@donotdev/functions 0.0.12 → 0.0.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@donotdev/functions",
-  "version": "0.0.12",
+  "version": "0.0.13",
   "private": false,
   "description": "Backend functions for DoNotDev Framework - Firebase, Vercel, and platform-agnostic implementations for auth, billing, CRUD, and OAuth",
   "main": "./lib/firebase/index.js",
@@ -47,9 +47,9 @@
     "serve": "firebase emulators:start --only functions"
   },
   "dependencies": {
-    "@donotdev/core": "^0.0.25",
-    "@donotdev/firebase": "^0.0.12",
-    "@donotdev/supabase": "^0.0.2"
+    "@donotdev/core": "^0.0.26",
+    "@donotdev/firebase": "^0.0.13",
+    "@donotdev/supabase": "^0.0.3"
   },
   "peerDependencies": {
     "@sentry/node": "^10.39.0",

package/src/firebase/auth/setCustomClaims.ts

@@ -60,11 +60,19 @@ async function setCustomClaimsLogic(
 
   // W17: Validate idempotency key to prevent oversized or malformed inputs.
   if (idempotencyKey !== undefined) {
-    if (typeof idempotencyKey !== 'string' || idempotencyKey.length === 0 || idempotencyKey.length > 256) {
-      throw new Error('idempotencyKey must be a non-empty string of at most 256 characters');
+    if (
+      typeof idempotencyKey !== 'string' ||
+      idempotencyKey.length === 0 ||
+      idempotencyKey.length > 256
+    ) {
+      throw new Error(
+        'idempotencyKey must be a non-empty string of at most 256 characters'
+      );
     }
     if (!/^[\w\-.:@]+$/.test(idempotencyKey)) {
-      throw new Error('idempotencyKey contains invalid characters (allowed: alphanumeric, -, _, ., :, @)');
+      throw new Error(
+        'idempotencyKey contains invalid characters (allowed: alphanumeric, -, _, ., :, @)'
+      );
     }
   }
 
@@ -85,11 +93,17 @@ async function setCustomClaimsLogic(
         alreadyProcessed = true;
         return;
       }
-      tx.set(idempotencyRef, { processing: true, reservedAt: new Date().toISOString() });
+      tx.set(idempotencyRef, {
+        processing: true,
+        reservedAt: new Date().toISOString(),
+      });
     });
 
     if (alreadyProcessed) {
-      return existingResult as { success: boolean; customClaims: Record<string, any> };
+      return existingResult as {
+        success: boolean;
+        customClaims: Record<string, any>;
+      };
     }
   }
 

package/src/firebase/baseFunction.ts

@@ -21,7 +21,10 @@ import { FUNCTION_CONFIG } from './config/constants.js';
 import { handleError } from '../shared/errorHandling.js';
 import { assertAuthenticated, getUserRole } from '../shared/utils.js';
 
-import type { CallableRequest, CallableOptions } from 'firebase-functions/v2/https';
+import type {
+  CallableRequest,
+  CallableOptions,
+} from 'firebase-functions/v2/https';
 
 // Optional monitoring imports - only used when enabled
 // Lazy loaded to avoid unnecessary Firestore operations
@@ -76,9 +79,14 @@ async function loadMonitoring() {
 function getClientIp(request: CallableRequest<unknown>): string {
   const forwardedFor = request.rawRequest.headers['x-forwarded-for'];
   if (forwardedFor) {
-    const raw = Array.isArray(forwardedFor) ? forwardedFor.join(',') : forwardedFor;
+    const raw = Array.isArray(forwardedFor)
+      ? forwardedFor.join(',')
+      : forwardedFor;
     // Split and take the RIGHTMOST entry (last untrusted / first-to-be-trusted)
-    const ips = raw.split(',').map((s) => s.trim()).filter(Boolean);
+    const ips = raw
+      .split(',')
+      .map((s) => s.trim())
+      .filter(Boolean);
     if (ips.length > 0) {
       return ips[ips.length - 1]!;
     }

