@mohasinac/appkit 4.42.8 → 4.42.10

package/dist/_internal/server/features/products/data.js

@@ -38,7 +38,31 @@ export const getProductForDetail = cache(async (slugOrId) => {
      * `pageViews` is the single counter now. `viewCount` on the document stays
      * for historical rows; nothing increments it.
      */
-    return (await productRepository.findByIdOrSlug(slugOrId)) ?? null;
+    const product = await productRepository.findByIdOrSlug(slugOrId);
+    if (!product)
+        return null;
+    /*
+     * 🛑 Status gate — added 2026-10-02 alongside the identical one in
+     * `makeGetListingForDetail`, which covers the other six listing types.
+     *
+     * Without it, an archived or rejected listing kept rendering in full at its
+     * own public URL, signed out, with a live CTA — measured on production. This
+     * is the standard, art and sticker half of that leak.
+     *
+     * `isPubliclyVisible` is the predicate every public LIST query already uses:
+     * it treats a MISSING status as visible, so pre-field documents survive, and
+     * it says nothing about availability — a sold-out product must still render
+     * with its "Out of Stock" chrome rather than 404.
+     *
+     * It is handed the one field it reads, not the whole document: its row type
+     * is an index-signature `Record` so that one predicate can serve Firestore
+     * docs, the Function's ISO-string rows and API JSON, and a declared
+     * interface does not satisfy that. Passing `{ status }` keeps it type-safe
+     * where a cast would only silence the check (Root Cause #98).
+     */
+    if (!isPubliclyVisible({ status: product.status }))
+        return null;
+    return product;
 });
 /** Fetch the first page of approved reviews for a product, deduped per request. */
 export const getReviewsForProduct = cache(async (productId, limit = REVIEWS_DETAIL_PAGE_SIZE) => {

package/dist/_internal/server/features/shared/listing-data-factory.js

@@ -2,8 +2,31 @@ import { cache } from "react";
 import { productRepository } from "../../../../repositories";
 import { safeRead } from "../../../../errors/safe-read";
 import { loadProductFeaturesForStore } from "../../../../features/products/repository/loadProductFeatures";
+import { isPubliclyVisible } from "../../../shared/listing-types/availability";
 // Returns a React.cache()-wrapped fetch gated on one listing type.
 // The guard prevents cross-type URL collisions (e.g. /auctions/classified-slug returning wrong product).
+//
+// 🛑 THE STATUS GATE IS LOAD-BEARING, AND ITS ABSENCE WAS A LIVE LEAK.
+//
+// Until 2026-10-02 this checked existence and listing type only. Measured on
+// production, signed out: an admin archiving OR rejecting a classified did NOT
+// remove it from /classified/{slug} — the page rendered in full, h1, description,
+// seller card and a live "Request to Buy" CTA. Deleting the product 404s the same
+// URL immediately, so the route reads live data; it simply had no status
+// predicate. A listing rejected as fraudulent stayed publicly buyable at its own
+// URL, and because the admin row updated correctly every time, the moderator had
+// no way to notice.
+//
+// One gate here covers SIX detail routes — auction, classified, digital-code,
+// live, pre-order, prize-draw — which is why it belongs in the factory rather
+// than in each page.
+//
+// `isPubliclyVisible` is the same predicate every public LIST query uses, and it
+// deliberately treats a MISSING status as visible: documents written before the
+// field existed must not vanish. It gates on status alone and says nothing about
+// availability — a sold-out or ended listing must still render, with its own
+// unavailable chrome, because a buyer following an old link deserves to be told
+// it is gone rather than shown a 404.
 export function makeGetListingForDetail(type) {
     return cache(async (slugOrId) => {
         if (!slugOrId)
@@ -11,6 +34,13 @@ export function makeGetListingForDetail(type) {
         const product = await productRepository.findByIdOrSlug(slugOrId);
         if (!product || product.listingType !== type)
             return null;
+        // `AvailabilityRow` is `Record<string, FirestoreValue>` on purpose — the same
+        // predicate serves Firestore documents, the Function's ISO-string rows and
+        // JSON from /api/products. A declared interface has no index signature, so
+        // the honest adaptation is to hand it the one field it reads rather than to
+        // cast a whole document past the type system (Root Cause #98).
+        if (!isPubliclyVisible({ status: product.status }))
+            return null;
         return product;
     });
 }

