@mohasinac/appkit 4.39.1 → 4.40.1

package/dist/features/tester/seed-data/authored/selling__digital-content-delivery.js

@@ -0,0 +1,148 @@
+/*
+ * WHY: Authored six-part procedures for selling/digital-content-delivery.
+ * WHAT: 8 cases, keyed by full checklist id.
+ *
+ * 🛑 THE POOL HAD NO WRITER (Root Cause #103). Its one seller-facing route
+ * answered `501 not implemented`, so the pool was empty in every environment,
+ * always — and the claim at checkout logged "code pool exhausted" and returned
+ * SILENTLY. The order completed normally and the buyer's reveal panel answered
+ * 404. Nothing errored, and the seller form's "Code Pool Size" field made the
+ * listing advertise stock that had never existed.
+ *
+ * So the first case here is deliberately about the EMPTY state, and several
+ * others assert a number moving rather than a screen appearing: "the reveal
+ * page loads" was true throughout the entire period the feature delivered
+ * nothing.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed-data/authored/index.ts
+ * @tag sideEffects:none
+ */
+export const authored = {
+    "checklist-selling-digital-content-delivery-pool-empty-by-default": {
+        roles: ["seller"],
+        startPage: "/store/digital-codes",
+        steps: [
+            "Sign in as tyson@beybladearena.in / TempPass123!.",
+            "Open /store/digital-codes and open any listing's Edit action.",
+            "Scroll to the Code Details section.",
+            "Read the pool area beneath the delivery fields.",
+        ],
+        expectedBehaviour: "The editor states what the listing will actually deliver. A listing whose pool is empty can still be bought, and the buyer receives nothing — so the editor has to say that rather than leave the seller to infer it from a Pool Size field they typed themselves.",
+        expectedUiState: "A pool area is present, showing an available count and an already-delivered count. It says in words that an empty pool delivers nothing.",
+        expectedData: { poolSectionVisible: true },
+        endResult: "Nothing is saved; the section was only read.",
+    },
+    "checklist-selling-digital-content-delivery-add-codes-bulk": {
+        roles: ["seller"],
+        startPage: "/store/digital-codes",
+        steps: [
+            "Sign in as tyson@beybladearena.in / TempPass123!.",
+            "Open any digital-code listing's Edit action and find the pool section.",
+            "Write down the current available count.",
+            "Paste exactly these four lines into the Add codes box: TEST-AAA, TEST-BBB, TEST-AAA, TEST-CCC — one per line.",
+            "Press Add codes.",
+            "Read the available count.",
+            "Reload the page and read the available count again.",
+        ],
+        inputs: { pasted: "TEST-AAA\nTEST-BBB\nTEST-AAA\nTEST-CCC", distinctCodes: 3 },
+        expectedBehaviour: "Four lines containing three distinct codes add three entries. A duplicate inside one paste is dropped: re-pasting a list is the obvious way to double a pool by accident, and a duplicated code means a second buyer is sold something already delivered.",
+        expectedUiState: "The available count rises by exactly 3, and three new rows appear in the list, each reading Code / available.",
+        expectedData: { availableDelta: 3 },
+        endResult: "After the reload the count is still the original plus 3 — the entries are stored, not just rendered.",
+    },
+    "checklist-selling-digital-content-delivery-buy-then-reveal-code": {
+        roles: ["buyer"],
+        startPage: "/digital-codes",
+        steps: [
+            "Sign in as the bot buyer claude-tester@letitrip.in / TempPass123!.",
+            "Open /digital-codes and open a listing that shows codes available.",
+            "Add it to the cart and complete checkout.",
+            "Open /user/digital-codes.",
+            "Find the row for what you just bought and press Reveal Code.",
+            "Read what appears.",
+        ],
+        expectedBehaviour: "The purchase claims one entry from that listing's pool and hands it to this buyer. If the pool is empty the claim logs and returns silently — the order still completes, so an order confirmation is NOT evidence that anything was delivered.",
+        expectedUiState: "A real code is shown in a monospace box with a Copy button. Not an error, and not 'No code found for this order'.",
+        expectedData: { codeRevealed: true },
+        endResult: "Reloading /user/digital-codes and revealing again shows the SAME code — it was claimed for this order, not generated on demand.",
+    },
+    "checklist-selling-digital-content-delivery-available-count-drops-after-purchase": {
+        roles: ["buyer", "seller"],
+        startPage: "/digital-codes",
+        steps: [
+            "Open a digital-code listing's public page and write down the codes-available number it shows.",
+            "Sign in as the bot buyer claude-tester@letitrip.in / TempPass123! and buy that listing.",
+            "Reload the listing's public page and read the number again.",
+        ],