package/src/firebase/billing/changePlan.ts

@@ -17,7 +17,11 @@ import { getFirebaseAdminAuth } from '@donotdev/firebase/server';
 
 import { updateUserSubscription } from '../../shared/billing/helpers/updateUserSubscription.js';
 import { handleError } from '../../shared/errorHandling.js';
-import { stripe, validateStripeEnvironment, initStripe } from '../../shared/utils.js';
+import {
+  stripe,
+  validateStripeEnvironment,
+  initStripe,
+} from '../../shared/utils.js';
 import { createBaseFunction } from '../baseFunction.js';
 import { STRIPE_CONFIG } from '../config/constants.js';
 import { stripeSecretKey } from '../config/secrets.js';

package/src/firebase/billing/createCustomerPortal.ts

@@ -70,10 +70,14 @@ async function createCustomerPortalLogic(
   // Use caller-supplied returnUrl or derive from FRONTEND_URL env var.
   const resolvedReturnUrl =
     returnUrl ??
-    (process.env.FRONTEND_URL ? `${process.env.FRONTEND_URL}/dashboard` : undefined);
+    (process.env.FRONTEND_URL
+      ? `${process.env.FRONTEND_URL}/dashboard`
+      : undefined);
 
   if (!resolvedReturnUrl) {
-    throw handleError(new Error('returnUrl is required (or set FRONTEND_URL env var)'));
+    throw handleError(
+      new Error('returnUrl is required (or set FRONTEND_URL env var)')
+    );
   }
 
   // Create portal session

package/src/firebase/billing/webhookHandler.ts

@@ -102,7 +102,10 @@ export function createStripeWebhook(
         async getUser(userId: string) {
           return getFirebaseAdminAuth().getUser(userId);
         },
-        async setCustomUserClaims(userId: string, claims: Record<string, unknown>) {
+        async setCustomUserClaims(
+          userId: string,
+          claims: Record<string, unknown>
+        ) {
           await getFirebaseAdminAuth().setCustomUserClaims(userId, claims);
         },
       };

package/src/firebase/crud/aggregate.ts

@@ -220,7 +220,11 @@ function aggregateEntitiesLogicFactory(
 ) {
   return async function aggregateEntitiesLogic(
     data: AggregateRequest,
-    context: { uid: string; userRole: UserRole; request: CallableRequest<AggregateRequest> }
+    context: {
+      uid: string;
+      userRole: UserRole;
+      request: CallableRequest<AggregateRequest>;
+    }
   ) {
     const db = getFirebaseAdminFirestore();
     const { userRole } = context;

package/src/firebase/crud/create.ts

@@ -160,11 +160,21 @@ function createEntityLogicFactory(
 
     // W17: Validate idempotency key length and content.
     if (idempotencyKey !== undefined) {
-      if (typeof idempotencyKey !== 'string' || idempotencyKey.length === 0 || idempotencyKey.length > 256) {
-        throw new DoNotDevError('idempotencyKey must be a non-empty string of at most 256 characters', 'invalid-argument');
+      if (
+        typeof idempotencyKey !== 'string' ||
+        idempotencyKey.length === 0 ||
+        idempotencyKey.length > 256
+      ) {
+        throw new DoNotDevError(
+          'idempotencyKey must be a non-empty string of at most 256 characters',
+          'invalid-argument'
+        );
       }
       if (!/^[\w\-.:@]+$/.test(idempotencyKey)) {
-        throw new DoNotDevError('idempotencyKey contains invalid characters', 'invalid-argument');
+        throw new DoNotDevError(
+          'idempotencyKey contains invalid characters',
+          'invalid-argument'
+        );
       }
     }
 
