@onesub/server 0.19.0 → 0.21.0

package/dist/index.js

@@ -2,7 +2,7 @@ import express, { Router } from 'express';
 import { PURCHASE_TYPE, ONESUB_ERROR_CODE, ROUTES, DEFAULT_PORT, SUBSCRIPTION_STATUS, MOCK_RECEIPT_PREFIX } from '@onesub/shared';
 import { z } from 'zod';
 import { decodeJwt, decodeProtectedHeader, importX509, jwtVerify, importPKCS8, SignJWT, createRemoteJWKSet } from 'jose';
-import { X509Certificate, randomUUID, timingSafeEqual, createSign, createHash } from 'crypto';
+import { X509Certificate, createHash, randomUUID, timingSafeEqual, createSign } from 'crypto';
 import { createRequire } from 'module';
 
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
@@ -84,11 +84,17 @@ var InMemoryPurchaseStore = class {
     }
     this.byTransactionId.set(purchase.transactionId, purchase);
     const list = this.byUserId.get(purchase.userId) ?? [];
-    list.push(purchase);
+    const at = Date.parse(purchase.purchasedAt);
+    const idx = list.findIndex((p) => Date.parse(p.purchasedAt) < at);
+    if (idx === -1) list.push(purchase);
+    else list.splice(idx, 0, purchase);
     this.byUserId.set(purchase.userId, list);
   }
   async getPurchasesByUserId(userId) {
-    return this.byUserId.get(userId) ?? [];
+    return [...this.byUserId.get(userId) ?? []];
+  }
+  async getPurchasesForProduct(userId, productId) {
+    return (this.byUserId.get(userId) ?? []).filter((p) => p.productId === productId);
   }
   async getPurchaseByTransactionId(txId) {
     return this.byTransactionId.get(txId) ?? null;
@@ -173,9 +179,13 @@ var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 async function fetchWithTimeout(input, init, timeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
   const controller = new AbortController();
   const callerSignal = init?.signal;
+  let onCallerAbort;
   if (callerSignal) {
     if (callerSignal.aborted) controller.abort(callerSignal.reason);
-    else callerSignal.addEventListener("abort", () => controller.abort(callerSignal.reason), { once: true });
+    else {
+      onCallerAbort = () => controller.abort(callerSignal.reason);
+      callerSignal.addEventListener("abort", onCallerAbort, { once: true });
+    }
   }
   const timer = setTimeout(() => {
     controller.abort(new Error(`[onesub] fetch timed out after ${timeoutMs}ms`));
@@ -184,6 +194,7 @@ async function fetchWithTimeout(input, init, timeoutMs = DEFAULT_FETCH_TIMEOUT_M
     return await fetch(input, { ...init, signal: controller.signal });
   } finally {
     clearTimeout(timer);
+    if (onCallerAbort) callerSignal?.removeEventListener("abort", onCallerAbort);
   }
 }
 
@@ -236,6 +247,70 @@ function getDefaultCache() {
 function setDefaultCache(adapter) {
   defaultAdapter = adapter;
 }
+var DEFAULT_MAX_ENTRIES = 32;
+var DEFAULT_MAX_TTL_MS = 60 * 60 * 1e3;
+var VerifiedKeyCache = class {
+  entries = /* @__PURE__ */ new Map();
+  maxEntries;
+  maxTtlMs;
+  now;
+  constructor(opts = {}) {
+    this.maxEntries = opts.maxEntries ?? DEFAULT_MAX_ENTRIES;
+    this.maxTtlMs = opts.maxTtlMs ?? DEFAULT_MAX_TTL_MS;
+    this.now = opts.now ?? Date.now;
+  }
+  /**
+   * Return the key for `parts`, verifying via `produce` only on a miss.
+   *
+   * `parts` must contain every input the verification depends on — for Apple
+   * that is the JWS `alg` plus the full x5c chain. Anything left out would let
+   * one input's result be served for a different input.