+        expectedBehaviour: "The counter is derived from the pool, so a claim reduces it. A counter a human typed into the seller form and that nothing recomputes will sit at its original value forever — which lets a sold-out listing keep advertising stock, because the availability predicate reads exactly that field.",
+        expectedUiState: "The number shown is one lower than before the purchase.",
+        expectedData: { availableDelta: -1 },
+        endResult: "The lower number survives a reload.",
+    },
+    "checklist-selling-digital-content-delivery-claimed-entry-cannot-be-removed": {
+        roles: ["seller"],
+        startPage: "/store/digital-codes",
+        steps: [
+            "Sign in as tyson@beybladearena.in / TempPass123!.",
+            "Open the Edit action for the listing a code was just bought from.",
+            "Find the pool list and locate the row whose status reads claimed.",
+            "Look for a Remove button on that row.",
+            "Look at a row whose status reads available and compare.",
+        ],
+        expectedBehaviour: "A claimed entry is somebody's purchase. Deleting it makes their reveal answer 404 with no record of what they bought, so the control is absent AND the server refuses it — the UI alone is not the boundary.",
+        expectedUiState: "The claimed row has no Remove button. The available row does.",
+        expectedData: { removeOnClaimedRow: false },
+        endResult: "The claimed entry is still present after a reload.",
+    },
+    "checklist-selling-digital-content-delivery-asset-download-requires-ownership": {
+        roles: ["guest", "buyer"],
+        startPage: "/user/orders",
+        steps: [
+            "Sign in as the bot buyer and open an order for a digital listing that delivered an image or a file.",
+            "Press Reveal, then press Download, and confirm the file arrives.",
+            "Copy the download URL from the address bar or the network panel.",
+            "Open a private window with no session and paste that URL.",
+            "Read what comes back.",
+            "Sign in as a DIFFERENT buyer in that window and load the same URL again.",
+        ],
+        expectedBehaviour: "The bytes live outside the public media path and are served only by an authenticated route that re-checks order ownership on every hit. A URL that works while signed out means the asset is reachable by anyone who learns the path — and product media filenames here are content-derived and therefore guessable.",
+        expectedUiState: "The buyer gets the file. The signed-out window and the other buyer both get a not-found page, not the file and not a sign-in redirect that then serves it.",
+        expectedData: { guestGetsFile: false, otherBuyerGetsFile: false },
+        endResult: "Nothing about the order changes. The buyer can still download it afterwards.",
+    },
+    "checklist-selling-digital-content-delivery-seller-cannot-upload-non-image": {
+        roles: ["seller", "admin"],
+        startPage: "/store/digital-codes",
+        steps: [
+            "Sign in as tyson@beybladearena.in / TempPass123! and open a digital-code listing's Edit action.",
+            "In the pool section, press the upload button and read its label.",
+            "Choose a PNG image and confirm it is accepted.",
+            "Try to choose a PDF and note whether the picker even offers it.",
+            "Sign out and sign in as admin@letitrip.in / TempPass123!.",
+            "Open the same listing's Edit action and read the upload button's label.",
+            "Try a PDF as admin.",
+        ],
+        expectedBehaviour: "A seller may attach the QR image they were given; any other file type is staff-only, because those bytes are later streamed to a buyer and a mislabelled document served inline is stored XSS. The rule is enforced on the server at BOTH the sign and the finalize step — hiding the button is convenience, not the boundary.",
+        expectedUiState: "As seller the button reads 'Upload QR image' and the picker is restricted to images. As admin it reads 'Upload QR or file' and a PDF is accepted.",
+        expectedData: { sellerPdfAccepted: false, adminPdfAccepted: true },
+        endResult: "Whatever was accepted is present in the pool after a reload.",
+    },
+    "checklist-selling-digital-content-delivery-pool-list-never-shows-the-code": {
+        roles: ["seller"],
+        startPage: "/store/digital-codes",
+        steps: [
+            "Sign in as tyson@beybladearena.in / TempPass123!.",
+            "Open a digital-code listing's Edit action and find the pool list.",
+            "Read every column of a row whose status is available.",
+            "Open the browser network panel, reload, and read the response body of the request that fetched the pool.",
+        ],
+        expectedBehaviour: "The pool view answers 'how many are left', not 'what are they'. The response is an allow-list, so the code and the asset path are absent from the payload rather than merely unrendered — a field that reaches the browser has been disclosed whether or not a component draws it.",
+        expectedUiState: "Each row shows a kind (Code / QR / File), a status, and a filename for assets. No row shows a redemption code.",
+        expectedData: { codeInResponseBody: false },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+};

