@onesub/server 0.15.0 → 0.17.0

package/dist/__tests__/apple-cert-chain.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * BasicConstraints enforcement for x5c issuer certificates.
+ *
+ * `verifyAppleCertChain` walks the JWS x5c chain and every certificate that
+ * SIGNS another one (index >= 1, plus the bundled Apple root when used as
+ * issuer) must carry basicConstraints CA=true — otherwise an Apple-issued
+ * leaf certificate could sign a forged leaf and splice it into a chain that
+ * still terminates at the trusted root.
+ *
+ * Node's crypto module cannot mint X.509 certificates, so building a real
+ * malicious chain in-test would require an external CA dependency. Instead
+ * the constraint check lives in the exported pure function
+ * `assertIssuerCanSign`, unit-tested here directly (mock-shaped objects for
+ * the negative path, the real bundled Apple root for the positive path).
+ */
+export {};
+//# sourceMappingURL=apple-cert-chain.test.d.ts.map

package/dist/__tests__/apple-cert-chain.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-cert-chain.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/apple-cert-chain.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/__tests__/openapi.test.d.ts

@@ -1,2 +1,16 @@
+/**
+ * OpenAPI parity tests.
+ *
+ * The spec (openapi.ts) is hand-maintained, so the guard here has to be
+ * mechanical: mount EVERY router via `createOneSubMiddleware` (adminSecret +
+ * entitlements + both mock platforms + offer keys + a DLQ-capable queue so
+ * every conditional router mounts), walk the express router stack to extract
+ * each registered path+method, and assert both directions:
+ *
+ *   1. every mounted route is documented (no undocumented endpoints)
+ *   2. every documented path is actually mounted (no stale spec entries)
+ *
+ * Express params (`:userId`) are normalized to OpenAPI form (`{userId}`).
+ */
 export {};
 //# sourceMappingURL=openapi.test.d.ts.map

package/dist/__tests__/openapi.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/openapi.test.ts"],"names":[],"mappings":""}
+{"version":3,"file":"openapi.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/openapi.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/__tests__/receipt-age.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * productReceiptMaxAgeHours — the one-time-purchase replay window is
+ * configurable (default 72h) so historical receipts can be validated on
+ * purpose (backend migrations, e2e against real store transactions).
+ */
+export {};
+//# sourceMappingURL=receipt-age.test.d.ts.map

package/dist/__tests__/receipt-age.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-age.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/receipt-age.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/__tests__/secret-compare.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=secret-compare.test.d.ts.map

package/dist/__tests__/secret-compare.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-compare.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/secret-compare.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/webhook-queue-integration.test.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Integration tests for the webhook queue wiring (config.webhookQueue).
+ *
+ * Covers:
+ *   - Queue mode: gating runs inline, decoded work is enqueued, the handler
+ *     registered in createWebhookRouter applies the state change (Apple + Google)
+ *   - Queue mode gating: invalid payloads 400 inline and are never enqueued;
+ *     duplicate event ids are deduped without a second job
+ *   - Job payloads survive a JSON round-trip (BullMQ ships them through Redis)
+ *   - Enqueue failure → 500 + unmark, so the source retry is processed
+ *   - Handler (job) failure does NOT unmark — the queue's retries/dead-letter
+ *     own recovery, and a source retry must stay deduped
+ *   - InProcessWebhookQueue works as a configured queue (synchronous inline run)
+ *   - Full middleware wiring via createOneSubMiddleware, including the admin
+ *     dead-letter endpoint reading from the configured queue
+ *   - BullMQWebhookQueue.setHandler without bullmq installed: no unhandled
+ *     rejection; the startup error surfaces on the next enqueue()
+ */
+export {};
+//# sourceMappingURL=webhook-queue-integration.test.d.ts.map

package/dist/__tests__/webhook-queue-integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-queue-integration.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/webhook-queue-integration.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}