+   */
+  async resolve(parts, produce) {
+    const cacheKey = digest(parts);
+    const now = this.now();
+    const hit = this.entries.get(cacheKey);
+    if (hit) {
+      if (hit.expiresAt > now) return hit.key;
+      this.entries.delete(cacheKey);
+    }
+    const verified = await produce();
+    const expiresAt = Math.min(now + this.maxTtlMs, verified.notAfter);
+    if (expiresAt > now) {
+      this.prune(now);
+      this.entries.set(cacheKey, { key: verified.key, expiresAt });
+    }
+    return verified.key;
+  }
+  /** Entries currently held, including any not yet pruned. Test/diagnostic use. */
+  get size() {
+    return this.entries.size;
+  }
+  /** Drop everything. Test/diagnostic use. */
+  clear() {
+    this.entries.clear();
+  }
+  /** Make room: expired entries first, then the oldest insertions. */
+  prune(now) {
+    for (const [key, entry] of this.entries) {
+      if (entry.expiresAt <= now) this.entries.delete(key);
+    }
+    while (this.entries.size >= this.maxEntries) {
+      const oldest = this.entries.keys().next();
+      if (oldest.done) break;
+      this.entries.delete(oldest.value);
+    }
+  }
+};
+function digest(parts) {
+  const hash = createHash("sha256");
+  for (const part of parts) {
+    hash.update(String(part.length));
+    hash.update(":");
+    hash.update(part);
+  }
+  return hash.digest("base64");
+}
 function classifyMockReceipt(receipt) {
   if (receipt.startsWith(MOCK_RECEIPT_PREFIX.NETWORK_ERROR)) return { kind: "network-error" };
   if (receipt.startsWith(MOCK_RECEIPT_PREFIX.REVOKED)) return { kind: "revoked" };
@@ -255,8 +330,8 @@ function outcomePasses(outcome, tag) {
   return false;
 }
 function deterministicTransactionId(prefix, receipt) {
-  const digest = createHash("sha256").update(receipt).digest("hex").slice(0, 24);
-  return `${prefix}_${digest}`;
+  const digest2 = createHash("sha256").update(receipt).digest("hex").slice(0, 24);
+  return `${prefix}_${digest2}`;
 }
 function extractBoundToken(receipt) {
   return receipt.match(/#token=([^#]+)/)?.[1];
@@ -346,11 +421,15 @@ function verifyAppleCertChain(x5c) {
   }
   const chain = x5c.map((der) => new X509Certificate(derBase64ToPem(der)));
   const now = /* @__PURE__ */ new Date();
+  let notAfter = Infinity;
   for (let i = 0; i < chain.length; i++) {
     const cert = chain[i];
-    if (new Date(cert.validFrom) > now || new Date(cert.validTo) < now) {
+    const validTo = new Date(cert.validTo).getTime();
+    if (new Date(cert.validFrom) > now || validTo < now.getTime()) {
       throw new Error(`[onesub/apple] cert[${i}] outside validity window`);
     }
+    if (Number.isNaN(validTo)) notAfter = 0;
+    else if (validTo < notAfter) notAfter = validTo;
     if (i >= 1) assertIssuerCanSign(cert, i);
     if (i + 1 < chain.length) {
       if (!cert.checkIssued(chain[i + 1]) || !cert.verify(chain[i + 1].publicKey)) {
@@ -373,8 +452,9 @@ function verifyAppleCertChain(x5c) {
   if (!trustsRoot) {
     throw new Error("[onesub/apple] cert chain does not terminate at a trusted Apple root");
   }
-  return chain[0].toString();
+  return { leafPem: chain[0].toString(), notAfter };
 }
+var appleLeafKeys = new VerifiedKeyCache();
 async function decodeJws(jws, skipVerification = false) {
   if (skipVerification) {
     if (process.env["NODE_ENV"] === "production") {
@@ -389,9 +469,11 @@ async function decodeJws(jws, skipVerification = false) {
   if (!x5c || x5c.length === 0) {
     throw new Error("[onesub/apple] JWS header missing x5c certificate chain");
   }
-  const leafPem = verifyAppleCertChain(x5c);
   const alg = header.alg ?? "ES256";
-  const key = await importX509(leafPem, alg);
+  const key = await appleLeafKeys.resolve([alg, ...x5c], async () => {
