@donotdev/functions 0.0.11 → 0.0.13

package/README.md

@@ -482,7 +482,7 @@ bun run typecheck
 bun run dev:firebase
 
 # Terminal 2: Forward webhooks
-stripe listen --forward-to localhost:5001/your-project/us-central1/stripeWebhook
+stripe listen --forward-to localhost:5001/your-project/europe-west1/stripeWebhook
 ```
 
 #### Vercel

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@donotdev/functions",
-  "version": "0.0.11",
+  "version": "0.0.13",
   "private": false,
   "description": "Backend functions for DoNotDev Framework - Firebase, Vercel, and platform-agnostic implementations for auth, billing, CRUD, and OAuth",
   "main": "./lib/firebase/index.js",
@@ -39,7 +39,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "type-check": "tsc --noEmit",
+    "type-check": "bunx tsc --noEmit",
     "build": "node build.mjs && tsc -p tsconfig.json",
     "build:types": "tsc -p tsconfig.json",
     "prepublishOnly": "bun run build",
@@ -47,13 +47,13 @@
     "serve": "firebase emulators:start --only functions"
   },
   "dependencies": {
-    "@donotdev/core": "^0.0.24",
-    "@donotdev/firebase": "^0.0.11",
-    "@donotdev/supabase": "^0.0.1"
+    "@donotdev/core": "^0.0.26",
+    "@donotdev/firebase": "^0.0.13",
+    "@donotdev/supabase": "^0.0.3"
   },
   "peerDependencies": {
     "@sentry/node": "^10.39.0",
-    "@supabase/supabase-js": "^2.49.0",
+    "@supabase/supabase-js": "^2.76.11",
     "firebase-admin": "^13.6.1",
     "firebase-functions": "^7.0.5",
     "next": "^16.1.6",
@@ -85,6 +85,9 @@
     "access": "public"
   },
   "peerDependenciesMeta": {
+    "@sentry/node": {
+      "optional": true
+    },
     "@supabase/supabase-js": {
       "optional": true
     },
@@ -96,9 +99,6 @@
     },
     "next": {
       "optional": true
-    },
-    "@sentry/node": {
-      "optional": true
     }
   }
 }

package/src/firebase/auth/setCustomClaims.ts

@@ -60,11 +60,19 @@ async function setCustomClaimsLogic(
 
   // W17: Validate idempotency key to prevent oversized or malformed inputs.
   if (idempotencyKey !== undefined) {
-    if (typeof idempotencyKey !== 'string' || idempotencyKey.length === 0 || idempotencyKey.length > 256) {
-      throw new Error('idempotencyKey must be a non-empty string of at most 256 characters');
+    if (
+      typeof idempotencyKey !== 'string' ||
+      idempotencyKey.length === 0 ||
+      idempotencyKey.length > 256
+    ) {
+      throw new Error(
+        'idempotencyKey must be a non-empty string of at most 256 characters'
+      );
     }
     if (!/^[\w\-.:@]+$/.test(idempotencyKey)) {
-      throw new Error('idempotencyKey contains invalid characters (allowed: alphanumeric, -, _, ., :, @)');
+      throw new Error(
+        'idempotencyKey contains invalid characters (allowed: alphanumeric, -, _, ., :, @)'
+      );
     }
   }
 
@@ -85,11 +93,17 @@ async function setCustomClaimsLogic(
         alreadyProcessed = true;
         return;
       }
-      tx.set(idempotencyRef, { processing: true, reservedAt: new Date().toISOString() });
+      tx.set(idempotencyRef, {
+        processing: true,
+        reservedAt: new Date().toISOString(),
+      });
     });
 
     if (alreadyProcessed) {
-      return existingResult as { success: boolean; customClaims: Record<string, any> };
+      return existingResult as {
+        success: boolean;
+        customClaims: Record<string, any>;
+      };
     }
   }
 

package/src/firebase/baseFunction.ts

@@ -21,7 +21,10 @@ import { FUNCTION_CONFIG } from './config/constants.js';
 import { handleError } from '../shared/errorHandling.js';
 import { assertAuthenticated, getUserRole } from '../shared/utils.js';
 
-import type { CallableRequest, CallableOptions } from 'firebase-functions/v2/https';
+import type {
+  CallableRequest,
+  CallableOptions,
+} from 'firebase-functions/v2/https';
 
