@mohasinac/appkit 4.30.10 → 4.30.12

package/dist/features/admin/components/AdminBlogView.js

@@ -21,7 +21,9 @@ export function AdminBlogView({ children, ...props }) {
     const config = {
         portal: "admin",
         title: "Blog Posts",
-        // Search intentionally absent: this endpoint does not read `q`, so the box accepted typing and changed nothing. Restore it when the collection gains searchTxt — audit-listing-search-capability tracks it.
+        // buildBlogSearchTxt indexes title + excerpt + category + tags — NOT the post
+        // body, which is not tokenised.
+        searchPlaceholder: "Search by title, excerpt, category or tag…",
         emptyLabel: "No blog posts found",
         filterKeys: ["status", "isFeatured"],
         defaultSort: sortBy("publishedAt", "DESC"),

package/dist/features/admin/components/AdminCouponsView.js

@@ -52,7 +52,8 @@ export function AdminCouponsView({ children, onBulkArchive, onBulkDelete, ...pro
     const config = {
         portal: "admin",
         title: "Coupons",
-        // Search intentionally absent: this endpoint does not read `q`, so the box accepted typing and changed nothing. Restore it when the collection gains searchTxt — audit-listing-search-capability tracks it.
+        // buildCouponSearchTxt indexes code + name + description — nothing else.
+        searchPlaceholder: "Search by code, name or description…",
         emptyLabel: "No coupons found",
         filterKeys: ["type", "showExpired"],
         defaultSort: sortBy("createdAt", "DESC"),

package/dist/features/admin/components/AdminOffersView.js

@@ -103,7 +103,10 @@ export function AdminOffersView({ children, ...props }) {
     const config = {
         portal: "admin",
         title: "Offers",
-        // Search intentionally absent: this endpoint does not read `q`, so the box accepted typing and changed nothing. Restore it when the collection gains searchTxt — audit-listing-search-capability tracks it.
+        // buildOfferSearchTxt indexes productTitle + productSlug + storeName. It does
+        // NOT index buyerName or buyerEmail — those are PII, and the placeholder
+        // must not promise a match it will never make.
+        searchPlaceholder: "Search by product or store…",
         emptyLabel: "No offers found",
         filterKeys: ["status"],
         defaultSort: sortBy("createdAt", "DESC"),

package/dist/features/auctions/repository/bid.repository.d.ts

@@ -17,6 +17,25 @@ export interface BidWriteContext {
 }
 export declare class BidRepository extends BaseRepository<BidDocument> {
     constructor();
+    /**
+     * Declared, not hand-rolled.
+     *
+     * `create` encrypted `userEmail` while nothing else did, and there was no
+     * `update` override — so `adminUpdateBid`, whose input type is
+     * `Partial<Omit<BidDocument,"id"|"createdAt">>` and therefore INCLUDES
+     * `userEmail`, routed to `BaseRepository.update` -> `applyWriteHooks` with
+     * `piiFields = []` and wrote plaintext back over the ciphertext.
+     *
+     * Declaring it covers all nine mutating methods, including the `*InTx` /
+     * `*InBatch` family that had no encryption at all.
+     *
+     * 🛑 It does NOT cover `setWinningBid`, `endAuction`, `cancelProductBids` or
+     * the `markWon`/`markLost`/`markOutbid`/`markWinning` cluster — those call
+     * `batch.update(ref, …)` DIRECTLY and always will. They do not touch
+     * `userEmail` today, so there is no leak; the next PII-shaped field added to
+     * one of those patches would inherit the bypass.
+     */
+    protected piiFields: readonly ["userEmail"];
     /** Override mapDoc to auto-decrypt PII on every bid read */
     protected mapDoc<D = BidDocument>(snap: import("../../../providers/db-firebase").DocumentSnapshot): D;
     /**