package/dist/features/tester/seed-data/authored/selling__listing-edit-roundtrip.d.ts

@@ -0,0 +1,2 @@
+import type { AuthoredCase } from "./_types";
+export declare const authored: Record<string, AuthoredCase>;

package/dist/features/tester/seed-data/authored/selling__listing-edit-roundtrip.js

@@ -0,0 +1,118 @@
+/*
+ * WHY: Authored six-part procedures for selling/listing-edit-roundtrip.
+ * WHAT: 6 cases, keyed by full checklist id.
+ *
+ * 🛑 THE UPDATE PATH HAD NO CASES AT ALL. `/store/products/new` carries 57; the
+ * editors carried zero — and the editors are where the 2026-09-14 data-loss bug
+ * lived (Root Cause #98). Nine of them spread an `ActionResult` envelope as if
+ * it were the product, so `notFound()` could never fire, every field resolved
+ * `undefined`, and `status === "published" ? … : "draft"` evaluated
+ * `undefined === "published"` — meaning **pressing Save wrote draft over a live
+ * listing** and removed it from every public surface.
+ *
+ * Every case below is written so it FAILS against that behaviour. A case reading
+ * "editing a listing works" passes on a blank form that destroys the record.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed-data/authored/index.ts
+ * @tag sideEffects:none
+ */
+export const authored = {
+    "checklist-selling-listing-edit-roundtrip-edit-opens-populated": {
+        roles: ["seller"],
+        startPage: "/store/products",
+        steps: [
+            "Sign in as tyson@beybladearena.in / TempPass123!.",
+            "Open /store/products and find a listing whose status reads Published.",
+            "Write down its title, its price and its stock quantity from the row.",
+            "Open that listing's Edit action.",
+            "Wait for the form to finish loading.",
+            "Read the Title, Price and Stock fields.",
+        ],
+        expectedBehaviour: "The editor is seeded from the listing's stored document. A blank form means the page received something other than a product — an ActionResult envelope spreads to all-undefined and renders exactly this way, with no error.",
+        expectedUiState: "Title, Price and Stock each hold the values written down from the row. No field that had a value on the row is empty here.",
+        expectedData: { emptyRequiredFieldCount: 0 },
+        endResult: "Nothing is saved; the form was only opened. Leaving without saving must not change the listing.",
+    },
+    "checklist-selling-listing-edit-roundtrip-edit-category-preselected": {
+        roles: ["seller"],
+        startPage: "/store/products",
+        steps: [
+            "Sign in as tyson@beybladearena.in / TempPass123!.",
+            "Open /store/products and pick any published listing.",
+            "Open its public page in a second tab and read which category it is filed under.",
+            "Return to the first tab and open the listing's Edit action.",
+            "Find the Category selector and read what it currently shows.",
+        ],
+        expectedBehaviour: "The selector is seeded from the listing's stored category. The stored field is `categorySlugs[]` and its FIRST entry is the leaf; a form reading a singular `categorySlug` gets undefined and opens blank — and then saving that blank submits it.",
+        expectedUiState: "The Category selector shows the same category name the public page showed — for example Original Plastic Gen. It is not empty and is not sitting on its unchosen placeholder.",
+        endResult: "Nothing is saved. If this case fails, do NOT press Save — saving a blank category is the damage it is warning about.",
+    },
+    "checklist-selling-listing-edit-roundtrip-edit-save-keeps-published": {
+        roles: ["seller"],
+        startPage: "/store/products",
+        steps: [
+            "Sign in as tyson@beybladearena.in / TempPass123!.",
+            "Open /store/products and find a listing whose status reads Published. Write down its title.",
+            "Open its Edit action.",
+            "Change only the Description — append the word roundtrip to it.",
+            "Press Save.",
+            "Return to /store/products and reload the page.",
+            "Find the same listing and read its status.",
+            "Open its public detail page.",
+        ],
+        inputs: { descriptionSuffix: "roundtrip" },
