@mohasinac/appkit 4.5.2 → 4.6.0

package/dist/client.d.ts

@@ -191,7 +191,7 @@ export { AuctionBidsTable } from "./features/auctions/components/AuctionBidsTabl
 export type { AuctionBidsTableProps, AuctionWithBids } from "./features/auctions/components/AuctionBidsTable";
 export { ProtectedRoute, AuthStatusPanel, ForgotPasswordView, LoginForm, RegisterForm, ResetPasswordView, VerifyEmailView } from "./features/auth/index";
 export type { AuthGuardUser, ForgotPasswordViewProps, LoginFormProps, LoginFormValues, RegisterFormProps, RegisterFormValues, ResetPasswordViewProps, VerifyEmailViewProps, } from "./features/auth/index";
-export { useLogout, useLogin, useGoogleLogin, useLinkGoogleAccount, useRegister, useForgotPassword, useResetPassword, useVerifyEmail, useChangePassword, useChangeEmail } from "./features/auth/index";
+export { useLogout, useLogin, useGoogleLogin, useLinkGoogleAccount, useRegister, useForgotPassword, useResetPassword, useVerifyEmail, useChangePassword, useRequestPasswordChangeOtp, useVerifyPasswordChangeOtp, useChangeEmail } from "./features/auth/index";
 export type { LoginCredentials, RegisterData, ForgotPasswordData, ResetPasswordData, VerifyEmailData, ChangePasswordData, ChangeEmailData } from "./features/auth/index";
 export { CartView, CartItemRow, CartSummary, CartDrawer, CheckoutView, CheckoutSuccessView, CheckoutAddressStep, useGuestCart, useCartCount, useAddToCart, useCart, useGuestCartMerge, useCartQuery } from "./features/cart/index";
 export type { CartItem, CartItemMeta, CartData, GuestCartItem } from "./features/cart/index";

package/dist/client.js

@@ -222,7 +222,7 @@ export { PageViewTracker } from "./features/analytics/components/PageViewTracker
 export { PAGE_VIEW_ENTITY_TYPES } from "./features/analytics/types";
 export { AuctionBidsTable } from "./features/auctions/components/AuctionBidsTable";
 export { ProtectedRoute, AuthStatusPanel, ForgotPasswordView, LoginForm, RegisterForm, ResetPasswordView, VerifyEmailView } from "./features/auth/index";
-export { useLogout, useLogin, useGoogleLogin, useLinkGoogleAccount, useRegister, useForgotPassword, useResetPassword, useVerifyEmail, useChangePassword, useChangeEmail } from "./features/auth/index";
+export { useLogout, useLogin, useGoogleLogin, useLinkGoogleAccount, useRegister, useForgotPassword, useResetPassword, useVerifyEmail, useChangePassword, useRequestPasswordChangeOtp, useVerifyPasswordChangeOtp, useChangeEmail } from "./features/auth/index";
 export { CartView, CartItemRow, CartSummary, CartDrawer, CheckoutView, CheckoutSuccessView, CheckoutAddressStep, useGuestCart, useCartCount, useAddToCart, useCart, useGuestCartMerge, useCartQuery } from "./features/cart/index";
 export { useAddresses, useCreateAddress, useUpdateAddress, useDeleteAddress, useSetDefaultAddress, useAddress } from "./features/account/index";
 export { AddressBook, AddressCard, AddressForm } from "./features/account/index";

package/dist/constants/api-endpoints.d.ts

@@ -32,6 +32,8 @@ export declare const ACCOUNT_ENDPOINTS: {
     readonly BY_ID: (userId: string) => string;
     readonly PROFILE: "/api/user/profile";
     readonly CHANGE_PASSWORD: "/api/user/change-password";
+    readonly CHANGE_PASSWORD_OTP_REQUEST: "/api/user/change-password/otp/request";
+    readonly CHANGE_PASSWORD_OTP_VERIFY: "/api/user/change-password/otp/verify";
     /** @param userId — for public profile pages */
     readonly PUBLIC_PROFILE: (userId: string) => string;
     /** @param userId — seller profile page */
@@ -481,6 +483,8 @@ export declare const API_ENDPOINTS: {
         readonly BY_ID: (userId: string) => string;
         readonly PROFILE: "/api/user/profile";
         readonly CHANGE_PASSWORD: "/api/user/change-password";
+        readonly CHANGE_PASSWORD_OTP_REQUEST: "/api/user/change-password/otp/request";
+        readonly CHANGE_PASSWORD_OTP_VERIFY: "/api/user/change-password/otp/verify";
         /** @param userId — for public profile pages */
         readonly PUBLIC_PROFILE: (userId: string) => string;
         /** @param userId — seller profile page */
@@ -932,6 +936,8 @@ export declare const API_ROUTES: {
         readonly BY_ID: (userId: string) => string;
         readonly PROFILE: "/api/user/profile";
         readonly CHANGE_PASSWORD: "/api/user/change-password";
+        readonly CHANGE_PASSWORD_OTP_REQUEST: "/api/user/change-password/otp/request";
+        readonly CHANGE_PASSWORD_OTP_VERIFY: "/api/user/change-password/otp/verify";
         /** @param userId — for public profile pages */
         readonly PUBLIC_PROFILE: (userId: string) => string;
         /** @param userId — seller profile page */