package/dist/features/admin/components/AdminFaqEditorView.js

@@ -9,6 +9,7 @@ import { FieldInput, FormErrorSummary, FormShellContext, useFormShellState } fro
 import { SectionForm, useSectionFormNav } from "../../shell";
 import { apiClient } from "../../../http";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints";
+import { FAQ_CATEGORY_LABELS } from "../../faq/schemas/firestore";
 /**
  * Matches the draft this form actually holds, and the payload it actually
  * sends.
@@ -57,14 +58,33 @@ const __O = {
     yAuto: "overflow-y-auto",
 };
 // --- Constants ---------------------------------------------------------------
-const CATEGORY_OPTIONS = [
-    { label: "Shipping", value: "shipping" },
-    { label: "Returns", value: "returns" },
-    { label: "Payments", value: "payments" },
-    { label: "Auctions", value: "auctions" },
-    { label: "Pre-orders", value: "pre-orders" },
-    { label: "General", value: "general" },
-];
+/*
+ * 🛑 DERIVED FROM THE REAL UNION. NEVER HAND-WRITE THIS LIST AGAIN.
+ *
+ * Until 2026-10-02 this was six hand-written options — shipping / returns /
+ * payments / auctions / pre-orders / general — and FIVE of them were values no
+ * reader in the product understands. `FAQCategory` is orders_payment |
+ * shipping_delivery | returns_refunds | product_information | account_security |
+ * technical_support | general | scam_awareness, so only `general` overlapped.
+ *
+ * Measured on production: an FAQ created with "Shipping" stored category
+ * "shipping" with isActive true, and then appeared on /faqs under NO sidebar
+ * category AND not under All FAQs — nowhere at all. The API types `category` as
+ * a bare z.string() and casts it, so the write was a clean 200 and the admin saw
+ * a saved FAQ that no visitor could ever reach. Moving it to "Payments" changed
+ * nothing.
+ *
+ * The old list almost certainly came from the OTHER `FAQCategory` declared in
+ * `admin/components/sections/adminSectionsTypes.ts` (general | shipping |
+ * returns | payment | account | products | sellers) — two same-named types in
+ * one package, Root Cause #36. Note it says "payment" where this list said
+ * "payments", so it did not even match its own source.
+ *
+ * `FAQ_CATEGORY_LABELS` is a `Record<FAQCategory, string>`, so adding a ninth
+ * category is a compile error here rather than a silently missing option, and a
+ * renamed value cannot drift out of this picker.
+ */
+const CATEGORY_OPTIONS = Object.entries(FAQ_CATEGORY_LABELS).map(([value, label]) => ({ value, label }));
 function toSlug(str) {
     const base = str
         .toLowerCase()

package/dist/features/admin/components/AdminStoreEditorView.d.ts

@@ -8,5 +8,15 @@ export interface AdminStoreEditorViewProps {
     currentIsVerified?: boolean;
     currentIsFeatured?: boolean;
     currentCapabilities?: string[];
+    /**
+     * 🛑 Required for the note to DISPLAY. Without it `adminNotes` was hardcoded
+     * `""` at both the initial-state and the reopen-reset sites, so a stored note
+     * could never appear — and because the payload sent `parsed.adminNotes ||
+     * undefined`, an always-empty box meant `"" || undefined === undefined`, the
+     * route skipped the key, and an existing note could never be CLEARED either.
+     * Verified on production 2026-10-02: the document held `adminNotes:
+     * "RT3-probe"` while `textarea[name="adminNotes"]` read `""`.
+     */
+    currentAdminNotes?: string;
 }
-export declare function AdminStoreEditorView({ open, onClose, storeId, storeName, currentStatus, currentIsVerified, currentIsFeatured, currentCapabilities, }: AdminStoreEditorViewProps): React.JSX.Element;
+export declare function AdminStoreEditorView({ open, onClose, storeId, storeName, currentStatus, currentIsVerified, currentIsFeatured, currentCapabilities, currentAdminNotes, }: AdminStoreEditorViewProps): React.JSX.Element;

