@mohasinac/appkit 4.41.13 → 4.41.14

package/dist/_internal/server/features/auctions/actions.js

@@ -8,7 +8,7 @@ import { assertAuctionActive, assertBidAmount, assertNotAuctionOwner, shouldAuto
 import { ValidationError } from "../../../shared/errors/index";
 export async function placeBidAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = placeBidActionSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid bid input");

package/dist/_internal/server/features/cart/actions.js

@@ -7,7 +7,7 @@ import { upsertCartItem, mergeGuestItems } from "./service";
 import { ValidationError } from "../../../shared/errors/index";
 export async function addToCartAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = addToCartSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid cart input");
@@ -17,7 +17,7 @@ export async function addToCartAction(input) {
 }
 export async function removeFromCartAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = removeFromCartSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
@@ -27,14 +27,14 @@ export async function removeFromCartAction(input) {
 }
 export async function clearCartAction() {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         await cartRepository.clearCart(user.uid);
         return { success: true };
     });
 }
 export async function mergeGuestCartAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = mergeGuestCartSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid cart data");

package/dist/_internal/server/features/events/actions.js

@@ -36,7 +36,7 @@ export async function updateEventAction(eventId, input) {
 }
 export async function registerForEventAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = registerForEventSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid registration input");
@@ -72,7 +72,7 @@ export async function registerForEventAction(input) {
 }
 export async function cancelEventRegistrationAction(entryId) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const entry = await eventEntryRepository.findById(entryId);
         if (!entry || entry.userId !== user.uid) {
             throw new ValidationError("Registration not found or does not belong to you");

package/dist/_internal/server/features/history/actions.js

@@ -4,7 +4,7 @@ import { requireRoleUser } from "../../../../providers/auth-firebase/helpers";
 import { historyRepository, } from "../../../../repositories";
 export async function trackProductViewAction(productId, productType, productSnapshot) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         await historyRepository.track(user.uid, {
             productId,
             productType,
@@ -14,7 +14,7 @@ export async function trackProductViewAction(productId, productType, productSnap
 }
 export async function mergeGuestHistoryAction(guestItems) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         return historyRepository.merge(user.uid, guestItems);
     });
 }

package/dist/_internal/server/features/lottery/actions.js

@@ -28,7 +28,7 @@ function isDrawWindowOpen(config) {
 export async function submitLotteryPullAction(input) {
     return wrapAction(async () => {
         // Auth — must be logged in
-        const user = await requireRoleUser(["buyer", "seller", "admin", "moderator", "employee"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin", "moderator", "employee"]);
         const parsed = submitLotteryPullSchema.safeParse(input);
         if (!parsed.success) {
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid lottery pull input");

package/dist/_internal/server/features/orders/actions.js

@@ -18,7 +18,7 @@ import { normalizeError } from "../../../../errors/normalize";
 import { serverLogger } from "../../../../monitoring";
 export async function createOrderAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = createOrderSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid order input");
@@ -31,7 +31,7 @@ export async function createOrderAction(input) {
 }
 export async function cancelOrderAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = cancelOrderSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
@@ -50,7 +50,7 @@ export async function cancelOrderAction(input) {
  */
 export async function requestReturnAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = returnRequestSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
@@ -161,7 +161,7 @@ function notifyAdminsOfPaymentProof(order) {
 }
 export async function attachPaymentProofAction(orderId, proof) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const order = await orderRepository.findById(orderId);
         if (!order)
             throw new OrderNotFoundError(orderId);
@@ -350,7 +350,7 @@ export async function adminRejectPaymentAsFraudAction(orderId, note) {
  */
 export async function raiseOrderDisputeAction(orderId, reason) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         if (!reason.trim())
             throw new ValidationError(REASON_REQUIRED_MSG);
         const order = await orderRepository.findById(orderId);

package/dist/_internal/server/features/pre-orders/actions.js

@@ -7,7 +7,7 @@ import { assertPreOrderAvailable, computeDeposit } from "./service";
 import { ValidationError } from "../../../shared/errors/index";
 export async function reservePreOrderAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = reservePreOrderSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid reservation input");

package/dist/_internal/server/features/promotions/actions.js

@@ -9,7 +9,7 @@ import { ValidationError } from "../../../shared/errors/index";
 const ERR_INVALID_COUPON_INPUT = "Invalid coupon input";
 export async function applyCouponAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = applyCouponSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? ERR_INVALID_COUPON_INPUT);

