@onesub/server 0.21.1 → 0.21.2

package/dist/routes/webhook-google.d.ts

@@ -24,6 +24,24 @@ export type GoogleWebhookWork = {
     kind: 'subscription';
     notification: DecodedGoogleSubscriptionNotification;
 };
+/**
+ * Startup check for the two conditions that leave `POST /onesub/webhook/google`
+ * open. Called once from `createOneSubMiddleware`; warns rather than throws
+ * because rejecting would break deployments that front the route with their own
+ * Pub/Sub verification.
+ *
+ * Gated on `NODE_ENV=production` for the same reason the mockMode guard is:
+ * neither condition is meaningful locally, where no real RTDN arrives, and
+ * warning unconditionally would fire on nearly every test and drown itself out.
+ *
+ * Why it matters. The subscription paths re-fetch state from Google before
+ * writing, so a forged notification cannot fabricate an entitlement. The voided
+ * path does not: it acts on the payload alone, setting a subscription to
+ * `canceled` by `purchaseToken` or deleting a one-time purchase row by
+ * `orderId`. So the exposure is entitlement *revocation* for a caller who knows
+ * or guesses one of those ids — not free entitlement.
+ */
+export declare function warnIfGoogleWebhookOpen(config: OneSubServerConfig): void;
 /**
  * State-mutating half of the Google webhook: everything AFTER the gate
  * (push-token auth, body validation, idempotency markIfNew, packageName

package/dist/routes/webhook-google.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-google.d.ts","sourceRoot":"","sources":["../../src/routes/webhook-google.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAA6B,kBAAkB,EAAoB,MAAM,gBAAgB,CAAC;AAEtG,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EACL,wBAAwB,EAYzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EACV,wBAAwB,EACxB,gCAAgC,EACjC,MAAM,wBAAwB,CAAC;AAIhC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAWxD,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,OAAO,EACZ,gBAAgB,EAAE,MAAM,EACxB,2BAA2B,CAAC,EAAE,MAAM,GACnC,OAAO,CAAC,OAAO,CAAC,CAqBlB;AAED,qFAAqF;AACrF,KAAK,qCAAqC,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC;AAEtG;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,cAAc,EAAE,gCAAgC,CAAA;CAAE,GAC5E;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,YAAY,EAAE,qCAAqC,CAAA;CAAE,CAAC;AAuClF;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,EACxB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,IAAI,CAAC,CAmIf;AAED,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,EACxB,aAAa,EAAE,aAAa,EAC5B,iBAAiB,CAAC,EAAE,iBAAiB,EACrC,YAAY,CAAC,EAAE,YAAY,GAC1B,OAAO,CAAC,IAAI,CAAC,CAmIf"}
+{"version":3,"file":"webhook-google.d.ts","sourceRoot":"","sources":["../../src/routes/webhook-google.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAA6B,kBAAkB,EAAoB,MAAM,gBAAgB,CAAC;AAEtG,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EACL,wBAAwB,EAYzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EACV,wBAAwB,EACxB,gCAAgC,EACjC,MAAM,wBAAwB,CAAC;AAIhC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAWxD,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,OAAO,EACZ,gBAAgB,EAAE,MAAM,EACxB,2BAA2B,CAAC,EAAE,MAAM,GACnC,OAAO,CAAC,OAAO,CAAC,CAqBlB;AAED,qFAAqF;AACrF,KAAK,qCAAqC,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC;AAEtG;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,cAAc,EAAE,gCAAgC,CAAA;CAAE,GAC5E;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,YAAY,EAAE,qCAAqC,CAAA;CAAE,CAAC;AAkBlF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CA2BxE;AAuBD;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,EACxB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,IAAI,CAAC,CAmIf;AAED,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,EACxB,aAAa,EAAE,aAAa,EAC5B,iBAAiB,CAAC,EAAE,iBAAiB,EACrC,YAAY,CAAC,EAAE,YAAY,GAC1B,OAAO,CAAC,IAAI,CAAC,CAmIf"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onesub/server",
-  "version": "0.21.1",
+  "version": "0.21.2",
   "description": "Server-side receipt validation middleware for react-native-iap. Apple StoreKit 2 + Google Play Billing. One line.",
   "main": "dist/index.cjs",
   "module": "dist/index.js",