@onesub/server 0.12.1 → 0.13.1

package/dist/__tests__/webhook-refund.test.js

@@ -0,0 +1,313 @@
+/**
+ * Refund / voided-purchase webhook tests.
+ *
+ * Covers:
+ *   - Apple webhook REFUND for IAP (Consumable / Non-Consumable) →
+ *     PurchaseStore row removed, SubscriptionStore untouched.
+ *   - Apple webhook REFUND for subscriptions still updates SubscriptionStore.
+ *   - Google voidedPurchaseNotification productType=2 → IAP row removed.
+ *   - Google voidedPurchaseNotification productType=1 → subscription canceled.
+ *   - decodeGoogleVoidedNotification recognises voided payload, ignores other kinds.
+ */
+import { describe, it, expect, beforeEach } from 'vitest';
+import express from 'express';
+import { SUBSCRIPTION_STATUS } from '@onesub/shared';
+import { createWebhookRouter } from '../routes/webhook.js';
+import { InMemorySubscriptionStore, InMemoryPurchaseStore } from '../store.js';
+import { decodeGoogleVoidedNotification } from '../providers/google.js';
+// ── helpers ─────────────────────────────────────────────────────────────────
+function makeJws(payload) {
+    const header = Buffer.from(JSON.stringify({ alg: 'ES256' })).toString('base64url');
+    const body = Buffer.from(JSON.stringify(payload)).toString('base64url');
+    return `${header}.${body}.fakesig`;
+}
+function appleConfig() {
+    return {
+        apple: { bundleId: 'com.example.app', skipJwsVerification: true },
+        database: { url: '' },
+    };
+}
+function googleConfig() {
+    return {
+        google: { packageName: 'com.example.app' },
+        database: { url: '' },
+    };
+}
+function buildServer(config, store, purchaseStore) {
+    const app = express();
+    app.use(express.json());
+    app.use(createWebhookRouter(config, store, purchaseStore));
+    return {
+        async request(path, body) {
+            // Use Node http directly for a lightweight test server.
+            const server = app.listen(0);
+            const address = server.address();
+            const port = typeof address === 'object' && address ? address.port : 0;
+            try {
+                const resp = await fetch(`http://127.0.0.1:${port}${path}`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify(body),
+                });
+                const text = await resp.text();
+                let parsed = text;
+                try {
+                    parsed = JSON.parse(text);
+                }
+                catch { /* keep as text */ }
+                return { status: resp.status, body: parsed };
+            }
+            finally {
+                await new Promise((resolve) => server.close(() => resolve()));
+            }
+        },
+    };
+}
+const samplePurchase = (overrides) => ({
+    userId: 'user_1',
+    productId: 'credits_100',
+    platform: 'apple',
+    type: 'consumable',
+    transactionId: 'txn_apple_consumable_001',
+    purchasedAt: '2026-01-01T00:00:00.000Z',
+    quantity: 1,
+    ...overrides,
+});
+const sampleSub = (overrides) => ({
+    userId: 'user_sub',
+    productId: 'pro_monthly',
+    platform: 'google',
+    status: 'active',
+    expiresAt: '2027-01-01T00:00:00.000Z',
+    originalTransactionId: 'token_google_sub_xyz',
+    purchasedAt: '2026-01-01T00:00:00.000Z',
+    willRenew: true,
+    ...overrides,
+});
+// ── Apple webhook: IAP REFUND ───────────────────────────────────────────────
+describe('Apple webhook — IAP REFUND', () => {
+    let store;
+    let purchaseStore;
+    let server;
+    beforeEach(() => {
+        store = new InMemorySubscriptionStore();
+        purchaseStore = new InMemoryPurchaseStore();
+        server = buildServer(appleConfig(), store, purchaseStore);
+    });
+    it('removes the consumable purchase row on REFUND', async () => {
+        await purchaseStore.savePurchase(samplePurchase({ transactionId: 'txn_consumable_a' }));
+        const signedTransactionInfo = makeJws({
+            bundleId: 'com.example.app',
+            type: 'Consumable',
+            productId: 'credits_100',
+            transactionId: 'txn_consumable_a',
+            originalTransactionId: 'orig_consumable_a',
+            purchaseDate: Date.now(),
+        });
