@cosmicdrift/kumiko-bundled-features 0.392.2 → 0.394.0

package/dist/subscription-dodo/verify-webhook.js

@@ -1,189 +0,0 @@
-// Dodo Payments webhook: Standard Webhooks signature verification plus mapping
-// of Dodo's event envelope onto the foundation's normalized events.
-//
-// Verification always runs against the raw body string; re-serialized JSON
-// would change whitespace and break the HMAC. The signature check happens
-// before any parsing, so no path bypasses it.
-import { createHmac, timingSafeEqual } from "node:crypto";
-import { BillingEventKinds, parseProviderConsentId, SubscriptionEventTypes, SubscriptionStatuses, } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
-import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
-import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import * as z from "zod";
-import { DODO_PROVIDER_NAME } from "./constants.js";
-export const WEBHOOK_TOLERANCE_SECONDS = 300;
-const SECRET_PREFIX = "whsec_";
-const SIGNATURE_VERSION = "v1";
-const TIMESTAMP_PATTERN = /^\d+$/;
-function signatureFor(secretKey, signedContent) {
-    return createHmac("sha256", secretKey).update(signedContent).digest();
-}
-function matchesAnyV1Signature(header, expected) {
-    return header.split(" ").some((entry) => {
-        const [version, encoded] = entry.split(",");
-        if (version !== SIGNATURE_VERSION || !encoded)
-            return false;
-        const candidate = Buffer.from(encoded, "base64");
-        return candidate.length === expected.length && timingSafeEqual(candidate, expected);
-    });
-}
-/** Throws unless the Standard Webhooks signature over `rawBody` is valid and
- *  the timestamp is within the tolerance in both directions. */
-export function verifyStandardWebhook(rawBody, headers, secret, nowSeconds) {
-    const id = headers["webhook-id"];
-    const timestamp = headers["webhook-timestamp"];
-    const signatureHeader = headers["webhook-signature"];
-    if (!id || !timestamp || !signatureHeader) {
-        throw new Error("subscription-dodo: webhook-id, webhook-timestamp or webhook-signature missing");
-    }
-    if (!TIMESTAMP_PATTERN.test(timestamp)) {
-        throw new Error("subscription-dodo: webhook-timestamp is not a Unix timestamp in seconds");
-    }
-    if (Math.abs(nowSeconds - Number(timestamp)) > WEBHOOK_TOLERANCE_SECONDS) {
-        throw new Error("subscription-dodo: webhook timestamp outside the tolerance window");
-    }
-    const secretKey = Buffer.from(secret.startsWith(SECRET_PREFIX) ? secret.slice(SECRET_PREFIX.length) : secret, "base64");
-    const expected = signatureFor(secretKey, `${id}.${timestamp}.${rawBody}`);
-    if (!matchesAnyV1Signature(signatureHeader, expected)) {
-        throw new Error("subscription-dodo: webhook signature verify failed");
-    }
-}
-// =============================================================================
-// Event mapping
-// =============================================================================
-const DODO_SUBSCRIPTION_EVENT_TYPES = {
-    "subscription.active": SubscriptionEventTypes.created,
-    "subscription.updated": SubscriptionEventTypes.updated,
-    "subscription.plan_changed": SubscriptionEventTypes.updated,
-    "subscription.paused": SubscriptionEventTypes.updated,
-    "subscription.unpaused": SubscriptionEventTypes.updated,
-    "subscription.update_payment_method": SubscriptionEventTypes.updated,
-    "subscription.renewed": SubscriptionEventTypes.invoicePaid,
-    "subscription.past_due": SubscriptionEventTypes.invoicePaymentFailed,
-    "subscription.on_hold": SubscriptionEventTypes.invoicePaymentFailed,
-    "subscription.cancelled": SubscriptionEventTypes.canceled,
-    "subscription.expired": SubscriptionEventTypes.canceled,
-    "subscription.failed": SubscriptionEventTypes.canceled,
-};
-const DODO_SUBSCRIPTION_STATUSES = {
-    pending: SubscriptionStatuses.incomplete,
-    active: SubscriptionStatuses.active,
-    on_hold: SubscriptionStatuses.pastDue,
-    past_due: SubscriptionStatuses.pastDue,
-    paused: SubscriptionStatuses.pastDue,
-    cancelled: SubscriptionStatuses.canceled,
-    failed: SubscriptionStatuses.canceled,
-    expired: SubscriptionStatuses.canceled,
-};
-const PAYMENT_SUCCEEDED = "payment.succeeded";
-const metadataSchema = z.record(z.string(), z.unknown()).nullish();
-const customerSchema = z.object({ customer_id: z.string().min(1) });
-const envelopeSchema = z.object({
-    type: z.string(),
-    timestamp: z.iso.datetime({ offset: true }),
-    data: z.unknown(),
-});
-export const dodoSubscriptionSchema = z.object({
-    subscription_id: z.string().min(1),
-    product_id: z.string().min(1),
-    status: z.string(),
-    customer: customerSchema,
-    metadata: metadataSchema,
-    next_billing_date: z.iso.datetime({ offset: true }),
-    cancel_at_next_billing_date: z.boolean().nullish(),
-});
-const dodoPaymentSchema = z.object({
-    subscription_id: z.string().nullish(),
-    checkout_session_id: z.string().nullish(),
-    customer: customerSchema,
