@onesub/server 0.13.1 → 0.14.0

package/dist/index.cjs

@@ -255,10 +255,12 @@ function mockValidateAppleProduct(receipt, expectedProductId) {
   const outcome = classifyMockReceipt(receipt);
   if (!outcomePasses(outcome, "apple")) return null;
   const productId = expectedProductId ?? "mock_product";
+  const tokenMatch = receipt.match(/#token=([^#]+)/);
   return {
     transactionId: deterministicTransactionId(`mock_apple_${productId}`, receipt),
     productId,
-    purchasedAt: (/* @__PURE__ */ new Date()).toISOString()
+    purchasedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...tokenMatch ? { appAccountToken: tokenMatch[1] } : {}
   };
 }
 function mockValidateGoogleSubscription(receipt, productId) {
@@ -280,9 +282,11 @@ function mockValidateGoogleSubscription(receipt, productId) {
 function mockValidateGoogleProduct(receipt, productId) {
   const outcome = classifyMockReceipt(receipt);
   if (!outcomePasses(outcome, "google")) return null;
+  const tokenMatch = receipt.match(/#token=([^#]+)/);
   return {
     transactionId: deterministicTransactionId(`mock_google_${productId}`, receipt),
-    purchasedAt: (/* @__PURE__ */ new Date()).toISOString()
+    purchasedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...tokenMatch ? { obfuscatedExternalAccountId: tokenMatch[1] } : {}
   };
 }
 
@@ -446,7 +450,8 @@ async function validateAppleConsumableReceipt(signedTransaction, config, expecte
   return {
     transactionId,
     productId: tx.productId,
-    purchasedAt: tx.purchaseDate ? new Date(tx.purchaseDate).toISOString() : (/* @__PURE__ */ new Date()).toISOString()
+    purchasedAt: tx.purchaseDate ? new Date(tx.purchaseDate).toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
+    appAccountToken: tx.appAccountToken ?? void 0
   };
 }
 async function decodeAppleNotification(payload, skipJwsVerification = false) {
@@ -1005,7 +1010,8 @@ async function validateGoogleProductReceipt(purchaseToken, productId, config, ty
   }
   return {
     transactionId: purchase.orderId,
-    purchasedAt: purchase.purchaseTimeMillis ? new Date(parseInt(purchase.purchaseTimeMillis, 10)).toISOString() : (/* @__PURE__ */ new Date()).toISOString()
+    purchasedAt: purchase.purchaseTimeMillis ? new Date(parseInt(purchase.purchaseTimeMillis, 10)).toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
+    obfuscatedExternalAccountId: purchase.obfuscatedExternalAccountId
   };
 }
 function decodeGoogleNotification(payload) {
@@ -1551,6 +1557,7 @@ function createPurchaseRouter(config, purchaseStore) {
       }
       let transactionId = null;
       let purchasedAt = (/* @__PURE__ */ new Date()).toISOString();
+      let boundAccountId = null;
       if (platform === "apple") {
         if (!config.apple) {
           sendError(res, 500, shared.ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, "Apple configuration not provided", NO_PURCHASE);
@@ -1560,6 +1567,7 @@ function createPurchaseRouter(config, purchaseStore) {
         if (result) {
           transactionId = result.transactionId;
           purchasedAt = result.purchasedAt;
+          boundAccountId = result.appAccountToken ?? null;
         }
       } else {
         if (!config.google) {
@@ -1575,12 +1583,26 @@ function createPurchaseRouter(config, purchaseStore) {
         if (result) {
           transactionId = result.transactionId;
           purchasedAt = result.purchasedAt;
+          boundAccountId = result.obfuscatedExternalAccountId ?? null;
         }
       }
       if (!transactionId) {
         sendError(res, 422, shared.ONESUB_ERROR_CODE.RECEIPT_VALIDATION_FAILED, "Receipt validation failed", NO_PURCHASE);
         return;
       }
+      if (boundAccountId && boundAccountId.toLowerCase() !== userId.toLowerCase()) {
+        log.warn(
+          `[onesub/purchase] account binding mismatch for transaction ${transactionId}: token does not match userId ${userId}`
+        );
+        sendError(
+          res,
+          409,
+          shared.ONESUB_ERROR_CODE.TRANSACTION_BELONGS_TO_OTHER_USER,
+          "TRANSACTION_BELONGS_TO_OTHER_USER",
+          NO_PURCHASE
+        );
+        return;
+      }
       const existing = await purchaseStore.getPurchaseByTransactionId(transactionId);
       let action = "new";
       if (existing) {