@mohasinac/appkit 4.34.0 → 4.35.0

package/dist/features/tester/seed-data/tester-window.d.ts

@@ -0,0 +1,25 @@
+/** Reproduces the historical 1h/2h/3h auction stagger when nothing overrides it. */
+export declare const DEFAULT_TESTER_WINDOW_MINUTES = 180;
+/** Below this nothing is observable — a page load alone can outlast it. */
+export declare const MIN_TESTER_WINDOW_MINUTES = 5;
+/** The sandbox TTL is 7 days; a window longer than that outlives its own fixtures. */
+export declare const MAX_TESTER_WINDOW_MINUTES: number;
+/**
+ * Length of the testing window, in minutes.
+ *
+ * Read at call time rather than captured at module scope so a caller that sets the
+ * env var before importing a seed file still wins. Anything unparseable, non-finite
+ * or out of range falls back to the default rather than throwing: a malformed env
+ * var must not be able to brick `appkit-seed load`.
+ */
+export declare function windowMinutes(): number;
+/**
+ * A point `fraction` of the way through the window, measured from now.
+ *
+ * `windowOffset(0)` is now, `windowOffset(1)` is the window's end. Fractions above 1
+ * are allowed and mean "after this run" — that is how a fixture says "still open when
+ * testing finishes" without hard-coding a duration.
+ */
+export declare function windowOffset(fraction: number): Date;
+/** The mirror of windowOffset, into the past — for fixtures that must already be closed. */
+export declare function windowAgo(fraction: number): Date;

package/dist/features/tester/seed-data/tester-window.js

@@ -0,0 +1,66 @@
+/*
+ * WHY: Every time-bound tester fixture — auction end dates, coupon validity, event
+ *      start/end, prize-draw reveal windows, offer expiry, lottery draw windows —
+ *      must open and close INSIDE one testing session. Hand-written offsets like
+ *      `Date.now() + 2 * 60 * 60 * 1000` cannot do that: they bake in a duration
+ *      nobody can shorten, so a case reading "watch the auction actually end" is
+ *      untestable without sitting there for two hours.
+ *
+ *      This file is the one knob. Fixtures express WHEN as a fraction of the run
+ *      window; the window's real length comes from TESTER_WINDOW_MINUTES.
+ *
+ * WHAT: windowMinutes() / windowOffset(fraction) / windowAgo(fraction).
+ *
+ * 🛑 The default is 180 minutes ON PURPOSE — it reproduces the pre-existing 1h/2h/3h
+ *    auction stagger exactly (fractions 1/3, 2/3, 1), so an ordinary `appkit-seed load`
+ *    behaves as it always has. Only the automated runner shortens it. Changing this
+ *    default silently re-times every fixture for human testers too.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed-data/*-tester-seed-data.ts
+ * @tag sideEffects:none
+ */
+/** Reproduces the historical 1h/2h/3h auction stagger when nothing overrides it. */
+export const DEFAULT_TESTER_WINDOW_MINUTES = 180;
+/** Below this nothing is observable — a page load alone can outlast it. */
+export const MIN_TESTER_WINDOW_MINUTES = 5;
+/** The sandbox TTL is 7 days; a window longer than that outlives its own fixtures. */
+export const MAX_TESTER_WINDOW_MINUTES = 7 * 24 * 60;
+/**
+ * Length of the testing window, in minutes.
+ *
+ * Read at call time rather than captured at module scope so a caller that sets the
+ * env var before importing a seed file still wins. Anything unparseable, non-finite
+ * or out of range falls back to the default rather than throwing: a malformed env
+ * var must not be able to brick `appkit-seed load`.
+ */
+export function windowMinutes() {
+    const raw = process.env.TESTER_WINDOW_MINUTES;
+    if (!raw)
+        return DEFAULT_TESTER_WINDOW_MINUTES;
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed))
+        return DEFAULT_TESTER_WINDOW_MINUTES;
+    if (parsed < MIN_TESTER_WINDOW_MINUTES)
+        return MIN_TESTER_WINDOW_MINUTES;
+    if (parsed > MAX_TESTER_WINDOW_MINUTES)
+        return MAX_TESTER_WINDOW_MINUTES;
+    return parsed;
+}
+/**
+ * A point `fraction` of the way through the window, measured from now.
+ *
+ * `windowOffset(0)` is now, `windowOffset(1)` is the window's end. Fractions above 1
+ * are allowed and mean "after this run" — that is how a fixture says "still open when
+ * testing finishes" without hard-coding a duration.
+ */
+export function windowOffset(fraction) {
+    return new Date(Date.now() + fraction * windowMinutes() * 60000);
+}
+/** The mirror of windowOffset, into the past — for fixtures that must already be closed. */
+export function windowAgo(fraction) {
+    return windowOffset(-fraction);
+}

