@mohasinac/appkit 4.30.4 → 4.30.5

package/dist/features/auth/actions/profile-actions.d.ts

@@ -23,7 +23,23 @@ export type UpdateProfileInput = {
 export declare function updateUserProfile(userId: string, input: UpdateProfileInput): Promise<UserDocument>;
 export declare function getUserProfile(userId: string): Promise<UserDocument | null>;
 export declare function getUserSessions(userId: string): Promise<import("..").SessionDocument[]>;
-export declare function getPublicUserProfile(userId: string): Promise<Pick<UserDocument, "id" | "displayName" | "photoURL" | "role" | "createdAt" | "storeId" | "storeSlug" | "publicProfile" | "stats"> | null>;
+/**
+ * Resolve a profile by slug, then document id, then Auth uid.
+ *
+ * ONE function because the page and `GET /api/profile/[userId]` had already
+ * diverged: the page fell back to `findByUid`, the route did not, so the same
+ * identifier resolved on one surface and 404'd on the other. Adding slug
+ * resolution to each of them separately would have made that three variants.
+ *
+ * Order matters. The slug is the canonical public identifier, so it is tried
+ * first; `id` is next because for every app-created account `id === uid`, which
+ * makes the third lookup a no-op for them. The uid fallback exists for seeded
+ * personas (whose document id is a `user-*` slug, not their uid) and for links
+ * shared before slugs existed — dropping it would 404 URLs already in the wild,
+ * including ones inside sent notification emails.
+ */
+export declare function resolveProfileUser(identifier: string): Promise<UserDocument | null>;
+export declare function getPublicUserProfile(userId: string): Promise<Pick<UserDocument, "id" | "slug" | "displayName" | "photoURL" | "role" | "createdAt" | "storeId" | "storeSlug" | "publicProfile" | "stats"> | null>;
 /** Fetch approved reviews for a store. storeId === storeSlug in this project. */
 export declare function getSellerReviews(storeId: string): Promise<Review[]>;
 export declare function getProfileStoreProducts(storeId: string): Promise<import("../../products").ProductDocument[]>;

package/dist/features/auth/actions/profile-actions.js

@@ -22,15 +22,37 @@ export async function getUserProfile(userId) {
 export async function getUserSessions(userId) {
     return sessionRepository.findAllByUser(userId);
 }
+/**
+ * Resolve a profile by slug, then document id, then Auth uid.
+ *
+ * ONE function because the page and `GET /api/profile/[userId]` had already
+ * diverged: the page fell back to `findByUid`, the route did not, so the same
+ * identifier resolved on one surface and 404'd on the other. Adding slug
+ * resolution to each of them separately would have made that three variants.
+ *
+ * Order matters. The slug is the canonical public identifier, so it is tried
+ * first; `id` is next because for every app-created account `id === uid`, which
+ * makes the third lookup a no-op for them. The uid fallback exists for seeded
+ * personas (whose document id is a `user-*` slug, not their uid) and for links
+ * shared before slugs existed — dropping it would 404 URLs already in the wild,
+ * including ones inside sent notification emails.
+ */
+export async function resolveProfileUser(identifier) {
+    const bySlug = await userRepository.findBySlug(identifier);
+    if (bySlug)
+        return bySlug;
+    const byId = await userRepository.findById(identifier);
+    if (byId)
+        return byId;
+    return userRepository.findByUid(identifier);
+}
 export async function getPublicUserProfile(userId) {
-    let user = await userRepository.findById(userId);
-    // Fallback: userId may be a Firebase Auth UID rather than the document slug
-    if (!user)
-        user = await userRepository.findByUid(userId);
+    const user = await resolveProfileUser(userId);
     if (!user)
         return null;
     return {
         id: user.id,
+        slug: user.slug,
         displayName: user.displayName,
         photoURL: user.photoURL,
         role: user.role,