package/dist/features/admin/components/AdminStoreEditorView.js

@@ -69,10 +69,10 @@ const STATUS_OPTIONS = [
  * right that it is unreadable there.
  */
 function CapabilityPicker({ selected, onToggle, }) {
-    return (_jsxs(Stack, { gap: "sm", children: [_jsxs(Span, { size: "sm", weight: "medium", color: "muted", children: ["Capabilities", _jsxs(Span, { size: "xs", weight: "normal", className: "ml-2", color: "muted", children: ["(", selected.size, " active)"] })] }), _jsx(Div, { className: "divide-y divide-[var(--appkit-color-border)]", rounded: "xl", border: "default", children: CAPABILITY_GROUPS.map((group) => (_jsxs(Details, { className: "group", children: [_jsxs(Summary, { paddingX: "x-sm", paddingY: "y-xs", weight: "semibold", color: "muted", layout: "flex", align: "center", justify: "between", className: "uppercase tracking-wide hover:bg-[var(--appkit-color-bg)] transition-colors", children: [_jsx(Span, { size: "xs", children: group.label }), _jsxs(Span, { size: "xs", weight: "normal", className: "normal-case", color: "faint", children: [group.caps.filter((c) => selected.has(c.key)).length, "/", group.caps.length] })] }), _jsx(Div, { layout: "grid", paddingY: "y-xs-tall", className: "grid-cols-2 gap-x-2 gap-y-1.5", surface: "muted", padding: "x-sm", children: group.caps.map((cap) => (_jsxs("label", { className: "flex items-center gap-[var(--appkit-space-2)] cursor-pointer text-[length:var(--appkit-text-xs)] text-[var(--appkit-color-text-muted)]", children: [_jsx(Checkbox, { bare: true, checked: selected.has(cap.key), onChange: () => onToggle(cap.key), className: "h-3.5 w-3.5 rounded border-[var(--appkit-color-border)] accent-primary" }), cap.label] }, cap.key))) })] }, group.label))) })] }));
+    return (_jsxs(Stack, { gap: "sm", children: [_jsxs(Span, { size: "sm", weight: "medium", color: "muted", children: ["Capabilities", _jsxs(Span, { size: "xs", weight: "normal", className: "ml-2", color: "muted", children: ["(", selected.size, " active)"] })] }), _jsx(Div, { className: "divide-y divide-[var(--appkit-color-border)]", rounded: "xl", border: "default", children: CAPABILITY_GROUPS.map((group) => (_jsxs(Details, { className: "group", children: [_jsxs(Summary, { paddingX: "x-sm", paddingY: "y-xs", weight: "semibold", color: "muted", layout: "flex", align: "center", justify: "between", className: "uppercase tracking-wide hover:bg-[var(--appkit-color-bg)] transition-colors", children: [_jsx(Span, { size: "xs", children: group.label }), _jsxs(Span, { size: "xs", weight: "normal", className: "normal-case", color: "faint", children: [group.caps.filter((c) => selected.has(c.key)).length, "/", group.caps.length] })] }), _jsx(Div, { layout: "grid", paddingY: "y-xs-tall", className: "grid-cols-2 gap-x-2 gap-y-1.5", surface: "muted", padding: "x-sm", children: group.caps.map((cap) => (_jsx(Checkbox, { label: cap.label, checked: selected.has(cap.key), onChange: () => onToggle(cap.key), wrapperClassName: "flex items-center gap-[var(--appkit-space-2)] cursor-pointer text-[length:var(--appkit-text-xs)] text-[var(--appkit-color-text-muted)]" }, cap.key))) })] }, group.label))) })] }));
 }
 // --- Component ---------------------------------------------------------------
-export function AdminStoreEditorView({ open, onClose, storeId, storeName, currentStatus, currentIsVerified, currentIsFeatured, currentCapabilities, }) {
+export function AdminStoreEditorView({ open, onClose, storeId, storeName, currentStatus, currentIsVerified, currentIsFeatured, currentCapabilities, currentAdminNotes, }) {
     const queryClient = useQueryClient();
     const { showToast } = useToast();
     const [values, setValues] = React.useState(() => ({
@@ -81,7 +81,7 @@ export function AdminStoreEditorView({ open, onClose, storeId, storeName, curren
         isFeatured: currentIsFeatured ?? false,
         suspensionReason: "",
         capabilities: currentCapabilities ?? DEFAULT_CAPABILITIES,
-        adminNotes: "",
+        adminNotes: currentAdminNotes ?? "",
     }));
     const handleChange = React.useCallback((partial) => {
         setValues((prev) => Object.assign({}, prev, partial));
@@ -95,9 +95,9 @@ export function AdminStoreEditorView({ open, onClose, storeId, storeName, curren
             isFeatured: currentIsFeatured ?? false,
             suspensionReason: "",
             capabilities: currentCapabilities ?? DEFAULT_CAPABILITIES,
-            adminNotes: "",
+            adminNotes: currentAdminNotes ?? "",
         });
-    }, [open, currentStatus, currentIsVerified, currentIsFeatured, currentCapabilities]);
+    }, [open, currentStatus, currentIsVerified, currentIsFeatured, currentCapabilities, currentAdminNotes]);
     const saveMutation = useApiMutation({
         errorMessage: "Failed to update store.",
         mutationFn: async () => {
@@ -114,7 +114,9 @@ export function AdminStoreEditorView({ open, onClose, storeId, storeName, curren
             const parsed = adminStoreUpdateSchema.parse(values);
             await apiClient.patch(ADMIN_ENDPOINTS.STORE_BY_ID(storeId), {
                 storeStatus: parsed.storeStatus,
-                adminNotes: parsed.adminNotes || undefined,
+                // `?? ""`, NOT `|| undefined` — sending undefined makes the route skip
+                // the key, so clearing a note was impossible.
+                adminNotes: parsed.adminNotes ?? "",
                 isFeatured: parsed.isFeatured,
                 isVerified: parsed.isVerified,
                 suspensionReason: parsed.suspensionReason || undefined,

