@onesub/server 0.20.0 → 0.21.1

package/dist/__tests__/errors.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Error-response helpers, and the guarantee that a 500 does not describe the
+ * server's internals to the caller.
+ *
+ * `parseOrSend` replaced three hand-rolled input-validation shapes across the
+ * routes. The parts worth pinning down are the ones a caller can observe: the
+ * status, the `errorCode`, whether the route's response shape survives on the
+ * error path, and — for the admin routes, which used to forward
+ * `(err as Error).message` verbatim — that internal failure text stays server-side.
+ */
+export {};
+//# sourceMappingURL=errors.test.d.ts.map

package/dist/__tests__/errors.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/errors.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/__tests__/purchase-product-lookup.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Product-scoped purchase lookup — `PurchaseStore.getPurchasesForProduct`.
+ *
+ * Non-consumable validation used to read a user's entire purchase history and
+ * filter it in process, so an account with a long consumable history paid for
+ * every one of those rows on each lifetime-product purchase. The optional
+ * store method pushes the filter into an index instead.
+ *
+ * Covered here:
+ *   - the store contract, including the most-recent-first ordering all three
+ *     built-in stores must agree on
+ *   - that the route actually uses the index-backed method when a store has one
+ *     (responses are identical either way, so only a call count shows it)
+ *   - that a store without the method still works, since it is optional
+ */
+export {};
+//# sourceMappingURL=purchase-product-lookup.test.d.ts.map

package/dist/__tests__/purchase-product-lookup.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purchase-product-lookup.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/purchase-product-lookup.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/errors.d.ts

@@ -14,4 +14,38 @@ export declare function sendError(res: Response, status: number, code: OneSubErr
  * are joined for the human-readable `error` field.
  */
 export declare function sendZodError(res: Response, err: z.ZodError, extra?: Record<string, unknown>): void;
+export interface ParseOrSendOptions {
+    /**
+     * Route-specific fields to merge into the error body, so a 400 keeps the
+     * shape the route's success response has (`subscription: null`,
+     * `purchases: []`, and so on).
+     */
+    extra?: Record<string, unknown>;
+    /**
+     * Send this one message instead of the per-issue zod detail. Use it where the
+     * route deliberately does not echo the input shape back — URL params, and the
+     * entitlement routes. Omit it to get the field-level detail.
+     */
+    message?: string;
+}
+/**
+ * Parse `input` with `schema`, or send a 400 and return `undefined`.
+ *
+ * ```ts
+ * const body = parseOrSend(res, validateSchema, req.body, { extra: NO_SUB });
+ * if (!body) return;
+ * ```
+ *
+ * Every route was hand-rolling this, and in three different shapes: a
+ * `try/catch` that re-threw non-zod errors, a `try/catch {}` that swallowed
+ * everything into one generic message, and `safeParse`. The first is correct but
+ * five lines per call site; the second silently turns a genuine bug inside the
+ * schema — a bad refinement, a throwing transform — into "400 bad input", which
+ * is the wrong status and hides the cause.
+ *
+ * This keeps the correct behaviour and makes it the short one: zod failures
+ * become a 400, and anything else propagates to the route's own error handling
+ * rather than being reported as the caller's fault.
