@mohasinac/appkit 4.29.1 → 4.30.1

package/scripts/seed-cli.mjs

@@ -108,9 +108,17 @@ if (!SERVICE_ACCOUNT_OVERRIDE && missing.length > 0) {
 
 // PII keys are mandatory for collections that encrypt fields
 const PII_REQUIRED = ["users", "addresses", "storeAddresses", "products", "orders", "reviews", "bids", "payouts", "eventEntries"];
-const PII_KEY_PRESENT = Boolean(process.env.PII_SECRET || process.env.PII_ENCRYPTION_KEY);
+// PII_ENCRYPTION_KEY ONLY. `PII_SECRET` used to be accepted here as an
+// alternative and is read by no runtime code — so a machine with only that set
+// passed this check and then threw at the first encrypt, mid-load, with some
+// collections already written.
+const PII_KEY_PRESENT = Boolean(process.env.PII_ENCRYPTION_KEY);
 if (ACTION === "load" && !PII_KEY_PRESENT) {
-  console.warn("⚠ PII_SECRET / PII_ENCRYPTION_KEY not set — collections with PII fields will fail.");
+  // A hard stop, not a warning. Loading without the key does not skip the PII
+  // collections — it writes some and then throws, leaving a half-seeded
+  // database that looks like a successful run until someone reads it.
+  console.error("✖ PII_ENCRYPTION_KEY is not set — users, addresses, orders, reviews, bids, payouts and eventEntries all encrypt fields at write time.");
+  process.exit(2);
 }
 
 // ---------------------------------------------------------------------------
@@ -166,7 +174,7 @@ const appkit = await import("@mohasinac/appkit");
 // client-safe barrel, only from "@mohasinac/appkit/server". The *_PII_FIELDS
 // / *_PII_INDEX_MAP constants are plain data and stay in the main barrel.
 const appkitServer = await import("@mohasinac/appkit/server");
-const { encryptPiiFields, addPiiIndices, encryptPayoutDetails, encryptPayoutBankAccount, encryptShippingConfig } = appkitServer;
+const { encryptPiiFields, piiIndicesFor, encryptPayoutDetails, encryptPayoutBankAccount, encryptShippingConfig } = appkitServer;
 
 const {
   // seed data
@@ -480,9 +488,16 @@ async function loadUsers(seed, stats) {
         await auth.setCustomUserClaims(uid, { role: u.role });
       }
 
-      let docData = stripUndefined({ ...u });
-      docData = addPiiIndices(docData, USER_PII_INDEX_MAP);
-      docData = encryptPiiFields(docData, [...USER_PII_FIELDS]);
+      // Both arguments read the PLAINTEXT `plain`: indices must be hashed from
+      // the source text, and encryption must not see an already-hashed value.
+      // The previous form relied on ordering alone (indices first, THEN
+      // encrypt) — correct, but one line-swap away from spreading plaintext
+      // back over ciphertext, which is why `addPiiIndices` no longer exists.
+      const plain = stripUndefined({ ...u });
+      let docData = {
+        ...encryptPiiFields(plain, [...USER_PII_FIELDS]),
+        ...piiIndicesFor(plain, USER_PII_INDEX_MAP),
+      };
       if (docData.payoutDetails) docData.payoutDetails = encryptPayoutDetails(docData.payoutDetails);
       if (docData.shippingConfig) docData.shippingConfig = encryptShippingConfig(docData.shippingConfig);
       await docRef.set(docData, { merge: true });