package/dist/constants/api-endpoints.js

@@ -47,6 +47,8 @@ export const ACCOUNT_ENDPOINTS = {
     BY_ID: (userId) => `/api/account/${userId}`,
     PROFILE: "/api/user/profile",
     CHANGE_PASSWORD: "/api/user/change-password",
+    CHANGE_PASSWORD_OTP_REQUEST: "/api/user/change-password/otp/request",
+    CHANGE_PASSWORD_OTP_VERIFY: "/api/user/change-password/otp/verify",
     /** @param userId — for public profile pages */
     PUBLIC_PROFILE: (userId) => `/api/profile/${userId}`,
     /** @param userId — seller profile page */

package/dist/contracts/client-auth.d.ts

@@ -15,6 +15,14 @@ export interface IClientAuthProvider {
     confirmPasswordReset(code: string, newPassword: string): Promise<void>;
     /** Re-authenticate with current password and change to new password */
     reauthenticateAndChangePassword(currentPassword: string, newPassword: string): Promise<void>;
+    /**
+     * Verify the current password only — does NOT change anything. Used to
+     * prove current-password knowledge before an OTP is sent, without the
+     * side effect of immediately applying a new password ahead of that OTP
+     * being verified (see password-change-otp.ts for why the two steps must
+     * stay separate).
+     */
+    reauthenticateOnly(currentPassword: string): Promise<void>;
     /** Re-authenticate and send a verification email to the new address; email updates after user clicks the link */
     reauthenticateAndSendEmailUpdateVerification(currentPassword: string, newEmail: string): Promise<void>;
     /** Reload the current user's profile */

package/dist/features/auth/actions/index.d.ts

@@ -1,2 +1,3 @@
 export * from "./profile-actions";
 export * from "./realtime-token-actions";
+export * from "./password-change-otp-actions";

package/dist/features/auth/actions/index.js

@@ -1,2 +1,3 @@
 export * from "./profile-actions";
 export * from "./realtime-token-actions";
+export * from "./password-change-otp-actions";

package/dist/features/auth/actions/password-change-otp-actions.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Password Change OTP Actions.
+ *
+ * Server-side gate for POST /api/user/change-password — see
+ * ../password-change-otp.ts for the full incident writeup. Mirrors
+ * checkout-value-otp-actions.ts's shape exactly (same crypto primitives,
+ * separate Firestore namespace and copy).
+ */
+/** Sends a password-change OTP to the account's registered email. Returns masked email so the UI can confirm which inbox to check. */
+export declare function sendPasswordChangeOtp(userId: string, userEmail: string): Promise<{
+    maskedEmail: string;
+}>;
+/** Verifies the 6-digit password-change OTP and marks the Firestore record verified. */
+export declare function verifyPasswordChangeOtp(userId: string, code: string): Promise<void>;
+/** Whether the account has a currently-verified password-change OTP on file. */
+export declare function isPasswordChangeOtpVerified(userId: string): Promise<boolean>;
+/** Consumes the verified OTP so it can't be reused for a future password change. */
+export declare function consumePasswordChangeOtp(userId: string): Promise<void>;

package/dist/features/auth/actions/password-change-otp-actions.js

@@ -0,0 +1,88 @@
+/**
+ * Password Change OTP Actions.
+ *
+ * Server-side gate for POST /api/user/change-password — see
+ * ../password-change-otp.ts for the full incident writeup. Mirrors
+ * checkout-value-otp-actions.ts's shape exactly (same crypto primitives,
+ * separate Firestore namespace and copy).
+ */
+import { timingSafeEqual } from "crypto";
+import { ValidationError } from "../../../errors";
+import { serverLogger } from "../../../monitoring";
+import { sendEmail } from "../../contact/email";
+import { getAdminDb } from "../../../providers/db-firebase";
+import { resolveDate } from "../../../utils";
+import { hashOtp, generateOtpCode, PASSWORD_CHANGE_OTP_EXPIRY_MS, PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, passwordChangeOtpRef, enforcePasswordChangeOtpRateLimit, } from "../password-change-otp";
+/** Sends a password-change OTP to the account's registered email. Returns masked email so the UI can confirm which inbox to check. */
+export async function sendPasswordChangeOtp(userId, userEmail) {
+    const db = getAdminDb();
+    await enforcePasswordChangeOtpRateLimit(db, userId);
+    const code = generateOtpCode();
+    const codeHash = hashOtp(code);
+    const expiresAt = new Date(Date.now() + PASSWORD_CHANGE_OTP_EXPIRY_MS);
+    await passwordChangeOtpRef(db, userId).set({
+        codeHash,
+        expiresAt,
+        attempts: 0,
+        verified: false,
+        createdAt: new Date(),
+    });
+    const siteName = process.env.NEXT_PUBLIC_SITE_NAME || "LetItRip";
+    const [local, domain] = userEmail.split("@");
+    const maskedEmail = domain
+        ? `${local.length <= 2 ? "*".repeat(local.length) : local[0] + "*".repeat(local.length - 2) + local[local.length - 1]}@${domain}`
+        : "***";
+    await sendEmail({
+        to: userEmail,
+        subject: `${siteName}: Verify your password change`,
+        html: `
+      <div style="font-family:sans-serif;max-width:480px;margin:0 auto;padding:24px">
+        <h2 style="margin-bottom:8px">Confirm Password Change</h2>
+        <p style="color:#555">Someone requested to change this account's password. Enter this code to confirm it was you:</p>
+        <div style="font-size:36px;font-weight:bold;letter-spacing:8px;text-align:center;margin:24px 0;padding:16px;background:#f3f4f6;border-radius:8px">${code}</div>
+        <p style="color:#888;font-size:12px">This code expires in 10 minutes. If you did not request this, your password has NOT been changed — but consider securing your account.</p>
+      </div>
+    `,
+    });
+    serverLogger.info(`Password change OTP sent: uid=${userId}`);
+    return { maskedEmail };
+}
+/** Verifies the 6-digit password-change OTP and marks the Firestore record verified. */
+export async function verifyPasswordChangeOtp(userId, code) {
+    const db = getAdminDb();
+    const ref = passwordChangeOtpRef(db, userId);
+    const snap = await ref.get();
+    if (!snap.exists) {
+        throw new ValidationError("No verification code found. Please request a new code.");
+    }
+    const otpDoc = snap.data();
+    if (otpDoc.verified)
+        return;
+    if (otpDoc.attempts >= PASSWORD_CHANGE_OTP_MAX_ATTEMPTS) {
+        throw new ValidationError("Too many failed attempts. Please request a new code.");
+    }
+    if (Date.now() > (resolveDate(otpDoc.expiresAt)?.getTime() ?? 0)) {
+        throw new ValidationError("Code expired. Please request a new one.");
+    }
+    const inputHash = hashOtp(code);
+    if (!timingSafeEqual(Buffer.from(inputHash, "hex"), Buffer.from(otpDoc.codeHash, "hex"))) {
+        await ref.update({ attempts: otpDoc.attempts + 1 });
+        throw new ValidationError("Invalid code. Please check and try again.");
+    }
+    await ref.update({ verified: true, verifiedAt: new Date() });
+    serverLogger.info(`Password change OTP verified: uid=${userId}`);
+}
+/** Whether the account has a currently-verified password-change OTP on file. */
+export async function isPasswordChangeOtpVerified(userId) {
+    const db = getAdminDb();
+    const snap = await passwordChangeOtpRef(db, userId).get();
+    if (!snap.exists)
+        return false;
+    const otpDoc = snap.data();
+    return otpDoc.verified === true;
+}
+/** Consumes the verified OTP so it can't be reused for a future password change. */
+export async function consumePasswordChangeOtp(userId) {
+    const db = getAdminDb();
+    await passwordChangeOtpRef(db, userId).delete();
+}