+ */
+export declare function parseOrSend<S extends z.ZodType>(res: Response, schema: S, input: unknown, opts?: ParseOrSendOptions): z.output<S> | undefined;
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGtD;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,IAAI,CAEN;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,QAAQ,EACb,GAAG,EAAE,CAAC,CAAC,QAAQ,EACf,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,IAAI,CAQN"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGtD;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,IAAI,CAEN;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,QAAQ,EACb,GAAG,EAAE,CAAC,CAAC,QAAQ,EACf,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,IAAI,CAQN;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAC7C,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,CAAC,EACT,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,kBAAuB,GAC5B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,CAUzB"}

package/dist/index.cjs

@@ -91,11 +91,17 @@ var InMemoryPurchaseStore = class {
     }
     this.byTransactionId.set(purchase.transactionId, purchase);
     const list = this.byUserId.get(purchase.userId) ?? [];
-    list.push(purchase);
+    const at = Date.parse(purchase.purchasedAt);
+    const idx = list.findIndex((p) => Date.parse(p.purchasedAt) < at);
+    if (idx === -1) list.push(purchase);
+    else list.splice(idx, 0, purchase);
     this.byUserId.set(purchase.userId, list);
   }
   async getPurchasesByUserId(userId) {
-    return this.byUserId.get(userId) ?? [];
+    return [...this.byUserId.get(userId) ?? []];
+  }
+  async getPurchasesForProduct(userId, productId) {
+    return (this.byUserId.get(userId) ?? []).filter((p) => p.productId === productId);
   }
   async getPurchaseByTransactionId(txId) {
     return this.byTransactionId.get(txId) ?? null;
@@ -1272,6 +1278,16 @@ function sendZodError(res, err2, extra = {}) {
     extra
   );
 }
+function parseOrSend(res, schema, input, opts = {}) {
+  const result = schema.safeParse(input);
+  if (result.success) return result.data;
+  if (opts.message !== void 0) {
+    sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, opts.message, opts.extra ?? {});
+  } else {
+    sendZodError(res, result.error, opts.extra ?? {});
+  }
+  return void 0;
+}
 
 // src/apps.ts
 function appName(app) {
@@ -1370,20 +1386,9 @@ function createValidateRouter(config, store) {
   const router = express.Router();
   const registry = getAppRegistry(config);
   router.post(shared.ROUTES.VALIDATE, async (req, res) => {
-    let platform;
-    let receipt;
-    let userId;
-    let productId;
-    let appId;
-    try {
-      ({ platform, receipt, userId, productId, appId } = validateSchema.parse(req.body));
-    } catch (err2) {
-      if (err2 instanceof zod.z.ZodError) {
-        sendZodError(res, err2, NO_SUB);
-        return;
-      }
-      throw err2;
-    }
+    const body = parseOrSend(res, validateSchema, req.body, { extra: NO_SUB });
+    if (!body) return;
+    const { platform, receipt, userId, productId, appId } = body;
     try {
       let sub = null;
       const appConfig = registry.configFor({
@@ -1981,20 +1986,19 @@ var purchaseStatusQuerySchema = zod.z.object({
   userId: zod.z.string().min(1).max(256),
   productId: zod.z.string().min(1).max(256).optional()
 });
+async function purchasesForProduct(purchaseStore, userId, productId) {
+  if (purchaseStore.getPurchasesForProduct) {
+    return purchaseStore.getPurchasesForProduct(userId, productId);
+  }
+  const all = await purchaseStore.getPurchasesByUserId(userId);
+  return all.filter((p) => p.productId === productId);
+}
 function createPurchaseRouter(config, purchaseStore) {
   const router = express.Router();
   const registry = getAppRegistry(config);
   router.post(shared.ROUTES.VALIDATE_PURCHASE, async (req, res) => {
-    let body;
-    try {
-      body = validatePurchaseSchema.parse(req.body);
-    } catch (err2) {
-      if (err2 instanceof zod.z.ZodError) {
-        sendZodError(res, err2, NO_PURCHASE);
-        return;
-      }
-      throw err2;
-    }
+    const body = parseOrSend(res, validatePurchaseSchema, req.body, { extra: NO_PURCHASE });
+    if (!body) return;
     const { platform, receipt, userId, productId, type, appId } = body;
     const appConfig = registry.configFor({
       appId,
@@ -2002,9 +2006,7 @@ function createPurchaseRouter(config, purchaseStore) {
     });
     try {
       if (type === shared.PURCHASE_TYPE.NON_CONSUMABLE) {
-        const owned = (await purchaseStore.getPurchasesByUserId(userId)).find(
-          (p) => p.productId === productId
-        );
+        const owned = (await purchasesForProduct(purchaseStore, userId, productId))[0];
         if (owned) {
           const response2 = {
             valid: true,
@@ -2122,22 +2124,13 @@ function createPurchaseRouter(config, purchaseStore) {
     }
   });
   router.get(shared.ROUTES.PURCHASE_STATUS, async (req, res) => {
-    let query;
-    try {
-      query = purchaseStatusQuerySchema.parse(req.query);
-    } catch (err2) {
-      if (err2 instanceof zod.z.ZodError) {
-        sendZodError(res, err2, { purchases: [] });
-        return;
