@wix/himalaya-cli 0.1033.0 → 0.1035.0

package/templates/podcast-creator/tier5-src/wix-spaces-my-subscriptions/index.ts

@@ -1,5 +1,6 @@
 // Tier-5 bundle: Wix Spaces clone — My Subscriptions / plan orders (site-scoped).
 import { defineService } from "@himalaya/state";
+import { withEmptyFlags } from "../_shared/empty-flags.js";
 import { dispatch } from "@himalaya/dispatch";
 import { listPlanOrders, type WixPlanOrder } from "@himalaya/wix-pricing-plans";
 
@@ -21,6 +22,10 @@ const EMPTY_MEMBER = "No subscriptions yet";
 const EMPTY_GUEST = "Sign in from Account to see subscriptions you’ve joined — we don’t invent sample memberships.";
 const EMPTY_FORBIDDEN = "No subscriptions for this member yet.";
 
+/** The signed-in member's email, or "" for anyone else. A visitor's identity is
+ *  `{ email: "" }` and a failed lookup proves nothing, so both read as "no member": the
+ *  plan-orders endpoint is not member-filtered, and calling it for a visitor would list
+ *  orders that are not theirs. Fail closed. */
 async function sessionEmail(): Promise<string> {
   try {
     const identity = await dispatch("himi.wix.memberIdentity") as unknown;
@@ -38,12 +43,16 @@ function looksForbidden(err: unknown): boolean {
   return /403|FORBIDDEN|permission|denied|UNAUTHORIZED|401/i.test(msg);
 }
 
-const svc = defineService<S, { load: (s: S) => Promise<S> }>("spacesMySubscriptions", {
+const svc = defineService<S, { load: (s: S) => Promise<S> }>("spacesMySubscriptions", withEmptyFlags({
   state: { status: "loading", orders: [], emptyText: "", hideAccountCta: false },
   actions: {
     load: async () => {
       const email = await sessionEmail();
       const hideAccountCta = Boolean(email);
+      // plan orders are a MEMBER's own. With no signed-in member there is no
+      // "my" to list, whatever the endpoint answers (a dev mock or a cached session can
+      // answer it): a visitor must never see a subscription as theirs.
+      if (!email) return { status: "ready", orders: [], emptyText: EMPTY_GUEST, hideAccountCta: false };
       try {
         const r = await listPlanOrders();
         const orders = (((r as unknown as { orders?: WixPlanOrder[] }).orders) ?? []).map(norm);
@@ -68,6 +77,6 @@ const svc = defineService<S, { load: (s: S) => Promise<S> }>("spacesMySubscripti
       }
     },
   },
-});
+}, { orders: "noOrders" }));
 svc.load();
 export { svc };

package/templates/podcast-creator/tier5-src/wix-spaces-whats-new/index.ts

@@ -1,5 +1,6 @@
 // Tier-5 bundle: Wix Spaces clone — What's New (ON-DEVICE, account-level).
 import { defineService } from "@himalaya/state";
+import { withEmptyFlags } from "../_shared/empty-flags.js";
 import { listAnnouncements, type WixAnnouncement } from "@himalaya/wix-new-releases";
 
 interface Row { id: string; name: string; subtitle: string }
@@ -10,7 +11,7 @@ function norm(a: WixAnnouncement, i: number): Row {
   return { id: aa.id || `a${i}`, name: aa.title || "Announcement", subtitle: aa.description || aa.bodyText || "" };
 }
 
-const svc = defineService<S, { load: (s: S) => Promise<S> }>("spacesWhatsNew", {
+const svc = defineService<S, { load: (s: S) => Promise<S> }>("spacesWhatsNew", withEmptyFlags({
   state: { status: "loading", items: [], emptyText: "" },
   actions: {
     load: async (s) => {
@@ -21,6 +22,6 @@ const svc = defineService<S, { load: (s: S) => Promise<S> }>("spacesWhatsNew", {
       } catch { return { ...s, status: "ready", items: [], emptyText: "Nothing new right now" }; }
     },
   },
-});
+}, { items: "noItems" }));
 svc.load();
 export { svc };