+    const { leafPem, notAfter } = verifyAppleCertChain(x5c);
+    return { key: await importX509(leafPem, alg), notAfter };
+  });
   const { payload } = await jwtVerify(jws, key);
   return payload;
 }
@@ -1898,6 +1980,13 @@ var purchaseStatusQuerySchema = z.object({
   userId: z.string().min(1).max(256),
   productId: z.string().min(1).max(256).optional()
 });
+async function purchasesForProduct(purchaseStore, userId, productId) {
+  if (purchaseStore.getPurchasesForProduct) {
+    return purchaseStore.getPurchasesForProduct(userId, productId);
+  }
+  const all = await purchaseStore.getPurchasesByUserId(userId);
+  return all.filter((p) => p.productId === productId);
+}
 function createPurchaseRouter(config, purchaseStore) {
   const router = Router();
   const registry = getAppRegistry(config);
@@ -1919,9 +2008,7 @@ function createPurchaseRouter(config, purchaseStore) {
     });
     try {
       if (type === PURCHASE_TYPE.NON_CONSUMABLE) {
-        const owned = (await purchaseStore.getPurchasesByUserId(userId)).find(
-          (p) => p.productId === productId
-        );
+        const owned = (await purchasesForProduct(purchaseStore, userId, productId))[0];
         if (owned) {
           const response2 = {
             valid: true,
@@ -2051,10 +2138,7 @@ function createPurchaseRouter(config, purchaseStore) {
     }
     const { userId, productId } = query;
     try {
-      let purchases = await purchaseStore.getPurchasesByUserId(userId);
-      if (productId !== void 0) {
-        purchases = purchases.filter((p) => p.productId === productId);
-      }
+      const purchases = productId !== void 0 ? await purchasesForProduct(purchaseStore, userId, productId) : await purchaseStore.getPurchasesByUserId(userId);
       const response = { purchases };
       res.status(200).json(response);
     } catch (err2) {
@@ -2064,10 +2148,8 @@ function createPurchaseRouter(config, purchaseStore) {
   });
   return router;
 }
-async function evaluateEntitlement(userId, entitlement, store, purchaseStore) {
+function evaluateEntitlementFrom(subs, purchases, entitlement, now = Date.now()) {
   const productIdSet = new Set(entitlement.productIds);
-  const now = Date.now();
-  const subs = await store.getAllByUserId(userId);
   for (const sub of subs) {
     if (!productIdSet.has(sub.productId)) continue;
     const statusAllows = sub.status === SUBSCRIPTION_STATUS.ACTIVE || sub.status === SUBSCRIPTION_STATUS.GRACE_PERIOD;
@@ -2080,7 +2162,6 @@ async function evaluateEntitlement(userId, entitlement, store, purchaseStore) {
       expiresAt: sub.expiresAt
     };
   }
-  const purchases = await purchaseStore.getPurchasesByUserId(userId);
   for (const p of purchases) {
     if (p.type !== PURCHASE_TYPE.NON_CONSUMABLE) continue;
     if (!productIdSet.has(p.productId)) continue;
@@ -2092,6 +2173,14 @@ async function evaluateEntitlement(userId, entitlement, store, purchaseStore) {
   }
   return { active: false, source: null };
 }
+async function evaluateEntitlement(userId, entitlement, store, purchaseStore) {
+  const now = Date.now();
+  const subs = await store.getAllByUserId(userId);
+  const fromSubs = evaluateEntitlementFrom(subs, [], entitlement, now);
+  if (fromSubs.active) return fromSubs;
+  const purchases = await purchaseStore.getPurchasesByUserId(userId);
+  return evaluateEntitlementFrom([], purchases, entitlement, now);
+}
 var userIdSchema = z.string().min(1).max(256);
 var entitlementIdSchema = z.string().min(1).max(128);
 function createEntitlementRouter(config, store, purchaseStore) {
@@ -2133,11 +2222,13 @@ function createEntitlementRouter(config, store, purchaseStore) {
       return;
     }
     try {
-      const entries = await Promise.all(
