@onesub/server 0.18.2 → 0.19.0

package/README.md

@@ -96,6 +96,9 @@ explicit app IDs fail closed and are never validated with another app's credenti
 | `GET  /onesub/admin/subscriptions/:transactionId` | Get subscription detail (requires `adminSecret`) |
 | `GET  /onesub/admin/customers/:userId` | Get a customer profile (requires `adminSecret`) |
 | `POST /onesub/admin/sync-apple/:originalTransactionId` | Refresh a subscription from Apple (requires `adminSecret`) |
+| `GET /onesub/admin/test-overrides` | List sandbox-only entitlement overrides (requires `adminSecret`) |
+| `PUT /onesub/admin/test-overrides/:userId` | Force an entitlement verdict for one user — body `{ "entitled": false }`. Honoured **only for Sandbox receipts**, so production customers are unaffected. Exists because Apple cannot cancel a sandbox subscription bought with a real Apple Account, which otherwise locks a tester out of the purchase flow. Process-local and non-persistent |
+| `DELETE /onesub/admin/test-overrides/:userId` | Clear that user's override (requires `adminSecret`) |
 | `GET  /onesub/admin/webhook-deadletters` | List failed webhook jobs in DLQ (requires `adminSecret` + BullMQ) |
 | `POST /onesub/admin/webhook-replay/:id` | Replay a dead-letter job (requires `adminSecret` + BullMQ) |
 | `GET  /onesub/entitlement?userId=&id=` | Evaluate one configured entitlement |

package/dist/__tests__/test-overrides.test.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Sandbox-only entitlement overrides.
+ *
+ * Apple cannot cancel a sandbox subscription bought with a real Apple Account
+ * through TestFlight, so a tester who subscribes once stays entitled and can
+ * never re-run the purchase flow. That is not a hypothetical: it hid a paywall
+ * entry point from App Review (PenguinRun 2.0.6, Guideline 2.1(b)) because the
+ * reviewer had subscribed in an earlier round.
+ *
+ * The guarantee under test is the safety one — an override must be incapable of
+ * touching a paying customer. It is honoured only when the receipt just
+ * validated came from Sandbox.
+ */
+export {};
+//# sourceMappingURL=test-overrides.test.d.ts.map

package/dist/__tests__/test-overrides.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-overrides.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/test-overrides.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/dist/index.cjs