-    metadata: metadataSchema,
-    product_cart: z.array(z.object({ product_id: z.string().min(1) })).nullish(),
-});
-function metadataString(metadata, key) {
-    const value = metadata?.[key];
-    return typeof value === "string" && value.length > 0 ? value : undefined;
-}
-/** Shared by the webhook and retrieveSubscription so both map Dodo state
- *  identically. Null when the status is unknown or the product is not in
- *  `priceToTier` (SubscriptionEvent.tier is required). */
-export function mapDodoSubscriptionState(sub, priceToTier) {
-    const status = DODO_SUBSCRIPTION_STATUSES[sub.status];
-    const tier = priceToTier[sub.product_id];
-    if (!status || !tier)
-        return null;
-    return {
-        status,
-        tier,
-        currentPeriodEnd: sub.next_billing_date,
-        cancelAt: sub.cancel_at_next_billing_date === true ? sub.next_billing_date : null,
-    };
-}
-function currentUnixSeconds() {
-    return Math.floor(Temporal.Now.instant().epochMilliseconds / 1000);
-}
-function parsePaymentEvent(providerEventId, data) {
-    const parsed = dodoPaymentSchema.safeParse(data);
-    if (!parsed.success)
-        return null;
-    const payment = parsed.data;
-    // A subscription's own payments are covered by its subscription.* events.
-    if (payment.subscription_id)
-        return null;
-    const tenantId = metadataString(payment.metadata, "tenantId");
-    const priceId = payment.product_cart?.[0]?.product_id;
-    if (!tenantId || !priceId)
-        return null;
-    const consentId = parseProviderConsentId(payment.metadata?.["consentId"]);
-    return {
-        kind: BillingEventKinds.payment,
-        providerEventId,
-        providerName: DODO_PROVIDER_NAME,
-        tenantId,
-        ...(consentId !== undefined && { consentId }),
-        ...(payment.checkout_session_id && { providerCheckoutId: payment.checkout_session_id }),
-        providerCustomerId: payment.customer.customer_id,
-        priceId,
-    };
-}
-function parseSubscriptionEvent(providerEventId, type, providerEventAt, data, priceToTier) {
-    const parsed = dodoSubscriptionSchema.safeParse(data);
-    if (!parsed.success)
-        return null;
-    const sub = parsed.data;
-    const tenantId = metadataString(sub.metadata, "tenantId");
-    const state = mapDodoSubscriptionState(sub, priceToTier);
-    if (!tenantId || !state)
-        return null;
-    const consentId = parseProviderConsentId(sub.metadata?.["consentId"]);
-    return {
-        providerEventId,
-        providerName: DODO_PROVIDER_NAME,
-        type,
-        tenantId,
-        ...(consentId !== undefined && { consentId }),
-        providerCustomerId: sub.customer.customer_id,
-        providerSubscriptionId: sub.subscription_id,
-        providerEventAt,
-        ...state,
-    };
-}
-export function verifyAndParseDodoWebhook(runtime, options) {
-    const nowSeconds = options.nowSeconds ?? currentUnixSeconds;
-    return async (rawBody, headers, systemSecrets) => {
-        const secret = await runtime.resolveWebhookSecret(systemSecrets);
-        verifyStandardWebhook(rawBody, headers, secret, nowSeconds());
-        // Past verification the body is trusted to be Dodo's; a malformed shape is
-        // schema drift, so it is dropped (200 ignored) instead of answered with a 401.
-        const envelope = envelopeSchema.safeParse(parseJsonOrThrow(rawBody, "subscription-dodo webhook body"));
-        // verifyStandardWebhook has checked webhook-id is present.
-        const providerEventId = headers["webhook-id"];
-        if (!envelope.success || !providerEventId)
-            return null;
-        const { type, timestamp, data } = envelope.data;
-        if (type === PAYMENT_SUCCEEDED)
-            return parsePaymentEvent(providerEventId, data);
-        const normalizedType = DODO_SUBSCRIPTION_EVENT_TYPES[type];
-        if (!normalizedType)
-            return null;
-        return parseSubscriptionEvent(providerEventId, normalizedType, timestamp, data, options.priceToTier);
-    };
-}

package/src/subscription-dodo/changes.json

@@ -1,14 +0,0 @@
-[
-  {
-    "version": "0.388.0",
-    "type": "improvement",
-    "title": "New subscription provider for Dodo Payments",
-    "detail": "createSubscriptionDodoFeature() registers the \"dodo\" subscription provider (Merchant of Record). It verifies Standard Webhooks signatures, maps Dodo events to the foundation events, creates hosted checkouts and portal sessions, and switches plans in the app through previewPlanSwitch and applyPlanSwitch. Config keys are api-key, webhook-secret, billing-live and environment. Plan switches need a Product Collection in Dodo."
-  },
-  {
-    "version": "0.388.0",
-    "type": "improvement",
-    "title": "dodoEnvSchema declares the Dodo product id slots",
-    "detail": "dodoEnvSchema({ prices: [\"PRO\"] }) adds one optional DODO_PRODUCT_PRO slot per plan next to the API key and webhook key, and checks the pdt_ prefix. It is the counterpart to stripeEnvSchema."
-  }
-]