# Page Review — Shop Settings (P3) + Settings (P9)

- **Routes:** `/shop-settings/index` (one long form, save in-place) · `/settings/index` (tabs: general/scheduling/payments/commercial/notifications) · `/settings/districts` (AJAX cascade)
- **Controllers:** `ShopSettingsController` · `SettingsController` · `common/models/Shop.php`
- **Reviewed:** 2026-07-01 · **Status:** 🔍 (code-review agent running)

## 2. Design findings
| # | What | Actual | Severity | Evidence |
|---|------|--------|----------|----------|
| D1 | shop-settings Media (gallery + cover) | ✅ renders RTL; copy "جالبري الصور" is transliterated Genglish — should be "معرض الصور" (subtitle already uses it) | LOW | ss_94292m0uv |
| D2 | Basic info (name/mobile/gender) | ✅ renders; gender value shows "نسالي" — likely a typo for "نسائي" (women's) — verify source data/label | LOW | ss_5269bclsj |
| D3 | Working hours | ✅ renders; time "AM 09:00 / PM 11:59" English + AM-before-number (same systemic i18n as calendar D1/D2) | LOW | ss_5269bclsj |
| **D4** | **Location map (الموقع)** | **❌ BROKEN — "Oops! Something went wrong. This page didn't load Google Maps correctly."** Address/district/city fields work; map picker dead. | **MEDIUM** | ss_44358mrb4 |
| D5 | Refund/scheduling settings | ✅ renders; admin-locked "خطوة وقت الفترة" correctly gated (lock + "can only be changed by admins") | — | ss_58984zp8z |
| D6 | /settings general tab + bank account | ✅ renders RTL (5 tabs; bank IBAN section for withdrawals) | — | ss_6166gk6l6 |

### D4 detail — broken Google Maps
The map overlay is the standard Google Maps JS API failure. The error is emitted cross-origin by `maps.googleapis.com` so the same-domain console reader couldn't capture the exact code, but the cause is the **API key**: almost certainly `RefererNotAllowedMapError` (the dev host `shop.navagoo.localhost` is not in the key's HTTP-referrer allowlist) or billing/quota. **Action for user:** check the Maps key restrictions (allow the serving domain) + billing; likely works on the production domain. Not a code bug.

## 3. Logic findings
| Action | Result |
|---|---|
| shop-settings save / settings save (🟡) | NOT live-submitted (would persist real shop config while user away); covered by code-review |
| settings tabs (general/scheduling/payments/commercial/notifications) | general verified render; others same pattern (not all clicked) |
| districts cascade | code-review agent |

## 4. Code trace
**Code-review agent (ShopSettingsController + SettingsController + Shop) — 0 CRIT, 1 HIGH, 2 MED:**
| Sev | File:line | Issue | Status |
|---|---|---|---|
| HIGH | SettingsController.php:204 (scheduling tab) | `slot_time_step` lock not re-pinned (shop-settings path does) → crafted POST overrides admin-locked slot size | ✅ FIXED (R-H005) |
| MED | base/Shop.php PRIVILEGED_FIELDS | `top_shop`/`rate`/`total_rates` writable via SCENARIO_SHOP_OWNER → owner self-promote in search / fake rating | ✅ FIXED (R-H006) |
| MED | `views/settings/_payments.php:88,143,155` | 3 walk-in checkboxes rendered but `ShopPaymentSettings` scenario drops them → toggles silently do nothing | ⚠️ LOGGED R-L08 (product decision: wire vs remove) |

**Confirmed clean:** shop always resolved from session (no POSTed shop id); uploads via `filekit UploadAction` + `imageValidationRules` (ext/mime/size ok, no path traversal); `districts` int-cast + parameterized + auth-gated; CSRF present; lat/lng bounded.

## 5. Fixes applied
| Issue | File:line | Change | Re-verified |
|-------|-----------|--------|-------------|
| R-H005 slot-step lock bypass (scheduling tab) | SettingsController.php:~203 | snapshot + re-pin `slot_time_step` when locked & not admin/manager (mirrors ShopSettingsService) | ✅ php -l clean |
| R-H006 rating/ranking mass-assignment | common/models/base/Shop.php:160 | add `top_shop`,`rate`,`total_rates` to PRIVILEGED_FIELDS (restricts SHOP_OWNER scenario only; DEFAULT/backend unaffected) | ✅ php -l clean |

> Copy fixes (D1 جالبري الصور→معرض الصور, D2 نسالي→نسائي) and D4 broken Maps key are candidates needing source/config check — logged, not yet changed.

## 6. Sign-off
- [x] shop-settings full form reviewed (media, basic, hours, location, refund, additional)
- [x] settings page tabs render
- [x] D4 broken map captured + root-caused
- [ ] code-review findings folded + fixes
- [ ] copy fixes (جالبري الصور → معرض الصور; نسالي → نسائي) pending source check