@mohasinac/appkit 4.39.0 → 4.39.1

package/dist/features/reviews/repository/reviews.repository.d.ts

@@ -37,7 +37,7 @@ declare class ReviewRepository extends BaseRepository<ReviewDocument> {
      * it can be reasoned about).
      */
     findApprovedByProduct(productId: string, limit?: number): Promise<ReviewDocument[]>;
-    findApprovedByStore(storeId: string): Promise<ReviewDocument[]>;
+    findApprovedByStore(storeId: string, limit?: number): Promise<ReviewDocument[]>;
     findByUser(userId: string): Promise<ReviewDocument[]>;
     findApprovedByUser(userId: string): Promise<ReviewDocument[]>;
     findPending(): Promise<ReviewDocument[]>;

package/dist/features/reviews/repository/reviews.repository.js

@@ -101,13 +101,13 @@ class ReviewRepository extends BaseRepository {
         const snapshot = await query.get();
         return snapshot.docs.map((doc) => this.mapDoc(doc));
     }
-    async findApprovedByStore(storeId) {
+    async findApprovedByStore(storeId, limit = 50) {
         const snapshot = await this.db
             .collection(this.collection)
             .where(REVIEW_FIELDS.STORE_ID, "==", storeId)
             .where(REVIEW_FIELDS.STATUS, "==", "approved")
             .orderBy(REVIEW_FIELDS.CREATED_AT, "desc")
-            .limit(50)
+            .limit(limit)
             .get();
         return snapshot.docs.map((doc) => this.mapDoc(doc));
     }

package/dist/features/stores/api/[storeSlug]/reviews/route.js

@@ -20,6 +20,8 @@
  */
 import { NextResponse } from "next/server.js";
 import { getProviders } from "../../../../../contracts";
+import { reviewRepository } from "../../../../reviews/repository/reviews.repository";
+import { maskPublicReview } from "../../../../../security/pii-mask";
 import { normalizeError } from "../../../../../errors/normalize";
 /**
  * Upper bound on the reviews scanned to build a store's aggregate. The average
@@ -81,14 +83,22 @@ export async function GET(request, context) {
          * the store's reviews are one equality away. This also turns 21 Firestore
          * queries into 1, well inside Rule #6's ~3-round-trip budget.
          */
-        const reviewsRepo = db.getRepository("reviews");
-        const reviewsResult = await reviewsRepo.findAll({
-            filters: `storeId==${store.id},status==approved`,
-            sort: "createdAt",
-            order: "desc",
-            perPage: STORE_REVIEW_SCAN_CAP,
-        });
-        const allFlat = reviewsResult.data;
+        /*
+         * 🛑 `reviewRepository`, NOT `db.getRepository("reviews")`.
+         *
+         * The generic provider repository returns the RAW document. `userName` is
+         * PII-encrypted at rest, so it came back as the literal string
+         * `enc:v1:…` — measured in production the moment this endpoint started
+         * returning rows at all — and so did `userNameIndex`, the HMAC blind index,
+         * `searchTxt`, `reportCount` and the moderation `status`. Only
+         * `reviewRepository.mapDoc` runs `decryptPiiFields`.
+         *
+         * This was INVISIBLE until the itemsSold fix (Root Cause #100): the
+         * endpoint returned zero reviews, so there was nothing to leak. A fix that
+         * makes a surface work for the first time is a fix that exposes whatever
+         * the surface does next.
+         */
+        const allFlat = (await reviewRepository.findApprovedByStore(store.id, STORE_REVIEW_SCAN_CAP));
         // Compute aggregate metrics from ALL reviews (unfiltered)
         const ratingDistribution = { 1: 0, 2: 0, 3: 0, 4: 0, 5: 0 };
         let ratingSum = 0;
@@ -184,11 +194,38 @@ export async function GET(request, context) {
         for (const p of fetched)
             if (p)
                 productMap.set(p.id, p);
-        const reviewsWithProduct = pageSlice.map((review) => ({
-            ...review,
-            productTitle: productMap.get(review.productId)?.title ?? review.productTitle,
-            productMainImage: productMap.get(review.productId)?.mainImage ?? null,
-        }));
+        /*
+         * 🛑 AN ALLOW-LIST, not a spread. `...review` published every field the
+         * document happens to carry — including `userNameIndex` (an HMAC blind
+         * index, which lets a caller confirm a guessed name), `searchTxt`,
+         * `reportCount` and the moderation `status`. Root Cause #70: a payload
+         * built by spreading publishes everything nobody thought to remove, and is
+         * blind to fields added later.
+         *
+         * `userName` is MASKED, matching every other public review surface —
+         * `maskPublicReview` is what `listReviewsForProduct` already applies.
+         */
+        const reviewsWithProduct = pageSlice.map((review) => {
+            const r = review;
+            const masked = maskPublicReview({ ...r, userName: String(r.userName ?? "") });
+            return {
+                id: r.id,
+                rating: r.rating,
+                title: r.title,
+                comment: r.comment ?? r.body,
+                images: r.images ?? [],
+                video: r.video,
+                verified: r.verified ?? r.isVerifiedPurchase,
+                helpfulCount: r.helpfulCount ?? 0,
+                sellerReply: r.sellerReply,
+                sellerRepliedAt: r.sellerRepliedAt,
+                createdAt: r.createdAt,
+                userName: masked.userName,
+                productId: r.productId,
+                productTitle: productMap.get(review.productId)?.title ?? review.productTitle,
+                productMainImage: productMap.get(review.productId)?.mainImage ?? null,
+            };
+        });
         return NextResponse.json({
             success: true,
             data: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.39.0",
+  "version": "4.39.1",
   "license": "MIT",
   "publishConfig": {
     "access": "public"