@mohasinac/appkit 4.53.1 → 4.54.0

package/dist/features/reviews/api/[id]/route.js

@@ -11,8 +11,21 @@
 import { NextResponse } from "next/server.js";
 import { z } from "zod";
 import { mediaUrlSchema } from "../../../../validation/schemas.js";
-import { getProviders } from "../../../../contracts/index.js";
 import { createRouteHandler } from "../../../../next/api/routeHandler.js";
+/*
+ * 🛑 The real repository, not `db.getRepository<Review>("reviews")`.
+ *
+ * The generic FirebaseRepository knows nothing about this collection, so every
+ * read and write through it skipped ReviewRepository's overrides:
+ *
+ *   - `update` encrypts `userName` (PII) and rebuilds `searchTxt`. Writing
+ *     through the generic repo left the tokens describing the OLD text, so an
+ *     edited review was findable only by what it used to say.
+ *   - `mapDoc` decrypts `userName` and strips `helpfulVoterIds`. Reading
+ *     through the generic repo returned the name as raw `enc:v1:…` ciphertext
+ *     and published the voter list.
+ */
+import { reviewRepository } from "../../repository/reviews.repository.js";
 import { normalizeError } from "../../../../errors/normalize.js";
 import { isAdminUser, isModeratorUser } from "../../../auth/role-predicates.js";
 const ERR_REVIEW_NOT_FOUND = "Review not found";
@@ -20,12 +33,14 @@ const ERR_REVIEW_NOT_FOUND = "Review not found";
 export async function GET(_request, context) {
     try {
         const { id } = await context.params;
-        const { db } = getProviders();
-        if (!db) {
-            return NextResponse.json({ success: false, error: "Database provider not registered" }, { status: 503 });
-        }
-        const repo = db.getRepository("reviews");
-        const review = await repo.findById(id);
+        /*
+         * Through `reviewRepository`, so `mapDoc` runs: `userName` is decrypted
+         * and `helpfulVoterIds` is stripped. The generic repo did neither, so this
+         * public endpoint returned the reviewer's name as raw `enc:v1:…`
+         * ciphertext and published the list of everyone who had voted the review
+         * helpful.
+         */
+        const review = await reviewRepository.findById(id);
         if (!review) {
             return NextResponse.json({ success: false, error: ERR_REVIEW_NOT_FOUND }, { status: 404 });
         }
@@ -39,6 +54,19 @@ export async function GET(_request, context) {
 }
 export { GET as reviewItemGET };
 // ---- PATCH /api/reviews/[id] -------------------------------------------------
+/*
+ * 🛑 `.strict()`, not `.passthrough()`.
+ *
+ * It was passthrough, so any unlisted key reached the write — including
+ * `userId`, `verified`, `helpfulCount` and `featured`. A reviewer could have
+ * marked their own review a verified purchase, or featured it on the homepage,
+ * by adding one field to the request body. Nothing in the handler below looked
+ * at the extra keys; they went straight into Firestore.
+ *
+ * `.strict()` rejects them with a 400 naming the field rather than silently
+ * dropping them, which is the honest answer to a caller sending something this
+ * endpoint does not own.
+ */
 const reviewUpdateSchema = z
     .object({
     rating: z
@@ -53,10 +81,28 @@ const reviewUpdateSchema = z
     title: z.string().min(1).max(100).optional(),
     comment: z.string().min(1).max(2000).optional(),
     images: z.array(mediaUrlSchema).max(10).optional(),
-    video: mediaUrlSchema.optional(),
     status: z.enum(["pending", "approved", "rejected"]).optional(),
 })
-    .passthrough();
+    .strict();
+/*
+ * 🛑 `video` is deliberately NOT accepted here, and that is a fix rather than
+ * an omission.
+ *
+ * It used to be declared as a bare `mediaUrlSchema` — a URL string — while
+ * `ReviewDocument.video` is a `ReviewVideoField` object. So a caller sending
+ * the real shape failed validation, and a caller sending a string wrote a
+ * string into a field every renderer reads as an object, leaving `video.url`
+ * undefined and the player with nothing.
+ *
+ * Accepting the object instead would still be wrong on this route: the URL
+ * would arrive as an unfinalised `tmp/` reference, because nothing here calls