package/dist/features/auth/hooks/useAuth.d.ts

@@ -90,6 +90,35 @@ export declare function useResetPassword(options?: {
     onSuccess?: (data: JsonValue) => void;
     onError?: (error: Error) => void;
 }): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, ResetPasswordData, unknown>;
+/**
+ * Password change is now a 3-step flow (root-caused 2026-08-20 — see
+ * appkit/src/features/auth/password-change-otp.ts): the old single-step
+ * reauthenticateAndChangePassword() applied the new password immediately
+ * client-side, before any server-verified identity check beyond the
+ * session cookie. Step order:
+ *   1. useRequestPasswordChangeOtp — verifies currentPassword via Firebase
+ *      reauth (proves the caller actually knows it, without changing
+ *      anything yet), then emails a 6-digit code.
+ *   2. useVerifyPasswordChangeOtp — verifies the code server-side.
+ *   3. useChangePassword — only now actually applies newPassword; the API
+ *      route rejects this call unless step 2 already succeeded.
+ */
+export declare function useRequestPasswordChangeOtp(options?: {
+    onSuccess?: (data: {
+        maskedEmail: string;
+    }) => void;
+    onError?: (error: Error) => void;
+}): import("@tanstack/react-query").UseMutationResult<{
+    maskedEmail: string;
+}, Error, {
+    currentPassword: string;
+}, unknown>;
+export declare function useVerifyPasswordChangeOtp(options?: {
+    onSuccess?: (data: JsonValue) => void;
+    onError?: (error: Error) => void;
+}): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, {
+    code: string;
+}, unknown>;
 export declare function useChangePassword(options?: {
     onSuccess?: (data: JsonValue) => void;
     onError?: (error: Error) => void;

package/dist/features/auth/hooks/useAuth.js

@@ -353,16 +353,43 @@ export function useResetPassword(options) {
         onError: options?.onError,
     });
 }
-export function useChangePassword(options) {
+/**
+ * Password change is now a 3-step flow (root-caused 2026-08-20 — see
+ * appkit/src/features/auth/password-change-otp.ts): the old single-step
+ * reauthenticateAndChangePassword() applied the new password immediately
+ * client-side, before any server-verified identity check beyond the
+ * session cookie. Step order:
+ *   1. useRequestPasswordChangeOtp — verifies currentPassword via Firebase
+ *      reauth (proves the caller actually knows it, without changing
+ *      anything yet), then emails a 6-digit code.
+ *   2. useVerifyPasswordChangeOtp — verifies the code server-side.
+ *   3. useChangePassword — only now actually applies newPassword; the API
+ *      route rejects this call unless step 2 already succeeded.
+ */
+export function useRequestPasswordChangeOtp(options) {
     return useMutation({
-        mutationFn: async (data) => {
-            await getClientAuthProvider().reauthenticateAndChangePassword(data.currentPassword, data.newPassword);
-            return apiClient.post(ACCOUNT_ENDPOINTS.CHANGE_PASSWORD, data);
+        mutationFn: async ({ currentPassword }) => {
+            await getClientAuthProvider().reauthenticateOnly(currentPassword);
+            return apiClient.post(ACCOUNT_ENDPOINTS.CHANGE_PASSWORD_OTP_REQUEST, {});
         },
         onSuccess: options?.onSuccess,
         onError: options?.onError,
     });
 }
+export function useVerifyPasswordChangeOtp(options) {
+    return useMutation({
+        mutationFn: async ({ code }) => apiClient.post(ACCOUNT_ENDPOINTS.CHANGE_PASSWORD_OTP_VERIFY, { code }),
+        onSuccess: options?.onSuccess,
+        onError: options?.onError,
+    });
+}
+export function useChangePassword(options) {
+    return useMutation({
+        mutationFn: async (data) => apiClient.post(ACCOUNT_ENDPOINTS.CHANGE_PASSWORD, data),
+        onSuccess: options?.onSuccess,
+        onError: options?.onError,
+    });
+}
 export function useChangeEmail(options) {
     return useMutation({
         mutationFn: async (data) => {

