@mohasinac/appkit 4.30.9 → 4.30.11

package/dist/_internal/server/jobs/core/listingProcessor.js

@@ -56,13 +56,21 @@ const LISTERS = {
             ? `${m.filters},categoryType==brand`
             : "categoryType==brand",
     }),
-    orders: (m) => orderRepository.listAll(m),
-    reviews: (m) => reviewRepository.listAll(m),
+    orders: (m, o) => orderRepository.listAll(m, { search: getStringOpt(o, "search") }),
+    reviews: (m, o) => reviewRepository.listAll(m, { search: getStringOpt(o, "search") }),
     coupons: (m) => couponsRepository.list(m),
     bids: (m) => bidRepository.list(m),
     payouts: (m) => payoutRepository.list(m),
-    blogPosts: (m) => blogRepository.listAll(m),
-    events: (m) => eventRepository.list(m),
+    blogPosts: (m, o) => blogRepository.listAll(m, { search: getStringOpt(o, "search") }),
+    events: (m, o) => eventRepository.list(m, { search: getStringOpt(o, "search") }),
+    // 🛑 EVERY lister whose repository accepts a `search` opt MUST forward it.
+    // `baseOpts.search` is how token search reaches the repository — Sieve cannot
+    // express array-contains, so it can never ride inside `filters`. A lister
+    // written `(m) => repo.list(m)` silently drops it and the Function returns an
+    // UNFILTERED page with a 200, while the same route's local fallback filters
+    // correctly — so it only reproduces in production, and only when the Function
+    // is reachable. That is how it survived here for orders, reviews, blogPosts,
+    // events and stores after their routes and repositories were both wired.
     // Forwards opts so `baseOpts.search` reaches the repository's token search.
     // This was `(m) => faqsRepository.list(m)` — the second argument was dropped,
     // which made FAQ token search structurally unreachable through the Function
@@ -82,7 +90,9 @@ const LISTERS = {
     productFeatures: (m) => productFeaturesRepository.list(m),
     homepageSections: (m) => homepageSectionsRepository.list(m),
     users: (m) => userRepository.list(m),
-    stores: (m, o) => storeRepository.listStores(m, getBoolOpt(o, "activeOnly", true)),
+    stores: (m, o) => storeRepository.listStores(m, getBoolOpt(o, "activeOnly", true), {
+        search: getStringOpt(o, "search"),
+    }),
     eventEntries: (m, o) => {
         const eventId = requireOpt(o, "eventId", "eventEntries");
         return eventEntryRepository.listForEvent(eventId, m);

package/dist/features/auctions/repository/bid.repository.d.ts

@@ -17,6 +17,25 @@ export interface BidWriteContext {
 }
 export declare class BidRepository extends BaseRepository<BidDocument> {
     constructor();
+    /**
+     * Declared, not hand-rolled.
+     *
+     * `create` encrypted `userEmail` while nothing else did, and there was no
+     * `update` override — so `adminUpdateBid`, whose input type is
+     * `Partial<Omit<BidDocument,"id"|"createdAt">>` and therefore INCLUDES
+     * `userEmail`, routed to `BaseRepository.update` -> `applyWriteHooks` with
+     * `piiFields = []` and wrote plaintext back over the ciphertext.
+     *
+     * Declaring it covers all nine mutating methods, including the `*InTx` /
+     * `*InBatch` family that had no encryption at all.
+     *
+     * 🛑 It does NOT cover `setWinningBid`, `endAuction`, `cancelProductBids` or
+     * the `markWon`/`markLost`/`markOutbid`/`markWinning` cluster — those call
+     * `batch.update(ref, …)` DIRECTLY and always will. They do not touch
+     * `userEmail` today, so there is no leak; the next PII-shaped field added to
+     * one of those patches would inherit the bypass.
+     */
+    protected piiFields: readonly ["userEmail"];
     /** Override mapDoc to auto-decrypt PII on every bid read */
     protected mapDoc<D = BidDocument>(snap: import("../../../providers/db-firebase").DocumentSnapshot): D;
     /**