+ * `finalizeStagedMediaUrl`. `updateReview` (features/reviews/actions) is the
+ * path that owns review media — it finalises the upload and builds the full
+ * field — and `REVIEW_UPDATABLE_FIELDS` already documents the updatable set as
+ * rating / title / comment / images, with no video in it.
+ *
+ * One owner for media writes, and this is not it.
+ */
 export const reviewItemPATCH = createRouteHandler({
     auth: true,
     schema: reviewUpdateSchema,
@@ -64,11 +110,7 @@ export const reviewItemPATCH = createRouteHandler({
         const url = new URL(request.url);
         const segments = url.pathname.split("/");
         const id = segments[segments.length - 1];
-        const { db } = getProviders();
-        if (!db)
-            return NextResponse.json({ success: false, error: "DB not configured" }, { status: 503 });
-        const repo = db.getRepository("reviews");
-        const review = await repo.findById(id);
+        const review = await reviewRepository.findById(id);
         if (!review)
             return NextResponse.json({ success: false, error: ERR_REVIEW_NOT_FOUND }, { status: 404 });
         const isOwner = review.userId === user.uid;
@@ -77,13 +119,34 @@ export const reviewItemPATCH = createRouteHandler({
         if (!isOwner && !isModerator && !isAdmin) {
             return NextResponse.json({ success: false, error: "Forbidden" }, { status: 403 });
         }
-        // Owners can only edit content fields, not status
+        /*
+         * Owners edit content, not moderation state. Pinning `status` rather than
+         * rejecting the field is deliberate and pre-existing: an approved review
+         * edited by its author stays approved and is NOT sent back for
+         * re-moderation.
+         */
         const patch = isOwner && !isModerator && !isAdmin
             ? { ...body, status: review.status }
             : body;
-        const updated = await repo.update(id, {
+        /*
+         * 🛑 `hasImages` is DERIVED and has to move with `images`, or the two
+         * disagree. It is a real queryable field (`hasImages` is `canFilter` in
+         * SIEVE_FIELDS and backs the "with photos" review filter), so a review
+         * whose last photo was removed stayed in that filter for ever, and one
+         * that gained its first was absent from it.
+         */
+        const nextImages = body?.images;
+        const derived = nextImages !== undefined ? { hasImages: nextImages.length > 0 } : {};
+        /*
+         * 🛑 A `Date`, not an ISO string. Everything else in this codebase writes
+         * `Date` to `updatedAt`, and `reviewRepository`'s own Sieve config marks it
+         * sortable — so a string here sorts lexicographically beside real
+         * timestamps and silently orders wrong.
+         */
+        const updated = await reviewRepository.update(id, {
             ...patch,
-            updatedAt: new Date().toISOString(),
+            ...derived,
+            updatedAt: new Date(),
         });
         return NextResponse.json({ success: true, data: updated });
     },
@@ -95,11 +158,8 @@ export const reviewItemDELETE = createRouteHandler({
         const url = new URL(request.url);
         const segments = url.pathname.split("/");
         const id = segments[segments.length - 1];
-        const { db } = getProviders();
-        if (!db)
-            return NextResponse.json({ success: false, error: "DB not configured" }, { status: 503 });
-        const repo = db.getRepository("reviews");
-        const review = await repo.findById(id);
+        // Same repository as GET and PATCH — one collection, one repository.
+        const review = await reviewRepository.findById(id);
         if (!review)
             return NextResponse.json({ success: false, error: ERR_REVIEW_NOT_FOUND }, { status: 404 });
         const isOwner = review.userId === user.uid;
@@ -108,7 +168,7 @@ export const reviewItemDELETE = createRouteHandler({
         if (!isOwner && !isModerator && !isAdmin) {
             return NextResponse.json({ success: false, error: "Forbidden" }, { status: 403 });
         }
-        await repo.delete(id);
+        await reviewRepository.delete(id);
         return NextResponse.json({ success: true });
     },
 });