package/dist/features/auth/actions/user-slug.d.ts

@@ -0,0 +1,37 @@
+/** Reservation collection: doc id IS the slug, so the id is the uniqueness. */
+export declare const USER_SLUGS_COLLECTION = "userSlugs";
+/**
+ * The stem a slug is built from.
+ *
+ * 🛑 `displayName` ONLY. `generateUserId` used to append
+ * `email.split("@")[0].substring(0, 8)`, which put the local-part of a real
+ * email address into a public URL. That function is deleted; do not
+ * reintroduce an email- or phone-derived stem here.
+ *
+ * 🛑 …AND the caller must pass `email`, because deleting that function was not
+ * enough. TWO of the three signup paths — Google callback and session — set
+ *
+ *     displayName: name ?? email.split("@")[0] ?? DEFAULT_DISPLAY_NAME
+ *
+ * so a Google account with no name, or any session-created user, already HOLDS
+ * its email local-part as its display name. Deriving a slug from displayName
+ * would publish it in the URL through the back door. When the two match, this
+ * falls back to `member` — a guard that does not depend on every caller
+ * remembering, which is the only kind that survives.
+ */
+export declare function userSlugBase(displayName: string | null | undefined, email?: string | null): string;
+/**
+ * Claim a unique slug for `uid`, returning it.
+ *
+ * Idempotent per user: if `uid` already holds a reservation, that slug is
+ * returned rather than a second one being minted.
+ *
+ * The claim is a TRANSACTION because Firestore has no unique constraint — a
+ * read-then-write races two simultaneous signups onto the same slug, and the
+ * loser silently overwrites the winner's reservation.
+ */
+export declare function reserveUserSlug(uid: string, displayName: string | null | undefined, 
+/** Pass it. See `userSlugBase` — two signup paths put the local-part here. */
+email?: string | null, opts?: {
+    maxAttempts?: number;
+}): Promise<string | null>;

