@onesub/server 0.20.0 → 0.21.1

package/dist/index.js

@@ -84,11 +84,17 @@ var InMemoryPurchaseStore = class {
     }
     this.byTransactionId.set(purchase.transactionId, purchase);
     const list = this.byUserId.get(purchase.userId) ?? [];
-    list.push(purchase);
+    const at = Date.parse(purchase.purchasedAt);
+    const idx = list.findIndex((p) => Date.parse(p.purchasedAt) < at);
+    if (idx === -1) list.push(purchase);
+    else list.splice(idx, 0, purchase);
     this.byUserId.set(purchase.userId, list);
   }
   async getPurchasesByUserId(userId) {
-    return this.byUserId.get(userId) ?? [];
+    return [...this.byUserId.get(userId) ?? []];
+  }
+  async getPurchasesForProduct(userId, productId) {
+    return (this.byUserId.get(userId) ?? []).filter((p) => p.productId === productId);
   }
   async getPurchaseByTransactionId(txId) {
     return this.byTransactionId.get(txId) ?? null;
@@ -1265,6 +1271,16 @@ function sendZodError(res, err2, extra = {}) {
     extra
   );
 }
+function parseOrSend(res, schema, input, opts = {}) {
+  const result = schema.safeParse(input);
+  if (result.success) return result.data;
+  if (opts.message !== void 0) {
+    sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, opts.message, opts.extra ?? {});
+  } else {
+    sendZodError(res, result.error, opts.extra ?? {});
+  }
+  return void 0;
+}
 
 // src/apps.ts
 function appName(app) {
@@ -1363,20 +1379,9 @@ function createValidateRouter(config, store) {
   const router = Router();
   const registry = getAppRegistry(config);
   router.post(ROUTES.VALIDATE, async (req, res) => {
-    let platform;
-    let receipt;
-    let userId;
-    let productId;
-    let appId;
-    try {
-      ({ platform, receipt, userId, productId, appId } = validateSchema.parse(req.body));
-    } catch (err2) {
-      if (err2 instanceof z.ZodError) {
-        sendZodError(res, err2, NO_SUB);
-        return;
-      }
-      throw err2;
-    }
+    const body = parseOrSend(res, validateSchema, req.body, { extra: NO_SUB });
+    if (!body) return;
+    const { platform, receipt, userId, productId, appId } = body;
     try {
       let sub = null;
       const appConfig = registry.configFor({
@@ -1974,20 +1979,19 @@ var purchaseStatusQuerySchema = z.object({
   userId: z.string().min(1).max(256),
   productId: z.string().min(1).max(256).optional()
 });
+async function purchasesForProduct(purchaseStore, userId, productId) {
+  if (purchaseStore.getPurchasesForProduct) {
+    return purchaseStore.getPurchasesForProduct(userId, productId);
+  }
+  const all = await purchaseStore.getPurchasesByUserId(userId);
+  return all.filter((p) => p.productId === productId);
+}
 function createPurchaseRouter(config, purchaseStore) {
   const router = Router();
   const registry = getAppRegistry(config);
   router.post(ROUTES.VALIDATE_PURCHASE, async (req, res) => {
-    let body;
-    try {
-      body = validatePurchaseSchema.parse(req.body);
-    } catch (err2) {
-      if (err2 instanceof z.ZodError) {
-        sendZodError(res, err2, NO_PURCHASE);
-        return;
-      }
-      throw err2;
-    }
+    const body = parseOrSend(res, validatePurchaseSchema, req.body, { extra: NO_PURCHASE });
+    if (!body) return;
     const { platform, receipt, userId, productId, type, appId } = body;
     const appConfig = registry.configFor({
       appId,
@@ -1995,9 +1999,7 @@ function createPurchaseRouter(config, purchaseStore) {
     });
     try {
       if (type === PURCHASE_TYPE.NON_CONSUMABLE) {
-        const owned = (await purchaseStore.getPurchasesByUserId(userId)).find(
-          (p) => p.productId === productId
-        );
+        const owned = (await purchasesForProduct(purchaseStore, userId, productId))[0];
         if (owned) {
           const response2 = {
             valid: true,
@@ -2115,22 +2117,13 @@ function createPurchaseRouter(config, purchaseStore) {
     }
   });
   router.get(ROUTES.PURCHASE_STATUS, async (req, res) => {
-    let query;
-    try {
-      query = purchaseStatusQuerySchema.parse(req.query);
-    } catch (err2) {
-      if (err2 instanceof z.ZodError) {
-        sendZodError(res, err2, { purchases: [] });
-        return;
-      }
-      throw err2;
-    }
+    const query = parseOrSend(res, purchaseStatusQuerySchema, req.query, {
+      extra: { purchases: [] }
+    });
+    if (!query) return;
     const { userId, productId } = query;
     try {
-      let purchases = await purchaseStore.getPurchasesByUserId(userId);
-      if (productId !== void 0) {
-        purchases = purchases.filter((p) => p.productId === productId);
-      }
+      const purchases = productId !== void 0 ? await purchasesForProduct(purchaseStore, userId, productId) : await purchaseStore.getPurchasesByUserId(userId);
       const response = { purchases };
       res.status(200).json(response);
     } catch (err2) {