@@ -187,7 +197,10 @@ function createEntityLogicFactory(
           alreadyProcessed = true;
           return;
         }
-        tx.set(idempotencyRef, { processing: true, reservedAt: new Date().toISOString() });
+        tx.set(idempotencyRef, {
+          processing: true,
+          reservedAt: new Date().toISOString(),
+        });
       });
 
       if (alreadyProcessed) {

package/src/firebase/crud/list.ts

@@ -137,7 +137,11 @@ function listEntitiesLogicFactory(
     // Apply where clauses for filtering — validate field names against entity schema
     for (const [field, operator, value] of where) {
       if (listFields && listFields.length > 0) {
-        if (!listFields.includes(field) && field !== 'status' && field !== 'id') {
+        if (
+          !listFields.includes(field) &&
+          field !== 'status' &&
+          field !== 'id'
+        ) {
           throw new DoNotDevError(
             `Where field '${field}' is not allowed`,
             'invalid-argument'
@@ -173,9 +177,10 @@ function listEntitiesLogicFactory(
 
     // W13: Cap at MAX_LIST_LIMIT to prevent unbounded reads (DoS via cost amplification).
     const MAX_LIST_LIMIT = 500;
-    const effectiveLimit = limit !== undefined && limit > 0
-      ? Math.min(limit, MAX_LIST_LIMIT)
-      : MAX_LIST_LIMIT;
+    const effectiveLimit =
+      limit !== undefined && limit > 0
+        ? Math.min(limit, MAX_LIST_LIMIT)
+        : MAX_LIST_LIMIT;
     query = query.limit(effectiveLimit);
 
     // Execute the query

package/src/firebase/crud/update.ts

@@ -153,11 +153,21 @@ function updateEntityLogicFactory(
 
     // W17: Validate idempotency key length and content.
     if (idempotencyKey !== undefined) {
-      if (typeof idempotencyKey !== 'string' || idempotencyKey.length === 0 || idempotencyKey.length > 256) {
-        throw new DoNotDevError('idempotencyKey must be a non-empty string of at most 256 characters', 'invalid-argument');
+      if (
+        typeof idempotencyKey !== 'string' ||
+        idempotencyKey.length === 0 ||
+        idempotencyKey.length > 256
+      ) {
+        throw new DoNotDevError(
+          'idempotencyKey must be a non-empty string of at most 256 characters',
+          'invalid-argument'
+        );
       }
       if (!/^[\w\-.:@]+$/.test(idempotencyKey)) {
-        throw new DoNotDevError('idempotencyKey contains invalid characters', 'invalid-argument');
+        throw new DoNotDevError(
+          'idempotencyKey contains invalid characters',
+          'invalid-argument'
+        );
       }
     }
 
@@ -178,7 +188,10 @@ function updateEntityLogicFactory(
           alreadyProcessed = true;
           return;
         }
-        tx.set(idempotencyRef, { processing: true, reservedAt: new Date().toISOString() });
+        tx.set(idempotencyRef, {
+          processing: true,
+          reservedAt: new Date().toISOString(),
+        });
       });
 
       if (alreadyProcessed) {

package/src/firebase/oauth/exchangeToken.ts

@@ -39,11 +39,21 @@ export const exchangeToken = onCall<ExchangeTokenRequest>(async (request) => {
 
   // W17: Validate idempotency key length and content.
   if (idempotencyKey !== undefined) {
-    if (typeof idempotencyKey !== 'string' || idempotencyKey.length === 0 || idempotencyKey.length > 256) {
-      throw new HttpsError('invalid-argument', 'idempotencyKey must be a non-empty string of at most 256 characters');
+    if (
+      typeof idempotencyKey !== 'string' ||
+      idempotencyKey.length === 0 ||
+      idempotencyKey.length > 256
+    ) {
+      throw new HttpsError(
+        'invalid-argument',
+        'idempotencyKey must be a non-empty string of at most 256 characters'
+      );
     }
     if (!/^[\w\-.:@]+$/.test(idempotencyKey)) {
-      throw new HttpsError('invalid-argument', 'idempotencyKey contains invalid characters');
+      throw new HttpsError(
+        'invalid-argument',
+        'idempotencyKey contains invalid characters'
+      );
     }
   }
 