-      }
-      throw err2;
-    }
+    const query = parseOrSend(res, purchaseStatusQuerySchema, req.query, {
+      extra: { purchases: [] }
+    });
+    if (!query) return;
     const { userId, productId } = query;
     try {
-      let purchases = await purchaseStore.getPurchasesByUserId(userId);
-      if (productId !== void 0) {
-        purchases = purchases.filter((p) => p.productId === productId);
-      }
+      const purchases = productId !== void 0 ? await purchasesForProduct(purchaseStore, userId, productId) : await purchaseStore.getPurchasesByUserId(userId);
       const response = { purchases };
       res.status(200).json(response);
     } catch (err2) {
@@ -2182,6 +2175,8 @@ async function evaluateEntitlement(userId, entitlement, store, purchaseStore) {
 }
 var userIdSchema = zod.z.string().min(1).max(256);
 var entitlementIdSchema = zod.z.string().min(1).max(128);
+var entitlementQuerySchema = zod.z.object({ userId: userIdSchema, id: entitlementIdSchema });
+var entitlementsQuerySchema = zod.z.object({ userId: userIdSchema });
 function createEntitlementRouter(config, store, purchaseStore) {
   if (!config.entitlements || Object.keys(config.entitlements).length === 0) {
     return null;
@@ -2189,15 +2184,11 @@ function createEntitlementRouter(config, store, purchaseStore) {
   const entitlements = config.entitlements;
   const router = express.Router();
   router.get(shared.ROUTES.ENTITLEMENT, async (req, res) => {
-    let userId;
-    let id;
-    try {
-      userId = userIdSchema.parse(req.query["userId"]);
-      id = entitlementIdSchema.parse(req.query["id"]);
-    } catch {
-      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId and id are required");
-      return;
-    }
+    const query = parseOrSend(res, entitlementQuerySchema, req.query, {
+      message: "userId and id are required"
+    });
+    if (!query) return;
+    const { userId, id } = query;
     const entitlement = entitlements[id];
     if (!entitlement) {
       sendError(res, 404, shared.ONESUB_ERROR_CODE.ENTITLEMENT_NOT_FOUND, `Unknown entitlement: ${id}`);
@@ -2213,13 +2204,11 @@ function createEntitlementRouter(config, store, purchaseStore) {
     }
   });
   router.get(shared.ROUTES.ENTITLEMENTS, async (req, res) => {
-    let userId;
-    try {
-      userId = userIdSchema.parse(req.query["userId"]);
-    } catch {
-      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId is required");
-      return;
-    }
+    const query = parseOrSend(res, entitlementsQuerySchema, req.query, {
+      message: "userId is required"
+    });
+    if (!query) return;
+    const { userId } = query;
     try {
       const [subs, purchases] = await Promise.all([
         store.getAllByUserId(userId),
@@ -2268,13 +2257,10 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     productId: zod.z.string().min(1).max(256)
   });
   router.delete("/onesub/purchase/admin/:userId/:productId", async (req, res) => {
-    let params;
-    try {
-      params = resetParamsSchema.parse(req.params);
-    } catch {
-      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId and productId required");
-      return;
-    }
+    const params = parseOrSend(res, resetParamsSchema, req.params, {
+      message: "userId and productId required"
+    });
+    if (!params) return;
     const deleted = await purchaseStore.deletePurchases(params.userId, params.productId);
     res.json({ ok: true, deleted });
   });
@@ -2283,16 +2269,8 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     newUserId: zod.z.string().min(1).max(256)
   });
   router.post("/onesub/purchase/admin/transfer", async (req, res) => {
-    let body;
-    try {
-      body = transferSchema.parse(req.body);
-    } catch (err2) {
-      if (err2 instanceof zod.z.ZodError) {
-        sendZodError(res, err2);
-        return;
-      }
-      throw err2;
-    }
+    const body = parseOrSend(res, transferSchema, req.body);
+    if (!body) return;
     const existing = await purchaseStore.getPurchaseByTransactionId(body.transactionId);
     if (!existing) {
       sendError(res, 404, shared.ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, "TRANSACTION_NOT_FOUND");
@@ -2314,16 +2292,8 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     transactionId: zod.z.string().min(1).max(256).optional()
   });
   router.post("/onesub/purchase/admin/grant", async (req, res) => {
-    let body;
-    try {
-      body = grantSchema.parse(req.body);
-    } catch (err2) {
-      if (err2 instanceof zod.z.ZodError) {
-        sendZodError(res, err2);
-        return;
-      }
-      throw err2;
-    }
+    const body = parseOrSend(res, grantSchema, req.body);
+    if (!body) return;
     const transactionId = body.transactionId ?? `admin_grant_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
     const purchase = {
       transactionId,
@@ -2355,16 +2325,8 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     offset: zod.z.coerce.number().int().nonnegative().optional()
   });
   router.get(shared.ROUTES.ADMIN_SUBSCRIPTIONS, async (req, res) => {
-    let query;
-    try {
-      query = listQuerySchema.parse(req.query);
-    } catch (err2) {