-        Object.entries(entitlements).map(async ([id, entitlement]) => {
-          const status = await evaluateEntitlement(userId, entitlement, store, purchaseStore);
-          return [id, status];
-        })
+      const [subs, purchases] = await Promise.all([
+        store.getAllByUserId(userId),
+        purchaseStore.getPurchasesByUserId(userId)
+      ]);
+      const now = Date.now();
+      const entries = Object.entries(entitlements).map(
+        ([id, entitlement]) => [id, evaluateEntitlementFrom(subs, purchases, entitlement, now)]
       );
       const response = {
         entitlements: Object.fromEntries(entries)
@@ -2328,9 +2419,10 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       ]);
       let entitlements;
       if (config.entitlements && Object.keys(config.entitlements).length > 0) {
+        const now = Date.now();
         entitlements = {};
         for (const [id, def] of Object.entries(config.entitlements)) {
-          entitlements[id] = await evaluateEntitlement(params.userId, def, store, purchaseStore);
+          entitlements[id] = evaluateEntitlementFrom(subscriptions, purchases, def, now);
         }
       }
       const response = {
@@ -2442,11 +2534,135 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
   }
   return router;
 }
+var MS_PER_DAY = 864e5;
+function bump(map, key) {
+  map[key] = (map[key] ?? 0) + 1;
+}
+function utcDateKey(ms) {
+  const d = new Date(ms);
+  const yyyy = d.getUTCFullYear();
+  const mm = String(d.getUTCMonth() + 1).padStart(2, "0");
+  const dd = String(d.getUTCDate()).padStart(2, "0");
+  return `${yyyy}-${mm}-${dd}`;
+}
+function emptyDailyBuckets(fromMs, toMs) {
+  const out = [];
+  const start = new Date(fromMs);
+  start.setUTCHours(0, 0, 0, 0);
+  let cur = start.getTime();
+  while (cur <= toMs) {
+    out.push({ date: utcDateKey(cur), count: 0 });
+    cur += MS_PER_DAY;
+  }
+  return out;
+}
+function aggregateRange(records, opts) {
+  const byProduct = {};
+  const byPlatform = {};
+  let total = 0;
+  const buckets = opts.groupBy === "day" ? emptyDailyBuckets(opts.fromMs, opts.toMs) : null;
+  const bucketIndex = buckets ? new Map(buckets.map((b, i) => [b.date, i])) : null;
+  for (const record of records) {
+    if (opts.include && !opts.include(record)) continue;
+    const anchorMs = new Date(opts.anchor(record)).getTime();
+    if (Number.isNaN(anchorMs)) continue;
+    if (anchorMs < opts.fromMs || anchorMs > opts.toMs) continue;
+    total++;
+    bump(byProduct, record.productId);
+    bump(byPlatform, record.platform);
+    if (buckets && bucketIndex) {
+      const idx = bucketIndex.get(utcDateKey(anchorMs));
+      if (idx !== void 0) buckets[idx].count++;
+    }
+  }
+  return { total, byProduct, byPlatform, ...buckets ? { buckets } : {} };
+}
+function isActiveSubscription(sub, nowMs) {
+  const statusAllows = sub.status === SUBSCRIPTION_STATUS.ACTIVE || sub.status === SUBSCRIPTION_STATUS.GRACE_PERIOD;
+  return statusAllows && new Date(sub.expiresAt).getTime() > nowMs;
+}
+function isEndedSubscription(sub) {
+  return sub.status === SUBSCRIPTION_STATUS.EXPIRED || sub.status === SUBSCRIPTION_STATUS.CANCELED;
+}
+function isNonConsumable(purchase) {
+  return purchase.type === PURCHASE_TYPE.NON_CONSUMABLE;
+}
+function aggregateActive(subs, purchases, nowMs) {
+  const byProduct = {};
+  const byProductPurchases = {};
+  const byPlatform = {};
+  let activeSubscriptions = 0;
+  let gracePeriodSubscriptions = 0;
+  let nonConsumablePurchases = 0;
+  for (const sub of subs) {
+    if (!isActiveSubscription(sub, nowMs)) continue;
+    activeSubscriptions++;
+    if (sub.status === SUBSCRIPTION_STATUS.GRACE_PERIOD) gracePeriodSubscriptions++;
+    bump(byProduct, sub.productId);