package/dist/features/auth/password-change-otp.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Password Change OTP.
+ *
+ * Root-caused 2026-08-20: POST /api/user/change-password validated the
+ * *shape* of `currentPassword` (Zod: non-empty, differs from newPassword)
+ * but the handler never read or verified it — `getAdminAuth().updateUser()`
+ * overwrote the password unconditionally for whatever `uid` the session
+ * cookie carried. The only real current-password check
+ * (`reauthenticateWithCredential` in the Firebase client SDK) happens in
+ * the browser and is trivially bypassed by calling the API directly with a
+ * stolen session cookie — a session hijack (XSS, log leak, etc.) was
+ * enough to take over the account's password with zero server-enforced
+ * identity check. This module gates the actual server-side write behind an
+ * email OTP, verified server-side, mirroring the Tier PP checkout-value-OTP
+ * pattern exactly (same crypto primitives, reused not duplicated) so a
+ * session-cookie thief also needs access to the account's inbox.
+ */
+import { hashOtp, generateOtpCode, CHECKOUT_VALUE_OTP_EXPIRY_MS as PASSWORD_CHANGE_OTP_EXPIRY_MS, CHECKOUT_VALUE_OTP_EXPIRY_MINUTES as PASSWORD_CHANGE_OTP_EXPIRY_MINUTES, CHECKOUT_VALUE_OTP_COOLDOWN_MS as PASSWORD_CHANGE_OTP_COOLDOWN_MS, CHECKOUT_VALUE_OTP_MAX_ATTEMPTS as PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, CHECKOUT_VALUE_OTP_VERIFY_RATE_LIMIT as PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT } from "./checkout-value-otp";
+export { hashOtp, generateOtpCode, PASSWORD_CHANGE_OTP_EXPIRY_MS, PASSWORD_CHANGE_OTP_EXPIRY_MINUTES, PASSWORD_CHANGE_OTP_COOLDOWN_MS, PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT, };
+type Db = FirebaseFirestore.Firestore;
+/** Single-slot doc per user — a user can only be mid-password-change once. */
+export declare function passwordChangeOtpRef(db: Db, uid: string): FirebaseFirestore.DocumentReference<FirebaseFirestore.DocumentData, FirebaseFirestore.DocumentData>;
+export declare function passwordChangeOtpRateLimitRef(db: Db, uid: string): FirebaseFirestore.DocumentReference<FirebaseFirestore.DocumentData, FirebaseFirestore.DocumentData>;
+export interface PasswordChangeOtpDoc {
+    codeHash: string;
+    expiresAt: FirebaseFirestore.Timestamp;
+    attempts: number;
+    verified: boolean;
+}
+/**
+ * Enforce the per-user send rate-limit.
+ * Throws AuthorizationError("passwordChangeOtpRateLimit") when throttled.
+ */
+export declare function enforcePasswordChangeOtpRateLimit(db: Db, uid: string): Promise<void>;

package/dist/features/auth/password-change-otp.js

@@ -0,0 +1,56 @@
+/**
+ * Password Change OTP.
+ *
+ * Root-caused 2026-08-20: POST /api/user/change-password validated the
+ * *shape* of `currentPassword` (Zod: non-empty, differs from newPassword)
+ * but the handler never read or verified it — `getAdminAuth().updateUser()`
+ * overwrote the password unconditionally for whatever `uid` the session
+ * cookie carried. The only real current-password check
+ * (`reauthenticateWithCredential` in the Firebase client SDK) happens in
+ * the browser and is trivially bypassed by calling the API directly with a
+ * stolen session cookie — a session hijack (XSS, log leak, etc.) was
+ * enough to take over the account's password with zero server-enforced
+ * identity check. This module gates the actual server-side write behind an
+ * email OTP, verified server-side, mirroring the Tier PP checkout-value-OTP
+ * pattern exactly (same crypto primitives, reused not duplicated) so a
+ * session-cookie thief also needs access to the account's inbox.
+ */
+import { AuthorizationError } from "../../errors";
+import { resolveDate } from "../../utils";
+import { USER_COLLECTION } from "./schemas";
+import { hashOtp, generateOtpCode, CHECKOUT_VALUE_OTP_EXPIRY_MS as PASSWORD_CHANGE_OTP_EXPIRY_MS, CHECKOUT_VALUE_OTP_EXPIRY_MINUTES as PASSWORD_CHANGE_OTP_EXPIRY_MINUTES, CHECKOUT_VALUE_OTP_COOLDOWN_MS as PASSWORD_CHANGE_OTP_COOLDOWN_MS, CHECKOUT_VALUE_OTP_MAX_ATTEMPTS as PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, CHECKOUT_VALUE_OTP_VERIFY_RATE_LIMIT as PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT, } from "./checkout-value-otp";
+export { hashOtp, generateOtpCode, PASSWORD_CHANGE_OTP_EXPIRY_MS, PASSWORD_CHANGE_OTP_EXPIRY_MINUTES, PASSWORD_CHANGE_OTP_COOLDOWN_MS, PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT, };
+/** Single-slot doc per user — a user can only be mid-password-change once. */
+export function passwordChangeOtpRef(db, uid) {
+    return db
+        .collection(USER_COLLECTION)
+        .doc(uid)
+        .collection("passwordChangeOtps")
+        .doc("current");
+}
+export function passwordChangeOtpRateLimitRef(db, uid) {
+    return db
+        .collection(USER_COLLECTION)
+        .doc(uid)
+        .collection("passwordChangeOtpRateLimit")
+        .doc("meta");
+}
+/**
+ * Enforce the per-user send rate-limit.
+ * Throws AuthorizationError("passwordChangeOtpRateLimit") when throttled.
+ */
+export async function enforcePasswordChangeOtpRateLimit(db, uid) {
+    const metaRef = passwordChangeOtpRateLimitRef(db, uid);
+    await db.runTransaction(async (tx) => {
+        const metaSnap = await tx.get(metaRef);
+        const meta = metaSnap.exists
+            ? metaSnap.data()
+            : null;
+        const lastSentMs = resolveDate(meta?.lastSentAt)?.getTime() ?? 0;
+        const elapsed = Date.now() - lastSentMs;
+        if (elapsed < PASSWORD_CHANGE_OTP_COOLDOWN_MS) {
+            throw new AuthorizationError("passwordChangeOtpRateLimit");
+        }
+        tx.set(metaRef, { lastSentAt: new Date() }, { merge: true });
+    });
+}