 // Optional monitoring imports - only used when enabled
 // Lazy loaded to avoid unnecessary Firestore operations
@@ -76,9 +79,14 @@ async function loadMonitoring() {
 function getClientIp(request: CallableRequest<unknown>): string {
   const forwardedFor = request.rawRequest.headers['x-forwarded-for'];
   if (forwardedFor) {
-    const raw = Array.isArray(forwardedFor) ? forwardedFor.join(',') : forwardedFor;
+    const raw = Array.isArray(forwardedFor)
+      ? forwardedFor.join(',')
+      : forwardedFor;
     // Split and take the RIGHTMOST entry (last untrusted / first-to-be-trusted)
-    const ips = raw.split(',').map((s) => s.trim()).filter(Boolean);
+    const ips = raw
+      .split(',')
+      .map((s) => s.trim())
+      .filter(Boolean);
     if (ips.length > 0) {
       return ips[ips.length - 1]!;
     }

package/src/firebase/billing/changePlan.ts

@@ -17,7 +17,11 @@ import { getFirebaseAdminAuth } from '@donotdev/firebase/server';
 
 import { updateUserSubscription } from '../../shared/billing/helpers/updateUserSubscription.js';
 import { handleError } from '../../shared/errorHandling.js';
-import { stripe, validateStripeEnvironment, initStripe } from '../../shared/utils.js';
+import {
+  stripe,
+  validateStripeEnvironment,
+  initStripe,
+} from '../../shared/utils.js';
 import { createBaseFunction } from '../baseFunction.js';
 import { STRIPE_CONFIG } from '../config/constants.js';
 import { stripeSecretKey } from '../config/secrets.js';

package/src/firebase/billing/createCheckoutSession.ts

@@ -63,7 +63,6 @@ async function createCheckoutSessionLogic(
 
   const {
     priceId,
-    userId,
     customerEmail,
     metadata = {},
     successUrl,
@@ -72,6 +71,9 @@ async function createCheckoutSessionLogic(
     mode = 'payment',
   } = data;
 
+  // Use authenticated uid from context — client no longer sends userId
+  const userId = context.uid;
+
   logger.debug('[createCheckoutSession] Processing request', {
     priceId,
     userId,

package/src/firebase/billing/createCustomerPortal.ts

@@ -70,10 +70,14 @@ async function createCustomerPortalLogic(
   // Use caller-supplied returnUrl or derive from FRONTEND_URL env var.
   const resolvedReturnUrl =
     returnUrl ??
-    (process.env.FRONTEND_URL ? `${process.env.FRONTEND_URL}/dashboard` : undefined);
+    (process.env.FRONTEND_URL
+      ? `${process.env.FRONTEND_URL}/dashboard`
+      : undefined);
 
   if (!resolvedReturnUrl) {
-    throw handleError(new Error('returnUrl is required (or set FRONTEND_URL env var)'));
+    throw handleError(
+      new Error('returnUrl is required (or set FRONTEND_URL env var)')
+    );
   }
 
   // Create portal session

package/src/firebase/billing/webhookHandler.ts

@@ -102,7 +102,10 @@ export function createStripeWebhook(
         async getUser(userId: string) {
           return getFirebaseAdminAuth().getUser(userId);
         },
-        async setCustomUserClaims(userId: string, claims: Record<string, unknown>) {
+        async setCustomUserClaims(
+          userId: string,
+          claims: Record<string, unknown>
+        ) {
           await getFirebaseAdminAuth().setCustomUserClaims(userId, claims);
         },
       };

package/src/firebase/crud/aggregate.ts

@@ -220,7 +220,11 @@ function aggregateEntitiesLogicFactory(
 ) {
   return async function aggregateEntitiesLogic(
     data: AggregateRequest,
-    context: { uid: string; userRole: UserRole; request: CallableRequest<AggregateRequest> }
+    context: {
+      uid: string;
+      userRole: UserRole;
+      request: CallableRequest<AggregateRequest>;
+    }
   ) {
     const db = getFirebaseAdminFirestore();
     const { userRole } = context;

package/src/firebase/crud/create.ts

@@ -160,11 +160,21 @@ function createEntityLogicFactory(
 
     // W17: Validate idempotency key length and content.
