@mohasinac/appkit 4.42.9 → 4.42.10

package/dist/_internal/server/features/products/data.js

@@ -38,7 +38,31 @@ export const getProductForDetail = cache(async (slugOrId) => {
      * `pageViews` is the single counter now. `viewCount` on the document stays
      * for historical rows; nothing increments it.
      */
-    return (await productRepository.findByIdOrSlug(slugOrId)) ?? null;
+    const product = await productRepository.findByIdOrSlug(slugOrId);
+    if (!product)
+        return null;
+    /*
+     * 🛑 Status gate — added 2026-10-02 alongside the identical one in
+     * `makeGetListingForDetail`, which covers the other six listing types.
+     *
+     * Without it, an archived or rejected listing kept rendering in full at its
+     * own public URL, signed out, with a live CTA — measured on production. This
+     * is the standard, art and sticker half of that leak.
+     *
+     * `isPubliclyVisible` is the predicate every public LIST query already uses:
+     * it treats a MISSING status as visible, so pre-field documents survive, and
+     * it says nothing about availability — a sold-out product must still render
+     * with its "Out of Stock" chrome rather than 404.
+     *
+     * It is handed the one field it reads, not the whole document: its row type
+     * is an index-signature `Record` so that one predicate can serve Firestore
+     * docs, the Function's ISO-string rows and API JSON, and a declared
+     * interface does not satisfy that. Passing `{ status }` keeps it type-safe
+     * where a cast would only silence the check (Root Cause #98).
+     */
+    if (!isPubliclyVisible({ status: product.status }))
+        return null;
+    return product;
 });
 /** Fetch the first page of approved reviews for a product, deduped per request. */
 export const getReviewsForProduct = cache(async (productId, limit = REVIEWS_DETAIL_PAGE_SIZE) => {

package/dist/_internal/server/features/shared/listing-data-factory.js

@@ -2,8 +2,31 @@ import { cache } from "react";
 import { productRepository } from "../../../../repositories";
 import { safeRead } from "../../../../errors/safe-read";
 import { loadProductFeaturesForStore } from "../../../../features/products/repository/loadProductFeatures";
+import { isPubliclyVisible } from "../../../shared/listing-types/availability";
 // Returns a React.cache()-wrapped fetch gated on one listing type.
 // The guard prevents cross-type URL collisions (e.g. /auctions/classified-slug returning wrong product).
+//
+// 🛑 THE STATUS GATE IS LOAD-BEARING, AND ITS ABSENCE WAS A LIVE LEAK.
+//
+// Until 2026-10-02 this checked existence and listing type only. Measured on
+// production, signed out: an admin archiving OR rejecting a classified did NOT
+// remove it from /classified/{slug} — the page rendered in full, h1, description,
+// seller card and a live "Request to Buy" CTA. Deleting the product 404s the same
+// URL immediately, so the route reads live data; it simply had no status
+// predicate. A listing rejected as fraudulent stayed publicly buyable at its own
+// URL, and because the admin row updated correctly every time, the moderator had
+// no way to notice.
+//
+// One gate here covers SIX detail routes — auction, classified, digital-code,
+// live, pre-order, prize-draw — which is why it belongs in the factory rather
+// than in each page.
+//
+// `isPubliclyVisible` is the same predicate every public LIST query uses, and it
+// deliberately treats a MISSING status as visible: documents written before the
+// field existed must not vanish. It gates on status alone and says nothing about
+// availability — a sold-out or ended listing must still render, with its own
+// unavailable chrome, because a buyer following an old link deserves to be told
+// it is gone rather than shown a 404.
 export function makeGetListingForDetail(type) {
     return cache(async (slugOrId) => {
         if (!slugOrId)
@@ -11,6 +34,13 @@ export function makeGetListingForDetail(type) {
         const product = await productRepository.findByIdOrSlug(slugOrId);
         if (!product || product.listingType !== type)
             return null;
+        // `AvailabilityRow` is `Record<string, FirestoreValue>` on purpose — the same
+        // predicate serves Firestore documents, the Function's ISO-string rows and
+        // JSON from /api/products. A declared interface has no index signature, so
+        // the honest adaptation is to hand it the one field it reads rather than to
+        // cast a whole document past the type system (Root Cause #98).
+        if (!isPubliclyVisible({ status: product.status }))
+            return null;
         return product;
     });
 }

package/dist/features/admin/components/AdminFaqEditorView.js

@@ -9,6 +9,7 @@ import { FieldInput, FormErrorSummary, FormShellContext, useFormShellState } fro
 import { SectionForm, useSectionFormNav } from "../../shell";
 import { apiClient } from "../../../http";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints";
+import { FAQ_CATEGORY_LABELS } from "../../faq/schemas/firestore";
 /**
  * Matches the draft this form actually holds, and the payload it actually
  * sends.
@@ -57,14 +58,33 @@ const __O = {
     yAuto: "overflow-y-auto",
 };
 // --- Constants ---------------------------------------------------------------
-const CATEGORY_OPTIONS = [
-    { label: "Shipping", value: "shipping" },
-    { label: "Returns", value: "returns" },
-    { label: "Payments", value: "payments" },
-    { label: "Auctions", value: "auctions" },
-    { label: "Pre-orders", value: "pre-orders" },
-    { label: "General", value: "general" },
-];
+/*
+ * 🛑 DERIVED FROM THE REAL UNION. NEVER HAND-WRITE THIS LIST AGAIN.
+ *
+ * Until 2026-10-02 this was six hand-written options — shipping / returns /
+ * payments / auctions / pre-orders / general — and FIVE of them were values no
+ * reader in the product understands. `FAQCategory` is orders_payment |
+ * shipping_delivery | returns_refunds | product_information | account_security |
+ * technical_support | general | scam_awareness, so only `general` overlapped.
+ *
+ * Measured on production: an FAQ created with "Shipping" stored category
+ * "shipping" with isActive true, and then appeared on /faqs under NO sidebar
+ * category AND not under All FAQs — nowhere at all. The API types `category` as
+ * a bare z.string() and casts it, so the write was a clean 200 and the admin saw
+ * a saved FAQ that no visitor could ever reach. Moving it to "Payments" changed
+ * nothing.
+ *
+ * The old list almost certainly came from the OTHER `FAQCategory` declared in
+ * `admin/components/sections/adminSectionsTypes.ts` (general | shipping |
+ * returns | payment | account | products | sellers) — two same-named types in
+ * one package, Root Cause #36. Note it says "payment" where this list said
+ * "payments", so it did not even match its own source.
+ *
+ * `FAQ_CATEGORY_LABELS` is a `Record<FAQCategory, string>`, so adding a ninth
+ * category is a compile error here rather than a silently missing option, and a
+ * renamed value cannot drift out of this picker.
+ */
+const CATEGORY_OPTIONS = Object.entries(FAQ_CATEGORY_LABELS).map(([value, label]) => ({ value, label }));
 function toSlug(str) {
     const base = str
         .toLowerCase()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.42.9",
+  "version": "4.42.10",
   "license": "MIT",
   "publishConfig": {
     "access": "public"