package/dist/features/categories/components/BrandDetailTabs.js

@@ -16,20 +16,6 @@ const TAB_TYPE_MAP = {
     bundles: { kind: "category", type: "bundle" },
 };
 export function BrandDetailTabs({ brandName, initialProductsData, initialBundles = [], counts, enabledListingTypes, enabledCategoryTypes, }) {
-    const visibleTabs = CATEGORY_PAGE_TABS.filter((t) => {
-        const mapping = TAB_TYPE_MAP[t.id];
-        if (!mapping)
-            return true;
-        if (mapping.kind === "listing" && enabledListingTypes) {
-            return enabledListingTypes.includes(mapping.type);
-        }
-        if (mapping.kind === "category" && enabledCategoryTypes) {
-            return enabledCategoryTypes.includes(mapping.type);
-        }
-        return true;
-    });
-    const firstTabId = (visibleTabs[0]?.id ?? "products");
-    const [activeTab, setActiveTab] = useState(firstTabId);
     const countFor = (id) => {
         switch (id) {
             case "products": return counts?.products;
@@ -40,5 +26,28 @@ export function BrandDetailTabs({ brandName, initialProductsData, initialBundles
             default: return undefined;
         }
     };
+    const visibleTabs = CATEGORY_PAGE_TABS.filter((t) => {
+        const mapping = TAB_TYPE_MAP[t.id];
+        // This view only has content renderers for the 5 tab ids in
+        // TAB_TYPE_MAP (products/auctions/pre-orders/prize-draws/bundles) — any
+        // other CATEGORY_PAGE_TABS id (stores, classifieds, etc.) has no case in
+        // the render switch below and would show a blank tab, so exclude those
+        // here rather than rely on downstream JSX to silently render nothing.
+        if (!mapping)
+            return false;
+        if (mapping.kind === "listing" && enabledListingTypes) {
+            if (!enabledListingTypes.includes(mapping.type))
+                return false;
+        }
+        if (mapping.kind === "category" && enabledCategoryTypes) {
+            if (!enabledCategoryTypes.includes(mapping.type))
+                return false;
+        }
+        // Hide a tab only when its count is known and explicitly zero.
+        const count = countFor(t.id);
+        return count === undefined || count > 0;
+    });
+    const firstTabId = (visibleTabs[0]?.id ?? "products");
+    const [activeTab, setActiveTab] = useState(firstTabId);
     return (_jsxs(_Fragment, { children: [_jsx(Tabs, { value: activeTab, onChange: (v) => setActiveTab(v), className: "mb-6", children: _jsx(TabsList, { children: visibleTabs.map((t) => (_jsx(TabsTrigger, { value: t.id, badge: countFor(t.id), children: t.label }, t.id))) }) }), activeTab === "products" && (_jsx(CategoryProductsListing, { categorySlug: "", brandName: brandName, initialData: initialProductsData })), activeTab === "auctions" && (_jsx(AuctionsIndexListing, { brandName: brandName })), activeTab === "pre-orders" && (_jsx(PreOrdersIndexListing, { brandName: brandName })), activeTab === "prize-draws" && (_jsx(PrizeDrawsIndexListing, { brandName: brandName })), activeTab === "bundles" && (_jsx(CategoryBundlesListing, { initialBundles: initialBundles, brandName: brandName }))] }));
 }