package/dist/features/reviews/components/PurchaseReviewAffordance.d.ts

@@ -0,0 +1,6 @@
+export interface PurchaseReviewAffordanceProps {
+    productId: string;
+    storeId?: string;
+    className?: string;
+}
+export declare function PurchaseReviewAffordance({ productId, storeId, className, }: PurchaseReviewAffordanceProps): import("react").JSX.Element;

package/dist/features/reviews/components/PurchaseReviewAffordance.js

@@ -0,0 +1,42 @@
+"use client";
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * The strip and the review drawer, connected.
+ *
+ * Exists because the two halves need shared client state (which review is
+ * open) while the product detail page that mounts them is an async Server
+ * Component. One small client island is cheaper than making the detail view
+ * take two render-prop slots and thread state between them.
+ *
+ * @tag domain:reviews
+ * @tag layer:components
+ * @tag access:client
+ */
+import { useCallback, useState } from "react";
+import { useQueryClient } from "@tanstack/react-query";
+import { YourPurchaseStrip } from "../../orders/components/YourPurchaseStrip.js";
+import { ReviewFormDrawer } from "./ReviewFormDrawer.js";
+export function PurchaseReviewAffordance({ productId, storeId, className, }) {
+    const queryClient = useQueryClient();
+    const [open, setOpen] = useState(false);
+    const [editingId, setEditingId] = useState(undefined);
+    /*
+     * Invalidate the strip's own query, not just the reviews list. The strip is
+     * what shows "Your review: 4/5", so saving without invalidating it leaves
+     * the buyer looking at their old rating and reasonably concluding the edit
+     * did not take.
+     */
+    const handleSaved = useCallback(() => {
+        void queryClient.invalidateQueries({
+            queryKey: ["user", "purchases", productId],
+        });
+        void queryClient.invalidateQueries({ queryKey: ["reviews"] });
+    }, [queryClient, productId]);
+    return (_jsxs(_Fragment, { children: [_jsx(YourPurchaseStrip, { productId: productId, className: className, onEditReview: (reviewId) => {
+                    setEditingId(reviewId);
+                    setOpen(true);
+                }, onWriteReview: () => {
+                    setEditingId(undefined);
+                    setOpen(true);
+                } }), _jsx(ReviewFormDrawer, { isOpen: open, onClose: () => setOpen(false), reviewId: editingId, productId: productId, storeId: storeId, onSaved: handleSaved })] }));
+}

package/dist/features/reviews/components/ReviewFormDrawer.d.ts

@@ -0,0 +1,34 @@
+import { z } from "zod";
+/**
+ * Mirrors the PATCH route's schema, which is `.strict()`. A field this form can
+ * send that the route does not accept is a 400 naming it — which is the point:
+ * the two were allowed to disagree before, and the route silently accepted
+ * anything.
+ */
+export declare const reviewFormSchema: z.ZodObject<{
+    rating: z.ZodNumber;
+    title: z.ZodString;
+    comment: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    title: string;
+    rating: number;
+    comment: string;
+}, {
+    title: string;
+    rating: number;
+    comment: string;
+}>;
+export type ReviewFormValues = z.infer<typeof reviewFormSchema>;
+export interface ReviewFormDrawerProps {
+    isOpen: boolean;
+    onClose: () => void;
+    /** Present = editing that review. Absent = writing a new one. */
+    reviewId?: string;
+    /** Required when writing; the review is filed against this product. */
+    productId?: string;
+    storeId?: string;
+    initialValues?: Partial<ReviewFormValues>;
+    /** Called after a successful save, so the caller can refetch. */
+    onSaved?: () => void;
+}
+export declare function ReviewFormDrawer({ isOpen, onClose, reviewId, productId, storeId, initialValues, onSaved, }: ReviewFormDrawerProps): import("react").JSX.Element;