+        const signedRenewalInfo = makeJws({});
+        const signedPayload = makeJws({
+            notificationType: 'REFUND',
+            data: { signedTransactionInfo, signedRenewalInfo },
+        });
+        const resp = await server.request('/onesub/webhook/apple', { signedPayload });
+        expect(resp.status).toBe(200);
+        expect(await purchaseStore.getPurchaseByTransactionId('txn_consumable_a')).toBeNull();
+    });
+    it('removes the non-consumable purchase row on REVOKE', async () => {
+        await purchaseStore.savePurchase(samplePurchase({
+            transactionId: 'txn_nc_a',
+            type: 'non_consumable',
+            productId: 'premium_unlock',
+        }));
+        const signedTransactionInfo = makeJws({
+            bundleId: 'com.example.app',
+            type: 'Non-Consumable',
+            productId: 'premium_unlock',
+            transactionId: 'txn_nc_a',
+            originalTransactionId: 'txn_nc_a',
+            purchaseDate: Date.now(),
+        });
+        const signedPayload = makeJws({
+            notificationType: 'REVOKE',
+            data: { signedTransactionInfo, signedRenewalInfo: makeJws({}) },
+        });
+        const resp = await server.request('/onesub/webhook/apple', { signedPayload });
+        expect(resp.status).toBe(200);
+        expect(await purchaseStore.getPurchaseByTransactionId('txn_nc_a')).toBeNull();
+    });
+    it('does not touch the SubscriptionStore on IAP REFUND', async () => {
+        await store.save(sampleSub({ originalTransactionId: 'orig_sub_untouched' }));
+        await purchaseStore.savePurchase(samplePurchase({ transactionId: 'iap_only' }));
+        const signedTransactionInfo = makeJws({
+            bundleId: 'com.example.app',
+            type: 'Consumable',
+            productId: 'credits_100',
+            transactionId: 'iap_only',
+            originalTransactionId: 'iap_only',
+            purchaseDate: Date.now(),
+        });
+        const signedPayload = makeJws({
+            notificationType: 'REFUND',
+            data: { signedTransactionInfo, signedRenewalInfo: makeJws({}) },
+        });
+        await server.request('/onesub/webhook/apple', { signedPayload });
+        expect(await store.getByTransactionId('orig_sub_untouched')).not.toBeNull();
+    });
+    it('still routes subscription REFUND through the SubscriptionStore', async () => {
+        await store.save(sampleSub({
+            platform: 'apple',
+            originalTransactionId: 'orig_sub_apple',
+            status: 'active',
+        }));
+        const signedTransactionInfo = makeJws({
+            bundleId: 'com.example.app',
+            type: 'Auto-Renewable Subscription',
+            productId: 'pro_monthly',
+            transactionId: 'tx_sub_apple_1',
+            originalTransactionId: 'orig_sub_apple',
+            purchaseDate: Date.now(),
+            expiresDate: Date.now() + 86400000,
+        });
+        const signedPayload = makeJws({
+            notificationType: 'REFUND',
+            data: { signedTransactionInfo, signedRenewalInfo: makeJws({}) },
+        });
+        const resp = await server.request('/onesub/webhook/apple', { signedPayload });
+        expect(resp.status).toBe(200);
+        const updated = await store.getByTransactionId('orig_sub_apple');
+        expect(updated?.status).toBe(SUBSCRIPTION_STATUS.CANCELED);
+    });
+});
+// ── Google webhook: voidedPurchaseNotification ──────────────────────────────
+function makeVoidedPushBody(notification) {
+    const json = JSON.stringify({
+        version: '1.0',
+        eventTimeMillis: String(Date.now()),
+        ...notification,
+    });
+    return {
+        message: {
+            data: Buffer.from(json, 'utf-8').toString('base64'),
+            messageId: '1',
+        },
+        subscription: 'projects/x/subscriptions/y',
+    };
+}
+describe('Google webhook — voidedPurchaseNotification', () => {
+    let store;
+    let purchaseStore;
+    let server;
+    beforeEach(() => {
+        store = new InMemorySubscriptionStore();
+        purchaseStore = new InMemoryPurchaseStore();
+        server = buildServer(googleConfig(), store, purchaseStore);