@@ -67,7 +77,10 @@ export const exchangeToken = onCall<ExchangeTokenRequest>(async (request) => {
         return;
       }
       // Reserve the key before executing business logic
-      tx.set(idempotencyRef, { processing: true, reservedAt: new Date().toISOString() });
+      tx.set(idempotencyRef, {
+        processing: true,
+        reservedAt: new Date().toISOString(),
+      });
     });
 
     if (alreadyProcessed) {

package/src/shared/__tests__/validation.test.ts

@@ -108,7 +108,9 @@ describe('validateUrl', () => {
   });
 
   it('includes custom name in error message', () => {
-    expect(() => validateUrl('bad', 'Success URL')).toThrow('Invalid Success URL');
+    expect(() => validateUrl('bad', 'Success URL')).toThrow(
+      'Invalid Success URL'
+    );
   });
 });
 
@@ -121,10 +123,10 @@ describe('validateMetadata', () => {
 
   it('rejects non-string values', () => {
     expect(() => validateMetadata({ key: 123 as any })).toThrow(
-      "must be a string"
+      'must be a string'
     );
     expect(() => validateMetadata({ key: true as any })).toThrow(
-      "must be a string"
+      'must be a string'
     );
   });
 

package/src/shared/billing/__tests__/createCheckout.test.ts

@@ -61,7 +61,9 @@ const BASE_REQUEST: CreateCheckoutSessionRequest = {
 // Mock factories
 // ---------------------------------------------------------------------------
 
-function makeStripeProvider(overrides?: Partial<StripeCheckoutProvider>): StripeCheckoutProvider {
+function makeStripeProvider(
+  overrides?: Partial<StripeCheckoutProvider>
+): StripeCheckoutProvider {
   return {
     createCheckoutSession: vi.fn().mockResolvedValue({
       id: 'cs_test_session123',
@@ -71,7 +73,9 @@ function makeStripeProvider(overrides?: Partial<StripeCheckoutProvider>): Stripe
   };
 }
 
-function makeAuthProvider(overrides?: Partial<AuthCheckoutProvider>): AuthCheckoutProvider {
+function makeAuthProvider(
+  overrides?: Partial<AuthCheckoutProvider>
+): AuthCheckoutProvider {
   return {
     getUser: vi.fn().mockResolvedValue({ customClaims: {} }),
     ...overrides,
@@ -112,14 +116,24 @@ describe('createCheckoutAlgorithm', () => {
     });
 
     it('verifies the user before creating the session', async () => {
-      await createCheckoutAlgorithm(BASE_REQUEST, stripeProvider, authProvider, BILLING_CONFIG);
+      await createCheckoutAlgorithm(
+        BASE_REQUEST,
+        stripeProvider,
+        authProvider,
+        BILLING_CONFIG
+      );
 
       expect(authProvider.getUser).toHaveBeenCalledOnce();
       expect(authProvider.getUser).toHaveBeenCalledWith('user_001');
     });
 
     it('forwards priceId, mode, successUrl, cancelUrl to Stripe', async () => {
-      await createCheckoutAlgorithm(BASE_REQUEST, stripeProvider, authProvider, BILLING_CONFIG);
+      await createCheckoutAlgorithm(
+        BASE_REQUEST,
+        stripeProvider,
+        authProvider,
+        BILLING_CONFIG
+      );
 
       expect(stripeProvider.createCheckoutSession).toHaveBeenCalledWith(
         expect.objectContaining({
@@ -132,7 +146,12 @@ describe('createCheckoutAlgorithm', () => {
     });
 
     it('ensures userId and billingConfigKey are set in session metadata', async () => {
-      await createCheckoutAlgorithm(BASE_REQUEST, stripeProvider, authProvider, BILLING_CONFIG);
+      await createCheckoutAlgorithm(
+        BASE_REQUEST,
+        stripeProvider,
+        authProvider,
+        BILLING_CONFIG
+      );
 
       expect(stripeProvider.createCheckoutSession).toHaveBeenCalledWith(
         expect.objectContaining({
@@ -150,7 +169,12 @@ describe('createCheckoutAlgorithm', () => {
         customerEmail: 'user@example.com',
       };
 