package/dist/features/auctions/repository/bid.repository.js

@@ -8,11 +8,30 @@ import { BaseRepository, getFirestoreCount, prepareForFirestore, parseSieveDateV
 import { DatabaseError } from "../../../errors";
 import { BID_COLLECTION, BID_TRACKED_FIELDS, BID_HISTORY_PII_FIELDS, createBidId } from "../schemas";
 import { withHistory } from "../../../_internal/shared/history/index";
-import { encryptPiiFields, decryptPiiFields, BID_PII_FIELDS, } from "../../../security";
+import { decryptPiiFields, BID_PII_FIELDS, } from "../../../security";
 import { BID_FIELDS } from "../../../constants/field-names";
 export class BidRepository extends BaseRepository {
     constructor() {
         super(BID_COLLECTION);
+        /**
+         * Declared, not hand-rolled.
+         *
+         * `create` encrypted `userEmail` while nothing else did, and there was no
+         * `update` override — so `adminUpdateBid`, whose input type is
+         * `Partial<Omit<BidDocument,"id"|"createdAt">>` and therefore INCLUDES
+         * `userEmail`, routed to `BaseRepository.update` -> `applyWriteHooks` with
+         * `piiFields = []` and wrote plaintext back over the ciphertext.
+         *
+         * Declaring it covers all nine mutating methods, including the `*InTx` /
+         * `*InBatch` family that had no encryption at all.
+         *
+         * 🛑 It does NOT cover `setWinningBid`, `endAuction`, `cancelProductBids` or
+         * the `markWon`/`markLost`/`markOutbid`/`markWinning` cluster — those call
+         * `batch.update(ref, …)` DIRECTLY and always will. They do not touch
+         * `userEmail` today, so there is no leak; the next PII-shaped field added to
+         * one of those patches would inherit the bypass.
+         */
+        this.piiFields = BID_PII_FIELDS;
     }
     /** Override mapDoc to auto-decrypt PII on every bid read */
     mapDoc(snap) {
@@ -38,8 +57,9 @@ export class BidRepository extends BaseRepository {
             createdAt: new Date(),
             updatedAt: new Date(),
         };
-        // Encrypt PII before persisting
-        const encrypted = encryptPiiFields(bidData, [...BID_PII_FIELDS]);
+        // The SAME hook every other write path uses, rather than a second
+        // hand-rolled call that has to stay in agreement with it.
+        const encrypted = this.applyWriteHooks(bidData);
         await this.db
             .collection(this.collection)
             .doc(id)
@@ -437,7 +457,12 @@ BidRepository.SIEVE_FIELDS = {
     productTitle: { canFilter: true, canSort: true },
     userId: { canFilter: true, canSort: false },
     userName: { canFilter: true, canSort: true },
-    userEmail: { canFilter: true, canSort: true },
+    // Encrypted (BID_PII_FIELDS). Filtering compares plaintext against
+    // `enc:v1:…` and matches ZERO rows with a 200; sorting orders by base64
+    // noise. It appeared to work only because the column was still
+    // plaintext. There is no blind index for bids (`indexMap: {}`), so the
+    // fix is to close it, not to add one — same as payout.sellerEmail.
+    userEmail: { canFilter: false, canSort: false },
     bidAmount: { canFilter: true, canSort: true },
     status: { canFilter: true, canSort: true },
     isWinning: { canFilter: true, canSort: false },

package/dist/features/catalogue/repository/catalogue.repository.js

@@ -33,7 +33,18 @@ export class CatalogueRepository extends BaseRepository {
             createdAt: now,
             updatedAt: now,
         };
-        await this.getCollection().doc(id).set(prepareForFirestore(data));
+        // `applyWriteHooks`, NOT a bare `.set(data)`.
+        //
+        // This wrote the document directly, bypassing the hook entirely — so
+        // `ownerEmail` was persisted in CLEARTEXT on every create despite
+        // `piiFields` being declared above. `mapDoc` then calls `decryptPiiFields`,
+        // which passes a non-`enc:v1:` string straight through, so reads looked
+        // correct and nothing ever errored.
+        //
+        // Deliberately not `this.createWithId(id, data)`: that does a
+        // read-after-write, costing a Firestore read on every create (Rule #6) and
+        // changing the return from this plaintext echo to a `mapDoc` round-trip.
+        await this.getCollection().doc(id).set(prepareForFirestore(this.applyWriteHooks(data)));
         return { id, ...data };
     }
     /**