-      if (err2 instanceof zod.z.ZodError) {
-        sendZodError(res, err2);
-        return;
-      }
-      throw err2;
-    }
+    const query = parseOrSend(res, listQuerySchema, req.query);
+    if (!query) return;
     try {
       const result = await store.listFiltered(query);
       const response = {
@@ -2375,20 +2337,18 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       };
       res.status(200).json(response);
     } catch (err2) {
-      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, err2.message ?? "list error");
+      log.error("[onesub/admin/subscriptions] list error:", err2);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
     }
   });
   const detailParamsSchema = zod.z.object({
     transactionId: zod.z.string().min(1).max(256)
   });
   router.get("/onesub/admin/subscriptions/:transactionId", async (req, res) => {
-    let params;
-    try {
-      params = detailParamsSchema.parse(req.params);
-    } catch {
-      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "transactionId required");
-      return;
-    }
+    const params = parseOrSend(res, detailParamsSchema, req.params, {
+      message: "transactionId required"
+    });
+    if (!params) return;
     try {
       const sub = await store.getByTransactionId(params.transactionId);
       if (!sub) {
@@ -2397,20 +2357,18 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       }
       res.status(200).json(sub);
     } catch (err2) {
-      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, err2.message ?? "detail error");
+      log.error("[onesub/admin/subscriptions/:transactionId] detail error:", err2);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
     }
   });
   const customerParamsSchema = zod.z.object({
     userId: zod.z.string().min(1).max(256)
   });
   router.get("/onesub/admin/customers/:userId", async (req, res) => {
-    let params;
-    try {
-      params = customerParamsSchema.parse(req.params);
-    } catch {
-      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId required");
-      return;
-    }
+    const params = parseOrSend(res, customerParamsSchema, req.params, {
+      message: "userId required"
+    });
+    if (!params) return;
     try {
       const [subscriptions, purchases] = await Promise.all([
         store.getAllByUserId(params.userId),
@@ -2432,20 +2390,18 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       };
       res.status(200).json(response);
     } catch (err2) {
-      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, err2.message ?? "customer error");
+      log.error("[onesub/admin/customers/:userId] error:", err2);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
     }
   });
   const syncAppleParamsSchema = zod.z.object({
     originalTransactionId: zod.z.string().min(1).max(256)
   });
   router.post(shared.ROUTES.ADMIN_SYNC_APPLE, async (req, res) => {
-    let params;
-    try {
-      params = syncAppleParamsSchema.parse(req.params);
-    } catch {
-      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "originalTransactionId required");
-      return;
-    }
+    const params = parseOrSend(res, syncAppleParamsSchema, req.params, {
+      message: "originalTransactionId required"
+    });
+    if (!params) return;
     if (!config.apple?.issuerId || !config.apple?.keyId || !config.apple?.privateKey) {
       sendError(res, 400, shared.ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, "Apple API credentials not configured");
       return;
@@ -2464,7 +2420,8 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       await store.save(fresh);
       res.status(200).json({ ok: true, subscription: fresh });
     } catch (err2) {
-      sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, err2.message ?? "sync error");
+      log.error("[onesub/admin/sync-apple] error:", err2);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, "Internal server error");
     }
   });
   const overrideParamsSchema = zod.z.object({ userId: zod.z.string().min(1).max(256) });
@@ -2473,19 +2430,10 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     res.json({ overrides: listTestOverrides() });
   });
   router.put(shared.ROUTES.ADMIN_TEST_OVERRIDE, (req, res) => {
-    let params;
-    let body;
-    try {
-      params = overrideParamsSchema.parse(req.params);
-      body = overrideBodySchema.parse(req.body);
-    } catch (err2) {
-      if (err2 instanceof zod.z.ZodError) {
-        sendZodError(res, err2);
-      } else {
-        sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId and { entitled: boolean } required");
-      }
-      return;
-    }
+    const params = parseOrSend(res, overrideParamsSchema, req.params);
+    if (!params) return;
+    const body = parseOrSend(res, overrideBodySchema, req.body);
+    if (!body) return;
     setTestOverride(params.userId, body.entitled);
     log.warn(
       `[onesub/admin] sandbox test override set for ${params.userId}: entitled=${body.entitled}`
@@ -2493,13 +2441,10 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     res.json({ ok: true, userId: params.userId, entitled: body.entitled, sandboxOnly: true });
   });