+    });
+    it('removes IAP row when productType=2 (one-time product refund)', async () => {
+        await purchaseStore.savePurchase(samplePurchase({
+            platform: 'google',
+            transactionId: 'GPA.refunded_order',
+        }));
+        const resp = await server.request('/onesub/webhook/google', makeVoidedPushBody({
+            packageName: 'com.example.app',
+            voidedPurchaseNotification: {
+                purchaseToken: 'tok_x',
+                orderId: 'GPA.refunded_order',
+                productType: 2,
+                refundType: 1,
+            },
+        }));
+        expect(resp.status).toBe(200);
+        expect(await purchaseStore.getPurchaseByTransactionId('GPA.refunded_order')).toBeNull();
+    });
+    it('cancels subscription when productType=1', async () => {
+        await store.save(sampleSub({ originalTransactionId: 'tok_sub' }));
+        const resp = await server.request('/onesub/webhook/google', makeVoidedPushBody({
+            packageName: 'com.example.app',
+            voidedPurchaseNotification: {
+                purchaseToken: 'tok_sub',
+                orderId: 'GPA.sub_order',
+                productType: 1,
+                refundType: 1,
+            },
+        }));
+        expect(resp.status).toBe(200);
+        const updated = await store.getByTransactionId('tok_sub');
+        expect(updated?.status).toBe(SUBSCRIPTION_STATUS.CANCELED);
+    });
+    it('rejects voided notification when packageName mismatches', async () => {
+        const resp = await server.request('/onesub/webhook/google', makeVoidedPushBody({
+            packageName: 'com.attacker.app',
+            voidedPurchaseNotification: {
+                purchaseToken: 'tok',
+                orderId: 'GPA.x',
+                productType: 2,
+                refundType: 1,
+            },
+        }));
+        expect(resp.status).toBe(400);
+    });
+    it('acknowledges with 200 even when the orderId is unknown', async () => {
+        // Idempotent ack semantics — Google retries until 2xx; we don't want loops
+        // when the row was already removed.
+        const resp = await server.request('/onesub/webhook/google', makeVoidedPushBody({
+            packageName: 'com.example.app',
+            voidedPurchaseNotification: {
+                purchaseToken: 'tok',
+                orderId: 'GPA.unknown',
+                productType: 2,
+                refundType: 1,
+            },
+        }));
+        expect(resp.status).toBe(200);
+    });
+});
+// ── decodeGoogleVoidedNotification unit ─────────────────────────────────────
+describe('decodeGoogleVoidedNotification', () => {
+    it('returns null for subscription notifications', () => {
+        const json = JSON.stringify({
+            packageName: 'com.example.app',
+            eventTimeMillis: '0',
+            subscriptionNotification: {
+                version: '1.0',
+                notificationType: 4,
+                purchaseToken: 't',
+                subscriptionId: 'p',
+            },
+        });
+        const result = decodeGoogleVoidedNotification({
+            message: { data: Buffer.from(json).toString('base64'), messageId: '1' },
+            subscription: 's',
+        });
+        expect(result).toBeNull();
+    });
+    it('extracts voided payload fields', () => {
+        const json = JSON.stringify({
+            packageName: 'com.example.app',
+            eventTimeMillis: '0',
+            voidedPurchaseNotification: {
+                purchaseToken: 'tok123',
+                orderId: 'GPA.xyz',
+                productType: 2,
+                refundType: 1,
+            },
+        });
+        const result = decodeGoogleVoidedNotification({
+            message: { data: Buffer.from(json).toString('base64'), messageId: '1' },
+            subscription: 's',
+        });
+        expect(result).toEqual({
+            purchaseToken: 'tok123',
+            orderId: 'GPA.xyz',
+            productType: 2,
+            refundType: 1,
+            packageName: 'com.example.app',
+        });
+    });
+    it('returns null for malformed base64', () => {
