@onesub/server 0.12.1 → 0.13.0

package/dist/index.cjs

@@ -477,7 +477,9 @@ async function decodeAppleNotification(payload, skipJwsVerification = false) {
     environment,
     status,
     willRenew,
-    expiresAt: tx.expiresDate ? new Date(tx.expiresDate).toISOString() : null
+    expiresAt: tx.expiresDate ? new Date(tx.expiresDate).toISOString() : null,
+    appAccountToken: tx.appAccountToken ?? null,
+    inAppOwnershipType: tx.inAppOwnershipType ?? null
   };
 }
 var appleJwtMintPromises = /* @__PURE__ */ new Map();
@@ -623,6 +625,91 @@ async function fetchAppleSubscriptionStatus(originalTransactionId, config, optio
     willRenew: renewal?.autoRenewStatus === 1
   };
 }
+async function fetchAppleTransactionHistory(originalTransactionId, config, options) {
+  if (config.mockMode) return null;
+  let jwt;
+  try {
+    jwt = await makeAppleApiJwt(config);
+  } catch (err) {
+    log.warn("[onesub/apple] Cannot fetch transaction history \u2014 JWT mint failed:", err);
+    return null;
+  }
+  const host = options?.sandbox ? "api.storekit-sandbox.itunes.apple.com" : "api.storekit.itunes.apple.com";
+  const results = [];
+  let revision;
+  for (; ; ) {
+    const url = new URL(`https://${host}/inApps/v2/history/${encodeURIComponent(originalTransactionId)}`);
+    if (revision) url.searchParams.set("revision", revision);
+    let page;
+    try {
+      const resp = await fetchWithTimeout(url.toString(), {
+        headers: { Authorization: `Bearer ${jwt}` }
+      });
+      if (!resp.ok) {
+        const text = await resp.text();
+        log.warn(`[onesub/apple] Transaction History API error ${resp.status}: ${text}`);
+        return null;
+      }
+      page = await resp.json();
+    } catch (err) {
+      log.warn("[onesub/apple] Transaction History API network error:", err);
+      return null;
+    }
+    for (const signed of page.signedTransactions ?? []) {
+      try {
+        const tx = await decodeJws(signed, config.skipJwsVerification);
+        if (!tx.originalTransactionId || !tx.transactionId || !tx.productId) continue;
+        results.push({
+          originalTransactionId: tx.originalTransactionId,
+          transactionId: tx.transactionId,
+          productId: tx.productId,
+          type: tx.type ?? "Unknown",
+          purchasedAt: tx.purchaseDate ? new Date(tx.purchaseDate).toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
+          expiresAt: tx.expiresDate ? new Date(tx.expiresDate).toISOString() : null,
+          appAccountToken: tx.appAccountToken ?? null,
+          inAppOwnershipType: tx.inAppOwnershipType ?? null,
+          revocationDate: tx.revocationDate ? new Date(tx.revocationDate).toISOString() : null
+        });
+      } catch {
+      }
+    }
+    if (!page.hasMore) break;
+    revision = page.revision;
+  }
+  return results;
+}
+async function signApplePromotionalOffer(input, config) {
+  const { offerKeyId, offerPrivateKey } = config;
+  if (!offerKeyId || !offerPrivateKey) {
+    throw new Error("[onesub/apple] Promotional Offer signing requires config.apple.offerKeyId and config.apple.offerPrivateKey");
+  }
+  const nonce = crypto.randomUUID().toLowerCase();
+  const timestamp = Date.now();
+  const separator = "\u2063";
+  const message = [
+    input.bundleId,
+    offerKeyId,
+    input.productId,
+    input.offerId,
+    input.applicationUsername,
+    nonce,
+    String(timestamp)
+  ].join(separator);
+  if (!offerPrivateKey.includes("BEGIN") || !offerPrivateKey.includes("END")) {
+    throw new Error("[onesub/apple] offerPrivateKey does not appear to be PEM-encoded");
+  }
+  let signatureBuffer;
+  try {
+    const sign = crypto.createSign("SHA256");
+    sign.update(message);
+    sign.end();
+    signatureBuffer = sign.sign(offerPrivateKey);
+  } catch (err) {
+    throw new Error(`[onesub/apple] Failed to sign promotional offer \u2014 check that offerPrivateKey is a valid ES256 PEM key: ${err.message}`);
+  }
+  const signature = signatureBuffer.toString("base64");
+  return { keyId: offerKeyId, nonce, timestamp, signature };
+}
 var GOOGLE_NOTIFICATION_TYPE = {
   SUBSCRIPTION_RECOVERED: 1,
   SUBSCRIPTION_RENEWED: 2,
@@ -685,8 +772,8 @@ async function getAccessToken(serviceAccountKey) {
     })
   ).toString("base64url");
   const signingInput = `${header}.${payload}`;
-  const { createSign } = await import('crypto');
-  const sign = createSign("RSA-SHA256");
+  const { createSign: createSign2 } = await import('crypto');
+  const sign = createSign2("RSA-SHA256");
   sign.update(signingInput);
   const signature = sign.sign(key.private_key, "base64url");
   const assertion = `${signingInput}.${signature}`;