+    bump(byPlatform, sub.platform);
+  }
+  for (const purchase of purchases) {
+    if (!isNonConsumable(purchase)) continue;
+    nonConsumablePurchases++;
+    bump(byProductPurchases, purchase.productId);
+    bump(byPlatform, purchase.platform);
+  }
+  return {
+    total: activeSubscriptions + nonConsumablePurchases,
+    activeSubscriptions,
+    gracePeriodSubscriptions,
+    nonConsumablePurchases,
+    byProduct,
+    byProductPurchases,
+    byPlatform
+  };
+}
+
+// src/metrics-cache.ts
+function isDisabled(ttlSeconds) {
+  return !Number.isFinite(ttlSeconds) || ttlSeconds <= 0;
+}
+function createMetricsCache(ttlSeconds, storage = new InMemoryCacheAdapter()) {
+  const inflight = /* @__PURE__ */ new Map();
+  const gridMs = Math.max(1, Math.floor(ttlSeconds * 1e3));
+  return {
+    quantizeToWindow(ms) {
+      if (isDisabled(ttlSeconds)) return ms;
+      return Math.floor(ms / gridMs) * gridMs;
+    },
+    async resolve(keyParts, produce) {
+      if (isDisabled(ttlSeconds)) return produce();
+      const key = `metrics:${keyParts.join(":")}`;
+      const cache = storage;
+      const hit = await cache.get(key);
+      if (hit !== null && hit !== void 0) return hit;
+      const pending = inflight.get(key);
+      if (pending) return pending;
+      const promise = (async () => {
+        const value = await produce();
+        await cache.set(key, value, ttlSeconds);
+        return value;
+      })();
+      inflight.set(key, promise);
+      try {
+        return await promise;
+      } finally {
+        inflight.delete(key);
+      }
+    }
+  };
+}
+
+// src/routes/metrics.ts
 var ADMIN_SECRET_HEADER2 = "x-admin-secret";
+var DEFAULT_METRICS_CACHE_TTL_SECONDS = 30;
 function createMetricsRouter(config, store, purchaseStore) {
   if (!config.adminSecret) return null;
   const router = Router();
   const adminSecret = config.adminSecret;
+  const metricsCache = createMetricsCache(
+    config.metricsCacheTtlSeconds ?? DEFAULT_METRICS_CACHE_TTL_SECONDS
+  );
   router.use("/onesub/metrics", (req, res, next) => {
     const provided = req.headers[ADMIN_SECRET_HEADER2];
     if (typeof provided !== "string" || !secretsEqual(provided, adminSecret)) {
@@ -2455,50 +2671,15 @@ function createMetricsRouter(config, store, purchaseStore) {
     }
     next();
   });
-  const isActiveSub = (sub, now) => {
-    const statusAllows = sub.status === SUBSCRIPTION_STATUS.ACTIVE || sub.status === SUBSCRIPTION_STATUS.GRACE_PERIOD;
-    return statusAllows && new Date(sub.expiresAt).getTime() > now;
-  };
-  const bump = (map, key) => {
-    map[key] = (map[key] ?? 0) + 1;
-  };
   router.get(ROUTES.METRICS_ACTIVE, async (_req, res) => {
     try {
-      const [subs, purchases] = await Promise.all([
-        store.listAll(),
-        purchaseStore.listAll()
-      ]);
-      const now = Date.now();
-      const byProduct = {};
-      const byProductPurchases = {};
-      const byPlatform = {};
-      let activeSubscriptions = 0;
-      let gracePeriodSubscriptions = 0;
-      let nonConsumablePurchases = 0;
-      for (const sub of subs) {
-        if (!isActiveSub(sub, now)) continue;
-        activeSubscriptions++;
-        if (sub.status === SUBSCRIPTION_STATUS.GRACE_PERIOD) {
-          gracePeriodSubscriptions++;
+      const response = await metricsCache.resolve(
+        ["active", metricsCache.quantizeToWindow(Date.now())],
+        async () => {
+          const [subs, purchases] = await Promise.all([store.listAll(), purchaseStore.listAll()]);
+          return aggregateActive(subs, purchases, Date.now());
         }
-        bump(byProduct, sub.productId);
-        bump(byPlatform, sub.platform);
-      }
-      for (const p of purchases) {
-        if (p.type !== PURCHASE_TYPE.NON_CONSUMABLE) continue;