package/dist/seed/carousel-slides-seed-data.js

@@ -112,7 +112,7 @@ const _rawSlides = [
             // helper routes through /api/media/ext, which only serves images
             // (rejects non-image content-type with 400). MediaVideo watermarks
             // video client-side instead, so the raw external URL is correct here.
-            url: "https://storage.googleapis.com/gtv-videos-bucket/sample/BigBuckBunny.mp4", // audit-seed-external-url-ok: raw <video> src, /api/media/ext is image-only (Root Cause #27)
+            url: "/demo-media/sample-video.mp4",
             thumbnail: seedPhoto("carousel-auctions-live-20260101", 1600, 700),
             dimOverlay: { enabled: true, opacity: 0.5 },
         },

package/dist/seed/products-standard-seed-data.js

@@ -457,7 +457,7 @@ const _rawProductsStandardSeedData = [
             seedPhoto("product-image-beyblade-original-dragoon-f-video-demo-2-20260819", 900, 900),
         ],
         video: {
-            url: "https://storage.googleapis.com/gtv-videos-bucket/sample/ForBiggerBlazes.mp4", // audit-seed-external-url-ok: raw <video> src, /api/media/ext is image-only (Root Cause #27)
+            url: "/demo-media/sample-video.mp4",
             thumbnailUrl: seedPhoto("product-video-thumb-beyblade-original-dragoon-f-video-demo-20260819", 800, 450),
             duration: 15,
         },
@@ -490,7 +490,7 @@ const _rawProductsStandardSeedData = [
             seedPhoto("product-image-beyblade-x-dran-sword-video-demo-2-20260819", 900, 900),
         ],
         video: {
-            url: "https://storage.googleapis.com/gtv-videos-bucket/sample/ElephantsDream.mp4", // audit-seed-external-url-ok: raw <video> src, /api/media/ext is image-only (Root Cause #27)
+            url: "/demo-media/sample-video.mp4",
             thumbnailUrl: seedPhoto("product-video-thumb-beyblade-x-dran-sword-video-demo-20260819", 800, 450),
             duration: 20,
         },

package/dist/seed/reviews-seed-data.js

@@ -21,7 +21,12 @@ const daysAgo = (n) => new Date(NOW.getTime() - n * 86400000);
 // Public, direct-playable sample MP4 — review.video.url renders through a raw
 // <video src> element (ReviewDetailShell.tsx), NOT the /api/media/ext image
 // proxy, so it must stay an unwrapped external URL (never seedExtMedia()).
-const SAMPLE_VIDEO_URL = "https://storage.googleapis.com/gtv-videos-bucket/sample/BigBuckBunny.mp4"; // audit-seed-external-url-ok: raw <video> src, /api/media/ext is image-only (Root Cause #27)
+// Local fixture, not a third-party URL. The Google sample-video bucket these all
+// pointed at now returns 403 (measured 2026-09-05), so every seeded video was a
+// dead link and any case testing playback failed for a reason that is not a bug
+// here. Generated/committed by tester/scripts/make-media-fixtures.mjs.
+// Stays raw and unwrapped: /api/media/ext is image-only (Root Cause #27).
+const SAMPLE_VIDEO_URL = "/demo-media/sample-video.mp4";
 const reviewTemplates = [
     { title: "Excellent quality and fast shipping!", comment: "Received exactly as described. Item is in perfect condition. Will buy again!", rating: 5 },
     { title: "Good condition, minor wear", comment: "Arrived safely but has slight edge wear. Still happy with the purchase overall.", rating: 4 },

