@mohasinac/appkit 4.41.12 → 4.41.14

package/dist/_internal/server/features/auctions/actions.js

@@ -8,7 +8,7 @@ import { assertAuctionActive, assertBidAmount, assertNotAuctionOwner, shouldAuto
 import { ValidationError } from "../../../shared/errors/index";
 export async function placeBidAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = placeBidActionSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid bid input");

package/dist/_internal/server/features/cart/actions.js

@@ -7,7 +7,7 @@ import { upsertCartItem, mergeGuestItems } from "./service";
 import { ValidationError } from "../../../shared/errors/index";
 export async function addToCartAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = addToCartSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid cart input");
@@ -17,7 +17,7 @@ export async function addToCartAction(input) {
 }
 export async function removeFromCartAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = removeFromCartSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
@@ -27,14 +27,14 @@ export async function removeFromCartAction(input) {
 }
 export async function clearCartAction() {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         await cartRepository.clearCart(user.uid);
         return { success: true };
     });
 }
 export async function mergeGuestCartAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = mergeGuestCartSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid cart data");

package/dist/_internal/server/features/events/actions.js

@@ -36,7 +36,7 @@ export async function updateEventAction(eventId, input) {
 }
 export async function registerForEventAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = registerForEventSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid registration input");
@@ -72,7 +72,7 @@ export async function registerForEventAction(input) {
 }
 export async function cancelEventRegistrationAction(entryId) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const entry = await eventEntryRepository.findById(entryId);
         if (!entry || entry.userId !== user.uid) {
             throw new ValidationError("Registration not found or does not belong to you");

package/dist/_internal/server/features/history/actions.js

@@ -4,7 +4,7 @@ import { requireRoleUser } from "../../../../providers/auth-firebase/helpers";
 import { historyRepository, } from "../../../../repositories";
 export async function trackProductViewAction(productId, productType, productSnapshot) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         await historyRepository.track(user.uid, {
             productId,
             productType,
@@ -14,7 +14,7 @@ export async function trackProductViewAction(productId, productType, productSnap
 }
 export async function mergeGuestHistoryAction(guestItems) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         return historyRepository.merge(user.uid, guestItems);
     });
 }

package/dist/_internal/server/features/lottery/actions.js

@@ -28,7 +28,7 @@ function isDrawWindowOpen(config) {
 export async function submitLotteryPullAction(input) {
     return wrapAction(async () => {
         // Auth — must be logged in
-        const user = await requireRoleUser(["buyer", "seller", "admin", "moderator", "employee"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin", "moderator", "employee"]);
         const parsed = submitLotteryPullSchema.safeParse(input);
         if (!parsed.success) {
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid lottery pull input");

package/dist/_internal/server/features/orders/actions.js

@@ -18,7 +18,7 @@ import { normalizeError } from "../../../../errors/normalize";
 import { serverLogger } from "../../../../monitoring";
 export async function createOrderAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = createOrderSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid order input");
@@ -31,7 +31,7 @@ export async function createOrderAction(input) {
 }
 export async function cancelOrderAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = cancelOrderSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
@@ -50,7 +50,7 @@ export async function cancelOrderAction(input) {
  */
 export async function requestReturnAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = returnRequestSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
@@ -161,7 +161,7 @@ function notifyAdminsOfPaymentProof(order) {
 }
 export async function attachPaymentProofAction(orderId, proof) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const order = await orderRepository.findById(orderId);
         if (!order)
             throw new OrderNotFoundError(orderId);
@@ -350,7 +350,7 @@ export async function adminRejectPaymentAsFraudAction(orderId, note) {
  */
 export async function raiseOrderDisputeAction(orderId, reason) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         if (!reason.trim())
             throw new ValidationError(REASON_REQUIRED_MSG);
         const order = await orderRepository.findById(orderId);

package/dist/_internal/server/features/pre-orders/actions.js

@@ -7,7 +7,7 @@ import { assertPreOrderAvailable, computeDeposit } from "./service";
 import { ValidationError } from "../../../shared/errors/index";
 export async function reservePreOrderAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = reservePreOrderSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid reservation input");

package/dist/_internal/server/features/promotions/actions.js

@@ -9,7 +9,7 @@ import { ValidationError } from "../../../shared/errors/index";
 const ERR_INVALID_COUPON_INPUT = "Invalid coupon input";
 export async function applyCouponAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = applyCouponSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? ERR_INVALID_COUPON_INPUT);

