marketplaces/docs/KNOWN-ISSUES.md

Known Issues

Real, reproducible, currently-open frontend bugs only. Everything that needed a product/business decision moved to docs/PRODUCT_BACKLOG.md; everything nice-to-have moved to docs/FUTURE_FEATURES.md; everything backend-shaped moved to docs/BACKEND.md. Re-verified against source 2026-07-26.

Open

1. Ed25519 admin-auth error codes session-expired and invalid-signature are unreachable — dead UI. AuthError.code is documented as routing to a dedicated recovery screen per code (core/auth/models/auth-error.model.ts:1-4), but toAuthErrorShape() in core/auth/services/auth.service.ts:110-118 derives the code for any real HttpErrorResponse exclusively from authErrorCodeFromStatus(error.status) (line 112) — it never reads the caller-supplied fallbackCode parameter for real HTTP errors, and never reads any body-level error code from the response. authErrorCodeFromStatus() (auth-error.model.ts:21-32) only ever returns 'unauthorized', 'forbidden', or 'backend-unavailable' — there is no status or body condition anywhere in the codebase that produces 'session-expired' or 'invalid-signature'. Both screens exist and are wired, but are permanently unreachable from any real backend response today.

   • Fix requires both sides: a backend that returns a distinguishable error.code in the response body (see docs/BACKEND.md §6 Error Model), and a small frontend change to toAuthErrorShape() to prefer that body code over the blanket status-based fallback.
   • Found: 2026-07-26, Backend Finalization Sprint documentation pass (traced while writing docs/BACKEND.md §4 Authentication / §6 Error Model).

2. NavigationConfig.header dead editable field — top nav links list has no renderer. The Navigation editor section lets a client edit a list of header nav items (navigation.header), but HeaderComponent never reads NavigationConfig.header anywhere — its category menu comes from CategoryFacade instead. Editing this list currently has zero visible effect on the storefront.

   • Fix requires real feature work, not a wiring change: rendering a configurable top-nav means deciding positioning relative to the existing category menu, active-route styling, and whether children (dropdowns) are supported — out of scope for a mechanical fix.
   • Found: 2026-08-05, Sprint G dead-config sweep (docs/DEAD-CONFIG-AUDIT.md).

Fixed (this cycle)

Condensed — full detail in commit history and docs/RELEASE_REPORT.md.

• App-wide query-param routing broken (P0) — language.guard.ts legacy redirect percent-encoded query strings into the path.
• Backoffice Categories CRUD broken end-to-end (P0) — wrong provider-mode fallback always picked the real HTTP gateway with no backend present.
• Cart/builder native confirm()/alert() (16 call sites) replaced with shared app-confirm-dialog / toast service.
• getMainImage() no-photo fallback and footer payment-icon assets referenced files that didn't exist — both fixed, onerror fallback added everywhere.
• Backoffice Monitoring showed raw HTTP/queue/webhook strings by default — now friendly wording with technical detail collapsed behind a <details>.
• Category/subcategory empty states used apology wording ("Oops!") for a normal zero-results state.
• pages/category, pages/search, pages/item-detail, pages/info/**, pages/legal/** (40+ files) were unrouted dead code — deleted.
• dynamic-renderer/ was believed unwired — verified it's the live homepage rendering pipeline, no action needed.
• admin/products/:id/edit missing canDeactivate guard — added, mirrors categories.
• primeng/primeicons unused dependency — removed.
• Builder static-page body editor hidden inside a mislabeled collapsed section — un-hidden, relabeled.
• Several project-editor/admin-categories correctness bugs (footer icon id collisions, features toggle only driving one flag, languages silent duplicate no-op, static-pages slug collision, branding socialImageUrl never read, media-picker facade filter leakage between dialogs, categories draft-recovery/drag-reorder bugs, hardcoded locale-tab order) — see git history for the full per-bug list.
• HeaderConfig.showProfile dead toggle — wired up (login/logout only, no dropdown), reuses the existing customer Telegram AuthService.
• Admin reports nav stub — real page (backoffice/reports), reuses AdminAnalyticsFacade for Sales/Top Products/Marketplace Health cards with CSV export.
• Admin settings nav stub — real page (backoffice/settings), UI density preference (comfortable/compact), persisted to localStorage, applied to admin list tables.
• Admin documentation/help nav stubs — both wired to real external links (mailto: support email, tenant.documentationUrl).
• Sprint G dead-config sweep: footer.logoUrl, company.address.street, company.contacts.phone, catalog.suggestionsEnabled were editable with no runtime consumer — all four wired up. Full findings table in docs/DEAD-CONFIG-AUDIT.md.