package/dist/features/auctions/repository/bid.repository.js

@@ -8,11 +8,30 @@ import { BaseRepository, getFirestoreCount, prepareForFirestore, parseSieveDateV
 import { DatabaseError } from "../../../errors";
 import { BID_COLLECTION, BID_TRACKED_FIELDS, BID_HISTORY_PII_FIELDS, createBidId } from "../schemas";
 import { withHistory } from "../../../_internal/shared/history/index";
-import { encryptPiiFields, decryptPiiFields, BID_PII_FIELDS, } from "../../../security";
+import { decryptPiiFields, BID_PII_FIELDS, } from "../../../security";
 import { BID_FIELDS } from "../../../constants/field-names";
 export class BidRepository extends BaseRepository {
     constructor() {
         super(BID_COLLECTION);
+        /**
+         * Declared, not hand-rolled.
+         *
+         * `create` encrypted `userEmail` while nothing else did, and there was no
+         * `update` override — so `adminUpdateBid`, whose input type is
+         * `Partial<Omit<BidDocument,"id"|"createdAt">>` and therefore INCLUDES
+         * `userEmail`, routed to `BaseRepository.update` -> `applyWriteHooks` with
+         * `piiFields = []` and wrote plaintext back over the ciphertext.
+         *
+         * Declaring it covers all nine mutating methods, including the `*InTx` /
+         * `*InBatch` family that had no encryption at all.
+         *
+         * 🛑 It does NOT cover `setWinningBid`, `endAuction`, `cancelProductBids` or
+         * the `markWon`/`markLost`/`markOutbid`/`markWinning` cluster — those call
+         * `batch.update(ref, …)` DIRECTLY and always will. They do not touch
+         * `userEmail` today, so there is no leak; the next PII-shaped field added to
+         * one of those patches would inherit the bypass.
+         */
+        this.piiFields = BID_PII_FIELDS;
     }
     /** Override mapDoc to auto-decrypt PII on every bid read */
     mapDoc(snap) {
@@ -38,8 +57,9 @@ export class BidRepository extends BaseRepository {
             createdAt: new Date(),
             updatedAt: new Date(),
         };
-        // Encrypt PII before persisting
-        const encrypted = encryptPiiFields(bidData, [...BID_PII_FIELDS]);
+        // The SAME hook every other write path uses, rather than a second
+        // hand-rolled call that has to stay in agreement with it.
+        const encrypted = this.applyWriteHooks(bidData);
         await this.db
             .collection(this.collection)
             .doc(id)
@@ -437,7 +457,12 @@ BidRepository.SIEVE_FIELDS = {
     productTitle: { canFilter: true, canSort: true },
     userId: { canFilter: true, canSort: false },
     userName: { canFilter: true, canSort: true },
-    userEmail: { canFilter: true, canSort: true },
+    // Encrypted (BID_PII_FIELDS). Filtering compares plaintext against
+    // `enc:v1:…` and matches ZERO rows with a 200; sorting orders by base64
+    // noise. It appeared to work only because the column was still
+    // plaintext. There is no blind index for bids (`indexMap: {}`), so the
+    // fix is to close it, not to add one — same as payout.sellerEmail.
+    userEmail: { canFilter: false, canSort: false },
     bidAmount: { canFilter: true, canSort: true },
     status: { canFilter: true, canSort: true },
     isWinning: { canFilter: true, canSort: false },

package/dist/features/catalogue/repository/catalogue.repository.js

@@ -33,7 +33,18 @@ export class CatalogueRepository extends BaseRepository {
             createdAt: now,
             updatedAt: now,
         };
-        await this.getCollection().doc(id).set(prepareForFirestore(data));
+        // `applyWriteHooks`, NOT a bare `.set(data)`.
+        //
+        // This wrote the document directly, bypassing the hook entirely — so
+        // `ownerEmail` was persisted in CLEARTEXT on every create despite
+        // `piiFields` being declared above. `mapDoc` then calls `decryptPiiFields`,
+        // which passes a non-`enc:v1:` string straight through, so reads looked
+        // correct and nothing ever errored.
+        //
+        // Deliberately not `this.createWithId(id, data)`: that does a
+        // read-after-write, costing a Firestore read on every create (Rule #6) and
+        // changing the return from this plaintext echo to a `mapDoc` round-trip.
+        await this.getCollection().doc(id).set(prepareForFirestore(this.applyWriteHooks(data)));
         return { id, ...data };
     }
     /**

package/dist/features/events/components/AdminEventsView.js

@@ -33,7 +33,8 @@ export function AdminEventsView({ children, ...props }) {
     const config = {
         portal: "admin",
         title: "Events",
-        // Search intentionally absent: this endpoint does not read `q`, so the box accepted typing and changed nothing. Restore it when the collection gains searchTxt — audit-listing-search-capability tracks it.
+        // buildEventSearchTxt indexes title + description + type + tags.
+        searchPlaceholder: "Search by title, description, type or tag…",
         emptyLabel: "No events found",
         filterKeys: ["status", "type"],
         defaultSort: sortBy("startsAt", "DESC"),

