@onesub/server 0.21.2 → 0.22.0

package/dist/index.js

@@ -1744,18 +1744,22 @@ var GOOGLE_FAILURE_MESSAGES = {
     message: "Failed to process notification"
   }
 };
+function servesGoogle(config) {
+  return getAppRegistry(config).apps.some((app) => !!app.google);
+}
 function warnIfGoogleWebhookOpen(config) {
   if (process.env["NODE_ENV"] !== "production") return;
+  if (!servesGoogle(config)) return;
   const apps = getAppRegistry(config).apps;
   const googleApps = apps.map((a) => a.google).filter((g) => !!g);
-  if (googleApps.length > 0 && !googleApps.some((g) => g.pushAudience)) {
+  if (!googleApps.some((g) => g.pushAudience)) {
     log.warn(
       "[onesub] SECURITY: POST /onesub/webhook/google accepts unauthenticated requests \u2014 no configured app sets google.pushAudience, so the Pub/Sub OIDC token is never verified. A caller who knows a purchaseToken or orderId can cancel a subscription or delete a one-time purchase. Set google.pushAudience (and google.pushServiceAccountEmail)."
     );
   }
   if (!apps.some((a) => a.google?.packageName)) {
     log.warn(
-      "[onesub] POST /onesub/webhook/google is in open mode \u2014 no configured app declares google.packageName, so notifications for ANY package are accepted. The route is mounted whether or not Google is configured; set google.packageName, or block the path at your proxy if this deployment does not serve Google Play."
+      "[onesub] POST /onesub/webhook/google is in open mode \u2014 no configured app declares google.packageName, so notifications for ANY package are accepted. Set google.packageName on each app you serve."
     );
   }
 }
@@ -1974,10 +1978,12 @@ function createWebhookRouter(config, store, purchaseStore, webhookEventStore, we
     ROUTES.WEBHOOK_APPLE,
     (req, res) => handleAppleWebhook(req, res, config, store, purchaseStore, webhookEventStore, webhookQueue)
   );
-  router.post(
-    ROUTES.WEBHOOK_GOOGLE,
-    (req, res) => handleGoogleWebhook(req, res, config, store, purchaseStore, webhookEventStore, webhookQueue)
-  );
+  if (servesGoogle(config)) {
+    router.post(
+      ROUTES.WEBHOOK_GOOGLE,
+      (req, res) => handleGoogleWebhook(req, res, config, store, purchaseStore, webhookEventStore, webhookQueue)
+    );
+  }
   return router;
 }
 var NO_PURCHASE = { valid: false, purchase: null };