package/dist/features/auth/actions/user-slug.js

@@ -0,0 +1,124 @@
+/*
+ * WHY: Users are the only entity in the Slug Prefix System without a real slug —
+ *      every profile URL was a raw Firebase uid. This mints one, uniquely,
+ *      without moving the document key.
+ *
+ * WHAT: `reserveUserSlug(uid, displayName)` — transactional claim against a
+ *       `userSlugs/{slug}` reservation collection, returning the slug it won.
+ *
+ * @tag domain:auth
+ * @tag layer:server-data
+ * @tag access:server-only
+ * @tag sideEffects:firestore-write
+ */
+import { getAdminDb } from "../../../providers/db-firebase/admin";
+import { slugify } from "../../../utils";
+import { serverLogger } from "../../../monitoring/server-logger";
+import { normalizeError } from "../../../errors/normalize";
+/** Reservation collection: doc id IS the slug, so the id is the uniqueness. */
+export const USER_SLUGS_COLLECTION = "userSlugs";
+/**
+ * Slugs nobody may hold.
+ *
+ * `/profile/{slug}` has a `[tab]` child segment, so `overview` and `catalogue`
+ * are included even though a collision there is positional rather than fatal —
+ * a username that reads like a tab is confusing regardless. The rest are the
+ * words a URL-shaped identifier should never be able to impersonate.
+ */
+const RESERVED = new Set([
+    "admin", "administrator", "api", "app", "auth", "login", "logout", "register",
+    "signup", "signin", "new", "edit", "delete", "settings", "me", "self", "user",
+    "users", "profile", "profiles", "store", "stores", "seller", "sellers",
+    "support", "help", "about", "contact", "search", "null", "undefined", "root",
+    "system", "moderator", "staff", "team", "official", "letitrip",
+    // `/profile/{slug}/{tab}` values
+    "overview", "catalogue",
+]);
+/** Display names that carry no identity — `UserSchemaDefaults.DEFAULT_DISPLAY_NAME`. */
+const EMPTY_NAMES = new Set(["", "user", "anonymous", "null", "undefined"]);
+/** Longest a generated slug may be before the collision suffix. */
+const MAX_BASE_LENGTH = 40;
+/**
+ * The stem a slug is built from.
+ *
+ * 🛑 `displayName` ONLY. `generateUserId` used to append
+ * `email.split("@")[0].substring(0, 8)`, which put the local-part of a real
+ * email address into a public URL. That function is deleted; do not
+ * reintroduce an email- or phone-derived stem here.
+ *
+ * 🛑 …AND the caller must pass `email`, because deleting that function was not
+ * enough. TWO of the three signup paths — Google callback and session — set
+ *
+ *     displayName: name ?? email.split("@")[0] ?? DEFAULT_DISPLAY_NAME
+ *
+ * so a Google account with no name, or any session-created user, already HOLDS
+ * its email local-part as its display name. Deriving a slug from displayName
+ * would publish it in the URL through the back door. When the two match, this
+ * falls back to `member` — a guard that does not depend on every caller
+ * remembering, which is the only kind that survives.
+ */
+export function userSlugBase(displayName, email) {
+    const base = slugify(displayName ?? "").slice(0, MAX_BASE_LENGTH);
+    if (!base || EMPTY_NAMES.has(base))
+        return "member";
+    const localPart = (email ?? "").split("@")[0] ?? "";
+    if (localPart && slugify(localPart) === base)
+        return "member";
+    return base;
+}
+/** Whether a candidate may be claimed at all. */
+function isClaimable(candidate) {
+    return candidate.length > 0 && !RESERVED.has(candidate);
+}
+/**
+ * Claim a unique slug for `uid`, returning it.
+ *
+ * Idempotent per user: if `uid` already holds a reservation, that slug is
+ * returned rather than a second one being minted.
+ *
+ * The claim is a TRANSACTION because Firestore has no unique constraint — a
+ * read-then-write races two simultaneous signups onto the same slug, and the
+ * loser silently overwrites the winner's reservation.
+ */
+export async function reserveUserSlug(uid, displayName, 
+/** Pass it. See `userSlugBase` — two signup paths put the local-part here. */
+email, opts) {
+    const db = getAdminDb();
+    const base = userSlugBase(displayName, email);
+    const maxAttempts = opts?.maxAttempts ?? 50;
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        // `ravi-kumar`, then `ravi-kumar-2`, `ravi-kumar-3`… The suffix appears
+        // only when it has to, so the common case stays clean.
+        const candidate = attempt === 0 ? base : `${base}-${attempt + 1}`;
+        if (!isClaimable(candidate))
+            continue;
+        try {
+            const won = await db.runTransaction(async (tx) => {
+                const ref = db.collection(USER_SLUGS_COLLECTION).doc(candidate);
+                const snap = await tx.get(ref);
+                if (snap.exists) {
+                    // Already ours — re-running signup or a backfill must not mint a second.
+                    return snap.data()?.uid === uid;
+                }
+                tx.set(ref, { uid, createdAt: new Date() });
+                return true;
+            });
+            if (won)
+                return candidate;
+        }
+        catch (err) {
+            void normalizeError(err);
+            serverLogger.warn("reserveUserSlug: transaction failed", {
+                uid,
+                candidate,
+                error: err instanceof Error ? err.message : String(err),
+            });
+            return null;
+        }
+    }
+    // Never throw: a signup must not fail because a display name is popular.
+    // The profile route still resolves by id and uid, so the account works — it
+    // just keeps a uid-shaped URL.
+    serverLogger.warn("reserveUserSlug: exhausted attempts", { uid, base, maxAttempts });
+    return null;
+}

package/dist/features/auth/repository/user.repository.d.ts

@@ -11,6 +11,14 @@ export declare class UserRepository extends BaseRepository<UserDocument> {
     createWithId(id: string, data: Partial<UserDocument>): Promise<UserDocument>;
     create(input: Omit<UserDocument, "id" | "createdAt" | "updatedAt">): Promise<UserDocument>;
     findByUid(uid: string): Promise<UserDocument | null>;
+    /**
+     * Resolve a public profile slug.
+     *
+     * Separate from `findById` because the slug is a FIELD, not the document key
+     * — `id === uid` is what keeps every auth-gated request an O(1) lookup from
+     * the verified token claim, so the key could not be repurposed for this.
+     */
+    findBySlug(slug: string): Promise<UserDocument | null>;
     findByEmail(email: string): Promise<UserDocument | null>;
     findByPhone(phoneNumber: string): Promise<UserDocument | null>;
     findByRole(role: UserRole): Promise<UserDocument[]>;