package/dist/features/admin/components/AdminStoresView.js

@@ -127,5 +127,15 @@ export function AdminStoresView({ children, ...props }) {
     };
     return (_jsxs(_Fragment, { children: [_jsx(DataListingView, { config: config }), _jsx(AdminStoreEditorView, { open: Boolean(editorRow), onClose: () => setEditorRow(null), storeId: editorRow?.id, storeName: editorRow?.primary, currentStatus: editorRow?.status?.toLowerCase(), currentIsVerified: Boolean(editorRow?._raw?.isVerified), currentIsFeatured: Boolean(editorRow?._raw?.isFeatured), currentCapabilities: Array.isArray(editorRow?._raw?.capabilities)
                     ? editorRow._raw.capabilities
+                    : undefined, 
+                /*
+                 * The list serializer DOES emit `adminNotes`
+                 * (src/app/api/admin/stores/route.ts), so the row already carries it —
+                 * it was simply never passed down, which is why the textbox could not
+                 * display a stored note. Root Cause #38's shape, one hop later: the
+                 * field survives the API and dies at the prop.
+                 */
+                currentAdminNotes: typeof editorRow?._raw?.adminNotes === "string"
+                    ? editorRow._raw.adminNotes
                     : undefined })] }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.42.8",
+  "version": "4.42.10",
   "license": "MIT",
   "publishConfig": {
     "access": "public"