package/dist/features/reviews/components/ReviewFormDrawer.js

@@ -0,0 +1,127 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * Write or edit a review.
+ *
+ * ── This is the first review form the application has ever had ────────────
+ *
+ * 🛑 Measured before building: `useCreateReview` had ZERO component consumers,
+ * `ReviewForm` did not exist, `ViewReviewModal` is read-only, `/user/reviews`
+ * was index-only with no detail or edit route, and the ACTIONS registry had no
+ * REVIEW bucket. The repo already knew — a tester case records
+ * "createReviewAction, useCreateReview and the UI_TEXT.WRITE_REVIEW string all
+ * exist, but no .tsx consumes any of them". So there was a complete write path
+ * with nothing able to reach it.
+ *
+ * ── Field names, because the obvious guesses are all wrong ────────────────
+ *
+ *   body      → `comment`   (NOT `body`)
+ *   owner     → `userId`    (NOT `buyerId`)
+ *   verified  → `verified`  (there is no `isVerifiedPurchase`)
+ *   reply     → `sellerReply`
+ *
+ * `REVIEW_UPDATABLE_FIELDS` is already `["rating","title","comment","images"]`,
+ * so that is exactly what this form owns — and exactly what the PATCH route
+ * accepts now that it is `.strict()`.
+ *
+ * 🛑 Images are deliberately NOT edited here. The PATCH route does not finalise
+ * staged media, so a URL submitted through it would persist as a `tmp/`
+ * reference; `updateReview` owns review media. Rather than ship a picker whose
+ * uploads silently rot, this form edits the text and the rating.
+ *
+ * @tag domain:reviews
+ * @tag layer:components
+ * @tag access:client
+ */
+import { useEffect, useState } from "react";
+import { z } from "zod";
+import { apiClient } from "../../../http/index.js";
+import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
+import { REVIEW_ENDPOINTS } from "../../../constants/api-endpoints.js";
+import { Button, FieldInput, FieldTextarea, Form, Row, SideDrawer, Stack, Text, } from "../../../ui/index.js";
+import { FormErrorSummary } from "../../../ui/forms/FormErrorSummary.js";
+// Keys errors by the FULL dotted path, so a nested issue cannot collapse onto
+// one map entry and lose all but the last.
+import { applyZodIssues } from "../../../ui/forms/apply-zod-issues.js";
+import { Icon } from "../../../ui/components/Icon.js";
+import { IconButton } from "../../../ui/components/IconButton.js";
+import { normalizeError } from "../../../errors/normalize.js";
+import { toUserMessage } from "../../../errors/error-display-map.js";
+/**
+ * Mirrors the PATCH route's schema, which is `.strict()`. A field this form can
+ * send that the route does not accept is a 400 naming it — which is the point:
+ * the two were allowed to disagree before, and the route silently accepted
+ * anything.
+ */
+export const reviewFormSchema = z.object({
+    rating: z
+        .number()
+        .int()
+        .min(1, "Pick a rating from 1 to 5")
+        .max(5, "Pick a rating from 1 to 5"),
+    title: z.string().trim().min(1, "Give your review a title").max(100),
+    comment: z
+        .string()
+        .trim()
+        .min(1, "Say something about the item")
+        .max(2000, "Keep it under 2000 characters"),
+});
+const EMPTY = { rating: 0, title: "", comment: "" };
+export function ReviewFormDrawer({ isOpen, onClose, reviewId, productId, storeId, initialValues, onSaved, }) {
+    const editing = Boolean(reviewId);
+    const [values, setValues] = useState({
+        ...EMPTY,
+        ...initialValues,
+    });
+    const [busy, setBusy] = useState(false);
+    const [formError, setFormError] = useState(null);
+    /*
+     * Re-seed when the drawer is reopened for a DIFFERENT review. Without this
+     * the second review a buyer edits in one session shows the first one's text
+     * — the component stays mounted, so initial state alone is not enough.
+     */
+    useEffect(() => {
+        if (isOpen)
+            setValues({ ...EMPTY, ...initialValues });
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [isOpen, reviewId]);
+    async function submit({ setFieldError, clearErrors, markSubmitAttempted, }) {
+        clearErrors();
+        setFormError(null);
+        markSubmitAttempted?.();
+        const parsed = reviewFormSchema.safeParse(values);
+        if (!parsed.success) {
+            applyZodIssues(parsed.error.issues, setFieldError);
+            return;
+        }
+        setBusy(true);
+        try {
+            if (reviewId) {
+                await apiClient.patch(REVIEW_ENDPOINTS.BY_ID(reviewId), parsed.data);
+            }
+            else {
+                await apiClient.post(REVIEW_ENDPOINTS.LIST, {
+                    ...parsed.data,
+                    productId,
+                    storeId,
+                });
+            }
+            onSaved?.();
+            onClose();
+        }
+        catch (err) {
+            const normalized = normalizeError(err);
+            /*
+             * 🛑 toUserMessage, never the server's own message. A raw `?? error`
+             * fallback is what rendered a Node MODULE_NOT_FOUND with a require
+             * stack inside a bid modal (Root Cause #86); this resolves through
+             * errors.codes.* and terminates at UNKNOWN.
+             */
+            setFormError(toUserMessage(normalized.code ?? "UNKNOWN"));
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    return (_jsx(SideDrawer, { isOpen: isOpen, onClose: onClose, title: editing ? "Edit your review" : "Write a review", children: _jsx(Form, { schema: reviewFormSchema, onSubmit: (e) => e.preventDefault(), className: "space-y-4", children: ({ setFieldError, clearErrors, markSubmitAttempted }) => (_jsxs(Stack, { gap: "md", children: [_jsx(FormErrorSummary, {}), _jsxs(Stack, { gap: "xs", children: [_jsx(Text, { size: "sm", weight: "medium", children: "Rating" }), _jsx(Row, { gap: "xs", align: "center", children: [1, 2, 3, 4, 5].map((n) => (_jsx(IconButton, { "aria-label": `${n} star${n === 1 ? "" : "s"}`, "aria-pressed": values.rating === n, size: "md", variant: "ghost", icon: _jsx(Icon, { name: "review", size: "lg", filled: n <= values.rating, tone: n <= values.rating ? "warning" : "faint" }), onClick: () => setValues((v) => ({ ...v, rating: n })) }, n))) })] }), _jsx(FieldInput, { name: "title", label: "Title", required: true, value: values.title, onChange: (title) => setValues((v) => ({ ...v, title })) }), _jsx(FieldTextarea, { name: "comment", label: "Your review", required: true, rows: 6, value: values.comment, onChange: (comment) => setValues((v) => ({ ...v, comment })) }), formError && (_jsx(Text, { size: "sm", color: "error", role: "alert", children: formError })), _jsx(Button, { type: "submit", isLoading: busy, action: editing ? ACTIONS.REVIEW.edit : ACTIONS.REVIEW.write, onClick: () => void submit({ setFieldError, clearErrors, markSubmitAttempted }) })] })) }) }));
+}