package/dist/features/categories/components/CategoryDetailTabs.js

@@ -19,22 +19,6 @@ const TAB_TYPE_MAP = {
     stores: { kind: "entity", type: "stores" },
 };
 export function CategoryDetailTabs({ categorySlug, categoryId, initialProductsData, initialBundles = [], initialStores = [], counts, enabledListingTypes, enabledCategoryTypes, }) {
-    const visibleTabs = CATEGORY_PAGE_TABS.filter((t) => {
-        const mapping = TAB_TYPE_MAP[t.id];
-        if (!mapping)
-            return true;
-        if (mapping.kind === "listing" && enabledListingTypes) {
-            return enabledListingTypes.includes(mapping.type);
-        }
-        if (mapping.kind === "category" && enabledCategoryTypes) {
-            return enabledCategoryTypes.includes(mapping.type);
-        }
-        if (mapping.kind === "entity")
-            return true;
-        return true;
-    });
-    const firstTabId = (visibleTabs[0]?.id ?? "products");
-    const [activeTab, setActiveTab] = useState(firstTabId);
     const countFor = (id) => {
         switch (id) {
             case "products": return counts?.products;
@@ -46,5 +30,26 @@ export function CategoryDetailTabs({ categorySlug, categoryId, initialProductsDa
             default: return undefined;
         }
     };
+    const visibleTabs = CATEGORY_PAGE_TABS.filter((t) => {
+        const mapping = TAB_TYPE_MAP[t.id];
+        if (mapping) {
+            if (mapping.kind === "listing" && enabledListingTypes) {
+                if (!enabledListingTypes.includes(mapping.type))
+                    return false;
+            }
+            if (mapping.kind === "category" && enabledCategoryTypes) {
+                if (!enabledCategoryTypes.includes(mapping.type))
+                    return false;
+            }
+        }
+        // Hide a tab only when its count is known and explicitly zero — a tab
+        // whose count was never fetched (undefined) stays visible so we don't
+        // silently hide a listing type this page hasn't wired count-tracking
+        // for yet.
+        const count = countFor(t.id);
+        return count === undefined || count > 0;
+    });
+    const firstTabId = (visibleTabs[0]?.id ?? "products");
+    const [activeTab, setActiveTab] = useState(firstTabId);
     return (_jsxs(_Fragment, { children: [_jsx(Tabs, { value: activeTab, onChange: (v) => setActiveTab(v), className: "mb-6", children: _jsx(TabsList, { children: visibleTabs.map((t) => (_jsx(TabsTrigger, { value: t.id, badge: countFor(t.id), children: t.label }, t.id))) }) }), activeTab === "products" && (_jsx(CategoryProductsListing, { categorySlug: categorySlug, categoryId: categoryId, initialData: initialProductsData })), activeTab === "auctions" && (_jsx(AuctionsIndexListing, { categorySlug: categorySlug })), activeTab === "pre-orders" && (_jsx(PreOrdersIndexListing, { categorySlug: categorySlug })), activeTab === "prize-draws" && (_jsx(PrizeDrawsIndexListing, { categorySlug: categorySlug })), activeTab === "bundles" && (_jsx(CategoryBundlesListing, { initialBundles: initialBundles })), activeTab === "stores" && (_jsx(CategoryStoresListing, { stores: initialStores }))] }));
 }

package/dist/features/stores/components/StoreDetailLayoutView.js

@@ -111,14 +111,24 @@ export async function StoreDetailLayoutView({ storeSlug, activeTab, children, sc
         live: "live",
     };
     const visibleStoreTabs = STORE_PAGE_TABS.filter((tab) => {
-        if (tab.id === "bundles")
-            return isCategoryTypeEnabled("bundle", settings);
+        if (tab.id === "bundles") {
+            if (!isCategoryTypeEnabled("bundle", settings))
+                return false;
+            return listingCounts[tab.id] > 0;
+        }
         // Combined tab — visible if either underlying listing type is enabled.
         if (tab.id === "art") {
-            return isListingTypeEnabled("art", settings) || isListingTypeEnabled("stickers", settings);
+            if (!(isListingTypeEnabled("art", settings) || isListingTypeEnabled("stickers", settings)))
+                return false;
+            return listingCounts[tab.id] > 0;
         }
         const lt = TAB_LISTING_TYPE[tab.id];
-        return lt ? isListingTypeEnabled(lt, settings) : true;
+        if (lt && !isListingTypeEnabled(lt, settings))
+            return false;
+        // A store with zero items of a given listing type shouldn't offer a tab
+        // that leads to an empty page — matches the "hide empty tab" rule below
+        // for coupons/reviews.
+        return listingCounts[tab.id] > 0;
     });
     const dropdownTabs = visibleStoreTabs.map((tab) => ({
         value: tab.id,
@@ -126,8 +136,12 @@ export async function StoreDetailLayoutView({ storeSlug, activeTab, children, sc
         href: STORE_LISTING_HREF[tab.id](storeSlug),
     }));
     const tabs = [
-        { value: "coupons", label: tabLabel("Coupons", couponsCount), href: String(ROUTES.PUBLIC.STORE_COUPONS(storeSlug)) },
-        { value: "reviews", label: tabLabel("Reviews", reviewsCount), href: String(ROUTES.PUBLIC.STORE_REVIEWS(storeSlug)) },
+        ...(couponsCount > 0
+            ? [{ value: "coupons", label: tabLabel("Coupons", couponsCount), href: String(ROUTES.PUBLIC.STORE_COUPONS(storeSlug)) }]
+            : []),
+        ...(reviewsCount > 0
+            ? [{ value: "reviews", label: tabLabel("Reviews", reviewsCount), href: String(ROUTES.PUBLIC.STORE_REVIEWS(storeSlug)) }]
+            : []),
         { value: "about", label: "About", href: String(ROUTES.PUBLIC.STORE_ABOUT(storeSlug)) },
     ];
     return (_jsxs(Main, { children: [_jsx(StoreHeader, { store: store, trust: trust }), _jsxs(Container, { size: "xl", className: "mt-6", children: [_jsx(StoreNavTabs, { dropdownTabs: dropdownTabs, dropdownPlaceholder: "Browse listings", tabs: tabs, activeValue: activeTab }), _jsx(Section, { padding: "t-lg", children: children })] })] }));

