@onesub/server 0.21.0 → 0.21.2

package/dist/__tests__/errors.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Error-response helpers, and the guarantee that a 500 does not describe the
+ * server's internals to the caller.
+ *
+ * `parseOrSend` replaced three hand-rolled input-validation shapes across the
+ * routes. The parts worth pinning down are the ones a caller can observe: the
+ * status, the `errorCode`, whether the route's response shape survives on the
+ * error path, and — for the admin routes, which used to forward
+ * `(err as Error).message` verbatim — that internal failure text stays server-side.
+ */
+export {};
+//# sourceMappingURL=errors.test.d.ts.map

package/dist/__tests__/errors.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/errors.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/__tests__/google-webhook-open-warning.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Startup warning for the two conditions that leave the Google RTDN route open.
+ *
+ * `POST /onesub/webhook/google` verifies the Pub/Sub OIDC token only when an app
+ * declares `pushAudience`, and serves any `packageName` when none declares one.
+ * The route is mounted either way. Both behaviours are pre-existing and
+ * deliberate — a host may front the route with its own verification — so this
+ * warns instead of refusing, and these tests pin down that it says so exactly
+ * when it should and stays quiet otherwise.
+ */
+export {};
+//# sourceMappingURL=google-webhook-open-warning.test.d.ts.map

package/dist/__tests__/google-webhook-open-warning.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-webhook-open-warning.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/google-webhook-open-warning.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/errors.d.ts

@@ -14,4 +14,38 @@ export declare function sendError(res: Response, status: number, code: OneSubErr
  * are joined for the human-readable `error` field.
  */
 export declare function sendZodError(res: Response, err: z.ZodError, extra?: Record<string, unknown>): void;
+export interface ParseOrSendOptions {
+    /**
+     * Route-specific fields to merge into the error body, so a 400 keeps the
+     * shape the route's success response has (`subscription: null`,
+     * `purchases: []`, and so on).
+     */
+    extra?: Record<string, unknown>;
+    /**
+     * Send this one message instead of the per-issue zod detail. Use it where the
+     * route deliberately does not echo the input shape back — URL params, and the
+     * entitlement routes. Omit it to get the field-level detail.
+     */
+    message?: string;
+}
+/**
+ * Parse `input` with `schema`, or send a 400 and return `undefined`.
+ *
+ * ```ts
+ * const body = parseOrSend(res, validateSchema, req.body, { extra: NO_SUB });
+ * if (!body) return;
+ * ```
+ *
+ * Every route was hand-rolling this, and in three different shapes: a
+ * `try/catch` that re-threw non-zod errors, a `try/catch {}` that swallowed
+ * everything into one generic message, and `safeParse`. The first is correct but
+ * five lines per call site; the second silently turns a genuine bug inside the
+ * schema — a bad refinement, a throwing transform — into "400 bad input", which
+ * is the wrong status and hides the cause.
+ *
+ * This keeps the correct behaviour and makes it the short one: zod failures
+ * become a 400, and anything else propagates to the route's own error handling
+ * rather than being reported as the caller's fault.