-        nonConsumablePurchases++;
-        bump(byProductPurchases, p.productId);
-        bump(byPlatform, p.platform);
-      }
-      const response = {
-        total: activeSubscriptions + nonConsumablePurchases,
-        activeSubscriptions,
-        gracePeriodSubscriptions,
-        nonConsumablePurchases,
-        byProduct,
-        byProductPurchases,
-        byPlatform
-      };
+      );
       res.status(200).json(response);
     } catch (err2) {
       log.error("[onesub/metrics/active] error:", err2);
@@ -2529,140 +2710,63 @@ function createMetricsRouter(config, store, purchaseStore) {
     }
     return { fromMs, toMs, groupBy };
   }
-  function utcDateKey(ms) {
-    const d = new Date(ms);
-    const yyyy = d.getUTCFullYear();
-    const mm = String(d.getUTCMonth() + 1).padStart(2, "0");
-    const dd = String(d.getUTCDate()).padStart(2, "0");
-    return `${yyyy}-${mm}-${dd}`;
-  }
-  function emptyDailyBuckets(fromMs, toMs) {
-    const out = [];
-    const start = new Date(fromMs);
-    start.setUTCHours(0, 0, 0, 0);
-    let cur = start.getTime();
-    while (cur <= toMs) {
-      out.push({ date: utcDateKey(cur), count: 0 });
-      cur += 864e5;
-    }
-    return out;
-  }
-  router.get(ROUTES.METRICS_STARTED, async (req, res) => {
-    const range = parseRange(req);
-    if ("error" in range) {
-      sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, range.error);
-      return;
-    }
-    try {
-      const subs = await store.listAll();
-      const byProduct = {};
-      const byPlatform = {};
-      let total = 0;
-      const buckets = range.groupBy === "day" ? emptyDailyBuckets(range.fromMs, range.toMs) : null;
-      const bucketIndex = buckets ? new Map(buckets.map((b, i) => [b.date, i])) : null;
-      for (const sub of subs) {
-        const purchasedMs = new Date(sub.purchasedAt).getTime();
-        if (purchasedMs < range.fromMs || purchasedMs > range.toMs) continue;
-        total++;
-        bump(byProduct, sub.productId);
-        bump(byPlatform, sub.platform);
-        if (buckets && bucketIndex) {
-          const idx = bucketIndex.get(utcDateKey(purchasedMs));
-          if (idx !== void 0) buckets[idx].count++;
-        }
-      }
-      const response = {
-        from: req.query["from"],
-        to: req.query["to"],
-        total,
-        byProduct,
-        byPlatform,
-        ...buckets ? { buckets } : {}
-      };
-      res.status(200).json(response);
-    } catch (err2) {
-      log.error("[onesub/metrics/started] error:", err2);
-      sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
-    }
-  });
-  router.get(ROUTES.METRICS_EXPIRED, async (req, res) => {
-    const range = parseRange(req);
-    if ("error" in range) {
-      sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, range.error);
-      return;
-    }
-    try {
-      const subs = await store.listAll();
-      const byProduct = {};
-      const byPlatform = {};
-      let total = 0;
-      const buckets = range.groupBy === "day" ? emptyDailyBuckets(range.fromMs, range.toMs) : null;
-      const bucketIndex = buckets ? new Map(buckets.map((b, i) => [b.date, i])) : null;
-      for (const sub of subs) {
-        if (sub.status !== SUBSCRIPTION_STATUS.EXPIRED && sub.status !== SUBSCRIPTION_STATUS.CANCELED) continue;
-        const expiredMs = new Date(sub.expiresAt).getTime();
-        if (expiredMs < range.fromMs || expiredMs > range.toMs) continue;
-        total++;
-        bump(byProduct, sub.productId);
-        bump(byPlatform, sub.platform);
-        if (buckets && bucketIndex) {
-          const idx = bucketIndex.get(utcDateKey(expiredMs));
-          if (idx !== void 0) buckets[idx].count++;
-        }