package/dist/features/auth/repository/user.repository.js

@@ -2,7 +2,7 @@ import { normalizeError } from "../../../errors/normalize";
 import { DatabaseError } from "../../../errors";
 import { BaseRepository, getFirestoreCount, prepareForFirestore, parseSieveDateValue, } from "../../../providers/db-firebase";
 import { USER_PII_FIELDS, USER_PII_INDEX_MAP, piiIndicesFor, decryptPayoutDetails, decryptPiiFields, decryptShippingConfig, encryptPayoutDetails, encryptPiiFields, encryptShippingConfig, piiBlindIndex, } from "../../../security";
-import { USER_COLLECTION, USER_FIELDS, createUserId, } from "../schemas";
+import { USER_COLLECTION, USER_FIELDS, } from "../schemas";
 export class UserRepository extends BaseRepository {
     constructor() {
         super(USER_COLLECTION);
@@ -61,10 +61,18 @@ export class UserRepository extends BaseRepository {
         return super.createWithId(id, encrypted);
     }
     async create(input) {
-        const firstName = input.displayName?.split(" ")[0] || "user";
-        const lastName = input.displayName?.split(" ").slice(1).join(" ") || "account";
-        const email = input.email || "noemail@example.com";
-        const id = createUserId({ firstName, lastName, email });
+        // A Firestore auto-id, NOT a derived one.
+        //
+        // This used to call `createUserId({firstName, lastName, email})`, which
+        // built `user-{first}-{last}-{emailPrefix8}` — putting the local-part of a
+        // real email address into the document id, and therefore into the public
+        // profile URL. That generator is deleted.
+        //
+        // No real signup path reaches here (all three call `createWithId` with the
+        // Firebase Auth uid, because `id === uid` is what makes an auth-gated
+        // request an O(1) lookup). The readable public identifier is `slug`, minted
+        // by `reserveUserSlug` from displayName only.
+        const id = this.db.collection(this.collection).doc().id;
         const userData = {
             ...input,
             createdAt: new Date(),
@@ -80,6 +88,16 @@ export class UserRepository extends BaseRepository {
     async findByUid(uid) {
         return this.findOneBy(USER_FIELDS.UID, uid);
     }
+    /**
+     * Resolve a public profile slug.
+     *
+     * Separate from `findById` because the slug is a FIELD, not the document key
+     * — `id === uid` is what keeps every auth-gated request an O(1) lookup from
+     * the verified token claim, so the key could not be repurposed for this.
+     */
+    async findBySlug(slug) {
+        return this.findOneBy(USER_FIELDS.SLUG, slug);
+    }
     async findByEmail(email) {
         return this.findOneBy(USER_FIELDS.EMAIL_INDEX, piiBlindIndex(email));
     }
@@ -262,6 +280,7 @@ export class UserRepository extends BaseRepository {
 }
 UserRepository.SIEVE_FIELDS = {
     uid: { canFilter: true, canSort: false },
+    slug: { canFilter: true, canSort: false },
     emailIndex: { canFilter: true, canSort: false },
     displayName: { canFilter: true, canSort: true },
     role: { canFilter: true, canSort: true },

