@mohasinac/appkit 4.41.4 → 4.41.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -18,6 +18,7 @@ import { NextResponse } from "next/server.js";
18
18
  import { getProviders } from "../../../../contracts";
19
19
  import { EVENT_FIELDS } from "../../schemas";
20
20
  import { normalizeError } from "../../../../errors/normalize";
21
+ import { toClientLotteryConfig } from "../../../../_internal/server/features/lottery/adapters";
21
22
  // --- GET /api/events/[id] -----------------------------------------------------
22
23
  export async function GET(_request, context) {
23
24
  try {
@@ -33,8 +34,22 @@ export async function GET(_request, context) {
33
34
  event.status === EVENT_FIELDS.STATUS_VALUES.PAUSED) {
34
35
  return NextResponse.json({ success: false, error: "Event not found" }, { status: 404 });
35
36
  }
36
- // Strip internal field
37
- const { createdBy: _createdBy, ...publicEvent } = event;
37
+ // Strip internal field.
38
+ //
39
+ // 🛑 This is a deny-list spread, so anything NOT named here is published by
40
+ // default — which is how a lottery event's stored `lotteryConfig` reached
41
+ // anonymous callers whole. `toClientLotteryConfig` is the allow-list that
42
+ // belongs on this boundary: it drops the per-slot `price` and `weight` (the
43
+ // weighting is how the odds are set) and the internal `bookedByUserId`,
44
+ // while deliberately keeping `bookedByDisplayName` and
45
+ // `bookedByUserLotteryNumber`, which the public slot grid renders.
46
+ const { createdBy: _createdBy, ...rawPublicEvent } = event;
47
+ const publicEvent = rawPublicEvent.lotteryConfig
48
+ ? {
49
+ ...rawPublicEvent,
50
+ lotteryConfig: toClientLotteryConfig(rawPublicEvent.lotteryConfig),
51
+ }
52
+ : rawPublicEvent;
38
53
  const entriesRepo = db.getRepository("eventEntries");
39
54
  // For poll events with resultsVisibility='always': compute live vote tallies
40
55
  let pollResults = [];
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@mohasinac/appkit",
3
- "version": "4.41.4",
3
+ "version": "4.41.5",
4
4
  "license": "MIT",
5
5
  "publishConfig": {
6
6
  "access": "public"