@onesub/server 0.25.0 → 0.27.0

package/README.md

@@ -323,7 +323,9 @@ Canonical Postgres DDL shipped at [`sql/schema.sql`](./sql/schema.sql). Apply wi
 ## Security
 
 - Apple JWS signature verified end-to-end against **Apple Root CA G3** (as of `0.6.0`)
-- Google RTDN: `Authorization: Bearer` JWT verified against Google JWKS when `pushAudience` is configured
+- Google RTDN: `Authorization: Bearer` JWT verified against Google JWKS when `pushAudience` is
+  configured. Without it the request cannot be attributed to Google and is refused with 401 under
+  `NODE_ENV=production`, unless `google.allowUnauthenticatedWebhook` opts in
 - `transactionId` ownership enforced — same receipt can't be reused across users (`0.5.0+`)
 - zod input validation + 50 KB body cap
 - Full write-up: [`docs/SECURITY.md`](../../docs/SECURITY.md)

package/dist/__tests__/google-webhook-open-warning.test.d.ts

@@ -1,12 +1,20 @@
 /**
- * Startup warning for the two conditions that leave the Google RTDN route open.
+ * Startup warnings for the Google RTDN route's two loose conditions.
  *
- * `POST /onesub/webhook/google` verifies the Pub/Sub OIDC token only when an app
- * declares `pushAudience`, and serves any `packageName` when none declares one.
- * The route is mounted either way. Both behaviours are pre-existing and
- * deliberate — a host may front the route with its own verification — so this
- * warns instead of refusing, and these tests pin down that it says so exactly
- * when it should and stays quiet otherwise.
+ * The authentication half changed in 0.27.0: without a `pushAudience` the route used
+ * to accept the request, and now refuses it with 401 in production unless
+ * `google.allowUnauthenticatedWebhook` says otherwise. So there are two warnings to
+ * tell apart, and getting them backwards would be worse than having none — an
+ * operator reading "insecure" when the endpoint is actually refusing traffic goes
+ * hunting for a breach instead of a missing config value.
+ *
+ * Open mode (no `packageName`) is unchanged: it still warns rather than refusing.
+ *
+ * The assertions here were rewritten, not adjusted. Three of them were negative
+ * matches against the old warning's wording — text this file no longer produces at
+ * all, so they would have passed however loudly the new warning fired. A negative
+ * assertion against a string that cannot occur is not coverage, so each one now
+ * names both current warnings explicitly.
  */
 export {};
 //# sourceMappingURL=google-webhook-open-warning.test.d.ts.map

package/dist/__tests__/google-webhook-open-warning.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-webhook-open-warning.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/google-webhook-open-warning.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}
+{"version":3,"file":"google-webhook-open-warning.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/google-webhook-open-warning.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/__tests__/google-webhook-unauthenticated.test.d.ts

@@ -0,0 +1,30 @@
+/**
+ * `POST /onesub/webhook/google` refuses requests it cannot attribute to Google.
+ *
+ * ## Why this replaced masking the purchase token
+ *
+ * The RTDN paths are only dangerous because a caller who knows a `purchaseToken` or
+ * an `orderId` could reach them unauthenticated: the voided-purchase branch acts on
+ * the payload alone, cancelling a subscription by token or deleting a one-time
+ * purchase row by order id.
+ *
+ * Treating those ids as secrets does not work. For a Google subscription the purchase
+ * token **is** the record's `originalTransactionId` (`providers/google.ts` keys on it
+ * deliberately — RTDNs and `linkedPurchaseToken` chains carry nothing else), so it
+ * lives in the database, in every notification payload, and in the webhook lines
+ * where it is the subject of the investigation. Redacting it from logs would have left
+ * the capability intact while suggesting otherwise.
+ *
+ * Refusing unattributable requests removes the capability instead.
+ *
+ * ## Production-gated, and why that is not a loophole
+ *
+ * Locally and in CI no real RTDN arrives, and requiring Pub/Sub credentials there
+ * would break every webhook test in this repo and the `onesub dev` server for no
+ * security gain. This matches how the mockMode hard guard and the sandbox-receipt
+ * rejection are already gated. The residual risk — a production deployment that
+ * forgets `NODE_ENV=production` — is the same one those two already carry, so this
+ * adds no new footgun, and the boot warning fires on the same condition.
+ */
+export {};
+//# sourceMappingURL=google-webhook-unauthenticated.test.d.ts.map

package/dist/__tests__/google-webhook-unauthenticated.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-webhook-unauthenticated.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/google-webhook-unauthenticated.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG"}

package/dist/__tests__/route-log-fields.test.d.ts

@@ -0,0 +1,20 @@
+/**
+ * What the routes, stores and webhook handlers put on a log line.
+ *
+ * This is the half of the migration that delivers the point of it. `userId` does not
+ * exist in the provider layer — it arrives in a request body — so "show me every
+ * rejection for this user" only became answerable when these call sites moved.
+ * `provider-log-fields.test.ts` covers Apple and Google; this covers the other 54.
+ *
+ * Driven through HTTP with supertest rather than by calling handlers, because two of
+ * the values under test (`userId`, `bundleId`) are attacker-supplied through the
+ * request and the escaping only matters on that path. `bundleId` in particular is
+ * read out of an **unverified** JWS by `peekAppleBundleId`, which makes
+ * `apps.ts`'s "No app configured" line the most attacker-reachable log site in the
+ * package.
+ *
+ * Exact-line assertions again, for the reason given in `provider-log-fields.test.ts`:
+ * a substring match cannot tell a field from a sentence that mentions the value.
+ */
+export {};
+//# sourceMappingURL=route-log-fields.test.d.ts.map

package/dist/__tests__/route-log-fields.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-log-fields.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/route-log-fields.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/apps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../src/apps.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAG1E;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,eAAe,GAAG,SAAS,CAAC;IACjD;;;;OAIG;IACH,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,kBAAkB,CAAC;CAC9C;AAED,MAAM,WAAW,OAAO;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACtC;AAQD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,WAAW,CAMtE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,WAAW,CA8DxE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUjE"}
+{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../src/apps.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAG1E;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,eAAe,GAAG,SAAS,CAAC;IACjD;;;;OAIG;IACH,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,kBAAkB,CAAC;CAC9C;AAED,MAAM,WAAW,OAAO;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACtC;AAQD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,WAAW,CAMtE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,WAAW,CAiExE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUjE"}