package/dist/features/seller/repository/offer.repository.d.ts

@@ -112,7 +112,9 @@ declare class OfferRepository extends BaseRepository<OfferDocument> {
     }): Promise<FirebaseSieveResult<OfferDocument>>;
     create(input: OfferCreateInput): Promise<OfferDocument>;
     findByBuyer(buyerUid: string, model?: SieveModel): Promise<FirebaseSieveResult<OfferDocument>>;
-    findByStore(storeId: string, model?: SieveModel): Promise<FirebaseSieveResult<OfferDocument>>;
+    findByStore(storeId: string, model?: SieveModel, opts?: {
+        search?: string;
+    }): Promise<FirebaseSieveResult<OfferDocument>>;
     findPendingByStore(storeId: string): Promise<OfferDocument[]>;
     /** Returns all pending or countered offers past their expiresAt — used by expiry sweep job */
     findExpired(): Promise<OfferDocument[]>;

package/dist/features/seller/repository/offer.repository.js

@@ -102,11 +102,21 @@ class OfferRepository extends BaseRepository {
             hasMore: false,
         };
     }
-    async findByStore(storeId, model) {
+    async findByStore(storeId, model, opts) {
         if (model) {
-            return this.sieveQuery(model, OfferRepository.SIEVE_FIELDS, {
-                baseQuery: this.getCollection().where(OFFER_FIELDS.STORE_ID, "==", storeId),
+            const plan = planSearchTxt(opts?.search);
+            // A search that yielded no usable term must return NOTHING, not the
+            // store's whole offer list.
+            if (plan.empty)
+                return emptySearchResult();
+            let baseQuery = this.getCollection().where(OFFER_FIELDS.STORE_ID, "==", storeId);
+            if (plan.head) {
+                baseQuery = baseQuery.where(OFFER_FIELDS.SEARCH_TXT, "array-contains", plan.head);
+            }
+            const result = await this.sieveQuery(model, OfferRepository.SIEVE_FIELDS, {
+                baseQuery,
             });
+            return refineSearchTxt(result, plan.rest);
         }
         const snap = await this.getCollection()
             .where(OFFER_FIELDS.STORE_ID, "==", storeId)

package/dist/features/seller/schemas/firestore.d.ts

@@ -123,6 +123,8 @@ export declare const OFFER_FIELDS: {
     readonly COUNTER_ROUND: "counterRound";
     readonly CANCELLED_BY_ADMIN_UID: "cancelledByAdminUid";
     readonly CANCEL_REASON: "cancelReason";
+    /** Word-prefix n-grams for `array-contains` search. Derived by `buildOfferSearchTxt`. */
+    readonly SEARCH_TXT: "searchTxt";
 };
 export type OfferCreateInput = Pick<OfferDocument, "productId" | "productTitle" | "productSlug" | "productImageUrl" | "buyerUid" | "buyerName" | "buyerEmail" | "storeId" | "storeName" | "offerAmount" | "listedPrice" | "currency" | "buyerNote" | "previousOfferId" | "chainRootOfferId" | "counterRound">;
 export type OfferUpdateInput = Partial<Pick<OfferDocument, "status" | "counterAmount" | "lockedPrice" | "sellerNote" | "acceptedAt" | "checkoutDeadline" | "respondedAt" | "paidOrderId" | "paidAt" | "updatedAt" | "statusHistory" | "statusHistoryTruncated" | "supersededByOfferId" | "cancelledByAdminUid" | "cancelReason">>;

package/dist/features/seller/schemas/firestore.js

@@ -75,6 +75,8 @@ export const OFFER_FIELDS = {
     COUNTER_ROUND: "counterRound",
     CANCELLED_BY_ADMIN_UID: "cancelledByAdminUid",
     CANCEL_REASON: "cancelReason",
+    /** Word-prefix n-grams for `array-contains` search. Derived by `buildOfferSearchTxt`. */
+    SEARCH_TXT: "searchTxt",
 };
 export const offerQueryHelpers = {
     byBuyer: (buyerUid) => ["buyerUid", "==", buyerUid],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.30.9",
+  "version": "4.30.11",
   "license": "MIT",
   "publishConfig": {
     "access": "public"