "sm", className: "font-mono", color: "primary", surface: "muted", padding: "inline", rounded: "lg", children: buildPurchaseAnnouncementMessage({
+                        }, spacing: "md", children: [_jsx(FormErrorSummary, {}), _jsx(Input, { label: "WhatsApp Business Phone Number", value: phoneNumber, onChange: (e) => setPhoneNumber(e.target.value), placeholder: "919876543210", helperText: "Digits only, include country code (e.g. 91 for India)" }), _jsx(Input, { label: "WABA ID (WhatsApp Business Account ID)", value: wabaId, onChange: (e) => setWabaId(e.target.value), placeholder: "123456789012345", helperText: "From Meta Business Manager \u2192 WhatsApp Accounts" }), _jsx(Input, { label: "Catalog ID", value: catalogId, onChange: (e) => setCatalogId(e.target.value), placeholder: "987654321098765", helperText: "From Meta Commerce Manager \u2192 Catalogs" }), _jsx(MaskedTokenInput, { label: "System User Access Token", value: accessToken, onChange: setAccessToken, placeholder: "EAAxxxxxxxx\u2026", helperText: "Long-lived token with WhatsApp Business permissions" }), _jsx(FormActions, { align: "right", children: _jsx(Button, { type: "submit", isLoading: saveMutation.isPending, disabled: saveMutation.isPending, children: saveMutation.isPending ? "Saving…" : ACTIONS.STORE["whatsapp-connect"].label }) })] })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsx(Heading, { level: 2, className: "mb-4", color: "primary", size: "sm", weight: "semibold", children: "Catalog Sync" }), _jsxs(Row, { justify: "between", align: "center", className: "mb-4", children: [_jsxs(Div, { children: [_jsx(Text, { size: "sm", color: "muted", children: "Enable catalog sync" }), _jsx(Text, { size: "xs", color: "muted", children: "When enabled, your published standard products can be synced to WhatsApp." })] }), _jsx(Toggle, { checked: syncEnabled, onChange: setSyncEnabled, disabled: !cfg?.connected })] }), cfg?.lastCatalogSyncAt && (_jsxs(Row, { color: "muted", textSize: "xs", gap: "sm", align: "center", className: "mb-3", children: [_jsxs(Text, { children: ["Last sync: ", new Date(cfg.lastCatalogSyncAt).toLocaleString("en-IN")] }), cfg.lastSyncCount !== undefined && _jsxs(Text, { children: ["\u00B7 ", cfg.lastSyncCount, " products"] }), cfg.lastSyncStatus && (_jsx(Badge, { variant: STATUS_VARIANT[cfg.lastSyncStatus] ?? "default", children: cfg.lastSyncStatus }))] })), _jsx(Text, { className: "mb-3", color: "faint", size: "xs", children: "Only published standard products are synced. Auctions and pre-orders are excluded. Batches of up to 50 products per call." }), _jsxs(Row, { gap: "3", children: [_jsx(Button, { onClick: () => syncMutation.mutate(), isLoading: syncMutation.isPending, disabled: !cfg?.connected || !syncEnabled || syncMutation.isPending, variant: "secondary", children: syncMutation.isPending ? "Syncing…" : ACTIONS.STORE["whatsapp-catalog-sync"].label }), _jsx(Button, { onClick: () => void startImport(), isLoading: importing, disabled: !cfg?.connected || !syncEnabled || importing, variant: "secondary", children: importing ? "Importing…" : ACTIONS.STORE["whatsapp-catalog-import"].label })] }), _jsxs(Text, { className: "mt-3", color: "faint", size: "xs", children: [_jsx(Span, { weight: "bold", children: "Push" }), " sends your published standard products to WhatsApp.", " ", _jsx(Span, { weight: "bold", children: "Import" }), " creates draft products from your WhatsApp catalog. Products are matched by slug in the description field."] })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsx(Heading, { level: 2, className: "mb-2", color: "primary", size: "sm", weight: "semibold", children: "Purchase Announcement Preview" }), _jsx(Text, { className: "mb-3", color: "muted", size: "xs", children: "This message is sent automatically to your phone and the platform admin when a new order is placed." }), _jsx(Div, { textSize: "sm", className: "font-mono", color: "primary", surface: "muted", padding: "inline", rounded: "lg", children: buildPurchaseAnnouncementMessage({
                             buyerName: "Ravi K.",
                             firstItemName: "Charizard PSA 9",
                             additionalItemCount: 2,

package/dist/index.d.ts

@@ -3291,3 +3291,6 @@ export { scamReportFormSchema } from "./features/scams/schemas/report-form";
 export { sublistingCategoryFormSchema } from "./features/store-extensions/schemas/sublisting-category-form";
 export { adminAddressFormSchema, adminStoreUpdateSchema, announcementBarSchema, } from "./features/admin/schemas/admin-editor-forms";
 export { adminOrderUpdateSchema, employeeInviteSchema, hardBanReasonSchema, featureFlagsUpdateSchema, adminAdFormSchema, } from "./features/admin/schemas/admin-ops-forms";
+export { changeEmailSchema } from "./features/account/schemas/index";
+export { adminUserUpdateSchema, whatsappSettingsSchema, lotteryPullSchema, } from "./features/admin/schemas/admin-user-form";
+export { siteSettingsFormSchema } from "./features/admin/schemas/site-settings-form";

package/dist/index.js

@@ -5700,3 +5700,6 @@ export { scamReportFormSchema } from "./features/scams/schemas/report-form";
 export { sublistingCategoryFormSchema } from "./features/store-extensions/schemas/sublisting-category-form";
 export { adminAddressFormSchema, adminStoreUpdateSchema, announcementBarSchema, } from "./features/admin/schemas/admin-editor-forms";
 export { adminOrderUpdateSchema, employeeInviteSchema, hardBanReasonSchema, featureFlagsUpdateSchema, adminAdFormSchema, } from "./features/admin/schemas/admin-ops-forms";
+export { changeEmailSchema } from "./features/account/schemas/index";
+export { adminUserUpdateSchema, whatsappSettingsSchema, lotteryPullSchema, } from "./features/admin/schemas/admin-user-form";
+export { siteSettingsFormSchema } from "./features/admin/schemas/site-settings-form";