(SP: 3) [SHOP] Launch readiness hardening after repeat audit (#442)

Author: liudmylasovetovs

frontend/.env.example

@@ -162,6 +162,10 @@ GMAIL_USER=
 # Set explicitly in production to avoid incorrect absolute URLs.
 SHOP_BASE_URL=
 
+# Optional public seller address used by the Shop seller-information legal page.
+# Leave empty to keep the current placeholder-based public rendering until launch data is finalized.
+SHOP_SELLER_ADDRESS=
+
 # Policy/consent version labels used by Shop flows.
 SHOP_PRIVACY_VERSION=privacy-v1
 SHOP_TERMS_VERSION=terms-v1

frontend/app/[locale]/shop/products/[slug]/page.tsx

@@ -5,6 +5,7 @@ import { getMessages, getTranslations } from 'next-intl/server';
 
 import { AddToCartButton } from '@/components/shop/AddToCartButton';
 import { ProductGallery } from '@/components/shop/ProductGallery';
+import { SizeGuideAccordion } from '@/components/shop/SizeGuideAccordion';
 import { Link } from '@/i18n/routing';
 import { getStorefrontAvailabilityState } from '@/lib/shop/availability';
 import { formatMoney } from '@/lib/shop/currency';
@@ -39,7 +40,7 @@ export default async function ProductPage({
   const commerceProduct =
     result.kind === 'available' ? result.commerceProduct : null;
   const availabilityState = getStorefrontAvailabilityState(commerceProduct);
-  const sizeGuide = getApparelSizeGuideForProduct(commerceProduct, locale);
+  const sizeGuide = getApparelSizeGuideForProduct(product, locale);
   const galleryImages = getProductGalleryImages(product);
 
   const NAV_LINK = cn(
@@ -146,6 +147,12 @@ export default async function ProductPage({
             );
           })()}
 
+          {commerceProduct === null && sizeGuide ? (
+            <section className="mt-6" aria-label="Size guide">
+              <SizeGuideAccordion sizeGuide={sizeGuide} />
+            </section>
+          ) : null}
+
           {commerceProduct ? (
             <section aria-label="Purchase">
               <AddToCartButton

frontend/app/api/shop/admin/orders/[id]/cancel-payment/route.ts

@@ -20,6 +20,8 @@ import { cancelMonobankUnpaidPayment } from '@/lib/services/orders/monobank-canc
 import { writeAdminAudit } from '@/lib/services/shop/events/write-admin-audit';
 import { orderIdParamSchema, orderSummarySchema } from '@/lib/validation/shop';
 
+export const runtime = 'nodejs';
+
 function noStoreJson(body: unknown, init?: { status?: number }) {
   const res = NextResponse.json(body, { status: init?.status ?? 200 });
   res.headers.set('Cache-Control', 'no-store');

frontend/app/api/shop/admin/orders/[id]/refund/route.ts

@@ -30,6 +30,8 @@ import { refundOrder } from '@/lib/services/orders';
 import { writeAdminAudit } from '@/lib/services/shop/events/write-admin-audit';
 import { orderIdParamSchema, orderSummarySchema } from '@/lib/validation/shop';
 
+export const runtime = 'nodejs';
+
 function noStoreJson(body: unknown, init?: { status?: number }) {
   const res = NextResponse.json(body, { status: init?.status ?? 200 });
   res.headers.set('Cache-Control', 'no-store');

frontend/app/api/shop/admin/products/[id]/status/route.ts

@@ -13,6 +13,7 @@ import { ProductNotFoundError } from '@/lib/errors/products';
 import { logError, logWarn } from '@/lib/logging';
 import { requireAdminCsrf } from '@/lib/security/admin-csrf';
 import { guardBrowserSameOrigin } from '@/lib/security/origin';
+import { InvalidPayloadError, PriceConfigError } from '@/lib/services/errors';
 import { toggleProductStatus } from '@/lib/services/products';
 import { writeAdminAudit } from '@/lib/services/shop/events/write-admin-audit';
 
@@ -174,6 +175,47 @@ export async function PATCH(
       );
     }
 
+    if (error instanceof PriceConfigError) {
+      logWarn('admin_product_status_price_config_error', {
+        ...baseMeta,
+        code: error.code,
+        productId: productIdForLog,
+        currency: error.currency,
+        durationMs: Date.now() - startedAtMs,
+      });
+
+      return noStoreJson(
+        {
+          error: error.message,
+          code: error.code,
+          productId: error.productId,
+          currency: error.currency,
+          field: 'prices',
+        },
+        { status: 400 }
+      );
+    }
+
+    if (error instanceof InvalidPayloadError) {
+      logWarn('admin_product_status_invalid_payload_error', {
+        ...baseMeta,
+        code: error.code,
+        productId: productIdForLog,
+        field: error.field,
+        durationMs: Date.now() - startedAtMs,
+      });
+
+      return noStoreJson(
+        {
+          error: error.message || 'Invalid product state',
+          code: error.code,
+          field: error.field,
+          details: error.details,
+        },
+        { status: 400 }
+      );
+    }
+
     logError('admin_product_status_failed', error, {
       ...baseMeta,
       code: 'ADMIN_PRODUCT_STATUS_FAILED',