@onesub/server 0.22.0 → 0.23.1

package/dist/__tests__/logger.test.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The process-wide logger, and specifically that a caller cannot forge log lines.
+ *
+ * Much of what this server logs is attacker-influenced — `userId` arrives in the
+ * request body, and bundle ids, package names and receipt previews come out of
+ * submitted receipts. A newline in any of those would let a caller end the current
+ * line and write an entry of their own, and these logs are what support and fraud
+ * decisions get read from.
+ */
+export {};
+//# sourceMappingURL=logger.test.d.ts.map

package/dist/__tests__/logger.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/logger.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/__tests__/postgres-store.test.d.ts

@@ -0,0 +1,16 @@
+/**
+ * PostgresSubscriptionStore / PostgresPurchaseStore against a real database.
+ *
+ * Until now nothing executed this SQL. `schema.test.ts` compares the embedded DDL
+ * strings to `sql/schema.sql` as text, which catches the two drifting apart but
+ * says nothing about whether either one works, and every other suite runs on the
+ * in-memory store. So the store that production actually uses was the least
+ * verified code in the package — and two things shipped on the strength of
+ * reading it: `getPurchasesForProduct`, and the claim in ARCHITECTURE.md that the
+ * partial unique index is "the atomic guarantee" behind non-consumable dedup.
+ *
+ * Skipped unless `DATABASE_URL` is set, so a local `npm test` without a database
+ * still passes. CI provides one through a service container.
+ */
+export {};
+//# sourceMappingURL=postgres-store.test.d.ts.map

package/dist/__tests__/postgres-store.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-store.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/postgres-store.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/index.cjs

@@ -175,10 +175,20 @@ var current = console;
 function setLogger(logger) {
   if (logger) current = logger;
 }
+function escapeLineBreaks(value) {
+  return value.replace(/[\r\n\u2028\u2029]/g, (ch) => {
+    if (ch === "\n") return "\\n";
+    if (ch === "\r") return "\\r";
+    return `\\u${ch.charCodeAt(0).toString(16).padStart(4, "0")}`;
+  });
+}
+function scrub(args) {
+  return args.map((arg) => typeof arg === "string" ? escapeLineBreaks(arg) : arg);
+}
 var log = {
-  info: (...args) => current.info(...args),
-  warn: (...args) => current.warn(...args),
-  error: (...args) => current.error(...args)
+  info: (...args) => current.info(...scrub(args)),
+  warn: (...args) => current.warn(...scrub(args)),
+  error: (...args) => current.error(...scrub(args))
 };
 
