@onesub/server 0.24.0 → 0.26.0

package/dist/__tests__/field-vocabulary.test.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Holds every `log.*` call site in the package to the field vocabulary declared in
+ * `log-format.ts`.
+ *
+ * Why a source-scanning test rather than more per-call-site assertions. The value of
+ * moving data out of the message is that an operator can filter on `productId` — and
+ * that value is destroyed by one file calling it `product`, silently, on a path no
+ * test happens to exercise. That is not hypothetical: while building
+ * `provider-log-fields.test.ts` a mutation renaming `productId` to `product` at the
+ * "No orderId in product purchase" site **passed all 13 of its tests**, because that
+ * site is not one of the ones asserted. Covering ~100 sites individually to close
+ * that gap is not maintainable; checking the vocabulary once, over all of them, is.
+ *
+ * The vocabulary lives in `log-format.ts`'s module doc and is parsed out of it here,
+ * so there is exactly one list. A doc comment is an odd place for an enforced
+ * contract, but the alternative — an exported `const` array — would ship a
+ * test-only value in the bundle that `npm run size` gates.
+ *
+ * What this test cannot do: it does not know whether a field is *correctly named*
+ * for its value, only that the name is one of the sanctioned ones. `bundleId:
+ * tx.productId` passes here. Per-site assertions in `provider-log-fields.test.ts`
+ * cover that for the paths that matter.
+ */
+export {};
+//# sourceMappingURL=field-vocabulary.test.d.ts.map

package/dist/__tests__/field-vocabulary.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-vocabulary.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/field-vocabulary.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG"}

package/dist/__tests__/provider-log-fields.test.d.ts

@@ -0,0 +1,27 @@
+/**
+ * What the Apple and Google providers actually put on a log line.
+ *
+ * These paths had **no log assertions at all** before this file, which is worth
+ * stating plainly: the 49 call sites in `providers/apple.ts` and
+ * `providers/google.ts` could have been migrated to `(message, fields)` — or
+ * broken — and the whole suite would have stayed green either way. So this file
+ * is not belt-and-braces on top of `log-format.test.ts`; it is the only thing
+ * that holds the providers to the contract.
+ *
+ * It tests through the real provider functions rather than through
+ * `formatLogArgs`, because the two failure modes that matter are call-site
+ * failures a pure formatter test cannot see:
+ *
+ *   1. **A value left in the message.** `formatLogArgs` escapes whatever it is
+ *      given; it cannot know that `bundleId` should have been a field. Only an
+ *      assertion on the rendered line catches an interpolated value.
+ *   2. **A field named differently in two places.** The point of moving values
+ *      out of the message is that an operator can filter on `productId`. That is
+ *      lost the moment one file calls it `product` — and nothing but an exact
+ *      assertion notices.
+ *
+ * Hence exact-line assertions, not `toContain`. A substring match would pass on
+ * `productId=x` *and* on a message that happened to mention it.
+ */
+export {};
+//# sourceMappingURL=provider-log-fields.test.d.ts.map

package/dist/__tests__/provider-log-fields.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-log-fields.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/provider-log-fields.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG"}

package/dist/__tests__/route-log-fields.test.d.ts

@@ -0,0 +1,20 @@
+/**
+ * What the routes, stores and webhook handlers put on a log line.
+ *
+ * This is the half of the migration that delivers the point of it. `userId` does not
+ * exist in the provider layer — it arrives in a request body — so "show me every
+ * rejection for this user" only became answerable when these call sites moved.
+ * `provider-log-fields.test.ts` covers Apple and Google; this covers the other 54.
+ *
+ * Driven through HTTP with supertest rather than by calling handlers, because two of
+ * the values under test (`userId`, `bundleId`) are attacker-supplied through the
+ * request and the escaping only matters on that path. `bundleId` in particular is
+ * read out of an **unverified** JWS by `peekAppleBundleId`, which makes
+ * `apps.ts`'s "No app configured" line the most attacker-reachable log site in the
+ * package.
+ *
+ * Exact-line assertions again, for the reason given in `provider-log-fields.test.ts`:
+ * a substring match cannot tell a field from a sentence that mentions the value.
+ */
+export {};
+//# sourceMappingURL=route-log-fields.test.d.ts.map

package/dist/__tests__/route-log-fields.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-log-fields.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/route-log-fields.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/apps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../src/apps.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAG1E;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,eAAe,GAAG,SAAS,CAAC;IACjD;;;;OAIG;IACH,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,kBAAkB,CAAC;CAC9C;AAED,MAAM,WAAW,OAAO;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACtC;AAQD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,WAAW,CAMtE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,WAAW,CA8DxE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUjE"}
+{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../src/apps.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAG1E;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,eAAe,GAAG,SAAS,CAAC;IACjD;;;;OAIG;IACH,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,kBAAkB,CAAC;CAC9C;AAED,MAAM,WAAW,OAAO;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACtC;AAQD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,WAAW,CAMtE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,WAAW,CAiExE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUjE"}