@@ -2175,6 +2168,8 @@ async function evaluateEntitlement(userId, entitlement, store, purchaseStore) {
 }
 var userIdSchema = z.string().min(1).max(256);
 var entitlementIdSchema = z.string().min(1).max(128);
+var entitlementQuerySchema = z.object({ userId: userIdSchema, id: entitlementIdSchema });
+var entitlementsQuerySchema = z.object({ userId: userIdSchema });
 function createEntitlementRouter(config, store, purchaseStore) {
   if (!config.entitlements || Object.keys(config.entitlements).length === 0) {
     return null;
@@ -2182,15 +2177,11 @@ function createEntitlementRouter(config, store, purchaseStore) {
   const entitlements = config.entitlements;
   const router = Router();
   router.get(ROUTES.ENTITLEMENT, async (req, res) => {
-    let userId;
-    let id;
-    try {
-      userId = userIdSchema.parse(req.query["userId"]);
-      id = entitlementIdSchema.parse(req.query["id"]);
-    } catch {
-      sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, "userId and id are required");
-      return;
-    }
+    const query = parseOrSend(res, entitlementQuerySchema, req.query, {
+      message: "userId and id are required"
+    });
+    if (!query) return;
+    const { userId, id } = query;
     const entitlement = entitlements[id];
     if (!entitlement) {
       sendError(res, 404, ONESUB_ERROR_CODE.ENTITLEMENT_NOT_FOUND, `Unknown entitlement: ${id}`);
@@ -2206,13 +2197,11 @@ function createEntitlementRouter(config, store, purchaseStore) {
     }
   });
   router.get(ROUTES.ENTITLEMENTS, async (req, res) => {
-    let userId;
-    try {
-      userId = userIdSchema.parse(req.query["userId"]);
-    } catch {
-      sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, "userId is required");
-      return;
-    }
+    const query = parseOrSend(res, entitlementsQuerySchema, req.query, {
+      message: "userId is required"
+    });
+    if (!query) return;
+    const { userId } = query;
     try {
       const [subs, purchases] = await Promise.all([
         store.getAllByUserId(userId),
@@ -2261,13 +2250,10 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     productId: z.string().min(1).max(256)
   });
   router.delete("/onesub/purchase/admin/:userId/:productId", async (req, res) => {
-    let params;
-    try {
-      params = resetParamsSchema.parse(req.params);
-    } catch {
-      sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, "userId and productId required");
-      return;
-    }
+    const params = parseOrSend(res, resetParamsSchema, req.params, {
+      message: "userId and productId required"
+    });
+    if (!params) return;
     const deleted = await purchaseStore.deletePurchases(params.userId, params.productId);
     res.json({ ok: true, deleted });
   });
@@ -2276,16 +2262,8 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     newUserId: z.string().min(1).max(256)
   });
   router.post("/onesub/purchase/admin/transfer", async (req, res) => {
-    let body;
-    try {
-      body = transferSchema.parse(req.body);
-    } catch (err2) {
-      if (err2 instanceof z.ZodError) {
-        sendZodError(res, err2);
-        return;
-      }
-      throw err2;
-    }
+    const body = parseOrSend(res, transferSchema, req.body);
+    if (!body) return;
     const existing = await purchaseStore.getPurchaseByTransactionId(body.transactionId);
     if (!existing) {
       sendError(res, 404, ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, "TRANSACTION_NOT_FOUND");
@@ -2307,16 +2285,8 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     transactionId: z.string().min(1).max(256).optional()
   });
   router.post("/onesub/purchase/admin/grant", async (req, res) => {
-    let body;
-    try {
-      body = grantSchema.parse(req.body);
-    } catch (err2) {
-      if (err2 instanceof z.ZodError) {
-        sendZodError(res, err2);
-        return;
-      }
-      throw err2;
-    }
+    const body = parseOrSend(res, grantSchema, req.body);
+    if (!body) return;
     const transactionId = body.transactionId ?? `admin_grant_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
     const purchase = {
       transactionId,
@@ -2348,16 +2318,8 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     offset: z.coerce.number().int().nonnegative().optional()
   });
   router.get(ROUTES.ADMIN_SUBSCRIPTIONS, async (req, res) => {
-    let query;
-    try {
-      query = listQuerySchema.parse(req.query);
-    } catch (err2) {
-      if (err2 instanceof z.ZodError) {
-        sendZodError(res, err2);
-        return;
-      }
-      throw err2;
-    }
+    const query = parseOrSend(res, listQuerySchema, req.query);
+    if (!query) return;
     try {
       const result = await store.listFiltered(query);
       const response = {
@@ -2368,20 +2330,18 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       };
       res.status(200).json(response);
     } catch (err2) {
-      sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err2.message ?? "list error");