@@ -958,6 +1045,22 @@ function decodeGoogleVoidedNotification(payload) {
     packageName: notification.packageName
   };
 }
+function decodeGoogleOneTimeProductNotification(payload) {
+  let notification;
+  try {
+    const json = Buffer.from(payload.message.data, "base64").toString("utf-8");
+    notification = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  if (!notification.oneTimeProductNotification) return null;
+  const { notificationType, purchaseToken, sku } = notification.oneTimeProductNotification;
+  if (notificationType !== 1 && notificationType !== 2) {
+    log.warn("[onesub/google] Unknown oneTimeProductNotification type:", notificationType);
+    return null;
+  }
+  return { notificationType, purchaseToken, sku, packageName: notification.packageName };
+}
 function isGoogleActiveNotification(notificationType) {
   return notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_PURCHASED || notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_RENEWED || notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_RECOVERED || notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_RESTARTED;
 }
@@ -1133,7 +1236,9 @@ async function handleAppleWebhook(req, res, config, store, purchaseStore, webhoo
     environment,
     status,
     willRenew,
-    expiresAt
+    expiresAt,
+    appAccountToken,
+    inAppOwnershipType
   } = decoded;
   const notificationType = payload.notificationType;
   const subtype = payload.subtype;
@@ -1177,8 +1282,13 @@ async function handleAppleWebhook(req, res, config, store, purchaseStore, webhoo
     if (existing) {
       const isSubscriptionRefund = isRefundOrRevoke && !isOneTimePurchase && notificationType !== "CONSUMPTION_REQUEST";
       const keepEntitlement = isSubscriptionRefund && config.refundPolicy === "until_expiry";
-      const updated = keepEntitlement ? { ...existing, willRenew: false } : {
+      const correctedUserId = appAccountToken && existing.userId === originalTransactionId ? appAccountToken : existing.userId;
+      if (correctedUserId !== existing.userId) {
+        log.info("[onesub/webhook/apple] correcting userId from originalTransactionId to appAccountToken:", correctedUserId);
+      }
+      const updated = keepEntitlement ? { ...existing, userId: correctedUserId, willRenew: false } : {
         ...existing,
+        userId: correctedUserId,
         status: finalStatus,
         willRenew,
         expiresAt: expiresAt ?? existing.expiresAt
@@ -1189,7 +1299,11 @@ async function handleAppleWebhook(req, res, config, store, purchaseStore, webhoo
         sandbox: environment === "Sandbox"
       });
       if (fresh) {
-        fresh.userId = originalTransactionId;
+        fresh.userId = appAccountToken ?? originalTransactionId;
+        if (inAppOwnershipType === "FAMILY_SHARED") {
+          const source = appAccountToken ? "appAccountToken" : "originalTransactionId (fallback)";
+          log.info(`[onesub/webhook/apple] FAMILY_SHARED \u2014 userId: ${fresh.userId} (source: ${source})`);
+        }
         await store.save(fresh);
       } else {
         log.warn(
@@ -1277,6 +1391,32 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
     }
     return;
   }
+  const oneTimeProduct = decodeGoogleOneTimeProductNotification(body);
+  if (oneTimeProduct) {
+    if (config.google?.packageName && oneTimeProduct.packageName !== config.google.packageName) {
+      log.warn("[onesub/webhook/google] oneTimeProduct package name mismatch:", oneTimeProduct.packageName, "!==", config.google.packageName);
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.PACKAGE_NAME_MISMATCH, "Package name mismatch");
+      return;
+    }
+    try {
+      const { notificationType: notificationType2, purchaseToken: purchaseToken2, sku } = oneTimeProduct;
+      if (notificationType2 === 1) {
+        log.info("[onesub/webhook/google] oneTimeProduct PURCHASED:", sku);
+        if (config.google?.serviceAccountKey && config.google.packageName) {
+          void acknowledgeGoogleProduct(purchaseToken2, sku, config.google).catch(
+            (err) => log.warn(`[onesub/webhook/google] oneTimeProduct ack failed for SKU ${sku} \u2014 3-day auto-refund risk:`, err)
+          );
+        }
+      } else {
+        log.info("[onesub/webhook/google] oneTimeProduct CANCELED (pre-completion):", sku);
+      }
+      res.status(200).json({ received: true });
+    } catch (err) {
+      log.error("[onesub/webhook/google] oneTimeProduct error:", err);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process oneTimeProduct notification");
+    }
+    return;
+  }
   const notification = decodeGoogleNotification(body);
   if (!notification) {