package/dist/seed/users-seed-data.js

@@ -1,11 +1,16 @@
 /*
- * WHY: Provides 18 seed user accounts covering all marketplace roles and demographics.
- * WHAT: Exports 18 UserDocument partials — 1 admin, 2 sellers (store owners, one of which
- *       is also the dedicated isTester QA account), 15 buyers.
+ * WHY: Provides 21 seed user accounts covering all marketplace roles and demographics.
+ * WHAT: Exports 21 UserDocument partials — 1 admin, 2 sellers (store owners, one of which
+ *       is also the dedicated isTester QA account), 15 buyers, 1 automated tester
+ *       (`user-claude-tester`, isBot), and 2 employees on contrasting permission presets.
  *       All passwords are TempPass123! in the Firebase Auth emulator. UIDs match slugs.
  *
+ *       🛑 seed-cli sets that password ONLY when it creates the Auth record. A re-seed
+ *       never resets an existing password, so an account whose password was changed
+ *       stays changed and must be reset explicitly.
+ *
  * EXPORTS:
- *   usersSeedData — array of 18 Partial<UserDocument> objects for the seed runner
+ *   usersSeedData — array of 21 Partial<UserDocument> objects for the seed runner
  *
  * @tag domain:users,auth
  * @tag layer:seed
@@ -15,6 +20,7 @@
  * @tag sideEffects:none
  */
 import { getDefaultPhonePrefix } from "./seed-market-config";
+import { PERMISSION_GROUPS } from "../features/auth/permissions/constants";
 import { USER_FIELDS } from "../constants/field-names";
 import { seedPhoto } from "./_helpers/media";
 const _ph = getDefaultPhonePrefix();
@@ -522,4 +528,101 @@ export const usersSeedData = [
         createdAt: daysAgo(1),
         updatedAt: daysAgo(1),
     },
+    // ── Automated tester (the Claude-driven checklist runner answers as this account) ──
+    // `canTestAdmin` is REQUIRED, not decorative: 116 checklist cases are adminOnly and
+    // GET/PUT /api/user/tester-checklist 404s them for a caller without it, so the runner
+    // would silently see a shorter catalog than a human tester does.
+    // `isBot` keeps it off the public Bug Hunters leaderboard — see getBugHunterLeaderboard().
+    {
+        uid: "user-claude-tester",
+        email: "claude-tester@letitrip.in",
+        phoneNumber: `${_ph}9999900019`,
+        phoneVerified: true,
+        displayName: "Claude (automated)",
+        photoURL: seedPhoto("user-avatar-claude-tester-20260101", 400, 400),
+        role: USER_FIELDS.ROLE_VALUES.SELLER,
+        isTester: true,
+        canTestAdmin: true,
+        isBot: true,
+        emailVerified: true,
+        disabled: false,
+        storeId: "store-tester-qa-seller",
+        storeSlug: "store-tester-qa-seller",
+        storeStatus: "approved",
+        publicProfile: {
+            isPublic: false,
+            showEmail: false,
+            showPhone: false,
+            showOrders: false,
+            showWishlist: false,
+            bio: "Automated tester. Works the tester checklist against a freshly seeded catalog and records a verdict per case.",
+            location: "Bengaluru, Karnataka",
+        },
+        stats: { totalOrders: 0, auctionsWon: 0, itemsSold: 0, reviewsCount: 0 },
+        metadata: { lastSignInTime: daysAgo(1), creationTime: daysAgo(1).toISOString(), loginCount: 1 },
+        createdAt: daysAgo(1),
+        updatedAt: daysAgo(1),
+    },
+    // ── Employees: two contrasting permission presets ───────────────────────────
+    // These exist so the sidebar-scoping checklist cases can be tested AT ALL. Before
+    // this the seed had no `role: "employee"` account anywhere, so the case the
+    // checklist itself marks "🛑 THE BIG ONE" — an employee must see only what their
+    // permissions allow, not all 91 admin entries — had nothing to sign in as.
+    //
+    // `permissions` is the load-bearing field (it is what the RBAC checks read);
+    // `permissionGroup` is display-only. Both are set from the same preset so they
+    // cannot disagree. Two presets on purpose: one narrow, one broad — a scoping bug
+    // that happens to produce the right count for one group is caught by the other.
+    {
+        uid: "user-employee-blog",
+        email: "employee-blog@letitrip.in",
+        phoneNumber: `${_ph}9999900020`,
+        phoneVerified: true,
+        displayName: "Mock Employee 1",
+        photoURL: seedPhoto("user-avatar-employee-blog-20260101", 400, 400),
+        role: USER_FIELDS.ROLE_VALUES.EMPLOYEE,
+        permissionGroup: "blog_poster",
+        permissions: [...PERMISSION_GROUPS.blog_poster],
+        emailVerified: true,
+        disabled: false,
+        publicProfile: {
+            isPublic: false,
+            showEmail: false,
+            showPhone: false,
+            showOrders: false,
+            showWishlist: false,
+            bio: "Content employee — blog and media only.",
+            location: "Pune, Maharashtra",
+        },
+        stats: { totalOrders: 0, auctionsWon: 0, itemsSold: 0, reviewsCount: 0 },
+        metadata: { lastSignInTime: daysAgo(2), creationTime: daysAgo(30).toISOString(), loginCount: 12 },
+        createdAt: daysAgo(30),
+        updatedAt: daysAgo(2),
+    },
+    {
+        uid: "user-employee-trust",
+        email: "employee-trust@letitrip.in",
+        phoneNumber: `${_ph}9999900021`,
+        phoneVerified: true,
+        displayName: "Mock Employee 2",
+        photoURL: seedPhoto("user-avatar-employee-trust-20260101", 400, 400),
+        role: USER_FIELDS.ROLE_VALUES.EMPLOYEE,
+        permissionGroup: "trust_and_safety",
+        permissions: [...PERMISSION_GROUPS.trust_and_safety],
+        emailVerified: true,
+        disabled: false,
+        publicProfile: {
+            isPublic: false,
+            showEmail: false,
+            showPhone: false,
+            showOrders: false,
+            showWishlist: false,
+            bio: "Trust & Safety employee — users, bans, reviews and reports.",
+            location: "Chennai, Tamil Nadu",
+        },
+        stats: { totalOrders: 0, auctionsWon: 0, itemsSold: 0, reviewsCount: 0 },
+        metadata: { lastSignInTime: daysAgo(2), creationTime: daysAgo(60).toISOString(), loginCount: 40 },
+        createdAt: daysAgo(60),
+        updatedAt: daysAgo(2),
+    },
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.34.0",
+  "version": "4.35.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public"