+        expectedBehaviour: "Editing one field changes that field and nothing else. The status must survive the round trip: an editor that read the status as undefined will coerce it to draft on save, which silently unpublishes a live listing.",
+        expectedUiState: "After the reload the row still reads Published, and the public detail page still loads rather than 404ing.",
+        expectedData: { statusAfterSave: "published" },
+        endResult: "The description keeps the appended word after a reload, and the listing is still published and still publicly reachable.",
+    },
+    "checklist-selling-listing-edit-roundtrip-edit-missing-id-404s": {
+        roles: ["seller"],
+        startPage: "/store/products",
+        steps: [
+            "Sign in as tyson@beybladearena.in / TempPass123!.",
+            "Navigate directly to /store/products/zzzznope-not-a-listing-42/edit — a deliberately invented id, not a fixture.",
+            "Read what the page shows.",
+        ],
+        inputs: { listingId: "zzzznope-not-a-listing-42" },
+        expectedBehaviour: "An id that resolves to no listing must 404. A blank editor here is the tell that the page never checked: an always-truthy envelope makes the not-found branch unreachable, and the empty form it renders is indistinguishable from a real listing with no data.",
+        expectedUiState: "A not-found page. NOT an empty product form, and not a form with a Save button on it.",
+        expectedData: { showsEditForm: false },
+        endResult: "Nothing is created or saved.",
+    },
+    "checklist-selling-listing-edit-roundtrip-edit-other-sellers-listing-404s": {
+        roles: ["seller"],
+        startPage: "/store/products",
+        steps: [
+            "Sign in as the bot seller claude-tester@letitrip.in / TempPass123! (its store is empty).",
+            "In a second tab open /products and copy the slug of any listing belonging to Beyblade Arena.",
+            "Back in the first tab, navigate to /store/products/<that slug>/edit.",
+            "Read what the page shows.",
+        ],
+        expectedBehaviour: "Ownership is checked against the caller's STORE, and a product's `storeId` is the store SLUG rather than the owner's Auth uid. A check comparing `storeId` to a uid compares two different namespaces and can never pass — which returns null for every legitimate seller too, so a page that 404s here must be verified to still open the seller's OWN listing.",
+        expectedUiState: "A not-found page, with no editable fields.",
+        expectedData: { showsEditForm: false },
+        endResult: "Nothing is changed on the other seller's listing. Then re-open one of your own listings to confirm the guard has not locked everyone out.",
+    },
+    "checklist-selling-listing-edit-roundtrip-edit-ancestor-pages-after-recategorise": {
+        roles: ["seller"],
+        startPage: "/store/products",
+        steps: [
+            "Sign in as tyson@beybladearena.in / TempPass123!.",
+            "Open /categories/original-plastic-gen — a tier-3 category whose parent is original-tops and whose root is spinning-tops.",
+            "Open /store/products, pick a published listing, and open its Edit action.",
+            "Change its Category to Original Plastic Gen and press Save.",
+            "Open /categories/original-plastic-gen and look for the listing.",
+            "Open /categories/original-tops and look for the same listing.",
+            "Open /categories/spinning-tops and look for it again.",
+        ],
+        expectedBehaviour: "A product stores the FULL ancestor chain, so it is reachable from its own category and from every ancestor with one query. If only the leaf is stored, the ancestor pages match nothing — and the leaf page can fail too, because the stored field and the field the form sends are not the same one.",
+        expectedUiState: "The listing's card appears on all three pages: the deep category, its parent, and its root.",
+        expectedData: { visibleOnLeaf: true, visibleOnParent: true, visibleOnRoot: true },
+        endResult: "After a reload the listing is still filed under the deep category and still appears on all three pages.",
+    },
+};

package/dist/features/tester/seed-data/authored/selling__seller-orders-at-scale.d.ts