@@ -332,6 +332,10 @@ function mockValidateGoogleProduct(receipt, productId) {
 }
 
 // src/providers/apple.ts
+var EMPTY_APP_ACCOUNT_TOKEN = "00000000-0000-0000-0000-000000000000";
+function normalizeAppleAppAccountToken(token) {
+  return token === EMPTY_APP_ACCOUNT_TOKEN ? void 0 : token;
+}
 function derBase64ToPem(der) {
   return "-----BEGIN CERTIFICATE-----\n" + (der.match(/.{1,64}/g) ?? []).join("\n") + "\n-----END CERTIFICATE-----";
 }
@@ -407,7 +411,15 @@ function deriveStatus(tx, renewal) {
   return shared.SUBSCRIPTION_STATUS.EXPIRED;
 }
 async function validateAppleReceipt(receipt, config) {
-  if (config.mockMode) return mockValidateAppleSubscription(receipt);
+  if (config.mockMode) {
+    const mock = mockValidateAppleSubscription(receipt);
+    if (mock) {
+      const boundAccountId = normalizeAppleAppAccountToken(mock.boundAccountId);
+      if (boundAccountId) mock.boundAccountId = boundAccountId;
+      else delete mock.boundAccountId;
+    }
+    return mock;
+  }
   let tx;
   try {
     tx = await decodeJws(receipt, config.skipJwsVerification);
@@ -434,6 +446,7 @@ async function validateAppleReceipt(receipt, config) {
   }
   const status = deriveStatus(tx, null);
   const purchasedAt = tx.originalPurchaseDate ?? tx.purchaseDate ?? Date.now();
+  const appAccountToken = normalizeAppleAppAccountToken(tx.appAccountToken);
   return {
     userId: "",
     // caller fills this in from the request body
@@ -445,11 +458,22 @@ async function validateAppleReceipt(receipt, config) {
     purchasedAt: new Date(purchasedAt).toISOString(),
     willRenew: status === shared.SUBSCRIPTION_STATUS.ACTIVE,
     // refined by renewal info in webhook
-    ...tx.appAccountToken ? { boundAccountId: tx.appAccountToken } : {}
+    ...appAccountToken ? { boundAccountId: appAccountToken } : {},
+    // Transient, like boundAccountId: the validate route uses it to decide
+    // whether a sandbox-only test override may apply, then strips it.
+    ...tx.environment === "Sandbox" ? { sandbox: true } : {}
   };
 }
 async function validateAppleConsumableReceipt(signedTransaction, config, expectedProductId) {
-  if (config.mockMode) return mockValidateAppleProduct(signedTransaction, expectedProductId);
+  if (config.mockMode) {
+    const mock = mockValidateAppleProduct(signedTransaction, expectedProductId);
+    if (mock) {
+      const appAccountToken = normalizeAppleAppAccountToken(mock.appAccountToken);
+      if (appAccountToken) mock.appAccountToken = appAccountToken;
+      else delete mock.appAccountToken;
+    }
+    return mock;
+  }
   let tx;
   try {
     tx = await decodeJws(signedTransaction, config.skipJwsVerification);
@@ -502,7 +526,7 @@ async function validateAppleConsumableReceipt(signedTransaction, config, expecte
     transactionId,
     productId: tx.productId,
     purchasedAt: tx.purchaseDate ? new Date(tx.purchaseDate).toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
-    appAccountToken: tx.appAccountToken ?? void 0
+    appAccountToken: normalizeAppleAppAccountToken(tx.appAccountToken)
   };
 }
 async function decodeAppleNotification(payload, skipJwsVerification = false) {
@@ -534,7 +558,7 @@ async function decodeAppleNotification(payload, skipJwsVerification = false) {
     status,
     willRenew,
     expiresAt: tx.expiresDate ? new Date(tx.expiresDate).toISOString() : null,
-    appAccountToken: tx.appAccountToken ?? null,
+    appAccountToken: normalizeAppleAppAccountToken(tx.appAccountToken) ?? null,
     inAppOwnershipType: tx.inAppOwnershipType ?? null
   };
 }
@@ -724,7 +748,7 @@ async function fetchAppleTransactionHistory(originalTransactionId, config, optio
           type: tx.type ?? "Unknown",
           purchasedAt: tx.purchaseDate ? new Date(tx.purchaseDate).toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
           expiresAt: tx.expiresDate ? new Date(tx.expiresDate).toISOString() : null,
-          appAccountToken: tx.appAccountToken ?? null,
+          appAccountToken: normalizeAppleAppAccountToken(tx.appAccountToken) ?? null,
           inAppOwnershipType: tx.inAppOwnershipType ?? null,
           revocationDate: tx.revocationDate ? new Date(tx.revocationDate).toISOString() : null
         });
@@ -1241,6 +1265,21 @@ function peekAppleBundleId(jws) {
   }
 }
 