+      log.error("[onesub/admin/subscriptions] list error:", err2);
+      sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
     }
   });
   const detailParamsSchema = z.object({
     transactionId: z.string().min(1).max(256)
   });
   router.get("/onesub/admin/subscriptions/:transactionId", async (req, res) => {
-    let params;
-    try {
-      params = detailParamsSchema.parse(req.params);
-    } catch {
-      sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, "transactionId required");
-      return;
-    }
+    const params = parseOrSend(res, detailParamsSchema, req.params, {
+      message: "transactionId required"
+    });
+    if (!params) return;
     try {
       const sub = await store.getByTransactionId(params.transactionId);
       if (!sub) {
@@ -2390,20 +2350,18 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       }
       res.status(200).json(sub);
     } catch (err2) {
-      sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err2.message ?? "detail error");
+      log.error("[onesub/admin/subscriptions/:transactionId] detail error:", err2);
+      sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
     }
   });
   const customerParamsSchema = z.object({
     userId: z.string().min(1).max(256)
   });
   router.get("/onesub/admin/customers/:userId", async (req, res) => {
-    let params;
-    try {
-      params = customerParamsSchema.parse(req.params);
-    } catch {
-      sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, "userId required");
-      return;
-    }
+    const params = parseOrSend(res, customerParamsSchema, req.params, {
+      message: "userId required"
+    });
+    if (!params) return;
     try {
       const [subscriptions, purchases] = await Promise.all([
         store.getAllByUserId(params.userId),
@@ -2425,20 +2383,18 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       };
       res.status(200).json(response);
     } catch (err2) {
-      sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err2.message ?? "customer error");
+      log.error("[onesub/admin/customers/:userId] error:", err2);
+      sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
     }
   });
   const syncAppleParamsSchema = z.object({
     originalTransactionId: z.string().min(1).max(256)
   });
   router.post(ROUTES.ADMIN_SYNC_APPLE, async (req, res) => {
-    let params;
-    try {
-      params = syncAppleParamsSchema.parse(req.params);
-    } catch {
-      sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, "originalTransactionId required");
-      return;
-    }
+    const params = parseOrSend(res, syncAppleParamsSchema, req.params, {
+      message: "originalTransactionId required"
+    });
+    if (!params) return;
     if (!config.apple?.issuerId || !config.apple?.keyId || !config.apple?.privateKey) {
       sendError(res, 400, ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, "Apple API credentials not configured");
       return;
@@ -2457,7 +2413,8 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       await store.save(fresh);
       res.status(200).json({ ok: true, subscription: fresh });
     } catch (err2) {
-      sendError(res, 500, ONESUB_ERROR_CODE.INTERNAL_ERROR, err2.message ?? "sync error");
+      log.error("[onesub/admin/sync-apple] error:", err2);
+      sendError(res, 500, ONESUB_ERROR_CODE.INTERNAL_ERROR, "Internal server error");
     }
   });
   const overrideParamsSchema = z.object({ userId: z.string().min(1).max(256) });
@@ -2466,19 +2423,10 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     res.json({ overrides: listTestOverrides() });
   });
   router.put(ROUTES.ADMIN_TEST_OVERRIDE, (req, res) => {
-    let params;
-    let body;
-    try {
-      params = overrideParamsSchema.parse(req.params);
-      body = overrideBodySchema.parse(req.body);
-    } catch (err2) {
-      if (err2 instanceof z.ZodError) {
-        sendZodError(res, err2);
-      } else {
-        sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, "userId and { entitled: boolean } required");
-      }
-      return;
-    }
+    const params = parseOrSend(res, overrideParamsSchema, req.params);
+    if (!params) return;
+    const body = parseOrSend(res, overrideBodySchema, req.body);
+    if (!body) return;
     setTestOverride(params.userId, body.entitled);
     log.warn(
       `[onesub/admin] sandbox test override set for ${params.userId}: entitled=${body.entitled}`
@@ -2486,13 +2434,10 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     res.json({ ok: true, userId: params.userId, entitled: body.entitled, sandboxOnly: true });
   });
   router.delete(ROUTES.ADMIN_TEST_OVERRIDE, (req, res) => {
-    let params;
-    try {
-      params = overrideParamsSchema.parse(req.params);
-    } catch {
-      sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, "userId required");
-      return;
-    }