package/dist/features/reviews/components/index.d.ts

@@ -11,3 +11,7 @@ export type { ReviewsIndexListingProps } from "./ReviewsIndexListing";
 export { ReviewsListingPanel } from "./ReviewsListingPanel";
 export type { ReviewsListingPanelProps, ReviewsSource } from "./ReviewsListingPanel";
 export type { ReviewDetailPageViewProps } from "./ReviewDetailPageView";
+export { ReviewFormDrawer, reviewFormSchema } from "./ReviewFormDrawer";
+export type { ReviewFormDrawerProps, ReviewFormValues } from "./ReviewFormDrawer";
+export { PurchaseReviewAffordance } from "./PurchaseReviewAffordance";
+export type { PurchaseReviewAffordanceProps } from "./PurchaseReviewAffordance";

package/dist/features/reviews/components/index.js

@@ -4,3 +4,5 @@ export { ReviewSummary } from "./ReviewSummary.js";
 export { ViewReviewModal } from "./ReviewModal.js";
 export { ReviewsIndexListing } from "./ReviewsIndexListing.js";
 export { ReviewsListingPanel } from "./ReviewsListingPanel.js";
+export { ReviewFormDrawer, reviewFormSchema } from "./ReviewFormDrawer.js";
+export { PurchaseReviewAffordance } from "./PurchaseReviewAffordance.js";