package/scripts/seed-cli.mjs

@@ -182,6 +182,7 @@ const {
   categoriesSeedData, storesSeedData, sessionsSeedData,
   productsStandardSeedData, productsAuctionsSeedData, productsPreordersSeedData,
   productsPrizeDrawsSeedData, productsClassifiedsSeedData, productsDigitalCodesSeedData, productsLiveItemsSeedData,
+  productsArtSeedData, productsStickersSeedData,
   ordersSeedData, reviewsSeedData, cartsSeedData, bidsSeedData,
   couponsSeedData, couponUsageSeedData,
   eventsSeedData, eventEntriesSeedData, payoutsSeedData,
@@ -262,6 +263,11 @@ const SEED_DATA_MAP = {
   products: [
     ...(productsStandardSeedData || []), ...(productsAuctionsSeedData || []), ...(productsPreordersSeedData || []),
     ...(productsPrizeDrawsSeedData || []), ...(productsClassifiedsSeedData || []), ...(productsDigitalCodesSeedData || []), ...(productsLiveItemsSeedData || []),
+    // art + stickers were written, exported from the seed barrel, and then never
+    // spread here — so 13 fixtures had NEVER reached the database, /art and
+    // /stickers were permanently empty, and listingType=art|stickers returned 0.
+    // Root Cause #58's family one layer down: added everywhere except the runner.
+    ...(productsArtSeedData || []), ...(productsStickersSeedData || []),
     ...(productsTesterSeedData || []),
   ],
   orders: [...(ordersSeedData || []), ...(ordersTesterSeedData || [])],