     res.status(200).json({ received: true });
@@ -1788,6 +1928,38 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? "customer error");
     }
   });
+  const syncAppleParamsSchema = zod.z.object({
+    originalTransactionId: zod.z.string().min(1).max(256)
+  });
+  router.post(shared.ROUTES.ADMIN_SYNC_APPLE, async (req, res) => {
+    let params;
+    try {
+      params = syncAppleParamsSchema.parse(req.params);
+    } catch {
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "originalTransactionId required");
+      return;
+    }
+    if (!config.apple?.issuerId || !config.apple?.keyId || !config.apple?.privateKey) {
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, "Apple API credentials not configured");
+      return;
+    }
+    try {
+      const { originalTransactionId } = params;
+      const existingForEnv = await store.getByTransactionId(originalTransactionId);
+      const isSandbox = req.query["sandbox"] === "true" || existingForEnv?.environment === "Sandbox";
+      const fresh = await fetchAppleSubscriptionStatus(originalTransactionId, config.apple, { sandbox: isSandbox });
+      if (!fresh) {
+        sendError(res, 404, shared.ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, "Apple Status API returned no record");
+        return;
+      }
+      const existing = existingForEnv;
+      fresh.userId = existing?.userId ?? originalTransactionId;
+      await store.save(fresh);
+      res.status(200).json({ ok: true, subscription: fresh });
+    } catch (err) {
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, err.message ?? "sync error");
+    }
+  });
   if (webhookQueue?.listDeadLetters) {
     router.get("/onesub/admin/webhook-deadletters", async (_req, res) => {
       try {
@@ -2033,6 +2205,55 @@ function createMetricsRouter(config, store, purchaseStore) {
   });
   return router;
 }
+var OFFER_SECRET_HEADER = "x-onesub-offer-secret";
+var offerBodySchema = zod.z.object({
+  productId: zod.z.string().min(1).max(256),
+  offerId: zod.z.string().min(1).max(256),
+  applicationUsername: zod.z.string().min(1).max(256)
+});
+function createAppleOfferRouter(config) {
+  const apple = config.apple;
+  if (!apple?.offerKeyId || !apple?.offerPrivateKey) return null;
+  const router = express.Router();
+  router.post("/onesub/apple/offer-signature", async (req, res) => {
+    if (config.adminSecret) {
+      const provided = req.headers[OFFER_SECRET_HEADER];
+      if (typeof provided !== "string" || provided !== config.adminSecret) {
+        sendError(res, 401, shared.ONESUB_ERROR_CODE.UNAUTHORIZED, "Unauthorized");
+        return;
+      }
+    }
+    let body;
+    try {
+      body = offerBodySchema.parse(req.body);
+    } catch (err) {
+      if (err instanceof zod.z.ZodError) {
+        sendZodError(res, err);
+        return;
+      }
+      throw err;
+    }
+    if (!apple.bundleId) {
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, "config.apple.bundleId is required for offer signing");
+      return;
+    }
+    try {
+      const result = await signApplePromotionalOffer(
+        {
+          bundleId: apple.bundleId,
+          productId: body.productId,
+          offerId: body.offerId,
+          applicationUsername: body.applicationUsername
+        },
+        apple
+      );
+      res.status(200).json(result);
+    } catch (err) {
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, err.message ?? "Offer signing failed");
+    }
+  });
+  return router;
+}
 
 // src/stores/schema.ts
 var SUBSCRIPTIONS_SCHEMA_SQL = `
@@ -3019,6 +3240,8 @@ function createOneSubMiddleware(config) {
   if (entitlementRouter) router.use(entitlementRouter);
   const metricsRouter = createMetricsRouter(config, store, purchaseStore);
   if (metricsRouter) router.use(metricsRouter);
+  const appleOfferRouter = createAppleOfferRouter(config);
+  if (appleOfferRouter) router.use(appleOfferRouter);
   return router;
 }
 function createOneSubServer(config) {
@@ -3072,11 +3295,13 @@ exports.createOneSubMiddleware = createOneSubMiddleware;
 exports.createOneSubServer = createOneSubServer;
 exports.evaluateEntitlement = evaluateEntitlement;
 exports.fetchAppleSubscriptionStatus = fetchAppleSubscriptionStatus;
+exports.fetchAppleTransactionHistory = fetchAppleTransactionHistory;
 exports.getDefaultCache = getDefaultCache;
 exports.log = log;
 exports.openapiHandler = openapiHandler;
 exports.setDefaultCache = setDefaultCache;
 exports.setLogger = setLogger;
+exports.signApplePromotionalOffer = signApplePromotionalOffer;
 exports.validateAppleReceipt = validateAppleReceipt;
 exports.validateGoogleReceipt = validateGoogleReceipt;
 exports.withSpan = withSpan;