+// src/test-overrides.ts
+var overrides = /* @__PURE__ */ new Map();
+function setTestOverride(userId, entitled) {
+  overrides.set(userId, entitled);
+}
+function clearTestOverride(userId) {
+  return overrides.delete(userId);
+}
+function getTestOverride(userId) {
+  return overrides.get(userId);
+}
+function listTestOverrides() {
+  return [...overrides].map(([userId, entitled]) => ({ userId, entitled }));
+}
+
 // src/routes/validate.ts
 var NO_SUB = { valid: false, subscription: null };
 var validateSchema = zod.z.object({
@@ -1308,6 +1347,13 @@ function createValidateRouter(config, store) {
         );
         return;
       }
+      const isSandbox = sub.sandbox === true;
+      delete sub.sandbox;
+      if (isSandbox && getTestOverride(userId) === false) {
+        log.warn(`[onesub/validate] sandbox test override active for ${userId}: forcing not-entitled`);
+        sub.status = shared.SUBSCRIPTION_STATUS.EXPIRED;
+        sub.willRenew = false;
+      }
       sub.userId = userId;
       await store.save(sub);
       if (platform === "google" && appConfig.google) {
@@ -2337,6 +2383,42 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, err2.message ?? "sync error");
     }
   });
+  const overrideParamsSchema = zod.z.object({ userId: zod.z.string().min(1).max(256) });
+  const overrideBodySchema = zod.z.object({ entitled: zod.z.boolean() });
+  router.get(shared.ROUTES.ADMIN_TEST_OVERRIDES, (_req, res) => {
+    res.json({ overrides: listTestOverrides() });
+  });
+  router.put(shared.ROUTES.ADMIN_TEST_OVERRIDE, (req, res) => {
+    let params;
+    let body;
+    try {
+      params = overrideParamsSchema.parse(req.params);
+      body = overrideBodySchema.parse(req.body);
+    } catch (err2) {
+      if (err2 instanceof zod.z.ZodError) {
+        sendZodError(res, err2);
+      } else {
+        sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId and { entitled: boolean } required");
+      }
+      return;
+    }
+    setTestOverride(params.userId, body.entitled);
+    log.warn(
+      `[onesub/admin] sandbox test override set for ${params.userId}: entitled=${body.entitled}`
+    );
+    res.json({ ok: true, userId: params.userId, entitled: body.entitled, sandboxOnly: true });
+  });
+  router.delete(shared.ROUTES.ADMIN_TEST_OVERRIDE, (req, res) => {
+    let params;
+    try {
+      params = overrideParamsSchema.parse(req.params);
+    } catch {
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId required");
+      return;
+    }
+    const cleared = clearTestOverride(params.userId);
+    res.json({ ok: true, userId: params.userId, cleared });
+  });
   if (webhookQueue?.listDeadLetters) {
     router.get("/onesub/admin/webhook-deadletters", async (_req, res) => {
       try {
@@ -3500,6 +3582,54 @@ var ONESUB_OPENAPI = {
       }
     },
     // ── admin (mounted when config.adminSecret is set) ───────────────────────
+    [shared.ROUTES.ADMIN_TEST_OVERRIDES]: {
+      get: {
+        summary: "List sandbox-only entitlement overrides (admin).",
+        parameters: [ADMIN_SECRET_PARAM],
+        responses: {
+          200: { description: "OK" },
+          401: err("Invalid admin secret (INVALID_ADMIN_SECRET).")
+        }
+      }
+    },
+    "/onesub/admin/test-overrides/{userId}": {
+      put: {
+        summary: "Force an entitlement verdict for one userId. Honoured ONLY for Sandbox receipts \u2014 a Production receipt ignores it. Exists because Apple cannot cancel a sandbox subscription bought with a real Apple Account, which otherwise locks a tester in.",
+        parameters: [
+          ADMIN_SECRET_PARAM,
+          { in: "path", name: "userId", required: true, schema: { type: "string" } }
+        ],
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                required: ["entitled"],
+                properties: { entitled: { type: "boolean" } }
+              }
+            }
+          }
+        },
+        responses: {
+          200: { description: "OK" },
+          400: err("Invalid input (INVALID_INPUT)."),
+          401: err("Invalid admin secret (INVALID_ADMIN_SECRET).")
+        }
+      },
+      delete: {
+        summary: "Clear the sandbox entitlement override for one userId (admin).",
+        parameters: [
+          ADMIN_SECRET_PARAM,
+          { in: "path", name: "userId", required: true, schema: { type: "string" } }
+        ],
+        responses: {
+          200: { description: "OK" },
+          400: err("Invalid input (INVALID_INPUT)."),
+          401: err("Invalid admin secret (INVALID_ADMIN_SECRET).")
+        }
+      }
+    },
     [shared.ROUTES.ADMIN_SUBSCRIPTIONS]: {
       get: {
         summary: "Filtered, paginated subscription list (admin).",