@mohasinac/appkit 4.41.4 → 4.41.6

package/dist/_internal/server/features/events/adapters.d.ts

@@ -0,0 +1,46 @@
+import type { LotteryConfig, ClientLotteryConfig } from "../../../../features/lottery/types";
+/** A spin prize as a public visitor may see it: what it is, not what it is worth. */
+export interface ClientSpinPrize {
+    id: string;
+    label: string;
+    isActive: boolean;
+}
+/** Allow-list, not a spread: `weight` and `couponId` are deliberately absent. */
+export declare function toClientSpinPrize(prize: {
+    id: string;
+    label: string;
+    isActive?: boolean;
+}): ClientSpinPrize;
+/**
+ * The three fields this projection touches; every other field passes through.
+ *
+ * 🛑 `lotteryConfig` accepts EITHER shape, and that is not laxness — it is the
+ * reason this leak survived review. `EventItem.lotteryConfig` is declared as
+ * `ClientLotteryConfig`, i.e. the already-projected type, while the repository
+ * hands back the STORED document with `price`, `weight` and `bookedByUserId`
+ * still on every slot. The type asserted the projection had happened; nothing
+ * had performed it. Accepting both means the adapter can be applied to a value
+ * whose type is lying, which is precisely where it is needed.
+ */
+export interface PublicEventInput {
+    createdBy?: string;
+    lotteryConfig?: LotteryConfig | ClientLotteryConfig;
+    spinPrizes?: {
+        id: string;
+        label: string;
+        isActive?: boolean;
+    }[];
+}
+/** What a caller gets back: `createdBy` gone, the two nested shapes narrowed. */
+export type PublicEvent<T extends PublicEventInput> = Omit<T, "createdBy" | "lotteryConfig" | "spinPrizes"> & {
+    lotteryConfig?: ClientLotteryConfig;
+    spinPrizes?: ClientSpinPrize[];
+};
+/**
+ * Project one stored event into its public shape.
+ *
+ * The return TYPE is narrowed too, not just the runtime value — so a caller
+ * that goes looking for `slot.weight` on the result gets a compile error rather
+ * than `undefined` at runtime, and the next projection bug is caught by tsc.
+ */
+export declare function toPublicEvent<T extends PublicEventInput>(event: T): PublicEvent<T>;

package/dist/_internal/server/features/events/adapters.js

@@ -0,0 +1,51 @@
+/**
+ * Events adapters — the public projection for an event document.
+ *
+ * 🛑 An event is published by two separate routes (appkit's own `eventIdGET`
+ * and the consumer's `/api/events` list), and both previously built their
+ * payload by SPREADING the stored document and deleting `createdBy`. A
+ * deny-list keyed on a handful of remembered field names publishes everything
+ * nobody thought to delete — see § Public Data Projections and Root Cause #70.
+ *
+ * Two nested structures on `EventDocument` carry fields that decide outcomes
+ * and must never leave the server:
+ *
+ *   - `lotteryConfig.slots[]` — per-slot `price` and `weight` (the weighting IS
+ *     the odds), plus the internal `bookedByUserId`.
+ *   - `spinPrizes[]`         — per-prize `weight` (again, the odds) and
+ *     `couponId` (an internal coupon document id).
+ *
+ * `SpinWheelView` reads `id`, `label` and `isActive` and nothing else, so
+ * dropping the other two costs the client nothing. The prize a spin actually
+ * wins is resolved server-side in `assignSpinPrize` and returned as a coupon
+ * CODE on the entry, never as the coupon's document id.
+ *
+ * Both routes call `toPublicEvent` so the two can no longer disagree
+ * (Root Cause #75 — a rule reachable by copy-paste gets copied, and the copy
+ * never learns about the branch added later).
+ */
+import { toClientLotteryConfig } from "../lottery/adapters";
+/** Allow-list, not a spread: `weight` and `couponId` are deliberately absent. */
+export function toClientSpinPrize(prize) {
+    return {
+        id: prize.id,
+        label: prize.label,
+        isActive: prize.isActive !== false,
+    };
+}
+/**
+ * Project one stored event into its public shape.
+ *
+ * The return TYPE is narrowed too, not just the runtime value — so a caller
+ * that goes looking for `slot.weight` on the result gets a compile error rather
+ * than `undefined` at runtime, and the next projection bug is caught by tsc.
+ */
+export function toPublicEvent(event) {
+    const { createdBy: _createdBy, lotteryConfig, spinPrizes, ...rest } = event;
+    const out = rest;
+    if (lotteryConfig)
+        out.lotteryConfig = toClientLotteryConfig(lotteryConfig);
+    if (Array.isArray(spinPrizes))
+        out.spinPrizes = spinPrizes.map(toClientSpinPrize);
+    return out;
+}