package/dist/features/tester/seed-data/tester-checklist-seed-data.js

@@ -128,6 +128,38 @@ const rawTesterChecklistItems = [
                     description: "Verify against the seeded fixtures: \"Test Collectible — Sold Out\" (standard, hidden until \"Show sold\" is on), \"Test Auction — Already Won\" (hidden until \"Show ended\" is on), \"Test Prize Draw — Already Closed\" (hidden until \"Show closed\" is on). All three should be genuinely absent by default, not just from an unrelated broken query.",
                     href: "/products",
                 },
+                {
+                    key: "auctions-show-ended-off-shows-live",
+                    label: "With \"Show ended\" off (the default), the Auctions listing shows LIVE auctions — not empty, and not requiring the toggle to see anything",
+                    description: "Fixed 2026-08-20 — the bounded fetch behind the \"unsafe filter\" workaround used to be sorted by the same field the date filter was about to reject on (auctionEndDate ASC = oldest/most-ended first), so once a store accumulated enough already-ended auctions the entire batch could be all-ended and live ones never got fetched at all — you had to turn \"Show ended\" ON to see anything, including live auctions. Load /products?listingType=auction fresh with the toggle off and confirm live auctions appear without touching the toggle.",
+                    href: "/products",
+                },
+                {
+                    key: "auctions-show-ended-with-nondefault-sort",
+                    label: "Switching the Auctions sort to something other than \"Ending Soon\" (e.g. \"Highest Current Bid\") while \"Show ended\" stays off still shows live auctions, correctly sorted by the chosen field",
+                    description: "Same root cause as auctions-show-ended-off-shows-live, but for the case where the sort field doesn't match the date field being filtered on — a separate code path (in-memory re-sort after filtering) that needs its own check.",
+                    href: "/products",
+                },
+                {
+                    key: "sort-options-per-listing-type",
+                    label: "Every sort dropdown option (Price, Newest, Ending Soon, Highest/Lowest Bid, Most Bids, Delivery Date, etc.) actually reorders the results on Products, Auctions, and Pre-Orders listing pages",
+                    href: "/products",
+                },
+                {
+                    key: "filter-drawer-combines-correctly",
+                    label: "Applying multiple filters together (price range + brand + category + condition) narrows results correctly, and clearing filters restores the full list — on Products, Auctions, and Pre-Orders",
+                    href: "/products",
+                },
+                {
+                    key: "search-filter-sort-combo",
+                    label: "Typing a search query, then applying a filter, then changing sort — all three stay applied together and pagination reflects the combined result count (not just the last action applied)",
+                    href: "/products",
+                },
+                {
+                    key: "listing-toggles-persist-across-pagination",
+                    label: "Toggling \"Show sold\"/\"Show ended\"/\"Show closed\" and then navigating to page 2 keeps the toggle state — page 2 doesn't silently reset back to hiding those items",
+                    href: "/products",
+                },
             ],
         },
         {
@@ -728,6 +760,12 @@ const rawTesterChecklistItems = [
             cases: [
                 { key: "store-directory", label: "The store directory page loads correctly", href: "/stores" },
                 { key: "store-detail-tabs", label: "A store detail page's listing-type dropdown (Products/Auctions/Pre-Orders/Prize Draws/Bundles/Classifieds/Digital Codes/Live Items/Art & Stickers) switches correctly between listing types, and the separate Coupons/Reviews/About tabs next to it all load correctly", description: "The listing-type dropdown is always a dropdown (not just on narrow/mobile widths, unlike category/brand/product/event tabs) since a store can have up to 9 listing types — Coupons, Reviews, and About stay as standalone tabs beside it, never folded into the dropdown." },
+                {
+                    key: "empty-tabs-hidden",
+                    label: "A store/category/brand detail page never shows a tab for a listing type it has zero items of — e.g. a store with no products doesn't show a \"Products\" tab at all, not an empty products page",
+                    description: "Fixed 2026-08-20 — tab visibility now checks the already-fetched per-type count and omits the tab entirely when it's zero, instead of always rendering all tabs regardless of whether they'd show anything. \"About\" always stays visible on store pages (no item-count concept). Verify on a real store/category/brand that's genuinely missing at least one listing type.",
+                    href: "/stores",
+                },
                 { key: "sellers-directory", label: "The sellers directory page loads correctly", href: "/sellers" },
                 { key: "seller-detail-page", label: "An individual seller's public detail page loads correctly" },
                 { key: "scams-registry", label: "The scams registry page and an individual scam detail page load correctly", href: "/scams" },

package/dist/index.d.ts

@@ -1396,7 +1396,9 @@ export { placeBid, buyNowAuction } from "./features/auctions/server";
 export type { PlaceBidInput, BuyNowAuctionInput, BuyNowAuctionResult } from "./features/auctions/server";
 export type { PlaceBidResult } from "./features/auctions/server";
 export { CHECKOUT_VALUE_OTP_VERIFY_RATE_LIMIT } from "./features/auth/checkout-value-otp";
+export { PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT } from "./features/auth/password-change-otp";
 export { sendCheckoutValueOtp, verifyCheckoutValueOtp, } from "./features/checkout/server";
+export { sendPasswordChangeOtp, verifyPasswordChangeOtp, isPasswordChangeOtpVerified, consumePasswordChangeOtp, } from "./features/auth/server";
 export { authMeGET } from "./features/auth/server";
 export { createPasswordResetToken } from "./features/auth/server";
 export { createVerificationToken } from "./features/auth/server";