 // src/http.ts
@@ -2549,33 +2559,44 @@ function isEndedSubscription(sub) {
 function isNonConsumable(purchase) {
   return purchase.type === shared.PURCHASE_TYPE.NON_CONSUMABLE;
 }
-function aggregateActive(subs, purchases, nowMs) {
+function aggregateActiveSubscriptions(subs, nowMs) {
   const byProduct = {};
-  const byProductPurchases = {};
   const byPlatform = {};
-  let activeSubscriptions = 0;
-  let gracePeriodSubscriptions = 0;
-  let nonConsumablePurchases = 0;
+  let active = 0;
+  let gracePeriod = 0;
   for (const sub of subs) {
     if (!isActiveSubscription(sub, nowMs)) continue;
-    activeSubscriptions++;
-    if (sub.status === shared.SUBSCRIPTION_STATUS.GRACE_PERIOD) gracePeriodSubscriptions++;
+    active++;
+    if (sub.status === shared.SUBSCRIPTION_STATUS.GRACE_PERIOD) gracePeriod++;
     bump(byProduct, sub.productId);
     bump(byPlatform, sub.platform);
   }
+  return { active, gracePeriod, byProduct, byPlatform };
+}
+function aggregateNonConsumablePurchases(purchases) {
+  const byProduct = {};
+  const byPlatform = {};
+  let total = 0;
   for (const purchase of purchases) {
     if (!isNonConsumable(purchase)) continue;
-    nonConsumablePurchases++;
-    bump(byProductPurchases, purchase.productId);
+    total++;
+    bump(byProduct, purchase.productId);
     bump(byPlatform, purchase.platform);
   }
+  return { total, byProduct, byPlatform };
+}
+function composeActiveResponse(subs, purchases) {
+  const byPlatform = { ...subs.byPlatform };
+  for (const [platform, count] of Object.entries(purchases.byPlatform)) {
+    byPlatform[platform] = (byPlatform[platform] ?? 0) + count;
+  }
   return {
-    total: activeSubscriptions + nonConsumablePurchases,
-    activeSubscriptions,
-    gracePeriodSubscriptions,
-    nonConsumablePurchases,
-    byProduct,
-    byProductPurchases,
+    total: subs.active + purchases.total,
+    activeSubscriptions: subs.active,
+    gracePeriodSubscriptions: subs.gracePeriod,
+    nonConsumablePurchases: purchases.total,
+    byProduct: subs.byProduct,
+    byProductPurchases: purchases.byProduct,
     byPlatform
   };
 }
@@ -2638,8 +2659,12 @@ function createMetricsRouter(config, store, purchaseStore) {
       const response = await metricsCache.resolve(
         ["active", metricsCache.quantizeToWindow(Date.now())],
         async () => {
-          const [subs, purchases] = await Promise.all([store.listAll(), purchaseStore.listAll()]);
-          return aggregateActive(subs, purchases, Date.now());
+          const now = /* @__PURE__ */ new Date();
+          const [subsAgg, purchasesAgg] = await Promise.all([
+            store.aggregateActive ? store.aggregateActive(now) : store.listAll().then((subs) => aggregateActiveSubscriptions(subs, now.getTime())),
+            purchaseStore.aggregateNonConsumable ? purchaseStore.aggregateNonConsumable() : purchaseStore.listAll().then(aggregateNonConsumablePurchases)
+          ]);
+          return composeActiveResponse(subsAgg, purchasesAgg);
         }
       );
       res.status(200).json(response);
@@ -2672,7 +2697,7 @@ function createMetricsRouter(config, store, purchaseStore) {
     }
     return { fromMs, toMs, groupBy };
   }
-  function windowed(name, load, anchor, include) {
+  function windowed(name, sqlAggregate, load, anchor, include) {
     return async (req, res) => {
       const range = parseRange(req);
       if ("error" in range) {
@@ -2687,13 +2712,22 @@ function createMetricsRouter(config, store, purchaseStore) {
             metricsCache.quantizeToWindow(range.toMs),
             range.groupBy
           ],
-          async () => aggregateRange(await load(), {
-            fromMs: range.fromMs,
-            toMs: range.toMs,
-            groupBy: range.groupBy,
-            anchor,
-            ...include ? { include } : {}
-          })
+          async () => {
+            if (sqlAggregate) {
+              return sqlAggregate({
+                from: new Date(range.fromMs),
+                to: new Date(range.toMs),
+                groupBy: range.groupBy
+              });
+            }
+            return aggregateRange(await load(), {
+              fromMs: range.fromMs,
+              toMs: range.toMs,
+              groupBy: range.groupBy,
+              anchor,
+              ...include ? { include } : {}
+            });
+          }
         );
         const response = {
           from: req.query["from"],
@@ -2709,12 +2743,18 @@ function createMetricsRouter(config, store, purchaseStore) {
   }
   router.get(
     shared.ROUTES.METRICS_STARTED,
-    windowed("started", () => store.listAll(), (sub) => sub.purchasedAt)
+    windowed(
+      "started",
+      store.aggregateStarted?.bind(store),
+      () => store.listAll(),
+      (sub) => sub.purchasedAt
+    )
   );
   router.get(
     shared.ROUTES.METRICS_EXPIRED,
     windowed(
       "expired",
+      store.aggregateExpired?.bind(store),
       () => store.listAll(),
       (sub) => sub.expiresAt,
       isEndedSubscription
@@ -2724,6 +2764,7 @@ function createMetricsRouter(config, store, purchaseStore) {
     shared.ROUTES.METRICS_PURCHASES_STARTED,
     windowed(
       "purchases-started",
+      purchaseStore.aggregateStarted?.bind(purchaseStore),
       () => purchaseStore.listAll(),