+ */
+export declare function parseOrSend<S extends z.ZodType>(res: Response, schema: S, input: unknown, opts?: ParseOrSendOptions): z.output<S> | undefined;
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGtD;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,IAAI,CAEN;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,QAAQ,EACb,GAAG,EAAE,CAAC,CAAC,QAAQ,EACf,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,IAAI,CAQN"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGtD;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,IAAI,CAEN;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,QAAQ,EACb,GAAG,EAAE,CAAC,CAAC,QAAQ,EACf,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,IAAI,CAQN;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAC7C,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,CAAC,EACT,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,kBAAuB,GAC5B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,CAUzB"}

package/dist/index.cjs

@@ -1278,6 +1278,16 @@ function sendZodError(res, err2, extra = {}) {
     extra
   );
 }
+function parseOrSend(res, schema, input, opts = {}) {
+  const result = schema.safeParse(input);
+  if (result.success) return result.data;
+  if (opts.message !== void 0) {
+    sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, opts.message, opts.extra ?? {});
+  } else {
+    sendZodError(res, result.error, opts.extra ?? {});
+  }
+  return void 0;
+}
 
 // src/apps.ts
 function appName(app) {
@@ -1376,20 +1386,9 @@ function createValidateRouter(config, store) {
   const router = express.Router();
   const registry = getAppRegistry(config);
   router.post(shared.ROUTES.VALIDATE, async (req, res) => {
-    let platform;
-    let receipt;
-    let userId;
-    let productId;
-    let appId;
-    try {
-      ({ platform, receipt, userId, productId, appId } = validateSchema.parse(req.body));
-    } catch (err2) {
-      if (err2 instanceof zod.z.ZodError) {
-        sendZodError(res, err2, NO_SUB);
-        return;
-      }
-      throw err2;
-    }
+    const body = parseOrSend(res, validateSchema, req.body, { extra: NO_SUB });
+    if (!body) return;
+    const { platform, receipt, userId, productId, appId } = body;
     try {
       let sub = null;
       const appConfig = registry.configFor({
@@ -1752,6 +1751,21 @@ var GOOGLE_FAILURE_MESSAGES = {
     message: "Failed to process notification"
   }
 };
+function warnIfGoogleWebhookOpen(config) {
+  if (process.env["NODE_ENV"] !== "production") return;
+  const apps = getAppRegistry(config).apps;
+  const googleApps = apps.map((a) => a.google).filter((g) => !!g);
+  if (googleApps.length > 0 && !googleApps.some((g) => g.pushAudience)) {
+    log.warn(
+      "[onesub] SECURITY: POST /onesub/webhook/google accepts unauthenticated requests \u2014 no configured app sets google.pushAudience, so the Pub/Sub OIDC token is never verified. A caller who knows a purchaseToken or orderId can cancel a subscription or delete a one-time purchase. Set google.pushAudience (and google.pushServiceAccountEmail)."
+    );
+  }
+  if (!apps.some((a) => a.google?.packageName)) {
+    log.warn(
+      "[onesub] POST /onesub/webhook/google is in open mode \u2014 no configured app declares google.packageName, so notifications for ANY package are accepted. The route is mounted whether or not Google is configured; set google.packageName, or block the path at your proxy if this deployment does not serve Google Play."
+    );
+  }
+}
 function googleResolver(config) {
   const registry = getAppRegistry(config);
   const restricted = registry.apps.some((app) => !!app.google?.packageName);
@@ -1998,16 +2012,8 @@ function createPurchaseRouter(config, purchaseStore) {
   const router = express.Router();
   const registry = getAppRegistry(config);
   router.post(shared.ROUTES.VALIDATE_PURCHASE, async (req, res) => {
-    let body;
-    try {
-      body = validatePurchaseSchema.parse(req.body);
-    } catch (err2) {
-      if (err2 instanceof zod.z.ZodError) {
-        sendZodError(res, err2, NO_PURCHASE);
-        return;
-      }
-      throw err2;
-    }
+    const body = parseOrSend(res, validatePurchaseSchema, req.body, { extra: NO_PURCHASE });
+    if (!body) return;
     const { platform, receipt, userId, productId, type, appId } = body;
     const appConfig = registry.configFor({
       appId,
@@ -2133,16 +2139,10 @@ function createPurchaseRouter(config, purchaseStore) {
     }
   });
   router.get(shared.ROUTES.PURCHASE_STATUS, async (req, res) => {
-    let query;