package/dist/_internal/server/features/reviews/actions.js

@@ -8,7 +8,7 @@ import { createReviewSchema, replyToReviewSchema, deleteReviewSchema, } from "..
 import { assertNotDuplicateReview, assertReviewOwnership, getReviewOrThrow, } from "./service";
 export async function createReviewAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = createReviewSchema.safeParse(input);
         if (!parsed.success) {
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
@@ -54,7 +54,7 @@ export async function replyToReviewAction(input) {
 }
 export async function deleteReviewAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = deleteReviewSchema.safeParse(input);
         if (!parsed.success) {
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
@@ -71,7 +71,7 @@ export async function deleteReviewAction(input) {
 }
 export async function markReviewHelpfulAction(reviewId) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         await getReviewOrThrow(reviewId);
         // Keyed on the voter so a repeated call is a no-op rather than another +1.
         return reviewRepository.voteHelpful(reviewId, user.uid);

package/dist/_internal/server/features/wishlist/actions.js

@@ -7,7 +7,7 @@ import { WISHLIST_MAX } from "../../../shared/features/wishlist/config";
 import { WishlistCapError } from "../../../shared/features/wishlist/errors";
 export async function addToWishlistAction(productId, extras) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         try {
             return await wishlistRepository.addItem(user.uid, productId, extras);
         }
@@ -21,13 +21,13 @@ export async function addToWishlistAction(productId, extras) {
 }
 export async function removeFromWishlistAction(productId) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         await wishlistRepository.removeItem(user.uid, productId);
     });
 }
 export async function mergeGuestWishlistAction(guestItems) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const merged = [];
         for (const item of guestItems) {
             try {

package/dist/features/admin/components/AdminOrdersView.js

@@ -141,9 +141,35 @@ export function AdminOrdersView({ children, ...props }) {
                     ? `${title}${extraCount > 0 ? ` +${extraCount} more` : ""}`
                     : `Order ${orderId}`,
                 secondary: [
-                    toStringValue(item.buyerName ?? item.customerName, "Unknown buyer"),
-                    toCurrency(item.totalAmount ?? item.total ?? item.amount),
-                    orderId.slice(0, 14),
+                    /*
+                     * 🛑 `userName` and `totalPrice` FIRST — they are the document's
+                     * real field names (OrderDocument, and the live response of
+                     * GET /api/admin/orders).
+                     *
+                     * This read `buyerName ?? customerName` and
+                     * `totalAmount ?? total ?? amount`: five names, not one of which
+                     * the order document has ever carried. So every row rendered
+                     * "Unknown buyer · -", on all 25 rows, for as long as the view has
+                     * existed — and the `??` chains made it look like considered
+                     * defensive coding rather than a guess. A fallback spelled three
+                     * ways is the tell that nobody checked which one was real.
+                     *
+                     * The aliases are GONE rather than demoted to fallbacks: nothing
+                     * declares them (the client `Order` type has no such fields) and
+                     * nothing emits them (no adapter renames to them). Keeping a
+                     * fallback with no producer only preserves the ambiguity that
+                     * hid the bug.
+                     */
+                    toStringValue(item.userName, "Unknown buyer"),
+                    toCurrency(item.totalPrice),
+                    /*
+                     * Not `.slice(0, 14)` — that cut mid-date, so
+                     * `order-1-20260822-aucwon` and `order-1-20260821-prizedr` both
+                     * rendered as "order-1-202608". A truncation that destroys
+                     * uniqueness is worse than a long string, because the id is the
+                     * one thing on the row an admin searches by.
+                     */
+                    orderId,
                     paymentReviewLabel(item),
                 ]
                     .filter(Boolean)

package/dist/features/seller/components/SellerOrdersView.js

@@ -366,13 +366,37 @@ export function SellerOrdersView({ orderDetailApiBase = SELLER_ENDPOINTS.ORDERS,
             const loc = item.physicalLocation;
             return {
                 id: toStringValue(item.id, `order-${index}`),
-                primary: `Order ${toStringValue(item.id, "-").slice(0, 14)}`,
-                secondary: toStringValue(item.buyerName ?? item.buyerDisplayName, "Unknown buyer"),
+                /*
+                 * 🛑 The row says WHAT WAS SOLD, not the id repeated.
+                 *
+                 * This was `Order ${id.slice(0, 14)}` — a raw id, truncated
+                 * mid-date, so two different orders rendered identically. The title
+                 * was available the whole time: `items[0].productTitle` is
+                 * denormalised onto every order precisely so a list never needs a
+                 * second fetch (Root Cause #52), and it is already read three lines
+                 * below as `itemTitle`.
+                 */
+                primary: (() => {
+                    const title = typeof firstItem.productTitle === "string" ? firstItem.productTitle : "";
+                    if (!title)
+                        return `Order ${toStringValue(item.id, "-")}`;
+                    const extra = itemsArr.length - 1;
+                    return extra > 0 ? `${title} +${extra} more` : title;
+                })(),
+                /*
+                 * `userName` / `totalPrice` are the document's real field names.
+                 * `buyerName`/`buyerDisplayName`/`totalAmount`/`total` are four
+                 * spellings the order document has never carried, so every seller's
+                 * order list showed "Unknown buyer" and ₹0 — see AdminOrdersView for
+                 * the full writeup. They are removed rather than demoted: nothing
+                 * declares them and nothing emits them.
+                 */
+                secondary: toStringValue(item.userName, "Unknown buyer"),
                 status: toStringValue(item.status, "PENDING"),
                 updatedAt: toRelativeDate(item.updatedAt ?? item.orderDate ?? item.createdAt),
                 itemCount: itemsArr.length,
-                totalAmount: Number(item.totalAmount ?? item.total ?? 0),
-                buyerName: toStringValue(item.buyerName ?? item.buyerDisplayName, "Unknown buyer"),
+                totalAmount: Number(item.totalPrice ?? 0),
+                buyerName: toStringValue(item.userName, "Unknown buyer"),
                 itemImage: typeof firstItem.image === "string" ? firstItem.image : undefined,
                 itemTitle: typeof firstItem.productTitle === "string" ? firstItem.productTitle : undefined,
                 physicalLocation: loc && typeof loc.zone === "string"