package/dist/features/orders/repository/orders.repository.d.ts

@@ -151,7 +151,9 @@ declare class OrderRepository extends BaseRepository<OrderDocument> {
             canSort: boolean;
         };
     };
-    listForSeller(productIds: string[], model: SieveModel): Promise<FirebaseSieveResult<OrderDocument>>;
+    listForSeller(productIds: string[], model: SieveModel, opts?: {
+        search?: string;
+    }): Promise<FirebaseSieveResult<OrderDocument>>;
     listForUser(userId: string, model: SieveModel): Promise<FirebaseSieveResult<OrderDocument>>;
     static readonly ADMIN_SIEVE_FIELDS: {
         searchTxt: {

package/dist/features/orders/repository/orders.repository.js

@@ -260,7 +260,12 @@ class OrderRepository extends BaseRepository {
             throw new DatabaseError(`Failed to delete orders for user: ${userId}`, error);
         }
     }
-    async listForSeller(productIds, model) {
+    async listForSeller(productIds, model, opts) {
+        const plan = planSearchTxt(opts?.search);
+        // A search that yielded no usable term must return NOTHING, not the
+        // seller's whole order list.
+        if (plan.empty)
+            return emptySearchResult();
         if (productIds.length === 0) {
             const page = Math.max(1, Number(model.page ?? 1));
             const pageSize = Math.max(1, Number(model.pageSize ?? 20));
@@ -273,12 +278,22 @@ class OrderRepository extends BaseRepository {
                 hasMore: false,
             };
         }
-        const baseQuery = this.getCollection().where(ORDER_FIELDS.PRODUCT_ID, "in", productIds);
-        return this.sieveQuery(model, OrderRepository.SELLER_SIEVE_FIELDS, {
+        let baseQuery = this.getCollection().where(ORDER_FIELDS.PRODUCT_ID, "in", productIds);
+        if (plan.head) {
+            // `array-contains` alongside `in` is legal — Firestore's one-per-query
+            // limits are on `array-contains` and on the `in`/`not-in`/
+            // `array-contains-any` family separately, so one of each is fine.
+            // Verified against production data before this shipped, and the
+            // matching composite index is declared in firestore.indexes.json;
+            // the query happened to plan without one, which is not a guarantee.
+            baseQuery = baseQuery.where(ORDER_FIELDS.SEARCH_TXT, "array-contains", plan.head);
+        }
+        const result = await this.sieveQuery(model, OrderRepository.SELLER_SIEVE_FIELDS, {
             baseQuery,
             defaultPageSize: 20,
             maxPageSize: 100,
         });
+        return refineSearchTxt(result, plan.rest);
     }
     async listForUser(userId, model) {
         const baseQuery = this.getCollection().where(ORDER_FIELDS.USER_ID, "==", userId);

package/dist/features/seller/components/SellerCouponsView.js

@@ -49,7 +49,8 @@ export function SellerCouponsView({ onCreateClick, onEditClick, onToggle, onDele
     const config = {
         portal: "seller",
         title: "Coupons",
-        // Search intentionally absent: this endpoint does not read `q`, so the box accepted typing and changed nothing. Restore it when the collection gains searchTxt — audit-listing-search-capability tracks it.
+        // buildCouponSearchTxt indexes code + name + description — nothing else.
+        searchPlaceholder: "Search by code, name or description…",
         emptyLabel: "No coupons found — create your first coupon",
         filterKeys: ["isActive"],
         defaultSort: sortBy("createdAt", "DESC"),

package/dist/features/seller/components/SellerOffersView.js

@@ -22,7 +22,9 @@ export function SellerOffersView({ children, onAcceptOffer, onRejectOffer, onCou
     const config = {
         portal: "seller",
         title: "Offers",
-        // Search intentionally absent: this endpoint does not read `q`, so the box accepted typing and changed nothing. Restore it when the collection gains searchTxt — audit-listing-search-capability tracks it.
+        // buildOfferSearchTxt indexes productTitle + productSlug + storeName — never
+        // the buyer's name or email.
+        searchPlaceholder: "Search by product or store…",
         emptyLabel: "No offers received",
         filterKeys: ["status"],
         defaultSort: sortBy("createdAt", "DESC"),

package/dist/features/seller/components/SellerOrdersView.js

@@ -294,7 +294,10 @@ export function SellerOrdersView({ orderDetailApiBase = SELLER_ENDPOINTS.ORDERS,
     const config = {
         portal: "seller",
         title: "Orders",
-        // Search intentionally absent: this endpoint does not read `q`, so the box accepted typing and changed nothing. Restore it when the collection gains searchTxt — audit-listing-search-capability tracks it.
+        // buildOrderSearchTxt indexes productTitle, storeName and trackingNumber.
+        // It does NOT index the buyer's name, email or address — those are PII,
+        // and the placeholder must not promise a match it will never make.
+        searchPlaceholder: "Search by product, store or tracking number…",
         emptyLabel: "No orders yet",
         filterKeys: ["status"],
         defaultSort: DEFAULT_SORT,