-    try {
-      query = purchaseStatusQuerySchema.parse(req.query);
-    } catch (err2) {
-      if (err2 instanceof zod.z.ZodError) {
-        sendZodError(res, err2, { purchases: [] });
-        return;
-      }
-      throw err2;
-    }
+    const query = parseOrSend(res, purchaseStatusQuerySchema, req.query, {
+      extra: { purchases: [] }
+    });
+    if (!query) return;
     const { userId, productId } = query;
     try {
       const purchases = productId !== void 0 ? await purchasesForProduct(purchaseStore, userId, productId) : await purchaseStore.getPurchasesByUserId(userId);
@@ -2190,6 +2190,8 @@ async function evaluateEntitlement(userId, entitlement, store, purchaseStore) {
 }
 var userIdSchema = zod.z.string().min(1).max(256);
 var entitlementIdSchema = zod.z.string().min(1).max(128);
+var entitlementQuerySchema = zod.z.object({ userId: userIdSchema, id: entitlementIdSchema });
+var entitlementsQuerySchema = zod.z.object({ userId: userIdSchema });
 function createEntitlementRouter(config, store, purchaseStore) {
   if (!config.entitlements || Object.keys(config.entitlements).length === 0) {
     return null;
@@ -2197,15 +2199,11 @@ function createEntitlementRouter(config, store, purchaseStore) {
   const entitlements = config.entitlements;
   const router = express.Router();
   router.get(shared.ROUTES.ENTITLEMENT, async (req, res) => {
-    let userId;
-    let id;
-    try {
-      userId = userIdSchema.parse(req.query["userId"]);
-      id = entitlementIdSchema.parse(req.query["id"]);
-    } catch {
-      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId and id are required");
-      return;
-    }
+    const query = parseOrSend(res, entitlementQuerySchema, req.query, {
+      message: "userId and id are required"
+    });
+    if (!query) return;
+    const { userId, id } = query;
     const entitlement = entitlements[id];
     if (!entitlement) {
       sendError(res, 404, shared.ONESUB_ERROR_CODE.ENTITLEMENT_NOT_FOUND, `Unknown entitlement: ${id}`);
@@ -2221,13 +2219,11 @@ function createEntitlementRouter(config, store, purchaseStore) {
     }
   });
   router.get(shared.ROUTES.ENTITLEMENTS, async (req, res) => {
-    let userId;
-    try {
-      userId = userIdSchema.parse(req.query["userId"]);
-    } catch {
-      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId is required");
-      return;
-    }
+    const query = parseOrSend(res, entitlementsQuerySchema, req.query, {
+      message: "userId is required"
+    });
+    if (!query) return;
+    const { userId } = query;
     try {
       const [subs, purchases] = await Promise.all([
         store.getAllByUserId(userId),
@@ -2276,13 +2272,10 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     productId: zod.z.string().min(1).max(256)
   });
   router.delete("/onesub/purchase/admin/:userId/:productId", async (req, res) => {
-    let params;
-    try {
-      params = resetParamsSchema.parse(req.params);
-    } catch {
-      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId and productId required");
-      return;
-    }
+    const params = parseOrSend(res, resetParamsSchema, req.params, {
+      message: "userId and productId required"
+    });
+    if (!params) return;
     const deleted = await purchaseStore.deletePurchases(params.userId, params.productId);
     res.json({ ok: true, deleted });
   });
@@ -2291,16 +2284,8 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     newUserId: zod.z.string().min(1).max(256)
   });
   router.post("/onesub/purchase/admin/transfer", async (req, res) => {
-    let body;
-    try {
-      body = transferSchema.parse(req.body);
-    } catch (err2) {
-      if (err2 instanceof zod.z.ZodError) {
-        sendZodError(res, err2);
-        return;
-      }
-      throw err2;
-    }
+    const body = parseOrSend(res, transferSchema, req.body);
+    if (!body) return;
     const existing = await purchaseStore.getPurchaseByTransactionId(body.transactionId);
     if (!existing) {
       sendError(res, 404, shared.ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, "TRANSACTION_NOT_FOUND");
@@ -2322,16 +2307,8 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     transactionId: zod.z.string().min(1).max(256).optional()
   });
   router.post("/onesub/purchase/admin/grant", async (req, res) => {
-    let body;
-    try {
-      body = grantSchema.parse(req.body);
-    } catch (err2) {
-      if (err2 instanceof zod.z.ZodError) {
-        sendZodError(res, err2);
-        return;
-      }
-      throw err2;
-    }