package/dist/_internal/server/features/reviews/actions.js

@@ -8,7 +8,7 @@ import { createReviewSchema, replyToReviewSchema, deleteReviewSchema, } from "..
 import { assertNotDuplicateReview, assertReviewOwnership, getReviewOrThrow, } from "./service";
 export async function createReviewAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = createReviewSchema.safeParse(input);
         if (!parsed.success) {
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
@@ -54,7 +54,7 @@ export async function replyToReviewAction(input) {
 }
 export async function deleteReviewAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = deleteReviewSchema.safeParse(input);
         if (!parsed.success) {
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
@@ -71,7 +71,7 @@ export async function deleteReviewAction(input) {
 }
 export async function markReviewHelpfulAction(reviewId) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         await getReviewOrThrow(reviewId);
         // Keyed on the voter so a repeated call is a no-op rather than another +1.
         return reviewRepository.voteHelpful(reviewId, user.uid);

package/dist/_internal/server/features/wishlist/actions.js

@@ -7,7 +7,7 @@ import { WISHLIST_MAX } from "../../../shared/features/wishlist/config";
 import { WishlistCapError } from "../../../shared/features/wishlist/errors";
 export async function addToWishlistAction(productId, extras) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         try {
             return await wishlistRepository.addItem(user.uid, productId, extras);
         }
@@ -21,13 +21,13 @@ export async function addToWishlistAction(productId, extras) {
 }
 export async function removeFromWishlistAction(productId) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         await wishlistRepository.removeItem(user.uid, productId);
     });
 }
 export async function mergeGuestWishlistAction(guestItems) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const merged = [];
         for (const item of guestItems) {
             try {

package/dist/features/tester/seed-data/authored/buying__order-detail-actions.js

@@ -73,15 +73,29 @@ export const authored = {
         roles: ["buyer"],
         startPage: "/user/orders",
         steps: [
-            "Sign in as vivaan.kapoor@gmail.com / TempPass123! — this persona owns the seeded DELIVERED orders, and a return can only be requested on one.",
-            "Open /user/orders and open order-1-20251107-11joon, which is delivered.",
+            /*
+             * 🛑 rehan, NOT vivaan — and the order changed with it.
+             *
+             * This said vivaan.kapoor@gmail.com (user-seto-kaiba), who does own
+             * order-1-20251107-11joon. But TWO other cases in this same batch use
+             * that order as a FOREIGN one, and a batch browses as exactly one
+             * identity — so the page could not be worked as authored: the same
+             * order had to be both owned and not-owned by the signed-in user.
+             *
+             * rehan.sheikh@gmail.com (user-yugi-muto) is the harness's `main`
+             * identity, and order-1-20260818-stdctx is one of its delivered orders.
+             * That makes the whole batch coherent under one session and leaves the
+             * access-control cases genuinely foreign.
+             */
+            "Sign in as rehan.sheikh@gmail.com / TempPass123! — this persona owns the order below, and a return can only be requested on a delivered one.",
+            "Open /user/orders and open order-1-20260818-stdctx, which is delivered.",
             "Use the Return action.",
             "Give the reason: item not as described.",
             "Submit the request.",
             "Reload the order.",
             "Open /user/returns and look for it.",
         ],
-        inputs: { orderId: "order-1-20251107-11joon", reason: "item not as described" },
+        inputs: { orderId: "order-1-20260818-stdctx", reason: "item not as described" },
         expectedBehaviour: "A return request moves the order into Return Requested and appears on the returns surface. That status is deliberately an ACTIVE one — it is the seller's next action item, not a closed state — so the order must not disappear from the active list.",
         expectedUiState: "The order's status reads Return Requested, and the same order is listed under /user/returns.",
         expectedData: { statusAfterReturn: "return_requested" },

package/dist/seed/orders-seed-data.js

@@ -545,7 +545,25 @@ const acquisitionOrders = [
         shippingCarrier: "Delhivery",
         orderDate: daysAgo(12),
         shippingDate: daysAgo(9),
-        deliveryDate: daysAgo(6),
+        /*
+         * 🛑 TWO DAYS, NOT SIX — THIS IS THE RETURN-WINDOW FIXTURE.
+         *
+         * A return can only be requested on a DELIVERED order inside the 7-day
+         * window, and you cannot reach "delivered" by buying in a test: it needs
+         * seller action. So the return flow is testable only if a seeded delivered
+         * order sits inside the window — and until now none did for the harness's
+         * own identity. Every candidate was 6, 7, 8, 20, 29 days old, so
+         * /user/orders/{id}/return answered 'The 7-day return window for this
+         * order has closed.' and the case could never be worked.
+         *
+         * Six days would have been inside the window today and OUTSIDE it
+         * tomorrow — a fixture that passes on Monday and fails on Tuesday is worse
+         * than one that always fails, because the failure looks like a regression.
+         * Two days leaves five days of margin.
+         *
+         * Do not raise this without checking RETURN_WINDOW_DAYS.
+         */
+        deliveryDate: daysAgo(2),
         createdAt: daysAgo(12),
         updatedAt: daysAgo(6),
         sourceContext: { path: "standard", listPrice: 999 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.41.13",
+  "version": "4.41.14",
   "license": "MIT",
   "publishConfig": {
     "access": "public"