package/dist/features/scams/schemas/index.d.ts

@@ -10,11 +10,11 @@ export declare const scammerSocialMediaSchema: z.ZodObject<{
     handle: z.ZodString;
     url: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    platform: "other" | "youtube" | "instagram" | "facebook" | "whatsapp" | "telegram" | "twitter" | "olx" | "linkedin";
+    platform: "other" | "youtube" | "whatsapp" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "linkedin";
     handle: string;
     url?: string | undefined;
 }, {
-    platform: "other" | "youtube" | "instagram" | "facebook" | "whatsapp" | "telegram" | "twitter" | "olx" | "linkedin";
+    platform: "other" | "youtube" | "whatsapp" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "linkedin";
     handle: string;
     url?: string | undefined;
 }>;
@@ -44,11 +44,11 @@ export declare const scammerFirestoreSchema: z.ZodObject<{
         handle: z.ZodString;
         url: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        platform: "other" | "youtube" | "instagram" | "facebook" | "whatsapp" | "telegram" | "twitter" | "olx" | "linkedin";
+        platform: "other" | "youtube" | "whatsapp" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "linkedin";
         handle: string;
         url?: string | undefined;
     }, {
-        platform: "other" | "youtube" | "instagram" | "facebook" | "whatsapp" | "telegram" | "twitter" | "olx" | "linkedin";
+        platform: "other" | "youtube" | "whatsapp" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "linkedin";
         handle: string;
         url?: string | undefined;
     }>, "many">;
@@ -93,7 +93,7 @@ export declare const scammerFirestoreSchema: z.ZodObject<{
     scamType: string;
     reportedBy: string;
     reportedByAnon: boolean;
-    scamPlatform: "other" | "letitrip" | "instagram" | "facebook" | "whatsapp" | "telegram" | "twitter" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
+    scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
     evidence: string[];
     phones: string[];
     upiIds: string[];
@@ -102,7 +102,7 @@ export declare const scammerFirestoreSchema: z.ZodObject<{
     incidentCount: number;
     seoSlug: string;
     socialMedia: {
-        platform: "other" | "youtube" | "instagram" | "facebook" | "whatsapp" | "telegram" | "twitter" | "olx" | "linkedin";
+        platform: "other" | "youtube" | "whatsapp" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "linkedin";
         handle: string;
         url?: string | undefined;
     }[];
@@ -133,7 +133,7 @@ export declare const scammerFirestoreSchema: z.ZodObject<{
     scamType: string;
     reportedBy: string;
     reportedByAnon: boolean;
-    scamPlatform: "other" | "letitrip" | "instagram" | "facebook" | "whatsapp" | "telegram" | "twitter" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
+    scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
     evidence: string[];
     phones: string[];
     upiIds: string[];
@@ -142,7 +142,7 @@ export declare const scammerFirestoreSchema: z.ZodObject<{
     incidentCount: number;
     seoSlug: string;
     socialMedia: {
-        platform: "other" | "youtube" | "instagram" | "facebook" | "whatsapp" | "telegram" | "twitter" | "olx" | "linkedin";
+        platform: "other" | "youtube" | "whatsapp" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "linkedin";
         handle: string;
         url?: string | undefined;
     }[];
@@ -201,7 +201,7 @@ export declare const scammerIncidentFirestoreSchema: z.ZodObject<{
     reportedBy: string;
     scammerId: string;
     reportedByAnon: boolean;
-    scamPlatform: "other" | "letitrip" | "instagram" | "facebook" | "whatsapp" | "telegram" | "twitter" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
+    scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
     evidence: string[];
     verifiedBy?: string | undefined;
     amountLost?: number | undefined;
@@ -224,7 +224,7 @@ export declare const scammerIncidentFirestoreSchema: z.ZodObject<{
     reportedBy: string;
     scammerId: string;
     reportedByAnon: boolean;
-    scamPlatform: "other" | "letitrip" | "instagram" | "facebook" | "whatsapp" | "telegram" | "twitter" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
+    scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
     evidence: string[];
     verifiedBy?: string | undefined;
     amountLost?: number | undefined;

package/dist/features/search/action-index/settings-entries.js

@@ -169,15 +169,6 @@ export const SITE_SETTINGS_ENTRIES = [
         tab: "notifications",
         kind: "toggle",
     },
-    {
-        slug: "whatsapp-notifications",
-        anchored: true,
-        label: "WhatsApp notifications",
-        description: "Send order updates over WhatsApp.",
-        keywords: ["whatsapp", "order updates", "meta"],
-        tab: "notifications",
-        kind: "toggle",
-    },
     {
         slug: "daily-digest",
         anchored: true,

package/dist/features/seller/actions/seller-actions.d.ts

@@ -130,7 +130,7 @@ export declare function bulkSellerOrder(userId: string, userRole: string, userDi
  * only safe shape — a caller-supplied `storeId` would let a seller file a
  * listing under someone else's store.
  */
-export declare function createSellerProduct(userId: string, userName: string, userEmail: string, input: Record<string, JsonValue>): Promise<void>;
+export declare function createSellerProduct(userId: string, userName: string, userEmail: string, input: Record<string, JsonValue>, userRole?: string): Promise<void>;
 export declare function getSellerStore(userId: string): Promise<StoreDocument | null>;
 export declare function getSellerShipping(userId: string): Promise<import("../../auth").SellerShippingConfig | null>;
 export declare function getSellerPayoutSettings(userId: string): Promise<SellerPayoutDetails | {