+    const params = parseOrSend(res, overrideParamsSchema, req.params, {
+      message: "userId required"
+    });
+    if (!params) return;
     const cleared = clearTestOverride(params.userId);
     res.json({ ok: true, userId: params.userId, cleared });
   });
@@ -2502,25 +2447,22 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
         const items = await webhookQueue.listDeadLetters();
         res.status(200).json({ items });
       } catch (err2) {
-        sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err2.message ?? "list error");
+        log.error("[onesub/admin/webhook-deadletters] error:", err2);
+        sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
       }
     });
   }
   if (webhookQueue?.replayDeadLetter) {
     const replayParamsSchema = z.object({ id: z.string().min(1).max(256) });
     router.post("/onesub/admin/webhook-replay/:id", async (req, res) => {
-      let params;
-      try {
-        params = replayParamsSchema.parse(req.params);
-      } catch {
-        sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, "id required");
-        return;
-      }
+      const params = parseOrSend(res, replayParamsSchema, req.params, { message: "id required" });
+      if (!params) return;
       try {
         await webhookQueue.replayDeadLetter(params.id);
         res.status(200).json({ ok: true });
       } catch (err2) {
-        sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err2.message ?? "replay error");
+        log.error("[onesub/admin/webhook-replay] error:", err2);
+        sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
       }
     });
   }
@@ -2779,16 +2721,8 @@ function createAppleOfferRouter(config) {
         return;
       }
     }
-    let body;
-    try {
-      body = offerBodySchema.parse(req.body);
-    } catch (err2) {
-      if (err2 instanceof z.ZodError) {
-        sendZodError(res, err2);
-        return;
-      }
-      throw err2;
-    }
+    const body = parseOrSend(res, offerBodySchema, req.body);
+    if (!body) return;
     if (!apple.bundleId) {
       sendError(res, 400, ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, "config.apple.bundleId is required for offer signing");
       return;
@@ -2805,7 +2739,8 @@ function createAppleOfferRouter(config) {
       );
       res.status(200).json(result);
     } catch (err2) {
-      sendError(res, 500, ONESUB_ERROR_CODE.INTERNAL_ERROR, err2.message ?? "Offer signing failed");
+      log.error("[onesub/apple/offer] signing error:", err2);
+      sendError(res, 500, ONESUB_ERROR_CODE.INTERNAL_ERROR, "Offer signing failed");
     }
   });
   return router;
@@ -3106,6 +3041,26 @@ var PostgresPurchaseStore = class {
     );
     return result.rows.map(rowToPurchaseInfo);
   }
+  /**
+   * Purchases for one user + product, most-recent-first.
+   *
+   * Same shape and ordering as `getPurchasesByUserId`, with `product_id` pushed
+   * into the WHERE clause instead of filtered in process. Non-consumables also
+   * have a partial unique index on `(user_id, product_id)`, so the ownership
+   * check this backs is a single index lookup rather than a full read of the
+   * user's purchase history.
+   */
+  async getPurchasesForProduct(userId, productId) {
+    const pool = await this.getPool();
+    const result = await pool.query(
+      `SELECT *
+         FROM onesub_purchases
+        WHERE user_id = $1 AND product_id = $2
+        ORDER BY purchased_at DESC`,
+      [userId, productId]
+    );
+    return result.rows.map(rowToPurchaseInfo);
+  }
   async getPurchaseByTransactionId(txId) {
     const pool = await this.getPool();
     const result = await pool.query(
@@ -3316,6 +3271,23 @@ var RedisPurchaseStore = class {
     const raws = await this.redis.mget(...ids.map((id) => PUR_TX_PREFIX + id));
     return raws.filter((r) => r != null).map((r) => JSON.parse(r));
   }
+  /**
+   * Purchases for one user + product, most-recent-first.
+   *
+   * Served from the `user_product` set that `savePurchase` already maintains for
+   * `hasPurchased`, so this reads only the rows for this product rather than the
+   * user's whole purchase history.
+   *
+   * That set is unordered — unlike the per-user sorted set — so the
+   * most-recent-first contract is restored by an explicit sort here. The row
+   * count is per-product, so this is small.
+   */
+  async getPurchasesForProduct(userId, productId) {
+    const ids = await this.redis.smembers(PUR_USER_PRODUCT_PREFIX + userId + ":" + productId);
+    if (ids.length === 0) return [];
+    const raws = await this.redis.mget(...ids.map((id) => PUR_TX_PREFIX + id));
+    return raws.filter((r) => r != null).map((r) => JSON.parse(r)).sort((a, b) => Date.parse(b.purchasedAt) - Date.parse(a.purchasedAt));
+  }
   async getPurchaseByTransactionId(txId) {
     const raw = await this.redis.get(PUR_TX_PREFIX + txId);
     return raw ? JSON.parse(raw) : null;