+  function windowed(name, load, anchor, include) {
+    return async (req, res) => {
+      const range = parseRange(req);
+      if ("error" in range) {
+        sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, range.error);
+        return;
       }
-      const response = {
-        from: req.query["from"],
-        to: req.query["to"],
-        total,
-        byProduct,
-        byPlatform,
-        ...buckets ? { buckets } : {}
-      };
-      res.status(200).json(response);
-    } catch (err2) {
-      log.error("[onesub/metrics/expired] error:", err2);
-      sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
-    }
-  });
-  router.get(ROUTES.METRICS_PURCHASES_STARTED, async (req, res) => {
-    const range = parseRange(req);
-    if ("error" in range) {
-      sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, range.error);
-      return;
-    }
-    try {
-      const purchases = await purchaseStore.listAll();
-      const byProduct = {};
-      const byPlatform = {};
-      let total = 0;
-      const buckets = range.groupBy === "day" ? emptyDailyBuckets(range.fromMs, range.toMs) : null;
-      const bucketIndex = buckets ? new Map(buckets.map((b, i) => [b.date, i])) : null;
-      for (const p of purchases) {
-        if (p.type !== PURCHASE_TYPE.NON_CONSUMABLE) continue;
-        const purchasedMs = new Date(p.purchasedAt).getTime();
-        if (purchasedMs < range.fromMs || purchasedMs > range.toMs) continue;
-        total++;
-        bump(byProduct, p.productId);
-        bump(byPlatform, p.platform);
-        if (buckets && bucketIndex) {
-          const idx = bucketIndex.get(utcDateKey(purchasedMs));
-          if (idx !== void 0) buckets[idx].count++;
-        }
+      try {
+        const aggregate = await metricsCache.resolve(
+          [
+            name,
+            metricsCache.quantizeToWindow(range.fromMs),
+            metricsCache.quantizeToWindow(range.toMs),
+            range.groupBy
+          ],
+          async () => aggregateRange(await load(), {
+            fromMs: range.fromMs,
+            toMs: range.toMs,
+            groupBy: range.groupBy,
+            anchor,
+            ...include ? { include } : {}
+          })
+        );
+        const response = {
+          from: req.query["from"],
+          to: req.query["to"],
+          ...aggregate
+        };
+        res.status(200).json(response);
+      } catch (err2) {
+        log.error(`[onesub/metrics/${name}] error:`, err2);
+        sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
       }
-      const response = {
-        from: req.query["from"],
-        to: req.query["to"],
-        total,
-        byProduct,
-        byPlatform,
-        ...buckets ? { buckets } : {}
-      };
-      res.status(200).json(response);
-    } catch (err2) {
-      log.error("[onesub/metrics/purchases/started] error:", err2);
-      sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
-    }
-  });
+    };
+  }
+  router.get(
+    ROUTES.METRICS_STARTED,
+    windowed("started", () => store.listAll(), (sub) => sub.purchasedAt)
+  );
+  router.get(
+    ROUTES.METRICS_EXPIRED,
+    windowed(
+      "expired",
+      () => store.listAll(),
+      (sub) => sub.expiresAt,
+      isEndedSubscription
+    )
+  );
+  router.get(
+    ROUTES.METRICS_PURCHASES_STARTED,
+    windowed(
+      "purchases-started",
+      () => purchaseStore.listAll(),
+      (purchase) => purchase.purchasedAt,
+      isNonConsumable
+    )
+  );
   return router;
 }
 var OFFER_SECRET_HEADER = "x-onesub-offer-secret";
@@ -3010,6 +3114,26 @@ var PostgresPurchaseStore = class {
     );
     return result.rows.map(rowToPurchaseInfo);
   }
+  /**
+   * Purchases for one user + product, most-recent-first.