+        expect(decodeGoogleVoidedNotification({
+            message: { data: '!!!not-base64!!!', messageId: '1' },
+            subscription: 's',
+        })).toBeNull();
+    });
+});
+//# sourceMappingURL=webhook-refund.test.js.map

package/dist/__tests__/webhook-refund.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-refund.test.js","sourceRoot":"","sources":["../../src/__tests__/webhook-refund.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAExE,+EAA+E;AAE/E,SAAS,OAAO,CAAC,OAAgC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxE,OAAO,GAAG,MAAM,IAAI,IAAI,UAAU,CAAC;AACrC,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,KAAK,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,IAAI,EAAE;QACjE,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO;QACL,MAAM,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE;QAC1C,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;KACtB,CAAC;AACJ,CAAC;AAMD,SAAS,WAAW,CAClB,MAA0B,EAC1B,KAAgC,EAChC,aAAoC;IAEpC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;IAE3D,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI;YACtB,wDAAwD;YACxD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,GAAG,IAAI,EAAE,EAAE;oBAC1D,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC3B,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,MAAM,GAAY,IAAI,CAAC;gBAC3B,IAAI,CAAC;oBAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;gBAC/D,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC/C,CAAC;oBAAS,CAAC;gBACT,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,SAAiC,EAAgB,EAAE,CAAC,CAAC;IAC3E,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,aAAa;IACxB,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,YAAY;IAClB,aAAa,EAAE,0BAA0B;IACzC,WAAW,EAAE,0BAA0B;IACvC,QAAQ,EAAE,CAAC;IACX,GAAG,SAAS;CACb,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,SAAqC,EAAoB,EAAE,CAAC,CAAC;IAC9E,MAAM,EAAE,UAAU;IAClB,SAAS,EAAE,aAAa;IACxB,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,0BAA0B;IACrC,qBAAqB,EAAE,sBAAsB;IAC7C,WAAW,EAAE,0BAA0B;IACvC,SAAS,EAAE,IAAI;IACf,GAAG,SAAS;CACb,CAAC,CAAC;AAEH,+EAA+E;AAE/E,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,IAAI,KAAgC,CAAC;IACrC,IAAI,aAAoC,CAAC;IACzC,IAAI,MAAkB,CAAC;IAEvB,UAAU,CAAC,GAAG,EAAE;QACd,KAAK,GAAG,IAAI,yBAAyB,EAAE,CAAC;QACxC,aAAa,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAC5C,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,aAAa,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;QAExF,MAAM,qBAAqB,GAAG,OAAO,CAAC;YACpC,QAAQ,EAAE,iBAAiB;YAC3B,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,aAAa;YACxB,aAAa,EAAE,kBAAkB;YACjC,qBAAqB,EAAE,mBAAmB;YAC1C,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;SACzB,CAAC,CAAC;QACH,MAAM,iBAAiB,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,aAAa,GAAG,OAAO,CAAC;YAC5B,gBAAgB,EAAE,QAAQ;YAC1B,IAAI,EAAE,EAAE,qBAAqB,EAAE,iBAAiB,EAAE;SACnD,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,aAAa,CAAC,0BAA0B,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,aAAa,CAAC,YAAY,CAAC,cAAc,CAAC;YAC9C,aAAa,EAAE,UAAU;YACzB,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,gBAAgB;SAC5B,CAAC,CAAC,CAAC;QAEJ,MAAM,qBAAqB,GAAG,OAAO,CAAC;YACpC,QAAQ,EAAE,iBAAiB;YAC3B,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,gBAAgB;YAC3B,aAAa,EAAE,UAAU;YACzB,qBAAqB,EAAE,UAAU;YACjC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;SACzB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC;YAC5B,gBAAgB,EAAE,QAAQ;YAC1B,IAAI,EAAE,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE;SAChE,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,aAAa,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,aAAa,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QAEhF,MAAM,qBAAqB,GAAG,OAAO,CAAC;YACpC,QAAQ,EAAE,iBAAiB;YAC3B,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,aAAa;YACxB,aAAa,EAAE,UAAU;YACzB,qBAAqB,EAAE,UAAU;YACjC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;SACzB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC;YAC5B,gBAAgB,EAAE,QAAQ;YAC1B,IAAI,EAAE,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE;SAChE,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,QAAQ,EAAE,OAAO;YACjB,qBAAqB,EAAE,gBAAgB;YACvC,