+    const body = parseOrSend(res, grantSchema, req.body);
+    if (!body) return;
     const transactionId = body.transactionId ?? `admin_grant_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
     const purchase = {
       transactionId,
@@ -2363,16 +2340,8 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     offset: zod.z.coerce.number().int().nonnegative().optional()
   });
   router.get(shared.ROUTES.ADMIN_SUBSCRIPTIONS, async (req, res) => {
-    let query;
-    try {
-      query = listQuerySchema.parse(req.query);
-    } catch (err2) {
-      if (err2 instanceof zod.z.ZodError) {
-        sendZodError(res, err2);
-        return;
-      }
-      throw err2;
-    }
+    const query = parseOrSend(res, listQuerySchema, req.query);
+    if (!query) return;
     try {
       const result = await store.listFiltered(query);
       const response = {
@@ -2383,20 +2352,18 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       };
       res.status(200).json(response);
     } catch (err2) {
-      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, err2.message ?? "list error");
+      log.error("[onesub/admin/subscriptions] list error:", err2);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
     }
   });
   const detailParamsSchema = zod.z.object({
     transactionId: zod.z.string().min(1).max(256)
   });
   router.get("/onesub/admin/subscriptions/:transactionId", async (req, res) => {
-    let params;
-    try {
-      params = detailParamsSchema.parse(req.params);
-    } catch {
-      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "transactionId required");
-      return;
-    }
+    const params = parseOrSend(res, detailParamsSchema, req.params, {
+      message: "transactionId required"
+    });
+    if (!params) return;
     try {
       const sub = await store.getByTransactionId(params.transactionId);
       if (!sub) {
@@ -2405,20 +2372,18 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       }
       res.status(200).json(sub);
     } catch (err2) {
-      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, err2.message ?? "detail error");
+      log.error("[onesub/admin/subscriptions/:transactionId] detail error:", err2);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
     }
   });
   const customerParamsSchema = zod.z.object({
     userId: zod.z.string().min(1).max(256)
   });
   router.get("/onesub/admin/customers/:userId", async (req, res) => {
-    let params;
-    try {
-      params = customerParamsSchema.parse(req.params);
-    } catch {
-      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId required");
-      return;
-    }
+    const params = parseOrSend(res, customerParamsSchema, req.params, {
+      message: "userId required"
+    });
+    if (!params) return;
     try {
       const [subscriptions, purchases] = await Promise.all([
         store.getAllByUserId(params.userId),
@@ -2440,20 +2405,18 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       };
       res.status(200).json(response);
     } catch (err2) {
-      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, err2.message ?? "customer error");
+      log.error("[onesub/admin/customers/:userId] error:", err2);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
     }
   });
   const syncAppleParamsSchema = zod.z.object({
     originalTransactionId: zod.z.string().min(1).max(256)
   });
   router.post(shared.ROUTES.ADMIN_SYNC_APPLE, async (req, res) => {
-    let params;
-    try {
-      params = syncAppleParamsSchema.parse(req.params);
-    } catch {
-      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "originalTransactionId required");
-      return;
-    }
+    const params = parseOrSend(res, syncAppleParamsSchema, req.params, {
+      message: "originalTransactionId required"
+    });
+    if (!params) return;
     if (!config.apple?.issuerId || !config.apple?.keyId || !config.apple?.privateKey) {
       sendError(res, 400, shared.ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, "Apple API credentials not configured");
       return;
@@ -2472,7 +2435,8 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       await store.save(fresh);
       res.status(200).json({ ok: true, subscription: fresh });
     } catch (err2) {
-      sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, err2.message ?? "sync error");
+      log.error("[onesub/admin/sync-apple] error:", err2);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, "Internal server error");
     }
   });
   const overrideParamsSchema = zod.z.object({ userId: zod.z.string().min(1).max(256) });