+   *
+   * Same shape and ordering as `getPurchasesByUserId`, with `product_id` pushed
+   * into the WHERE clause instead of filtered in process. Non-consumables also
+   * have a partial unique index on `(user_id, product_id)`, so the ownership
+   * check this backs is a single index lookup rather than a full read of the
+   * user's purchase history.
+   */
+  async getPurchasesForProduct(userId, productId) {
+    const pool = await this.getPool();
+    const result = await pool.query(
+      `SELECT *
+         FROM onesub_purchases
+        WHERE user_id = $1 AND product_id = $2
+        ORDER BY purchased_at DESC`,
+      [userId, productId]
+    );
+    return result.rows.map(rowToPurchaseInfo);
+  }
   async getPurchaseByTransactionId(txId) {
     const pool = await this.getPool();
     const result = await pool.query(
@@ -3220,6 +3344,23 @@ var RedisPurchaseStore = class {
     const raws = await this.redis.mget(...ids.map((id) => PUR_TX_PREFIX + id));
     return raws.filter((r) => r != null).map((r) => JSON.parse(r));
   }
+  /**
+   * Purchases for one user + product, most-recent-first.
+   *
+   * Served from the `user_product` set that `savePurchase` already maintains for
+   * `hasPurchased`, so this reads only the rows for this product rather than the
+   * user's whole purchase history.
+   *
+   * That set is unordered — unlike the per-user sorted set — so the
+   * most-recent-first contract is restored by an explicit sort here. The row
+   * count is per-product, so this is small.
+   */
+  async getPurchasesForProduct(userId, productId) {
+    const ids = await this.redis.smembers(PUR_USER_PRODUCT_PREFIX + userId + ":" + productId);
+    if (ids.length === 0) return [];
+    const raws = await this.redis.mget(...ids.map((id) => PUR_TX_PREFIX + id));
+    return raws.filter((r) => r != null).map((r) => JSON.parse(r)).sort((a, b) => Date.parse(b.purchasedAt) - Date.parse(a.purchasedAt));
+  }
   async getPurchaseByTransactionId(txId) {
     const raw = await this.redis.get(PUR_TX_PREFIX + txId);
     return raw ? JSON.parse(raw) : null;
@@ -4126,6 +4267,6 @@ if (isMain) {
   });
 }
 
-export { BullMQWebhookQueue, CacheWebhookEventStore, InMemoryCacheAdapter, InMemoryPurchaseStore, InMemorySubscriptionStore, InMemoryWebhookEventStore, InProcessWebhookQueue, ONESUB_OPENAPI, PostgresPurchaseStore, PostgresSubscriptionStore, RedisCacheAdapter, RedisPurchaseStore, RedisSubscriptionStore, RedisWebhookEventStore, createOneSubMiddleware, createOneSubServer, evaluateEntitlement, fetchAppleSubscriptionStatus, fetchAppleTransactionHistory, getDefaultCache, log, openapiHandler, processAppleNotification, processGoogleNotification, setDefaultCache, setLogger, signApplePromotionalOffer, unmarkWebhookEvent, validateAppleReceipt, validateGoogleReceipt, withSpan };
+export { BullMQWebhookQueue, CacheWebhookEventStore, InMemoryCacheAdapter, InMemoryPurchaseStore, InMemorySubscriptionStore, InMemoryWebhookEventStore, InProcessWebhookQueue, ONESUB_OPENAPI, PostgresPurchaseStore, PostgresSubscriptionStore, RedisCacheAdapter, RedisPurchaseStore, RedisSubscriptionStore, RedisWebhookEventStore, createOneSubMiddleware, createOneSubServer, evaluateEntitlement, evaluateEntitlementFrom, fetchAppleSubscriptionStatus, fetchAppleTransactionHistory, getDefaultCache, log, openapiHandler, processAppleNotification, processGoogleNotification, setDefaultCache, setLogger, signApplePromotionalOffer, unmarkWebhookEvent, validateAppleReceipt, validateGoogleReceipt, withSpan };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map