@onesub/server 0.23.3 → 0.25.0

package/dist/__tests__/field-vocabulary.test.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Holds every `log.*` call site in the package to the field vocabulary declared in
+ * `log-format.ts`.
+ *
+ * Why a source-scanning test rather than more per-call-site assertions. The value of
+ * moving data out of the message is that an operator can filter on `productId` — and
+ * that value is destroyed by one file calling it `product`, silently, on a path no
+ * test happens to exercise. That is not hypothetical: while building
+ * `provider-log-fields.test.ts` a mutation renaming `productId` to `product` at the
+ * "No orderId in product purchase" site **passed all 13 of its tests**, because that
+ * site is not one of the ones asserted. Covering ~100 sites individually to close
+ * that gap is not maintainable; checking the vocabulary once, over all of them, is.
+ *
+ * The vocabulary lives in `log-format.ts`'s module doc and is parsed out of it here,
+ * so there is exactly one list. A doc comment is an odd place for an enforced
+ * contract, but the alternative — an exported `const` array — would ship a
+ * test-only value in the bundle that `npm run size` gates.
+ *
+ * What this test cannot do: it does not know whether a field is *correctly named*
+ * for its value, only that the name is one of the sanctioned ones. `bundleId:
+ * tx.productId` passes here. Per-site assertions in `provider-log-fields.test.ts`
+ * cover that for the paths that matter.
+ */
+export {};
+//# sourceMappingURL=field-vocabulary.test.d.ts.map

package/dist/__tests__/field-vocabulary.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-vocabulary.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/field-vocabulary.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG"}

package/dist/__tests__/log-format.test.d.ts

@@ -0,0 +1,15 @@
+/**
+ * formatLogArgs — the security properties of log rendering.
+ *
+ * These live here rather than in `logger.test.ts` because they are properties of a
+ * pure function from arguments to a string. `logger.ts` holds process-global state
+ * and needs `setLogger` juggling; nothing that carries a security claim should
+ * depend on that.
+ *
+ * The central claim is one property, asserted over a hostile matrix rather than
+ * case by case: **no byte supplied by a caller can begin a line.** Everything else
+ * here is either a corollary or a guard against the formatter throwing on input it
+ * will genuinely receive.
+ */
+export {};
+//# sourceMappingURL=log-format.test.d.ts.map

package/dist/__tests__/log-format.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-format.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/log-format.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/dist/__tests__/logger.test.d.ts

@@ -1,11 +1,18 @@
 /**
- * The process-wide logger, and specifically that a caller cannot forge log lines.
+ * The process-wide logger: routing, and the shape of what reaches the sink.
  *
- * Much of what this server logs is attacker-influenced — `userId` arrives in the
- * request body, and bundle ids, package names and receipt previews come out of
- * submitted receipts. A newline in any of those would let a caller end the current
- * line and write an entry of their own, and these logs are what support and fraud
- * decisions get read from.
+ * The escaping and rendering details moved to `log-format.test.ts`, which tests them
+ * as properties of a pure function over a hostile matrix rather than one case at a
+ * time. What is left here is what only this module can answer: that each level goes
+ * where it should, and that a sink receives **exactly one string argument**.
+ *
+ * That last one is the load-bearing assertion. It is the contract every documented
+ * sink depends on — `pino` treats a second argument as a printf interpolation
+ * parameter, not as structured fields, so anything "helpfully" passing fields
+ * alongside the message would silently degrade for the sink this package recommends
+ * for production. There is also then no shape for a JSON serialiser to drop: an
+ * `Error` passed as an object would serialise to `{}`, because its own properties
+ * are non-enumerable.
  */
 export {};
 //# sourceMappingURL=logger.test.d.ts.map

package/dist/__tests__/logger.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/logger.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}
+{"version":3,"file":"logger.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/logger.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG"}

package/dist/__tests__/provider-log-fields.test.d.ts

@@ -0,0 +1,27 @@
+/**
+ * What the Apple and Google providers actually put on a log line.
+ *
+ * These paths had **no log assertions at all** before this file, which is worth
+ * stating plainly: the 49 call sites in `providers/apple.ts` and
+ * `providers/google.ts` could have been migrated to `(message, fields)` — or
+ * broken — and the whole suite would have stayed green either way. So this file
+ * is not belt-and-braces on top of `log-format.test.ts`; it is the only thing
+ * that holds the providers to the contract.
+ *
+ * It tests through the real provider functions rather than through
+ * `formatLogArgs`, because the two failure modes that matter are call-site
+ * failures a pure formatter test cannot see:
+ *
+ *   1. **A value left in the message.** `formatLogArgs` escapes whatever it is
+ *      given; it cannot know that `bundleId` should have been a field. Only an
+ *      assertion on the rendered line catches an interpolated value.
+ *   2. **A field named differently in two places.** The point of moving values
+ *      out of the message is that an operator can filter on `productId`. That is
+ *      lost the moment one file calls it `product` — and nothing but an exact
+ *      assertion notices.
+ *
+ * Hence exact-line assertions, not `toContain`. A substring match would pass on
+ * `productId=x` *and* on a message that happened to mention it.
+ */
+export {};
+//# sourceMappingURL=provider-log-fields.test.d.ts.map

package/dist/__tests__/provider-log-fields.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-log-fields.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/provider-log-fields.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG"}