@@ -2481,19 +2445,10 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     res.json({ overrides: listTestOverrides() });
   });
   router.put(shared.ROUTES.ADMIN_TEST_OVERRIDE, (req, res) => {
-    let params;
-    let body;
-    try {
-      params = overrideParamsSchema.parse(req.params);
-      body = overrideBodySchema.parse(req.body);
-    } catch (err2) {
-      if (err2 instanceof zod.z.ZodError) {
-        sendZodError(res, err2);
-      } else {
-        sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId and { entitled: boolean } required");
-      }
-      return;
-    }
+    const params = parseOrSend(res, overrideParamsSchema, req.params);
+    if (!params) return;
+    const body = parseOrSend(res, overrideBodySchema, req.body);
+    if (!body) return;
     setTestOverride(params.userId, body.entitled);
     log.warn(
       `[onesub/admin] sandbox test override set for ${params.userId}: entitled=${body.entitled}`
@@ -2501,13 +2456,10 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     res.json({ ok: true, userId: params.userId, entitled: body.entitled, sandboxOnly: true });
   });
   router.delete(shared.ROUTES.ADMIN_TEST_OVERRIDE, (req, res) => {
-    let params;
-    try {
-      params = overrideParamsSchema.parse(req.params);
-    } catch {
-      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId required");
-      return;
-    }
+    const params = parseOrSend(res, overrideParamsSchema, req.params, {
+      message: "userId required"
+    });
+    if (!params) return;
     const cleared = clearTestOverride(params.userId);
     res.json({ ok: true, userId: params.userId, cleared });
   });
@@ -2517,25 +2469,22 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
         const items = await webhookQueue.listDeadLetters();
         res.status(200).json({ items });
       } catch (err2) {
-        sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, err2.message ?? "list error");
+        log.error("[onesub/admin/webhook-deadletters] error:", err2);
+        sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
       }
     });
   }
   if (webhookQueue?.replayDeadLetter) {
     const replayParamsSchema = zod.z.object({ id: zod.z.string().min(1).max(256) });
     router.post("/onesub/admin/webhook-replay/:id", async (req, res) => {
-      let params;
-      try {
-        params = replayParamsSchema.parse(req.params);
-      } catch {
-        sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "id required");
-        return;
-      }
+      const params = parseOrSend(res, replayParamsSchema, req.params, { message: "id required" });
+      if (!params) return;
       try {
         await webhookQueue.replayDeadLetter(params.id);
         res.status(200).json({ ok: true });
       } catch (err2) {
-        sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, err2.message ?? "replay error");
+        log.error("[onesub/admin/webhook-replay] error:", err2);
+        sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
       }
     });
   }
@@ -2794,16 +2743,8 @@ function createAppleOfferRouter(config) {
         return;
       }
     }
-    let body;
-    try {
-      body = offerBodySchema.parse(req.body);
-    } catch (err2) {
-      if (err2 instanceof zod.z.ZodError) {
-        sendZodError(res, err2);
-        return;
-      }
-      throw err2;
-    }
+    const body = parseOrSend(res, offerBodySchema, req.body);
+    if (!body) return;
     if (!apple.bundleId) {
       sendError(res, 400, shared.ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, "config.apple.bundleId is required for offer signing");
       return;
@@ -2820,7 +2761,8 @@ function createAppleOfferRouter(config) {
       );
       res.status(200).json(result);
     } catch (err2) {
-      sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, err2.message ?? "Offer signing failed");
+      log.error("[onesub/apple/offer] signing error:", err2);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, "Offer signing failed");
     }
   });
   return router;
@@ -4222,6 +4164,7 @@ function createOneSubMiddleware(config) {
       "[onesub] apple.mockMode / google.mockMode cannot be enabled when NODE_ENV=production \u2014 these modes accept any receipt as valid."
     );
   }
+  warnIfGoogleWebhookOpen(config);
   const store = config.store ?? new InMemorySubscriptionStore();
   const purchaseStore = config.purchaseStore ?? new InMemoryPurchaseStore();
   if (config.cache) setDefaultCache(config.cache);