@onesub/server 0.21.1 → 0.21.2

package/dist/__tests__/google-webhook-open-warning.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Startup warning for the two conditions that leave the Google RTDN route open.
+ *
+ * `POST /onesub/webhook/google` verifies the Pub/Sub OIDC token only when an app
+ * declares `pushAudience`, and serves any `packageName` when none declares one.
+ * The route is mounted either way. Both behaviours are pre-existing and
+ * deliberate — a host may front the route with its own verification — so this
+ * warns instead of refusing, and these tests pin down that it says so exactly
+ * when it should and stays quiet otherwise.
+ */
+export {};
+//# sourceMappingURL=google-webhook-open-warning.test.d.ts.map

package/dist/__tests__/google-webhook-open-warning.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-webhook-open-warning.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/google-webhook-open-warning.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/index.cjs

@@ -1751,6 +1751,21 @@ var GOOGLE_FAILURE_MESSAGES = {
     message: "Failed to process notification"
   }
 };
+function warnIfGoogleWebhookOpen(config) {
+  if (process.env["NODE_ENV"] !== "production") return;
+  const apps = getAppRegistry(config).apps;
+  const googleApps = apps.map((a) => a.google).filter((g) => !!g);
+  if (googleApps.length > 0 && !googleApps.some((g) => g.pushAudience)) {
+    log.warn(
+      "[onesub] SECURITY: POST /onesub/webhook/google accepts unauthenticated requests \u2014 no configured app sets google.pushAudience, so the Pub/Sub OIDC token is never verified. A caller who knows a purchaseToken or orderId can cancel a subscription or delete a one-time purchase. Set google.pushAudience (and google.pushServiceAccountEmail)."
+    );
+  }
+  if (!apps.some((a) => a.google?.packageName)) {
+    log.warn(
+      "[onesub] POST /onesub/webhook/google is in open mode \u2014 no configured app declares google.packageName, so notifications for ANY package are accepted. The route is mounted whether or not Google is configured; set google.packageName, or block the path at your proxy if this deployment does not serve Google Play."
+    );
+  }
+}
 function googleResolver(config) {
   const registry = getAppRegistry(config);
   const restricted = registry.apps.some((app) => !!app.google?.packageName);
@@ -4149,6 +4164,7 @@ function createOneSubMiddleware(config) {
       "[onesub] apple.mockMode / google.mockMode cannot be enabled when NODE_ENV=production \u2014 these modes accept any receipt as valid."
     );
   }
+  warnIfGoogleWebhookOpen(config);
   const store = config.store ?? new InMemorySubscriptionStore();
   const purchaseStore = config.purchaseStore ?? new InMemoryPurchaseStore();
   if (config.cache) setDefaultCache(config.cache);