@mohasinac/appkit 4.5.0 → 4.5.2

package/dist/_internal/client/features/layout/RoleGuard.d.ts

@@ -1,4 +1,4 @@
-import type { ReactNode } from "react";
+import { type ReactNode } from "react";
 import type { LayoutRole } from "../../../shared/features/layout/types";
 export interface RoleGuardProps {
     /** Single role or array. Omit for auth-only (any signed-in user). */

package/dist/_internal/client/features/layout/RoleGuard.js

@@ -12,13 +12,34 @@ import { jsx as _jsx } from "react/jsx-runtime";
  * route overrides. Everything else defaults to appkit's ROUTES.
  */
 import { useRouter } from "next/navigation";
+import { useEffect, useRef, useState } from "react";
 import { ProtectedRoute } from "../../../../features/auth/components/Guards";
 import { useSession } from "../../../../react/contexts/SessionContext";
 import { ROUTES } from "../../../../next/routing/route-map";
 export function RoleGuard({ role, requireAuth = true, loginPath, unauthorizedPath, loadingComponent, children, }) {
-    const { user, loading } = useSession();
+    const { user, loading, refreshUser } = useSession();
     const router = useRouter();
-    return (_jsx(ProtectedRoute, { user: user, loading: loading, requireAuth: requireAuth, requireRole: role, onNavigate: (path) => router.push(path), routes: {
+    // SessionContext only refreshes role/disabled periodically (every 5
+    // minutes) or on a hard reload/re-login — never on ordinary client-side
+    // navigation. A user just approved as a seller, or just un-banned, would
+    // otherwise keep getting redirected to /unauthorized by this exact guard
+    // for up to 5 minutes even though the same check against live Firestore
+    // data would already pass. Force one fresh check per mount (i.e. once per
+    // navigation into a role-gated layout, since Next.js layouts persist
+    // across sibling route changes) before trusting a denial.
+    const hasRefreshedRef = useRef(false);
+    const [verifying, setVerifying] = useState(true);
+    useEffect(() => {
+        if (loading || hasRefreshedRef.current)
+            return;
+        hasRefreshedRef.current = true;
+        if (!user) {
+            setVerifying(false);
+            return;
+        }
+        refreshUser().finally(() => setVerifying(false));
+    }, [loading, user, refreshUser]);
+    return (_jsx(ProtectedRoute, { user: user, loading: loading || verifying, requireAuth: requireAuth, requireRole: role, onNavigate: (path) => router.push(path), routes: {
             loginPath: loginPath ?? String(ROUTES.AUTH.LOGIN),
             unauthorizedPath: unauthorizedPath ?? String(ROUTES.ERRORS.UNAUTHORIZED),
         }, loadingComponent: loadingComponent, children: children }));

package/dist/features/tester/components/TesterHubView.js

@@ -7,7 +7,6 @@ import { apiClient } from "../../../http";
 import { useApiMutation } from "../../../client";
 import { useSession } from "../../../react";
 import { ACCOUNT_ENDPOINTS } from "../../../constants/api-endpoints";
-import { isAdminUser } from "../../auth/role-predicates";
 import { TesterChecklistStepRow } from "./TesterChecklistStepRow";
 function matchesQuery(item, query) {
     if (!query)
@@ -40,6 +39,11 @@ export function TesterHubView({ sandboxExpiresAt }) {
             const res = await apiClient.get(ACCOUNT_ENDPOINTS.TESTER_CHECKLIST);
             return res?.data ?? res;
         },
+        // The API route resolves isTester/canTestAdmin fresh from Firestore on
+        // every request, so retrying a 403 (a role that genuinely lacks access)
+        // wastes calls for no benefit — but a real access grant should still be
+        // visible on the very next request, not cached as a permanent failure.
+        retry: false,
     });
     const upsertMutation = useApiMutation({
         mutationFn: async (vars) => apiClient.put(ACCOUNT_ENDPOINTS.TESTER_CHECKLIST_ITEM_BY_ID(vars.checklistItemId), vars.patch),
@@ -47,9 +51,21 @@ export function TesterHubView({ sandboxExpiresAt }) {
             void queryClient.invalidateQueries({ queryKey: ["user", "tester-checklist"] });
         },
     });
-    if (!user?.isTester && !isAdminUser(user)) {
+    // Gate on the live API response, not the client-cached session snapshot.
+    // SessionContext only refreshes role/isTester/canTestAdmin periodically
+    // (every 5 minutes) or on a hard reload/re-login — never on ordinary
+    // client-side navigation — so a flag an admin just granted would
+    // otherwise still read as "Testers only" here for up to 5 minutes even
+    // though the same request already succeeds server-side. The tester-
+    // checklist API resolves these fields fresh from Firestore on every call,
+    // so trusting its actual response is both more accurate and immediate.
+    const isForbidden = query.isError && query.error?.status === 403;
+    if (isForbidden) {
         return (_jsx(Alert, { variant: "warning", title: "Testers only", children: "This page is only available to accounts flagged as testers (and admins). Contact an admin if you believe this is a mistake." }));
     }
+    if (query.isLoading) {
+        return _jsx(Text, { color: "muted", children: "Loading checklist\u2026" });
+    }
     // Items arrive pre-sorted by catalog `order` (listActive() orders by it).
     const items = query.data?.items ?? [];
     const filtered = items.filter((item) => matchesQuery(item, search));
@@ -72,7 +88,7 @@ export function TesterHubView({ sandboxExpiresAt }) {
     const handleSaveNote = async (checklistItemId, comment, screenshotUrl) => {
         await upsertMutation.mutateAsync({ checklistItemId, patch: { comment, screenshotUrl } });
     };
-    return (_jsxs(Stack, { gap: "lg", children: [_jsx(Heading, { level: 1, children: "Tester Hub" }), _jsx(Text, { color: "muted", children: "Work through the checklist below and answer Yes/No for each test case. Add a comment and screenshot wherever something looks off \u2014 colors, styles, readability, bugs. Your answers save automatically." }), sandboxExpiresAt && (_jsxs(Alert, { variant: "info", title: "Shared test sandbox", children: ["The shared test store/products/categories expire on ", new Date(sandboxExpiresAt).toLocaleDateString(), "."] })), _jsx(FieldInput, { name: "checklist-search", label: "Search test cases", value: search, onChange: setSearch, placeholder: "Search by title or route, e.g. checkout, /store/payouts..." }), query.isLoading && _jsx(Text, { color: "muted", children: "Loading checklist\u2026" }), sortedPhaseNumbers.map((phaseNumber) => {
+    return (_jsxs(Stack, { gap: "lg", children: [_jsx(Heading, { level: 1, children: "Tester Hub" }), _jsx(Text, { color: "muted", children: "Work through the checklist below and answer Yes/No for each test case. Add a comment and screenshot wherever something looks off \u2014 colors, styles, readability, bugs. Your answers save automatically." }), sandboxExpiresAt && (_jsxs(Alert, { variant: "info", title: "Shared test sandbox", children: ["The shared test store/products/categories expire on ", new Date(sandboxExpiresAt).toLocaleDateString(), "."] })), _jsx(FieldInput, { name: "checklist-search", label: "Search test cases", value: search, onChange: setSearch, placeholder: "Search by title or route, e.g. checkout, /store/payouts..." }), sortedPhaseNumbers.map((phaseNumber) => {
                 const groups = phases.get(phaseNumber);
                 const phaseItemCount = Array.from(groups.values())
                     .flatMap((g) => Array.from(g.pages.values()))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.5.0",
+  "version": "4.5.2",
   "license": "MIT",
   "publishConfig": {
     "access": "public"