package/dist/features/auth/schemas/firestore.d.ts

@@ -6,7 +6,6 @@
  */
 import type { UserRole } from "../types";
 import type { BannedAction, EmployeeGroup, Permission } from "../permissions/constants";
-import { type GenerateUserIdInput } from "../../../utils/id-generators";
 import type { BaseDocument } from "../../../_internal/shared/types/base-document";
 /**
  * Generic schema defaults for user-related data.
@@ -34,6 +33,25 @@ export interface AvatarMetadata {
 }
 export interface UserDocument extends BaseDocument {
     uid: string;
+    /**
+     * Public URL identifier — `/profile/{slug}`.
+     *
+     * NOT the document key. `id === uid` is what makes every auth-gated request an
+     * O(1) lookup from the verified token claim, and Firebase assigns that uid, so
+     * the app could not override it for organic signups even if it wanted to.
+     *
+     * Derived from `displayName` ONLY. Never from email or phone: a slug is public,
+     * and the local-part of an email address in a URL is a PII leak (D1 keeps
+     * displayName unencrypted precisely so it CAN be used this way).
+     *
+     * Immutable once set — categories, brands and bundles all treat slug that way,
+     * and a mutable public slug means link rot plus a freed slug someone else can
+     * claim, which is an impersonation vector.
+     *
+     * Optional because documents created before this field existed have none;
+     * profile resolution falls back to id and then uid.
+     */
+    slug?: string;
     email: string | null;
     phoneNumber: string | null;
     phoneVerified?: boolean;
@@ -177,7 +195,7 @@ export interface SellerPayoutDetails {
 }
 export declare const USER_COLLECTION: "users";
 export declare const DEFAULT_USER_DATA: Partial<UserDocument>;
-export declare const USER_INDEXED_FIELDS: readonly ["email", "emailIndex", "phoneNumber", "phoneIndex", "role", "disabled", "emailVerified", "phoneVerified", "storeSlug", "storeStatus", "isTester"];
+export declare const USER_INDEXED_FIELDS: readonly ["email", "emailIndex", "phoneNumber", "phoneIndex", "role", "disabled", "emailVerified", "phoneVerified", "storeSlug", "storeStatus", "isTester", "slug"];
 export declare const USER_PUBLIC_FIELDS: readonly ["uid", "displayName", "photoURL", "avatarMetadata", "role", "createdAt", "storeSlug", "publicProfile", "stats"];
 export declare const USER_UPDATABLE_FIELDS: readonly ["displayName", "photoURL"];
 export type UserCreateInput = Omit<UserDocument, "uid" | "id" | "createdAt" | "updatedAt">;
@@ -202,10 +220,11 @@ export declare const userQueryHelpers: {
     readonly active: () => readonly ["disabled", "==", false];
     readonly disabled: () => readonly ["disabled", "==", true];
 };
-export declare function createUserId(input: GenerateUserIdInput): string;
 export declare const USER_FIELDS: {
     readonly ID: "id";
     readonly UID: "uid";
+    /** Public URL identifier. Derived from displayName; never from PII. */
+    readonly SLUG: "slug";
     readonly EMAIL: "email";
     readonly PHONE_NUMBER: "phoneNumber";
     readonly PHONE_VERIFIED: "phoneVerified";

package/dist/features/auth/schemas/firestore.js

@@ -4,7 +4,6 @@
  * Canonical Firestore document interfaces, collection names, field constants,
  * and query helpers for the auth feature (users, tokens, sessions).
  */
-import { generateUserId, } from "../../../utils/id-generators";
 // ============================================================================
 // SCHEMA DEFAULTS
 // ============================================================================
@@ -59,6 +58,7 @@ export const USER_INDEXED_FIELDS = [
     "storeSlug",
     "storeStatus",
     "isTester",
+    "slug",
 ];
 export const USER_PUBLIC_FIELDS = [
     "uid",
@@ -84,13 +84,12 @@ export const userQueryHelpers = {
     active: () => ["disabled", "==", false],
     disabled: () => ["disabled", "==", true],
 };
-export function createUserId(input) {
-    return generateUserId(input);
-}
 // -- User field name constants ------------------------------------------------
 export const USER_FIELDS = {
     ID: "id",
     UID: "uid",
+    /** Public URL identifier. Derived from displayName; never from PII. */
+    SLUG: "slug",
     EMAIL: "email",
     PHONE_NUMBER: "phoneNumber",
     PHONE_VERIFIED: "phoneVerified",

package/dist/index.d.ts

@@ -1448,7 +1448,6 @@ export { USER_PUBLIC_FIELDS } from "./features/auth/schemas/index";
 export { USER_UPDATABLE_FIELDS } from "./features/auth/schemas/index";
 export { UserSchemaDefaults } from "./features/auth/schemas/index";
 export { authUserSchema } from "./features/auth/schemas/index";
-export { createUserId } from "./features/auth/schemas/index";
 export { forgotPasswordSchema } from "./features/auth/schemas/index";
 export { loginSchema } from "./features/auth/schemas/index";
 export { parseUserAgent } from "./features/auth/schemas/index";