@@ -0,0 +1,2 @@
+import type { AuthoredCase } from "./_types";
+export declare const authored: Record<string, AuthoredCase>;

package/dist/features/tester/seed-data/authored/selling__seller-orders-at-scale.js

@@ -0,0 +1,69 @@
+/*
+ * WHY: Authored six-part procedures for selling/seller-orders-at-scale.
+ * WHAT: 3 cases, keyed by full checklist id.
+ *
+ * 🛑 SCALE IS THE WHOLE POINT OF THIS PAGE. The seller order list queried
+ * `productId in [...]` with the seller's entire product list, against Firestore's
+ * 30-value cap on `in`. So it was a permanent 500 for the only real seller
+ * (65 products) and perfectly fine for both small stores — which is exactly why
+ * it survived: every existing case exercised a store below the cap.
+ *
+ * On the dashboard the same throw was caught by `.catch(() => ({items: []}))`
+ * and rendered as zero orders and ₹0 revenue with no error anywhere, so the
+ * second case asserts a NUMBER rather than that a page loaded.
+ *
+ * Always run these against Beyblade Arena. A store with fewer than 30 listings
+ * passes them all while broken.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed-data/authored/index.ts
+ * @tag sideEffects:none
+ */
+export const authored = {
+    "checklist-selling-seller-orders-at-scale-orders-list-loads-for-large-store": {
+        roles: ["seller"],
+        startPage: "/store/orders",
+        steps: [
+            "Sign in as tyson@beybladearena.in / TempPass123! — this store has more than 30 listings, which is the condition under test.",
+            "Open /store/products and read the total listing count shown by the pager.",
+            "Open /store/orders.",
+            "Wait for the list to finish loading.",
+            "Open the browser network panel and read the status of the /api/store/orders request.",
+        ],
+        expectedBehaviour: "The list is scoped by the store, not by a list of its product ids. Firestore rejects an `in` clause of more than 30 values, so a per-product query breaks at exactly the 31st listing and cannot be reproduced on a small store.",
+        expectedUiState: "Order rows are listed, or a genuine empty state. Not an error boundary and not a perpetual skeleton.",
+        expectedData: { ordersApiStatus: 200 },
+        endResult: "Reloading shows the same list.",
+    },
+    "checklist-selling-seller-orders-at-scale-dashboard-revenue-not-zero": {
+        roles: ["seller"],
+        startPage: "/store",
+        steps: [
+            "Sign in as tyson@beybladearena.in / TempPass123!.",
+            "Open /store/orders and count how many orders are listed.",
+            "Open /store.",
+            "Read the total-orders figure and the revenue figure on the dashboard.",
+        ],
+        expectedBehaviour: "The dashboard's headline numbers come from the same query as the order list, so they must agree with it. A failed query here is swallowed into an empty array, which renders as a confident zero rather than as an error.",
+        expectedUiState: "The order count matches what /store/orders listed, and revenue is greater than ₹0 for a store with delivered orders.",
+        expectedData: { revenueIsZero: false },
+        endResult: "The same figures survive a reload.",
+    },
+    "checklist-selling-seller-orders-at-scale-orders-only-this-store": {
+        roles: ["seller"],
+        startPage: "/store/orders",
+        steps: [
+            "Sign in as tyson@beybladearena.in / TempPass123! and open /store/orders.",
+            "Open any order and read which product it is for.",
+            "In a second tab open that product's public page and read which store it belongs to.",
+            "Repeat for two more orders, choosing rows from different pages of the list.",
+        ],
+        expectedBehaviour: "Scoping by store must not widen what a seller can see. A cart splits into one order per store, so every row here belongs to this store and no other seller's order is reachable.",
+        expectedUiState: "Every product checked belongs to Beyblade Arena.",
+        expectedData: { foreignOrdersFound: 0 },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+};