package/dist/features/tester/seed-data/authored/buying__order-detail-actions.js

@@ -73,15 +73,29 @@ export const authored = {
         roles: ["buyer"],
         startPage: "/user/orders",
         steps: [
-            "Sign in as vivaan.kapoor@gmail.com / TempPass123! — this persona owns the seeded DELIVERED orders, and a return can only be requested on one.",
-            "Open /user/orders and open order-1-20251107-11joon, which is delivered.",
+            /*
+             * 🛑 rehan, NOT vivaan — and the order changed with it.
+             *
+             * This said vivaan.kapoor@gmail.com (user-seto-kaiba), who does own
+             * order-1-20251107-11joon. But TWO other cases in this same batch use
+             * that order as a FOREIGN one, and a batch browses as exactly one
+             * identity — so the page could not be worked as authored: the same
+             * order had to be both owned and not-owned by the signed-in user.
+             *
+             * rehan.sheikh@gmail.com (user-yugi-muto) is the harness's `main`
+             * identity, and order-1-20260818-stdctx is one of its delivered orders.
+             * That makes the whole batch coherent under one session and leaves the
+             * access-control cases genuinely foreign.
+             */
+            "Sign in as rehan.sheikh@gmail.com / TempPass123! — this persona owns the order below, and a return can only be requested on a delivered one.",
+            "Open /user/orders and open order-1-20260818-stdctx, which is delivered.",
             "Use the Return action.",
             "Give the reason: item not as described.",
             "Submit the request.",
             "Reload the order.",
             "Open /user/returns and look for it.",
         ],
-        inputs: { orderId: "order-1-20251107-11joon", reason: "item not as described" },
+        inputs: { orderId: "order-1-20260818-stdctx", reason: "item not as described" },
         expectedBehaviour: "A return request moves the order into Return Requested and appears on the returns surface. That status is deliberately an ACTIVE one — it is the seller's next action item, not a closed state — so the order must not disappear from the active list.",
         expectedUiState: "The order's status reads Return Requested, and the same order is listed under /user/returns.",
         expectedData: { statusAfterReturn: "return_requested" },

package/dist/seed/orders-seed-data.js

@@ -545,7 +545,25 @@ const acquisitionOrders = [
         shippingCarrier: "Delhivery",
         orderDate: daysAgo(12),
         shippingDate: daysAgo(9),
-        deliveryDate: daysAgo(6),
+        /*
+         * 🛑 TWO DAYS, NOT SIX — THIS IS THE RETURN-WINDOW FIXTURE.
+         *
+         * A return can only be requested on a DELIVERED order inside the 7-day
+         * window, and you cannot reach "delivered" by buying in a test: it needs
+         * seller action. So the return flow is testable only if a seeded delivered
+         * order sits inside the window — and until now none did for the harness's
+         * own identity. Every candidate was 6, 7, 8, 20, 29 days old, so
+         * /user/orders/{id}/return answered 'The 7-day return window for this
+         * order has closed.' and the case could never be worked.
+         *
+         * Six days would have been inside the window today and OUTSIDE it
+         * tomorrow — a fixture that passes on Monday and fails on Tuesday is worse
+         * than one that always fails, because the failure looks like a regression.
+         * Two days leaves five days of margin.
+         *
+         * Do not raise this without checking RETURN_WINDOW_DAYS.
+         */
+        deliveryDate: daysAgo(2),
         createdAt: daysAgo(12),
         updatedAt: daysAgo(6),
         sourceContext: { path: "standard", listPrice: 999 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.41.12",
+  "version": "4.41.14",
   "license": "MIT",
   "publishConfig": {
     "access": "public"