@mohasinac/appkit 4.20.0 → 4.21.0

package/dist/_internal/server/features/reviews/actions.js

@@ -13,7 +13,7 @@ export async function createReviewAction(input) {
         if (!parsed.success) {
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
         }
-        const { productId, storeId, rating, title, body, images } = parsed.data;
+        const { productId, storeId, rating, title, comment, images } = parsed.data;
         await assertNotDuplicateReview(productId, user.uid);
         const product = await productRepository.findById(productId);
         const profile = await userRepository.findById(user.uid);
@@ -27,7 +27,9 @@ export async function createReviewAction(input) {
             userAvatar: profile?.photoURL ?? "",
             rating,
             title,
-            comment: body,
+            // Was `comment: body` — the schema called the field `body` and this
+            // line translated it. Both now use the document's own name.
+            comment,
             images: images ?? [],
             verified: false,
             status: "pending",

package/dist/_internal/shared/features/reviews/schema.d.ts

@@ -4,23 +4,23 @@ export declare const createReviewSchema: z.ZodObject<{
     storeId: z.ZodString;
     rating: z.ZodNumber;
     title: z.ZodString;
-    body: z.ZodString;
+    comment: z.ZodString;
     images: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
     orderId: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     title: string;
-    body: string;
     storeId: string;
     rating: number;
     images: string[];
     productId: string;
+    comment: string;
     orderId?: string | undefined;
 }, {
     title: string;
-    body: string;
     storeId: string;
     rating: number;
     productId: string;
+    comment: string;
     orderId?: string | undefined;
     images?: string[] | undefined;
 }>;

package/dist/_internal/shared/features/reviews/schema.js

@@ -5,7 +5,17 @@ export const createReviewSchema = z.object({
     storeId: z.string().min(1),
     rating: z.number().int().min(REVIEW_MIN_RATING).max(REVIEW_MAX_RATING),
     title: z.string().min(1).max(REVIEW_TITLE_MAX_LENGTH),
-    body: z.string().min(REVIEW_BODY_MIN_LENGTH).max(REVIEW_BODY_MAX_LENGTH),
+    /*
+     * 🛑 This was named `body`. The field is `comment` — on `ReviewDocument`
+     * (schemas/firestore.ts:39), on `CreateReviewActionInput`, and in what
+     * `useCreateReview` actually sends. So this schema disagreed with the
+     * document, the action AND the client, and would have rejected every real
+     * submission the moment anything used it to validate one.
+     *
+     * It went unnoticed because `POST /api/reviews` passed `body as any` and
+     * never consulted it.
+     */
+    comment: z.string().min(REVIEW_BODY_MIN_LENGTH).max(REVIEW_BODY_MAX_LENGTH),
     images: z.array(z.string().url()).max(REVIEW_IMAGES_MAX).default([]),
     orderId: z.string().optional(),
 });

package/dist/index.d.ts

@@ -3292,3 +3292,5 @@ export { adminOrderUpdateSchema, employeeInviteSchema, hardBanReasonSchema, feat
 export { changeEmailSchema } from "./features/account/schemas/index";
 export { adminUserUpdateSchema, whatsappSettingsSchema, lotteryPullSchema, } from "./features/admin/schemas/admin-user-form";
 export { siteSettingsFormSchema } from "./features/admin/schemas/site-settings-form";
+export { createReviewSchema as reviewSubmitSchema } from "./_internal/shared/features/reviews/schema";
+export { wishlistAddSchema } from "./schemas/api-routes";

package/dist/index.js

@@ -5702,3 +5702,12 @@ export { adminOrderUpdateSchema, employeeInviteSchema, hardBanReasonSchema, feat
 export { changeEmailSchema } from "./features/account/schemas/index";
 export { adminUserUpdateSchema, whatsappSettingsSchema, lotteryPullSchema, } from "./features/admin/schemas/admin-user-form";
 export { siteSettingsFormSchema } from "./features/admin/schemas/site-settings-form";
+/*
+ * Two schemas that existed and whose own routes did not use them.
+ * `postApiWishlist` had sat in SCHEMAS.api since the registry was seeded while
+ * `/api/wishlist` read its body raw; `createReviewSchema` was reachable only
+ * through a server action while `POST /api/reviews` passed `body as any`.
+ * Re-exported here under names that read clearly at a route call site.
+ */
+export { createReviewSchema as reviewSubmitSchema } from "./_internal/shared/features/reviews/schema";
+export { wishlistAddSchema } from "./schemas/api-routes";

package/dist/schemas/api-routes.d.ts

@@ -1,4 +1,13 @@
+import { z } from "zod";
 import type { ApiRouteSchema } from "./types";
+/** The body shape, named so a route can import it directly. */
+export declare const wishlistAddSchema: z.ZodObject<{
+    productId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    productId: string;
+}, {
+    productId: string;
+}>;
 export declare const postApiWishlist: ApiRouteSchema;
 export declare const postApiAuthSession: ApiRouteSchema;
 export declare const postApiAdminProductsIdGroup: ApiRouteSchema;

package/dist/schemas/api-routes.js

@@ -16,10 +16,12 @@
 // as the highest unknown-leakage offenders). W5–W7 will register the rest.
 import { z } from "zod";
 // ── POST /api/wishlist ────────────────────────────────────────────────────────
+/** The body shape, named so a route can import it directly. */
+export const wishlistAddSchema = z.object({
+    productId: z.string().min(1),
+});
 export const postApiWishlist = {
-    body: z.object({
-        productId: z.string().min(1),
-    }),
+    body: wishlistAddSchema,
 };
 // ── POST /api/auth/session ───────────────────────────────────────────────────
 export const postApiAuthSession = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.20.0",
+  "version": "4.21.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public"