package/dist/index.js

@@ -2591,12 +2591,16 @@ export { placeBid, buyNowAuction } from "./features/auctions/server";
 // [SERVER-ONLY]-Server-only â€" uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // CHECKOUT_VALUE_OTP_VERIFY_RATE_LIMIT - Constant used across modules.
 export { CHECKOUT_VALUE_OTP_VERIFY_RATE_LIMIT } from "./features/auth/checkout-value-otp";
+// PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT - Constant used across modules.
+export { PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT } from "./features/auth/password-change-otp";
 // [SERVER-ONLY] Tier PP — high-value checkout OTP gate. "use server" actions
 // belong in both index.ts and server.ts per the appkit Export Rules table;
 // these were only in server.ts, leaving src/actions/checkout.actions.ts's
 // `import { sendCheckoutValueOtp, verifyCheckoutValueOtp } from "@mohasinac/appkit"`
 // unresolved.
 export { sendCheckoutValueOtp, verifyCheckoutValueOtp, } from "./features/checkout/server";
+// [SERVER-ONLY] Password-change OTP gate — see features/auth/password-change-otp.ts.
+export { sendPasswordChangeOtp, verifyPasswordChangeOtp, isPasswordChangeOtpVerified, consumePasswordChangeOtp, } from "./features/auth/server";
 // [SERVER-ONLY]-Server-only â€" uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // authMeGET - Shared export for auth me get.
 export { authMeGET } from "./features/auth/server";

package/dist/providers/firebase-client/auth.d.ts

@@ -15,6 +15,7 @@ export declare class FirebaseClientAuthProvider implements IClientAuthProvider {
     sendPasswordResetEmail(email: string): Promise<void>;
     confirmPasswordReset(code: string, newPassword: string): Promise<void>;
     reauthenticateAndChangePassword(currentPassword: string, newPassword: string): Promise<void>;
+    reauthenticateOnly(currentPassword: string): Promise<void>;
     reauthenticateAndSendEmailUpdateVerification(currentPassword: string, newEmail: string): Promise<void>;
     reloadCurrentUser(): Promise<void>;
 }

package/dist/providers/firebase-client/auth.js

@@ -30,6 +30,13 @@ export class FirebaseClientAuthProvider {
         await reauthenticateWithCredential(user, credential);
         await updatePassword(user, newPassword);
     }
+    async reauthenticateOnly(currentPassword) {
+        const user = this._auth.currentUser;
+        if (!user?.email)
+            throw new Error("No authenticated user.");
+        const credential = EmailAuthProvider.credential(user.email, currentPassword);
+        await reauthenticateWithCredential(user, credential);
+    }
     async reauthenticateAndSendEmailUpdateVerification(currentPassword, newEmail) {
         const user = this._auth.currentUser;
         if (!user?.email)

package/dist/server.d.ts

@@ -248,6 +248,7 @@ export { listTopLevelCategories } from "./features/categories/server";
 export { updateCategory } from "./features/categories/server";
 export { sendCheckoutValueOtp, verifyCheckoutValueOtp, isCheckoutValueOtpVerified, } from "./features/checkout/server";
 export { FailedCheckoutRepository, failedCheckoutRepository } from "./features/checkout/server";
+export { sendPasswordChangeOtp, verifyPasswordChangeOtp, isPasswordChangeOtpVerified, consumePasswordChangeOtp, } from "./features/auth/server";
 export type { FailedCheckoutMeta, FailedPaymentMeta } from "./features/checkout/server";
 export { EmailButton, EmailColumn, EmailContainer, EmailDivider, EmailDoc, EmailFooter, EmailHeader, EmailImage, EmailLink, EmailRow, } from "./features/email";
 export type { EmailButtonProps, EmailColumnProps, EmailContainerProps, EmailDividerProps, EmailDocProps, EmailFooterProps, EmailHeaderProps, EmailImageProps, EmailLinkProps, EmailRowProps, EmailTone, } from "./features/email";

package/dist/server.js

@@ -715,6 +715,8 @@ export { updateCategory } from "./features/categories/server";
 // [SERVER-ONLY] Tier PP — high-value checkout OTP gate.
 export { sendCheckoutValueOtp, verifyCheckoutValueOtp, isCheckoutValueOtpVerified, } from "./features/checkout/server";
 export { FailedCheckoutRepository, failedCheckoutRepository } from "./features/checkout/server";
+// [SERVER-ONLY] Password-change OTP gate — see features/auth/password-change-otp.ts.
+export { sendPasswordChangeOtp, verifyPasswordChangeOtp, isPasswordChangeOtpVerified, consumePasswordChangeOtp, } from "./features/auth/server";
 // [SERVER-ONLY] Email primitives — table-based, inline-styled components
 // that render email-client-compatible HTML via renderToStaticMarkup. Use
 // these instead of authoring raw <table>/<tr>/<td> in email templates.

package/dist/validation/schemas.d.ts

@@ -114,17 +114,17 @@ export declare const changePasswordSchema: z.ZodEffects<z.ZodObject<{
     currentPassword: z.ZodString;
     newPassword: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
 }, "strip", z.ZodTypeAny, {
-    newPassword: string;
     currentPassword: string;
-}, {
     newPassword: string;
+}, {
     currentPassword: string;
-}>, {
     newPassword: string;
+}>, {
     currentPassword: string;
-}, {
     newPassword: string;
+}, {
     currentPassword: string;
+    newPassword: string;
 }>;
 export declare const cropDataSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
     sourceUrl: z.ZodEffects<z.ZodString, string, string>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.5.2",
+  "version": "4.6.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public"