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC,CAAC;QAEJ,MAAM,qBAAqB,GAAG,OAAO,CAAC;YACpC,QAAQ,EAAE,iBAAiB;YAC3B,IAAI,EAAE,6BAA6B;YACnC,SAAS,EAAE,aAAa;YACxB,aAAa,EAAE,gBAAgB;YAC/B,qBAAqB,EAAE,gBAAgB;YACvC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;YACxB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;SACnC,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC;YAC5B,gBAAgB,EAAE,QAAQ;YAC1B,IAAI,EAAE,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE;SAChE,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACjE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAE/E,SAAS,kBAAkB,CAAC,YAQ3B;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,OAAO,EAAE,KAAK;QACd,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,GAAG,YAAY;KAChB,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnD,SAAS,EAAE,GAAG;SACf;QACD,YAAY,EAAE,4BAA4B;KAC3C,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,IAAI,KAAgC,CAAC;IACrC,IAAI,aAAoC,CAAC;IACzC,IAAI,MAAkB,CAAC;IAEvB,UAAU,CAAC,GAAG,EAAE;QACd,KAAK,GAAG,IAAI,yBAAyB,EAAE,CAAC;QACxC,aAAa,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAC5C,MAAM,GAAG,WAAW,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,aAAa,CAAC,YAAY,CAAC,cAAc,CAAC;YAC9C,QAAQ,EAAE,QAAQ;YAClB,aAAa,EAAE,oBAAoB;SACpC,CAAC,CAAC,CAAC;QAEJ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,wBAAwB,EACxB,kBAAkB,CAAC;YACjB,WAAW,EAAE,iBAAiB;YAC9B,0BAA0B,EAAE;gBAC1B,aAAa,EAAE,OAAO;gBACtB,OAAO,EAAE,oBAAoB;gBAC7B,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,aAAa,CAAC,0BAA0B,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAElE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,wBAAwB,EACxB,kBAAkB,CAAC;YACjB,WAAW,EAAE,iBAAiB;YAC9B,0BAA0B,EAAE;gBAC1B,aAAa,EAAE,SAAS;gBACxB,OAAO,EAAE,eAAe;gBACxB,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,wBAAwB,EACxB,kBAAkB,CAAC;YACjB,WAAW,EAAE,kBAAkB;YAC/B,0BAA0B,EAAE;gBAC1B,aAAa,EAAE,KAAK;gBACpB,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,2EAA2E;QAC3E,oCAAoC;QACpC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,wBAAwB,EACxB,kBAAkB,CAAC;YACjB,WAAW,EAAE,iBAAiB;YAC9B,0BAA0B,EAAE;gBAC1B,aAAa,EAAE,KAAK;gBACpB,OAAO,EAAE,aAAa;gBACtB,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAE/E,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,WAAW,EAAE,iBAAiB;YAC9B,eAAe,EAAE,GAAG;YACpB,wBAAwB,EAAE;gBACxB,OAAO,EAAE,KAAK;gBACd,gBAAgB,EAAE,CAAC;gBACnB,aAAa,EAAE,GAAG;gBAClB,cAAc,EAAE,GAAG;aACpB;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC5C,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;YACvE,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,WAAW,EAAE,iBAAiB;YAC9B,eAAe,EAAE,GAAG;YACpB,0BAA0B,EAAE;gBAC1B,aAAa,EAAE,QAAQ;gBACvB,OAAO,EAAE,SAAS;gBAClB,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC5C,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;YACvE,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,aAAa,EAAE,QAAQ;YACvB,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,iBAAiB;SAC/B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,8BAA8B,CAAC;YACpC,OAAO,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,GAAG,EAAE;YACrD,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cache.js

@@ -0,0 +1,39 @@
+/**
+ * Process-local in-memory cache. Default for single-instance deployments.
+ */
+export class InMemoryCacheAdapter {
+    entries = new Map();
+    async get(key) {
+        const entry = this.entries.get(key);
+        if (!entry)
+            return null;
+        if (entry.expiresAt !== 0 && entry.expiresAt < Date.now()) {
+            this.entries.delete(key);
+            return null;
+        }
+        return entry.value;
+    }
+    async set(key, value, ttlSeconds) {
+        const expiresAt = ttlSeconds && ttlSeconds > 0 ? Date.now() + ttlSeconds * 1000 : 0;
+        this.entries.set(key, { value, expiresAt });
+    }
+    async del(key) {
+        this.entries.delete(key);
+    }
+    /** Test helper — clear everything. Not part of the public CacheAdapter contract. */
+    clear() {
+        this.entries.clear();
+    }
+}
+/**
+ * Module-level singleton used by providers when no per-call adapter is
+ * supplied. Keeps the existing single-instance behavior with zero config.