package/dist/features/seller/actions/seller-actions.js

@@ -13,6 +13,7 @@ import { normalizeError } from "../../../errors/normalize.js";
 import { enqueueJob } from "../../jobs/actions/enqueue-job.js";
 import { isAdminUser, isStrictSellerUser, isTesterUser } from "../../auth/role-predicates.js";
 import { ApiError, AuthorizationError, NotFoundError, ValidationError, } from "../../../errors/index.js";
+import { assertListingTypeAllowed } from "../../../_internal/shared/listing-types/tiers.js";
 import { userRepository } from "../../auth/repository/user.repository.js";
 import { storeRepository } from "../../stores/repository/store.repository.js";
 import { productRepository } from "../../products/repository/products.repository.js";
@@ -427,7 +428,13 @@ export async function bulkSellerOrder(userId, userRole, userDisplayName, userEma
  * only safe shape — a caller-supplied `storeId` would let a seller file a
  * listing under someone else's store.
  */
-export async function createSellerProduct(userId, userName, userEmail, input) {
+export async function createSellerProduct(userId, userName, userEmail, input, 
+/*
+ * 🛑 Defaults to `"seller"`, which FAILS CLOSED. A caller that forgets to
+ * pass a role gets the gate, not a bypass — the opposite default would make
+ * every un-updated call site an admin.
+ */
+userRole = "seller") {
     const store = await storeRepository.findByOwnerId(userId);
     // Refuse rather than write an orphan. A listing with no store is invisible on
     // its own storefront, forms no order group at checkout, and cannot be paid
@@ -436,6 +443,19 @@ export async function createSellerProduct(userId, userName, userEmail, input) {
     if (!store) {
         throw new NotFoundError("No store found for this account. Create your store first.");
     }
+    /*
+     * The advanced-listing-type gate, at the choke point every create funnels
+     * through.
+     *
+     * It lives HERE rather than only in the consumer action because this is the
+     * one place all creates meet, and because the store document is already in
+     * scope — so the check costs no extra Firestore read (Rule #6). The caller's
+     * own gate is a nicety; this one is the guarantee.
+     */
+    assertListingTypeAllowed(input.listingType, {
+        isPrivileged: userRole === "admin",
+        capabilities: store.capabilities,
+    });
     const finalizedData = await finalizeProductMediaReferences(input);
     await productRepository.create({
         ...finalizedData,
@@ -592,11 +612,37 @@ export async function sellerUpdateProduct(userId, userRole, productId, input) {
     if (!existing)
         throw new NotFoundError("Product not found");
     // existing.storeId is the store slug, not the seller's Firebase UID.
-    if (userRole !== "admin") {
-        const store = await storeRepository.findByOwnerId(userId);
+    const isPrivileged = userRole === "admin";
+    let store = null;
+    if (!isPrivileged) {
+        store = await storeRepository.findByOwnerId(userId);
         if (!store || existing.storeId !== store.id)
             throw new AuthorizationError("You do not own this product");
     }
+    /*
+     * 🛑 The UPDATE path had no listing-type gate at all, which made the
+     * create-time one bypassable in a single request: create a `standard`
+     * listing, then PATCH `listingType: "auction"` onto it and the type stuck.
+     * Gating only creates is gating nothing.
+     *
+     * 🛑 But it fires only on a CHANGE of type, and that is load-bearing. Every
+     * per-type edit page spreads its own literal into the payload
+     * (`store/art/[id]/edit` sends `listingType: "art"`), so gating on the
+     * submitted value alone would lock a seller out of editing listings they
+     * already own the moment the capability was turned off — or an admin revoked
+     * it. The rule is "you may not create or convert INTO an advanced type",
+     * never "you may not touch one".
+     *
+     * Reuses the store already loaded for the ownership check above, so a
+     * non-admin update pays no extra read. An admin skips both.
+     */
+    if (typeof input.listingType === "string" &&
+        input.listingType !== existing.listingType) {
+        assertListingTypeAllowed(input.listingType, {
+            isPrivileged,
+            capabilities: store?.capabilities,
+        });
+    }
     if (typeof input.status === "string" &&
         input.status !== "published" &&
         existing.status === "published") {