@onesub/server 0.21.1 → 0.22.0

package/dist/__tests__/google-webhook-open-warning.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Startup warning for the two conditions that leave the Google RTDN route open.
+ *
+ * `POST /onesub/webhook/google` verifies the Pub/Sub OIDC token only when an app
+ * declares `pushAudience`, and serves any `packageName` when none declares one.
+ * The route is mounted either way. Both behaviours are pre-existing and
+ * deliberate — a host may front the route with its own verification — so this
+ * warns instead of refusing, and these tests pin down that it says so exactly
+ * when it should and stays quiet otherwise.
+ */
+export {};
+//# sourceMappingURL=google-webhook-open-warning.test.d.ts.map

package/dist/__tests__/google-webhook-open-warning.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-webhook-open-warning.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/google-webhook-open-warning.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/__tests__/webhook-google-mount.test.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `POST /onesub/webhook/google` is mounted only for deployments that serve
+ * Google Play.
+ *
+ * Why it is conditional at all: unlike Apple's route, it does not authenticate
+ * unconditionally — the Pub/Sub OIDC token is verified only when an app declares
+ * a `pushAudience` — and its voided-purchase branch needs no Google credentials
+ * to run. It cancels a subscription by `purchaseToken`, or deletes a purchase row
+ * by `orderId`, straight from the payload. So an Apple-only deployment used to
+ * expose an unauthenticated endpoint that could revoke entitlement, with no
+ * Google purchases for it to be about.
+ *
+ * Apple's route stays unconditional, and this file asserts that too: it verifies
+ * the `signedPayload` JWS against the bundled Apple roots on every request
+ * regardless of config, so it is not open in the same way.
+ */
+export {};
+//# sourceMappingURL=webhook-google-mount.test.d.ts.map

package/dist/__tests__/webhook-google-mount.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-google-mount.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/webhook-google-mount.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG"}

package/dist/index.cjs

@@ -1751,6 +1751,25 @@ var GOOGLE_FAILURE_MESSAGES = {
     message: "Failed to process notification"
   }
 };
+function servesGoogle(config) {
+  return getAppRegistry(config).apps.some((app) => !!app.google);
+}
+function warnIfGoogleWebhookOpen(config) {
+  if (process.env["NODE_ENV"] !== "production") return;
+  if (!servesGoogle(config)) return;
+  const apps = getAppRegistry(config).apps;
+  const googleApps = apps.map((a) => a.google).filter((g) => !!g);
+  if (!googleApps.some((g) => g.pushAudience)) {
+    log.warn(
+      "[onesub] SECURITY: POST /onesub/webhook/google accepts unauthenticated requests \u2014 no configured app sets google.pushAudience, so the Pub/Sub OIDC token is never verified. A caller who knows a purchaseToken or orderId can cancel a subscription or delete a one-time purchase. Set google.pushAudience (and google.pushServiceAccountEmail)."
+    );
+  }
+  if (!apps.some((a) => a.google?.packageName)) {
+    log.warn(
+      "[onesub] POST /onesub/webhook/google is in open mode \u2014 no configured app declares google.packageName, so notifications for ANY package are accepted. Set google.packageName on each app you serve."
+    );
+  }
+}
 function googleResolver(config) {
   const registry = getAppRegistry(config);
   const restricted = registry.apps.some((app) => !!app.google?.packageName);
@@ -1966,10 +1985,12 @@ function createWebhookRouter(config, store, purchaseStore, webhookEventStore, we
     shared.ROUTES.WEBHOOK_APPLE,
     (req, res) => handleAppleWebhook(req, res, config, store, purchaseStore, webhookEventStore, webhookQueue)
   );
-  router.post(
-    shared.ROUTES.WEBHOOK_GOOGLE,
-    (req, res) => handleGoogleWebhook(req, res, config, store, purchaseStore, webhookEventStore, webhookQueue)
-  );
+  if (servesGoogle(config)) {
+    router.post(
+      shared.ROUTES.WEBHOOK_GOOGLE,
+      (req, res) => handleGoogleWebhook(req, res, config, store, purchaseStore, webhookEventStore, webhookQueue)
+    );
+  }
   return router;
 }
 var NO_PURCHASE = { valid: false, purchase: null };
@@ -4149,6 +4170,7 @@ function createOneSubMiddleware(config) {
       "[onesub] apple.mockMode / google.mockMode cannot be enabled when NODE_ENV=production \u2014 these modes accept any receipt as valid."
     );
   }
+  warnIfGoogleWebhookOpen(config);
   const store = config.store ?? new InMemorySubscriptionStore();
   const purchaseStore = config.purchaseStore ?? new InMemoryPurchaseStore();
   if (config.cache) setDefaultCache(config.cache);