-      await createCheckoutAlgorithm(request, stripeProvider, authProvider, BILLING_CONFIG);
+      await createCheckoutAlgorithm(
+        request,
+        stripeProvider,
+        authProvider,
+        BILLING_CONFIG
+      );
 
       expect(stripeProvider.createCheckoutSession).toHaveBeenCalledWith(
         expect.objectContaining({ customerEmail: 'user@example.com' })
@@ -163,7 +187,12 @@ describe('createCheckoutAlgorithm', () => {
         allowPromotionCodes: undefined,
       };
 
-      await createCheckoutAlgorithm(request, stripeProvider, authProvider, BILLING_CONFIG);
+      await createCheckoutAlgorithm(
+        request,
+        stripeProvider,
+        authProvider,
+        BILLING_CONFIG
+      );
 
       expect(stripeProvider.createCheckoutSession).toHaveBeenCalledWith(
         expect.objectContaining({ allowPromotionCodes: true })
@@ -176,7 +205,12 @@ describe('createCheckoutAlgorithm', () => {
         mode: undefined,
       };
 
-      await createCheckoutAlgorithm(request, stripeProvider, authProvider, BILLING_CONFIG);
+      await createCheckoutAlgorithm(
+        request,
+        stripeProvider,
+        authProvider,
+        BILLING_CONFIG
+      );
 
       expect(stripeProvider.createCheckoutSession).toHaveBeenCalledWith(
         expect.objectContaining({ mode: 'payment' })
@@ -233,7 +267,12 @@ describe('createCheckoutAlgorithm', () => {
       };
 
       await expect(
-        createCheckoutAlgorithm(request, stripeProvider, authProvider, BILLING_CONFIG)
+        createCheckoutAlgorithm(
+          request,
+          stripeProvider,
+          authProvider,
+          BILLING_CONFIG
+        )
       ).rejects.toThrow('Missing billingConfigKey in metadata');
     });
 
@@ -244,7 +283,12 @@ describe('createCheckoutAlgorithm', () => {
       };
 
       await expect(
-        createCheckoutAlgorithm(request, stripeProvider, authProvider, BILLING_CONFIG)
+        createCheckoutAlgorithm(
+          request,
+          stripeProvider,
+          authProvider,
+          BILLING_CONFIG
+        )
       ).rejects.toThrow('Missing billingConfigKey in metadata');
     });
 
@@ -255,7 +299,12 @@ describe('createCheckoutAlgorithm', () => {
       };
 
       await expect(
-        createCheckoutAlgorithm(request, stripeProvider, authProvider, BILLING_CONFIG)
+        createCheckoutAlgorithm(
+          request,
+          stripeProvider,
+          authProvider,
+          BILLING_CONFIG
+        )
       ).rejects.toThrow();
 
       expect(stripeProvider.createCheckoutSession).not.toHaveBeenCalled();
@@ -274,7 +323,12 @@ describe('createCheckoutAlgorithm', () => {
       };
 
       await expect(
-        createCheckoutAlgorithm(request, stripeProvider, authProvider, BILLING_CONFIG)
+        createCheckoutAlgorithm(
+          request,
+          stripeProvider,
+          authProvider,
+          BILLING_CONFIG
+        )
       ).rejects.toThrow('Invalid billing config key: nonexistent_plan');
     });
 
@@ -286,7 +340,12 @@ describe('createCheckoutAlgorithm', () => {
       };
 
       await expect(
-        createCheckoutAlgorithm(request, stripeProvider, authProvider, BILLING_CONFIG)
+        createCheckoutAlgorithm(
+          request,
+          stripeProvider,
+          authProvider,
+          BILLING_CONFIG
+        )
       ).rejects.toThrow('Price ID mismatch with configuration');
     });
 