       (purchase) => purchase.purchasedAt,
       isNonConsumable
@@ -2999,6 +3040,52 @@ var PostgresSubscriptionStore = class {
       offset
     };
   }
+  /**
+   * Counts of subscriptions currently granting entitlement.
+   *
+   * One `GROUP BY` instead of reading every row into the process. Grouping by
+   * status as well as product/platform is what lets the grace-period subset come
+   * out of the same query.
+   */
+  async aggregateActive(now) {
+    const pool = await this.getPool();
+    const result = await pool.query(
+      `SELECT product_id, platform, status, COUNT(*)::text AS n
+         FROM onesub_subscriptions
+        WHERE status IN ($1, $2) AND expires_at > $3
+        GROUP BY product_id, platform, status`,
+      [shared.SUBSCRIPTION_STATUS.ACTIVE, shared.SUBSCRIPTION_STATUS.GRACE_PERIOD, now]
+    );
+    const byProduct = {};
+    const byPlatform = {};
+    let active = 0;
+    let gracePeriod = 0;
+    for (const row of result.rows) {
+      const n = parseInt(row.n, 10);
+      active += n;
+      if (row.status === shared.SUBSCRIPTION_STATUS.GRACE_PERIOD) gracePeriod += n;
+      byProduct[row.product_id] = (byProduct[row.product_id] ?? 0) + n;
+      byPlatform[row.platform] = (byPlatform[row.platform] ?? 0) + n;
+    }
+    return { active, gracePeriod, byProduct, byPlatform };
+  }
+  /** Cohort-start counts: subscriptions whose `purchased_at` is in the window. */
+  async aggregateStarted(query) {
+    const pool = await this.getPool();
+    return aggregateViaSql(pool, "onesub_subscriptions", "purchased_at", query);
+  }
+  /**
+   * Subscriptions that have ended AND whose `expires_at` is in the window. A
+   * still-active record does not count even if its expiry lands inside it — see
+   * `isEndedSubscription`, which this mirrors.
+   */
+  async aggregateExpired(query) {
+    const pool = await this.getPool();
+    return aggregateViaSql(pool, "onesub_subscriptions", "expires_at", query, {
+      column: "status",
+      values: [shared.SUBSCRIPTION_STATUS.EXPIRED, shared.SUBSCRIPTION_STATUS.CANCELED]
+    });
+  }
   /** Gracefully close the underlying connection pool. */
   async close() {
     if (this.poolPromise) {
@@ -3139,6 +3226,35 @@ var PostgresPurchaseStore = class {
     const result = await pool.query(`SELECT * FROM onesub_purchases`);
     return result.rows.map(rowToPurchaseInfo);
   }
+  /** Counts of non-consumable purchases. Consumables are excluded. */
+  async aggregateNonConsumable() {
+    const pool = await this.getPool();
+    const result = await pool.query(
+      `SELECT product_id, platform, COUNT(*)::text AS n
+         FROM onesub_purchases
+        WHERE type = $1
+        GROUP BY product_id, platform`,
+      [shared.PURCHASE_TYPE.NON_CONSUMABLE]
+    );
+    const byProduct = {};
+    const byPlatform = {};
+    let total = 0;
+    for (const row of result.rows) {
+      const n = parseInt(row.n, 10);
+      total += n;
+      byProduct[row.product_id] = (byProduct[row.product_id] ?? 0) + n;
+      byPlatform[row.platform] = (byPlatform[row.platform] ?? 0) + n;
+    }
+    return { total, byProduct, byPlatform };
+  }
+  /** Non-consumable purchases whose `purchased_at` is in the window. */
+  async aggregateStarted(query) {
+    const pool = await this.getPool();
+    return aggregateViaSql(pool, "onesub_purchases", "purchased_at", query, {
+      column: "type",
+      values: [shared.PURCHASE_TYPE.NON_CONSUMABLE]
+    });
+  }
   /** Gracefully close the underlying connection pool. */
   async close() {
     if (this.poolPromise) {
@@ -3148,6 +3264,42 @@ var PostgresPurchaseStore = class {
     }
   }
 };
+async function aggregateViaSql(pool, table, anchorColumn, query, filter) {
+  const params = [query.from, query.to];
+  let filterClause = "";
+  if (filter) {
+    const placeholders = filter.values.map((_, i) => `$${params.length + i + 1}`).join(", ");
+    filterClause = `AND ${filter.column} IN (${placeholders})`;
+    params.push(...filter.values);
+  }
+  const bucketing = query.groupBy === "day";
+  const dayExpr = `to_char(date_trunc('day', ${anchorColumn} AT TIME ZONE 'UTC'), 'YYYY-MM-DD')`;
+  const result = await pool.query(
+    `SELECT product_id, platform,${bucketing ? ` ${dayExpr} AS day,` : ""}
+            COUNT(*)::text AS n
+       FROM ${table}
+      WHERE ${anchorColumn} >= $1 AND ${anchorColumn} <= $2 ${filterClause}
+      GROUP BY product_id, platform${bucketing ? ", day" : ""}`,
+    params
+  );
+  const byProduct = {};
+  const byPlatform = {};
+  const perDay = /* @__PURE__ */ new Map();
+  let total = 0;
+  for (const row of result.rows) {
+    const n = parseInt(row.n, 10);
+    total += n;
+    byProduct[row.product_id] = (byProduct[row.product_id] ?? 0) + n;
+    byPlatform[row.platform] = (byPlatform[row.platform] ?? 0) + n;
+    if (bucketing && row.day) perDay.set(row.day, (perDay.get(row.day) ?? 0) + n);
+  }
+  if (!bucketing) return { total, byProduct, byPlatform };
+  const buckets = emptyDailyBuckets(query.from.getTime(), query.to.getTime()).map((b) => ({
+    date: b.date,
+    count: perDay.get(b.date) ?? 0
+  }));
+  return { total, byProduct, byPlatform, buckets };
+}
 function rowToSubscriptionInfo(row) {
   return {
     originalTransactionId: row.original_transaction_id,