package/dist/_internal/server/features/lottery/adapters.d.ts

@@ -3,7 +3,13 @@
  * before any slot/config data leaves the server.
  */
 import type { LotteryConfig, LotterySlot, ClientLotteryConfig, ClientLotterySlot } from "../../../../features/lottery/types";
-/** Strip price and weight from a single slot for client consumption. */
-export declare function toClientLotterySlot(slot: LotterySlot): ClientLotterySlot;
+/**
+ * Strip price and weight from a single slot for client consumption.
+ *
+ * Takes the loose shape rather than `LotterySlot` so it can be applied to a
+ * value already TYPED as projected but not actually projected — which is the
+ * state `EventItem.lotteryConfig` is in when it comes off the repository.
+ */
+export declare function toClientLotterySlot(slot: LotterySlot | ClientLotterySlot): ClientLotterySlot;
 /** Strip price/weight from the entire config for client consumption. */
-export declare function toClientLotteryConfig(config: LotteryConfig): ClientLotteryConfig;
+export declare function toClientLotteryConfig(config: LotteryConfig | ClientLotteryConfig): ClientLotteryConfig;

package/dist/_internal/server/features/lottery/adapters.js

@@ -1,4 +1,10 @@
-/** Strip price and weight from a single slot for client consumption. */
+/**
+ * Strip price and weight from a single slot for client consumption.
+ *
+ * Takes the loose shape rather than `LotterySlot` so it can be applied to a
+ * value already TYPED as projected but not actually projected — which is the
+ * state `EventItem.lotteryConfig` is in when it comes off the repository.
+ */
 export function toClientLotterySlot(slot) {
     // Allow-list, not a spread: every field named here is a deliberate public
     // exposure with a known reader (§ Public Data Projections). `image` is read

package/dist/features/events/api/[id]/route.js

@@ -18,6 +18,7 @@ import { NextResponse } from "next/server.js";
 import { getProviders } from "../../../../contracts";
 import { EVENT_FIELDS } from "../../schemas";
 import { normalizeError } from "../../../../errors/normalize";
+import { toPublicEvent } from "../../../../_internal/server/features/events/adapters";
 // --- GET /api/events/[id] -----------------------------------------------------
 export async function GET(_request, context) {
     try {
@@ -33,8 +34,12 @@ export async function GET(_request, context) {
             event.status === EVENT_FIELDS.STATUS_VALUES.PAUSED) {
             return NextResponse.json({ success: false, error: "Event not found" }, { status: 404 });
         }
-        // Strip internal field
-        const { createdBy: _createdBy, ...publicEvent } = event;
+        // 🛑 Do not hand-roll this projection here. `toPublicEvent` drops
+        // `createdBy` AND allow-lists the two nested structures that decide
+        // outcomes — `lotteryConfig.slots[]` (price / weight / bookedByUserId) and
+        // `spinPrizes[]` (weight / couponId). Both were published to anonymous
+        // callers by the deny-list spread that used to live here.
+        const publicEvent = toPublicEvent(event);
         const entriesRepo = db.getRepository("eventEntries");
         // For poll events with resultsVisibility='always': compute live vote tallies
         let pollResults = [];

package/dist/server.d.ts

@@ -566,6 +566,8 @@ export { renderLiveItemOg, renderLiveItemOgImage, renderLiveItemOgFromDoc, type
 export { getLotteryEventCached, listLotteryEvents, getLotteryEntriesForAdmin, getLotteryEntriesForUser } from "./_internal/server/features/lottery/data";
 export type { LotteryEventClient } from "./_internal/server/features/lottery/data";
 export { toClientLotterySlot, toClientLotteryConfig } from "./_internal/server/features/lottery/adapters";
+export { toPublicEvent, toClientSpinPrize } from "./_internal/server/features/events/adapters";
+export type { ClientSpinPrize } from "./_internal/server/features/events/adapters";
 export { buildLotteryMetadata } from "./_internal/server/features/lottery/metadata";
 export { submitLotteryPullAction, flagLotteryEntryAction, reopenLotterySlotAction, createLotteryEventAction, updateLotteryEventAction, setProductLotteryModeAction, } from "./_internal/server/features/lottery/actions";
 export { lotteryEntryRepository } from "./features/lottery/repository/lottery-entry.repository";

package/dist/server.js

@@ -1464,6 +1464,7 @@ export { renderLiveItemOg, renderLiveItemOgImage, renderLiveItemOgFromDoc } from
 // ── Lottery feature — server data + adapters + actions ──────────────────────────
 export { getLotteryEventCached, listLotteryEvents, getLotteryEntriesForAdmin, getLotteryEntriesForUser } from "./_internal/server/features/lottery/data";
 export { toClientLotterySlot, toClientLotteryConfig } from "./_internal/server/features/lottery/adapters";
+export { toPublicEvent, toClientSpinPrize } from "./_internal/server/features/events/adapters";
 export { buildLotteryMetadata } from "./_internal/server/features/lottery/metadata";
 export { submitLotteryPullAction, flagLotteryEntryAction, reopenLotterySlotAction, createLotteryEventAction, updateLotteryEventAction, setProductLotteryModeAction, } from "./_internal/server/features/lottery/actions";
 export { lotteryEntryRepository } from "./features/lottery/repository/lottery-entry.repository";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.41.4",
+  "version": "4.41.6",
   "license": "MIT",
   "publishConfig": {
     "access": "public"