package/dist/index.js

@@ -2727,8 +2727,6 @@ export { UserSchemaDefaults } from "./features/auth/schemas/index";
 // authUserSchema - Model for auth user schema.
 export { authUserSchema } from "./features/auth/schemas/index";
 // [SCHEMA]-Schema / data-shape constant â€" Zod validator, default-value object, or Firestore collection/field name constant.
-// createUserId - Helper for create user id.
-export { createUserId } from "./features/auth/schemas/index";
 // [SCHEMA]-Schema / data-shape constant â€" Zod validator, default-value object, or Firestore collection/field name constant.
 // forgotPasswordSchema - Model for forgot password schema.
 export { forgotPasswordSchema } from "./features/auth/schemas/index";

package/dist/react/contexts/SessionContext.d.ts

@@ -20,6 +20,12 @@ export interface SessionUser {
     displayName: string | null;
     photoURL: string | null;
     phoneNumber: string | null;
+    /**
+     * Public profile slug, so the user's own "View public profile" links show the
+     * readable URL rather than their raw Firebase uid. Optional: accounts created
+     * before slugs existed have none, and `/profile/{uid}` still resolves.
+     */
+    slug?: string;
     role: string;
     disabled?: boolean;
     createdAt?: Date;

package/dist/server.d.ts

@@ -463,6 +463,8 @@ export { decryptPii } from "./security/index";
 export { isPiiEncrypted } from "./security/index";
 export { piiBlindIndex } from "./security/index";
 export { piiIndicesFor } from "./security/index";
+export { reserveUserSlug, userSlugBase, USER_SLUGS_COLLECTION } from "./features/auth/actions/user-slug";
+export { resolveProfileUser } from "./features/auth/actions/profile-actions";
 export { getPiiConfigError } from "./security/index";
 export { encryptShippingAddress } from "./security/index";
 export { decryptShippingAddress } from "./security/index";

package/dist/server.js

@@ -1295,6 +1295,8 @@ export { decryptPii } from "./security/index";
 export { isPiiEncrypted } from "./security/index";
 export { piiBlindIndex } from "./security/index";
 export { piiIndicesFor } from "./security/index";
+export { reserveUserSlug, userSlugBase, USER_SLUGS_COLLECTION } from "./features/auth/actions/user-slug";
+export { resolveProfileUser } from "./features/auth/actions/profile-actions";
 export { getPiiConfigError } from "./security/index";
 export { encryptShippingAddress } from "./security/index";
 export { decryptShippingAddress } from "./security/index";

package/dist/utils/id-generators.d.ts

@@ -12,13 +12,6 @@ export interface GenerateCategoryIdInput {
     customId?: string;
 }
 export declare function generateCategoryId(input: GenerateCategoryIdInput): string;
-export interface GenerateUserIdInput {
-    firstName: string;
-    lastName: string;
-    email: string;
-    customId?: string;
-}
-export declare function generateUserId(input: GenerateUserIdInput): string;
 export interface GenerateProductIdInput {
     name: string;
     category: string;

package/dist/utils/id-generators.js

@@ -26,15 +26,6 @@ export function generateCategoryId(input) {
         return `category-${nameSlug}-${slugify(input.rootName)}`;
     return `category-${nameSlug}`;
 }
-export function generateUserId(input) {
-    if (input.customId?.trim())
-        return input.customId.trim();
-    const firstSlug = slugify(input.firstName);
-    const lastSlug = slugify(input.lastName);
-    const emailPrefix = input.email.split("@")[0].toLowerCase().substring(0, 8);
-    const emailSlug = slugify(emailPrefix);
-    return `user-${firstSlug}-${lastSlug}-${emailSlug}`;
-}
 export function generateProductId(input) {
     if (input.customId?.trim())
         return input.customId.trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.30.4",
+  "version": "4.30.5",
   "license": "MIT",
   "publishConfig": {
     "access": "public"