   router.delete(shared.ROUTES.ADMIN_TEST_OVERRIDE, (req, res) => {
-    let params;
-    try {
-      params = overrideParamsSchema.parse(req.params);
-    } catch {
-      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId required");
-      return;
-    }
+    const params = parseOrSend(res, overrideParamsSchema, req.params, {
+      message: "userId required"
+    });
+    if (!params) return;
     const cleared = clearTestOverride(params.userId);
     res.json({ ok: true, userId: params.userId, cleared });
   });
@@ -2509,25 +2454,22 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
         const items = await webhookQueue.listDeadLetters();
         res.status(200).json({ items });
       } catch (err2) {
-        sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, err2.message ?? "list error");
+        log.error("[onesub/admin/webhook-deadletters] error:", err2);
+        sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
       }
     });
   }
   if (webhookQueue?.replayDeadLetter) {
     const replayParamsSchema = zod.z.object({ id: zod.z.string().min(1).max(256) });
     router.post("/onesub/admin/webhook-replay/:id", async (req, res) => {
-      let params;
-      try {
-        params = replayParamsSchema.parse(req.params);
-      } catch {
-        sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "id required");
-        return;
-      }
+      const params = parseOrSend(res, replayParamsSchema, req.params, { message: "id required" });
+      if (!params) return;
       try {
         await webhookQueue.replayDeadLetter(params.id);
         res.status(200).json({ ok: true });
       } catch (err2) {
-        sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, err2.message ?? "replay error");
+        log.error("[onesub/admin/webhook-replay] error:", err2);
+        sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
       }
     });
   }
@@ -2786,16 +2728,8 @@ function createAppleOfferRouter(config) {
         return;
       }
     }
-    let body;
-    try {
-      body = offerBodySchema.parse(req.body);
-    } catch (err2) {
-      if (err2 instanceof zod.z.ZodError) {
-        sendZodError(res, err2);
-        return;
-      }
-      throw err2;
-    }
+    const body = parseOrSend(res, offerBodySchema, req.body);
+    if (!body) return;
     if (!apple.bundleId) {
       sendError(res, 400, shared.ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, "config.apple.bundleId is required for offer signing");
       return;
@@ -2812,7 +2746,8 @@ function createAppleOfferRouter(config) {
       );
       res.status(200).json(result);
     } catch (err2) {
-      sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, err2.message ?? "Offer signing failed");
+      log.error("[onesub/apple/offer] signing error:", err2);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, "Offer signing failed");
     }
   });
   return router;
@@ -3113,6 +3048,26 @@ var PostgresPurchaseStore = class {
     );
     return result.rows.map(rowToPurchaseInfo);
   }
+  /**
+   * Purchases for one user + product, most-recent-first.
+   *
+   * Same shape and ordering as `getPurchasesByUserId`, with `product_id` pushed
+   * into the WHERE clause instead of filtered in process. Non-consumables also
+   * have a partial unique index on `(user_id, product_id)`, so the ownership
+   * check this backs is a single index lookup rather than a full read of the
+   * user's purchase history.
+   */
+  async getPurchasesForProduct(userId, productId) {
+    const pool = await this.getPool();
+    const result = await pool.query(
+      `SELECT *
+         FROM onesub_purchases
+        WHERE user_id = $1 AND product_id = $2
+        ORDER BY purchased_at DESC`,
+      [userId, productId]
+    );
+    return result.rows.map(rowToPurchaseInfo);
+  }
   async getPurchaseByTransactionId(txId) {
     const pool = await this.getPool();
     const result = await pool.query(
@@ -3323,6 +3278,23 @@ var RedisPurchaseStore = class {
     const raws = await this.redis.mget(...ids.map((id) => PUR_TX_PREFIX + id));
     return raws.filter((r) => r != null).map((r) => JSON.parse(r));
   }
+  /**
+   * Purchases for one user + product, most-recent-first.
+   *
+   * Served from the `user_product` set that `savePurchase` already maintains for
+   * `hasPurchased`, so this reads only the rows for this product rather than the
+   * user's whole purchase history.
+   *
+   * That set is unordered — unlike the per-user sorted set — so the
+   * most-recent-first contract is restored by an explicit sort here. The row
+   * count is per-product, so this is small.
+   */
+  async getPurchasesForProduct(userId, productId) {
+    const ids = await this.redis.smembers(PUR_USER_PRODUCT_PREFIX + userId + ":" + productId);
+    if (ids.length === 0) return [];
+    const raws = await this.redis.mget(...ids.map((id) => PUR_TX_PREFIX + id));
+    return raws.filter((r) => r != null).map((r) => JSON.parse(r)).sort((a, b) => Date.parse(b.purchasedAt) - Date.parse(a.purchasedAt));
+  }
   async getPurchaseByTransactionId(txId) {
     const raw = await this.redis.get(PUR_TX_PREFIX + txId);
     return raw ? JSON.parse(raw) : null;