Evergreen farms (pos)

Private

Tracker *Bug Feature Support Testing

Subject *

Description Edit 1.Critical Runtime Bug: ReferenceError: pid is not defined Location: evergreen_pos_be/src/services/nursery/cart.service.js:L369 Issue: Inside getCartByIdEcom, rule.targetProductIds.includes(pid) was executed before pid was declared, crashing cart retrieval when items with weather promotions were in the cart. Fix: Declared const pid = String(baseProductDoc?._id || baseId || '').toLowerCase().trim(); before evaluating applicableRules. 2.Security & Multi-Tenant Isolation Leak in Controller Location: evergreen_pos_be/src/controllers/nursery/weatherProduct.controller.js Issue: Handlers (listWeatherPromos, createWeatherPromo, updateWeatherPromo, deleteWeatherPromo, getWeatherSettings, updateWeatherSettings) executed Company.findOneAndUpdate(dbName ? { dbName } : {}, ...). When dbName was omitted from headers, {} matched and updated the first company document in the MongoDB collection across tenants. Fix: Added resolveCompanyAndDbName(req) helper to safely resolve the tenant from req.dbName, headers (x-dbname, x-tenant-slug, slug), req.user, or query params, and restricted all MongoDB mutations to { _id: company._id }. 3.Multi-Tenant Query Collision in Weather Alert Subscriptions Location: evergreen_pos_be/src/services/weather/weatherNotification.service.js Issue: In subscribe, unsubscribe, and getStatus, duplicate $or object keys ({ $or: [{ dbName }], $or: orConditions }) resulted in JavaScript object key collision, silently overwriting tenant isolation and querying all subscribers across the database. Fix: Wrapped the tenant filter and user match conditions into an explicit $and: [...] array. 4.Duplicate Mongoose Schema Fields Location: evergreen_pos_be/src/models/nursery/nursery.product.js Issue: weatherTags and daypartTags were declared twice within the same schema definition. Fix: Removed the duplicate declarations. 5.Checkout Telemetry & Attribution Gap Location: evergreenpos_E-commerce_new/src/features/checkout/pages/Checkout.tsx Issue: handlePlaceOrder mapped items to { productId, quantity, price, fulfillmentType }, discarding hasWeatherPromo, promoBadgeText, and appliedWeatherPromo. As a result, order.service.js never detected weather promotions in the order, and weather_picks_order conversion telemetry was never recorded. Fix: Forwarded hasWeatherPromo, promoBadgeText, appliedWeatherPromo, and finalPrice in order line items.