     if (idempotencyKey !== undefined) {
-      if (typeof idempotencyKey !== 'string' || idempotencyKey.length === 0 || idempotencyKey.length > 256) {
-        throw new DoNotDevError('idempotencyKey must be a non-empty string of at most 256 characters', 'invalid-argument');
+      if (
+        typeof idempotencyKey !== 'string' ||
+        idempotencyKey.length === 0 ||
+        idempotencyKey.length > 256
+      ) {
+        throw new DoNotDevError(
+          'idempotencyKey must be a non-empty string of at most 256 characters',
+          'invalid-argument'
+        );
       }
       if (!/^[\w\-.:@]+$/.test(idempotencyKey)) {
-        throw new DoNotDevError('idempotencyKey contains invalid characters', 'invalid-argument');
+        throw new DoNotDevError(
+          'idempotencyKey contains invalid characters',
+          'invalid-argument'
+        );
       }
     }
 
@@ -187,7 +197,10 @@ function createEntityLogicFactory(
           alreadyProcessed = true;
           return;
         }
-        tx.set(idempotencyRef, { processing: true, reservedAt: new Date().toISOString() });
+        tx.set(idempotencyRef, {
+          processing: true,
+          reservedAt: new Date().toISOString(),
+        });
       });
 
       if (alreadyProcessed) {

package/src/firebase/crud/list.ts

@@ -115,13 +115,44 @@ function listEntitiesLogicFactory(
     // Apply search if provided
     if (search) {
       const { field, query: searchQuery } = search;
+      // Validate search.field against entity schema (listFields as allowlist)
+      if (listFields && listFields.length > 0) {
+        if (!listFields.includes(field)) {
+          throw new DoNotDevError(
+            `Search field '${field}' is not allowed`,
+            'invalid-argument'
+          );
+        }
+      } else if (field.startsWith('_') || field.includes('.')) {
+        throw new DoNotDevError(
+          `Search field '${field}' is not allowed`,
+          'invalid-argument'
+        );
+      }
       query = query
         .where(field, '>=', searchQuery)
         .where(field, '<=', searchQuery + '\uf8ff');
     }
 
-    // Apply where clauses for filtering
+    // Apply where clauses for filtering — validate field names against entity schema
     for (const [field, operator, value] of where) {
+      if (listFields && listFields.length > 0) {
+        if (
+          !listFields.includes(field) &&
+          field !== 'status' &&
+          field !== 'id'
+        ) {
+          throw new DoNotDevError(
+            `Where field '${field}' is not allowed`,
+            'invalid-argument'
+          );
+        }
+      } else if (field.startsWith('_') || field.includes('.')) {
+        throw new DoNotDevError(
+          `Where field '${field}' is not allowed`,
+          'invalid-argument'
+        );
+      }
       query = query.where(field, operator, value);
     }
 
@@ -146,9 +177,10 @@ function listEntitiesLogicFactory(
 
     // W13: Cap at MAX_LIST_LIMIT to prevent unbounded reads (DoS via cost amplification).
     const MAX_LIST_LIMIT = 500;
-    const effectiveLimit = limit !== undefined && limit > 0
-      ? Math.min(limit, MAX_LIST_LIMIT)
-      : MAX_LIST_LIMIT;
+    const effectiveLimit =
+      limit !== undefined && limit > 0
+        ? Math.min(limit, MAX_LIST_LIMIT)
+        : MAX_LIST_LIMIT;
     query = query.limit(effectiveLimit);
 
     // Execute the query
@@ -225,7 +257,7 @@ function listEntitiesLogicFactory(
       items: transformFirestoreData(docs),
       lastVisible: snapshot.docs[snapshot.docs.length - 1]?.id || null,
       count: snapshot.docs.length,
-      hasMore: snapshot.docs.length === limit,
+      hasMore: snapshot.docs.length === effectiveLimit,
     };
   };
 }

package/src/firebase/crud/update.ts

@@ -153,11 +153,21 @@ function updateEntityLogicFactory(
 
     // W17: Validate idempotency key length and content.