+ */
+let defaultAdapter = new InMemoryCacheAdapter();
+export function getDefaultCache() {
+    return defaultAdapter;
+}
+export function setDefaultCache(adapter) {
+    defaultAdapter = adapter;
+}
+//# sourceMappingURL=cache.js.map

package/dist/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAyBA;;GAEG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IAEpD,KAAK,CAAC,GAAG,CAAI,GAAW;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,KAAU,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,KAAQ,EAAE,UAAmB;QACrD,MAAM,SAAS,GAAG,UAAU,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,oFAAoF;IACpF,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED;;;GAGG;AACH,IAAI,cAAc,GAAiB,IAAI,oBAAoB,EAAE,CAAC;AAE9D,MAAM,UAAU,eAAe;IAC7B,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAqB;IACnD,cAAc,GAAG,OAAO,CAAC;AAC3B,CAAC"}

package/dist/errors.js

@@ -0,0 +1,19 @@
+import { ONESUB_ERROR_CODE } from '@onesub/shared';
+/**
+ * Send a structured error response. Every onesub HTTP endpoint uses this
+ * so consumers can rely on `errorCode` being present on every 4xx/5xx body.
+ *
+ * `extra` lets callers inject route-specific defaults (e.g. `purchase: null`
+ * for ValidatePurchaseResponse shape compatibility).
+ */
+export function sendError(res, status, code, error, extra = {}) {
+    res.status(status).json({ ...extra, error, errorCode: code });
+}
+/**
+ * 400 response for a failed zod parse. The ZodError's per-issue messages
+ * are joined for the human-readable `error` field.
+ */
+export function sendZodError(res, err, extra = {}) {
+    sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, err.issues.map((e) => e.message).join(', '), extra);
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACvB,GAAa,EACb,MAAc,EACd,IAAqB,EACrB,KAAa,EACb,QAAiC,EAAE;IAEnC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAa,EACb,GAAe,EACf,QAAiC,EAAE;IAEnC,SAAS,CACP,GAAG,EACH,GAAG,EACH,iBAAiB,CAAC,aAAa,EAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAsB,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAChE,KAAK,CACN,CAAC;AACJ,CAAC"}

package/dist/http.js

@@ -0,0 +1,36 @@
+/**
+ * Outbound HTTP helpers shared by Apple/Google providers.
+ *
+ * Why timeouts: Node's global fetch has no default timeout. If the upstream
+ * (Apple App Store Server API, Google Play Developer API, Google OAuth) hangs,
+ * webhook handlers and validate routes hang with it — Apple/Google retry on
+ * their side, so a hung outbound call cascades into request pile-up here.
+ */
+/** Default timeout for outbound API calls (10s). */
+export const DEFAULT_FETCH_TIMEOUT_MS = 10_000;
+/**
+ * fetch with an `AbortController`-based timeout. Throws an `AbortError`-like
+ * Error when the timer fires. Caller is expected to catch and decide
+ * (return null, log, propagate as 5xx, etc.).
+ */
+export async function fetchWithTimeout(input, init, timeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
+    const controller = new AbortController();
+    // Allow caller-provided signal to compose with our timeout.
+    const callerSignal = init?.signal;
+    if (callerSignal) {
+        if (callerSignal.aborted)
+            controller.abort(callerSignal.reason);
+        else
+            callerSignal.addEventListener('abort', () => controller.abort(callerSignal.reason), { once: true });
+    }
+    const timer = setTimeout(() => {
+        controller.abort(new Error(`[onesub] fetch timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    try {
+        return await fetch(input, { ...init, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oDAAoD;AACpD,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAwB,EACxB,IAAkB,EAClB,SAAS,GAAG,wBAAwB;IAEpC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,4DAA4D;IAC5D,MAAM,YAAY,GAAG,IAAI,EAAE,MAAM,CAAC;IAClC,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,YAAY,CAAC,OAAO;YAAE,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;;YAC3D,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,kCAAkC,SAAS,IAAI,CAAC,CAAC,CAAC;IAC/E,CAAC,EAAE,SAAS,CAAC,CAAC;IAEd,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}