package/dist/features/seller/repository/offer.repository.d.ts

@@ -112,7 +112,9 @@ declare class OfferRepository extends BaseRepository<OfferDocument> {
     }): Promise<FirebaseSieveResult<OfferDocument>>;
     create(input: OfferCreateInput): Promise<OfferDocument>;
     findByBuyer(buyerUid: string, model?: SieveModel): Promise<FirebaseSieveResult<OfferDocument>>;
-    findByStore(storeId: string, model?: SieveModel): Promise<FirebaseSieveResult<OfferDocument>>;
+    findByStore(storeId: string, model?: SieveModel, opts?: {
+        search?: string;
+    }): Promise<FirebaseSieveResult<OfferDocument>>;
     findPendingByStore(storeId: string): Promise<OfferDocument[]>;
     /** Returns all pending or countered offers past their expiresAt — used by expiry sweep job */
     findExpired(): Promise<OfferDocument[]>;

package/dist/features/seller/repository/offer.repository.js

@@ -102,11 +102,21 @@ class OfferRepository extends BaseRepository {
             hasMore: false,
         };
     }
-    async findByStore(storeId, model) {
+    async findByStore(storeId, model, opts) {
         if (model) {
-            return this.sieveQuery(model, OfferRepository.SIEVE_FIELDS, {
-                baseQuery: this.getCollection().where(OFFER_FIELDS.STORE_ID, "==", storeId),
+            const plan = planSearchTxt(opts?.search);
+            // A search that yielded no usable term must return NOTHING, not the
+            // store's whole offer list.
+            if (plan.empty)
+                return emptySearchResult();
+            let baseQuery = this.getCollection().where(OFFER_FIELDS.STORE_ID, "==", storeId);
+            if (plan.head) {
+                baseQuery = baseQuery.where(OFFER_FIELDS.SEARCH_TXT, "array-contains", plan.head);
+            }
+            const result = await this.sieveQuery(model, OfferRepository.SIEVE_FIELDS, {
+                baseQuery,
             });
+            return refineSearchTxt(result, plan.rest);
         }
         const snap = await this.getCollection()
             .where(OFFER_FIELDS.STORE_ID, "==", storeId)

package/dist/features/seller/schemas/firestore.d.ts

@@ -123,6 +123,8 @@ export declare const OFFER_FIELDS: {
     readonly COUNTER_ROUND: "counterRound";
     readonly CANCELLED_BY_ADMIN_UID: "cancelledByAdminUid";
     readonly CANCEL_REASON: "cancelReason";
+    /** Word-prefix n-grams for `array-contains` search. Derived by `buildOfferSearchTxt`. */
+    readonly SEARCH_TXT: "searchTxt";
 };
 export type OfferCreateInput = Pick<OfferDocument, "productId" | "productTitle" | "productSlug" | "productImageUrl" | "buyerUid" | "buyerName" | "buyerEmail" | "storeId" | "storeName" | "offerAmount" | "listedPrice" | "currency" | "buyerNote" | "previousOfferId" | "chainRootOfferId" | "counterRound">;
 export type OfferUpdateInput = Partial<Pick<OfferDocument, "status" | "counterAmount" | "lockedPrice" | "sellerNote" | "acceptedAt" | "checkoutDeadline" | "respondedAt" | "paidOrderId" | "paidAt" | "updatedAt" | "statusHistory" | "statusHistoryTruncated" | "supersededByOfferId" | "cancelledByAdminUid" | "cancelReason">>;

package/dist/features/seller/schemas/firestore.js

@@ -75,6 +75,8 @@ export const OFFER_FIELDS = {
     COUNTER_ROUND: "counterRound",
     CANCELLED_BY_ADMIN_UID: "cancelledByAdminUid",
     CANCEL_REASON: "cancelReason",
+    /** Word-prefix n-grams for `array-contains` search. Derived by `buildOfferSearchTxt`. */
+    SEARCH_TXT: "searchTxt",
 };
 export const offerQueryHelpers = {
     byBuyer: (buyerUid) => ["buyerUid", "==", buyerUid],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.30.10",
+  "version": "4.30.12",
   "license": "MIT",
   "publishConfig": {
     "access": "public"