@@ -298,7 +357,12 @@ describe('createCheckoutAlgorithm', () => {
       };
 
       await expect(
-        createCheckoutAlgorithm(request, stripeProvider, authProvider, BILLING_CONFIG)
+        createCheckoutAlgorithm(
+          request,
+          stripeProvider,
+          authProvider,
+          BILLING_CONFIG
+        )
       ).rejects.toThrow();
 
       expect(stripeProvider.createCheckoutSession).not.toHaveBeenCalled();
@@ -311,7 +375,12 @@ describe('createCheckoutAlgorithm', () => {
 
   describe('auth validation', () => {
     it('calls getUser with the request userId', async () => {
-      await createCheckoutAlgorithm(BASE_REQUEST, stripeProvider, authProvider, BILLING_CONFIG);
+      await createCheckoutAlgorithm(
+        BASE_REQUEST,
+        stripeProvider,
+        authProvider,
+        BILLING_CONFIG
+      );
 
       expect(authProvider.getUser).toHaveBeenCalledWith('user_001');
     });
@@ -322,7 +391,12 @@ describe('createCheckoutAlgorithm', () => {
       });
 
       await expect(
-        createCheckoutAlgorithm(BASE_REQUEST, stripeProvider, authProvider, BILLING_CONFIG)
+        createCheckoutAlgorithm(
+          BASE_REQUEST,
+          stripeProvider,
+          authProvider,
+          BILLING_CONFIG
+        )
       ).rejects.toThrow('User not found');
     });
 
@@ -332,7 +406,12 @@ describe('createCheckoutAlgorithm', () => {
       });
 
       await expect(
-        createCheckoutAlgorithm(BASE_REQUEST, stripeProvider, authProvider, BILLING_CONFIG)
+        createCheckoutAlgorithm(
+          BASE_REQUEST,
+          stripeProvider,
+          authProvider,
+          BILLING_CONFIG
+        )
       ).rejects.toThrow();
 
       expect(stripeProvider.createCheckoutSession).not.toHaveBeenCalled();
@@ -346,11 +425,18 @@ describe('createCheckoutAlgorithm', () => {
   describe('Stripe error handling', () => {
     it('propagates Stripe API errors', async () => {
       stripeProvider = makeStripeProvider({
-        createCheckoutSession: vi.fn().mockRejectedValue(new Error('Stripe network error')),
+        createCheckoutSession: vi
+          .fn()
+          .mockRejectedValue(new Error('Stripe network error')),
       });
 
       await expect(
-        createCheckoutAlgorithm(BASE_REQUEST, stripeProvider, authProvider, BILLING_CONFIG)
+        createCheckoutAlgorithm(
+          BASE_REQUEST,
+          stripeProvider,
+          authProvider,
+          BILLING_CONFIG
+        )
       ).rejects.toThrow('Stripe network error');
     });
 
@@ -362,7 +448,12 @@ describe('createCheckoutAlgorithm', () => {
       });
 
       await expect(
-        createCheckoutAlgorithm(BASE_REQUEST, stripeProvider, authProvider, BILLING_CONFIG)
+        createCheckoutAlgorithm(
+          BASE_REQUEST,
+          stripeProvider,
+          authProvider,
+          BILLING_CONFIG
+        )
       ).rejects.toThrow('Your card was declined');
     });
 
@@ -374,7 +465,12 @@ describe('createCheckoutAlgorithm', () => {
       });
 
       await expect(
-        createCheckoutAlgorithm(BASE_REQUEST, stripeProvider, authProvider, BILLING_CONFIG)
+        createCheckoutAlgorithm(
+          BASE_REQUEST,
+          stripeProvider,
+          authProvider,
+          BILLING_CONFIG
+        )
       ).rejects.toThrow('Too many requests');
     });
 
@@ -386,7 +482,12 @@ describe('createCheckoutAlgorithm', () => {
       });
 
       await expect(
-        createCheckoutAlgorithm(BASE_REQUEST, stripeProvider, authProvider, BILLING_CONFIG)
+        createCheckoutAlgorithm(
+          BASE_REQUEST,
+          stripeProvider,
+          authProvider,
+          BILLING_CONFIG
+        )
       ).rejects.toBe(unexpected);
     });
   });