@mohasinac/appkit 4.41.3 → 4.41.5

package/dist/features/events/api/[id]/route.js

@@ -18,6 +18,7 @@ import { NextResponse } from "next/server.js";
 import { getProviders } from "../../../../contracts";
 import { EVENT_FIELDS } from "../../schemas";
 import { normalizeError } from "../../../../errors/normalize";
+import { toClientLotteryConfig } from "../../../../_internal/server/features/lottery/adapters";
 // --- GET /api/events/[id] -----------------------------------------------------
 export async function GET(_request, context) {
     try {
@@ -33,8 +34,22 @@ export async function GET(_request, context) {
             event.status === EVENT_FIELDS.STATUS_VALUES.PAUSED) {
             return NextResponse.json({ success: false, error: "Event not found" }, { status: 404 });
         }
-        // Strip internal field
-        const { createdBy: _createdBy, ...publicEvent } = event;
+        // Strip internal field.
+        //
+        // 🛑 This is a deny-list spread, so anything NOT named here is published by
+        // default — which is how a lottery event's stored `lotteryConfig` reached
+        // anonymous callers whole. `toClientLotteryConfig` is the allow-list that
+        // belongs on this boundary: it drops the per-slot `price` and `weight` (the
+        // weighting is how the odds are set) and the internal `bookedByUserId`,
+        // while deliberately keeping `bookedByDisplayName` and
+        // `bookedByUserLotteryNumber`, which the public slot grid renders.
+        const { createdBy: _createdBy, ...rawPublicEvent } = event;
+        const publicEvent = rawPublicEvent.lotteryConfig
+            ? {
+                ...rawPublicEvent,
+                lotteryConfig: toClientLotteryConfig(rawPublicEvent.lotteryConfig),
+            }
+            : rawPublicEvent;
         const entriesRepo = db.getRepository("eventEntries");
         // For poll events with resultsVisibility='always': compute live vote tallies
         let pollResults = [];

package/dist/features/shell/field-ui-meta.js

@@ -162,8 +162,17 @@ function stringMaxLength(schema) {
  */
 function enumOptions(schema) {
     const direct = schema.options;
-    if (Array.isArray(direct))
-        return direct.filter((o) => typeof o === "string");
+    if (Array.isArray(direct)) {
+        const strings = direct.filter((o) => typeof o === "string");
+        // On a ZodUnion `.options` is the member SCHEMAS, not strings, so the
+        // filter above yields []. Empty is truthy downstream, which is how a union
+        // rendered as a <select> with nothing in it. Read the literals instead.
+        if (strings.length === 0) {
+            const literals = unionStringLiterals(direct);
+            return literals.length > 0 ? literals : undefined;
+        }
+        return strings;
+    }
     const values = schema._def?.values;
     if (Array.isArray(values))
         return values.filter((o) => typeof o === "string");
@@ -172,6 +181,26 @@ function enumOptions(schema) {
     }
     return undefined;
 }
+/**
+ * String literal values carried by a union's members.
+ *
+ * `z.literal("a").or(z.literal("b"))` is a genuine choice and yields
+ * `["a", "b"]`. `z.string().optional().or(z.literal(""))` — the idiomatic
+ * "optional text that also accepts empty" — yields nothing usable, because its
+ * only literal is the empty string. That distinction is what decides whether a
+ * union field is a select or a text input.
+ */
+function unionStringLiterals(members) {
+    const out = [];
+    for (const member of members) {
+        const direct = member?.value;
+        const nested = member?._def?.value;
+        const value = typeof direct === "string" ? direct : nested;
+        if (typeof value === "string" && value !== "")
+            out.push(value);
+    }
+    return out;
+}
 /** Public: the option list for a select-shaped field, or null. */
 export function schemaEnumOptions(schema) {
     const { schema: inner } = unwrapSchema(schema);
@@ -180,7 +209,27 @@ export function schemaEnumOptions(schema) {
 /** Public: whether a field's type is optional-wrapped (i.e. not required). */
 export function schemaIsOptional(schema) {
     const type = typeOf(schema);
-    return type === "optional" || type === "default" || type === "nullish";
+    if (type === "optional" || type === "default" || type === "nullish")
+        return true;
+    // A union HIDES optionality from the check above: the outer type is "union",
+    // so `z.string().optional().or(z.literal(""))` read as required and rendered
+    // a `*` on a field the schema is happy to leave empty. If any member is
+    // optional, or accepts "", the field is optional.
+    if (type === "union") {
+        const members = schema.options;
+        if (Array.isArray(members)) {
+            return members.some((member) => {
+                const memberType = typeOf(member);
+                if (memberType === "optional" || memberType === "default" || memberType === "nullish") {
+                    return true;
+                }
+                const direct = member?.value;
+                const nested = member?._def?.value;
+                return direct === "" || nested === "";
+            });
+        }
+    }
+    return false;
 }
 /**
  * The `.shape` of an object schema, seeing through effects wrappers.
@@ -257,8 +306,19 @@ function fromZodType(type, inner) {
         case "enum":
         case "nativeEnum":
         case "literal":
-        case "union":
             return { kind: "select", row: "pair" };
+        case "union": {
+            // Only a union that actually yields choices is a select. The other
+            // common shape, `z.string().optional().or(z.literal(""))`, is an optional
+            // TEXT field — rendering it as a select produced a dropdown with zero
+            // options, which is unusable and (being marked required) made the whole
+            // form unsubmittable. Seen live on /user/addresses/new, where
+            // "Address line 2" and "Landmark" were both required empty dropdowns.
+            const choices = enumOptions(inner);
+            return choices && choices.length > 0
+                ? { kind: "select", row: "pair" }
+                : { kind: "text", row: "pair" };
+        }
         case "date":
             return { kind: "date", row: "pair" };
         case "number":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.41.3",
+  "version": "4.41.5",
   "license": "MIT",
   "publishConfig": {
     "access": "public"