     if (idempotencyKey !== undefined) {
-      if (typeof idempotencyKey !== 'string' || idempotencyKey.length === 0 || idempotencyKey.length > 256) {
-        throw new DoNotDevError('idempotencyKey must be a non-empty string of at most 256 characters', 'invalid-argument');
+      if (
+        typeof idempotencyKey !== 'string' ||
+        idempotencyKey.length === 0 ||
+        idempotencyKey.length > 256
+      ) {
+        throw new DoNotDevError(
+          'idempotencyKey must be a non-empty string of at most 256 characters',
+          'invalid-argument'
+        );
       }
       if (!/^[\w\-.:@]+$/.test(idempotencyKey)) {
-        throw new DoNotDevError('idempotencyKey contains invalid characters', 'invalid-argument');
+        throw new DoNotDevError(
+          'idempotencyKey contains invalid characters',
+          'invalid-argument'
+        );
       }
     }
 
@@ -178,7 +188,10 @@ function updateEntityLogicFactory(
           alreadyProcessed = true;
           return;
         }
-        tx.set(idempotencyRef, { processing: true, reservedAt: new Date().toISOString() });
+        tx.set(idempotencyRef, {
+          processing: true,
+          reservedAt: new Date().toISOString(),
+        });
       });
 
       if (alreadyProcessed) {

package/src/firebase/oauth/exchangeToken.ts

@@ -39,11 +39,21 @@ export const exchangeToken = onCall<ExchangeTokenRequest>(async (request) => {
 
   // W17: Validate idempotency key length and content.
   if (idempotencyKey !== undefined) {
-    if (typeof idempotencyKey !== 'string' || idempotencyKey.length === 0 || idempotencyKey.length > 256) {
-      throw new HttpsError('invalid-argument', 'idempotencyKey must be a non-empty string of at most 256 characters');
+    if (
+      typeof idempotencyKey !== 'string' ||
+      idempotencyKey.length === 0 ||
+      idempotencyKey.length > 256
+    ) {
+      throw new HttpsError(
+        'invalid-argument',
+        'idempotencyKey must be a non-empty string of at most 256 characters'
+      );
     }
     if (!/^[\w\-.:@]+$/.test(idempotencyKey)) {
-      throw new HttpsError('invalid-argument', 'idempotencyKey contains invalid characters');
+      throw new HttpsError(
+        'invalid-argument',
+        'idempotencyKey contains invalid characters'
+      );
     }
   }
 
@@ -67,7 +77,10 @@ export const exchangeToken = onCall<ExchangeTokenRequest>(async (request) => {
         return;
       }
       // Reserve the key before executing business logic
-      tx.set(idempotencyRef, { processing: true, reservedAt: new Date().toISOString() });
+      tx.set(idempotencyRef, {
+        processing: true,
+        reservedAt: new Date().toISOString(),
+      });
     });
 
     if (alreadyProcessed) {

package/src/shared/__tests__/validation.test.ts

@@ -108,7 +108,9 @@ describe('validateUrl', () => {
   });
 
   it('includes custom name in error message', () => {
-    expect(() => validateUrl('bad', 'Success URL')).toThrow('Invalid Success URL');
+    expect(() => validateUrl('bad', 'Success URL')).toThrow(
+      'Invalid Success URL'
+    );
   });
 });
 
@@ -121,10 +123,10 @@ describe('validateMetadata', () => {
 
   it('rejects non-string values', () => {
     expect(() => validateMetadata({ key: 123 as any })).toThrow(
-      "must be a string"
+      'must be a string'
     );
     expect(() => validateMetadata({ key: true as any })).toThrow(
-      "must be a string"
+      'must be a string'
     );
   });