@onesub/server 0.26.0 → 0.27.0

package/README.md

@@ -323,7 +323,9 @@ Canonical Postgres DDL shipped at [`sql/schema.sql`](./sql/schema.sql). Apply wi
 ## Security
 
 - Apple JWS signature verified end-to-end against **Apple Root CA G3** (as of `0.6.0`)
-- Google RTDN: `Authorization: Bearer` JWT verified against Google JWKS when `pushAudience` is configured
+- Google RTDN: `Authorization: Bearer` JWT verified against Google JWKS when `pushAudience` is
+  configured. Without it the request cannot be attributed to Google and is refused with 401 under
+  `NODE_ENV=production`, unless `google.allowUnauthenticatedWebhook` opts in
 - `transactionId` ownership enforced — same receipt can't be reused across users (`0.5.0+`)
 - zod input validation + 50 KB body cap
 - Full write-up: [`docs/SECURITY.md`](../../docs/SECURITY.md)

package/dist/__tests__/google-webhook-open-warning.test.d.ts

@@ -1,12 +1,20 @@
 /**
- * Startup warning for the two conditions that leave the Google RTDN route open.
+ * Startup warnings for the Google RTDN route's two loose conditions.
  *
- * `POST /onesub/webhook/google` verifies the Pub/Sub OIDC token only when an app
- * declares `pushAudience`, and serves any `packageName` when none declares one.
- * The route is mounted either way. Both behaviours are pre-existing and
- * deliberate — a host may front the route with its own verification — so this
- * warns instead of refusing, and these tests pin down that it says so exactly
- * when it should and stays quiet otherwise.
+ * The authentication half changed in 0.27.0: without a `pushAudience` the route used
+ * to accept the request, and now refuses it with 401 in production unless
+ * `google.allowUnauthenticatedWebhook` says otherwise. So there are two warnings to
+ * tell apart, and getting them backwards would be worse than having none — an
+ * operator reading "insecure" when the endpoint is actually refusing traffic goes
+ * hunting for a breach instead of a missing config value.
+ *
+ * Open mode (no `packageName`) is unchanged: it still warns rather than refusing.
+ *
+ * The assertions here were rewritten, not adjusted. Three of them were negative
+ * matches against the old warning's wording — text this file no longer produces at
+ * all, so they would have passed however loudly the new warning fired. A negative
+ * assertion against a string that cannot occur is not coverage, so each one now
+ * names both current warnings explicitly.
  */
 export {};
 //# sourceMappingURL=google-webhook-open-warning.test.d.ts.map

package/dist/__tests__/google-webhook-open-warning.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-webhook-open-warning.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/google-webhook-open-warning.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}
+{"version":3,"file":"google-webhook-open-warning.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/google-webhook-open-warning.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/__tests__/google-webhook-unauthenticated.test.d.ts

@@ -0,0 +1,30 @@
+/**
+ * `POST /onesub/webhook/google` refuses requests it cannot attribute to Google.
+ *
+ * ## Why this replaced masking the purchase token
+ *
+ * The RTDN paths are only dangerous because a caller who knows a `purchaseToken` or
+ * an `orderId` could reach them unauthenticated: the voided-purchase branch acts on
+ * the payload alone, cancelling a subscription by token or deleting a one-time
+ * purchase row by order id.
+ *
+ * Treating those ids as secrets does not work. For a Google subscription the purchase
+ * token **is** the record's `originalTransactionId` (`providers/google.ts` keys on it
+ * deliberately — RTDNs and `linkedPurchaseToken` chains carry nothing else), so it
+ * lives in the database, in every notification payload, and in the webhook lines
+ * where it is the subject of the investigation. Redacting it from logs would have left
+ * the capability intact while suggesting otherwise.
+ *
+ * Refusing unattributable requests removes the capability instead.
+ *
+ * ## Production-gated, and why that is not a loophole
+ *
+ * Locally and in CI no real RTDN arrives, and requiring Pub/Sub credentials there
+ * would break every webhook test in this repo and the `onesub dev` server for no
+ * security gain. This matches how the mockMode hard guard and the sandbox-receipt
+ * rejection are already gated. The residual risk — a production deployment that
+ * forgets `NODE_ENV=production` — is the same one those two already carry, so this
+ * adds no new footgun, and the boot warning fires on the same condition.
+ */
+export {};
+//# sourceMappingURL=google-webhook-unauthenticated.test.d.ts.map

package/dist/__tests__/google-webhook-unauthenticated.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-webhook-unauthenticated.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/google-webhook-unauthenticated.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG"}

package/dist/index.cjs

@@ -174,6 +174,8 @@ var APPLE_ROOT_CA_PEMS = [APPLE_ROOT_CA_G3_PEM];
 var LOG_CONTINUATION = "\n    | ";
 var BARE_VALUE = /^[\w.:/@+-]+$/;
 var LINE_TERMINATORS = /\r\n|\r|\n|\u2028|\u2029/;
+var MAX_VALUE_CHARS = 512;
+var PLAY_TOKEN_IN_URL = /\/tokens\/[^/:"'\s\\]+/g;
 var MAX_CAUSE_DEPTH = 2;
 var MAX_AGGREGATE_ERRORS = 3;
 function esc(value) {
@@ -182,6 +184,13 @@ function esc(value) {
 function escQuoted(value) {
   return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\r/g, "\\r").replace(/\n/g, "\\n").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
+function clamp(value) {
+  if (value.length <= MAX_VALUE_CHARS) return value;
+  return `${value.slice(0, MAX_VALUE_CHARS)}\u2026+${value.length - MAX_VALUE_CHARS} more`;
+}
+function sanitize(value) {
+  return clamp(value.replace(PLAY_TOKEN_IN_URL, "/tokens/[redacted]"));
+}
 function renderValue(value) {
   if (value === void 0) return void 0;
   if (value === null) return "null";
@@ -191,17 +200,19 @@ function renderValue(value) {
       return String(value);
     case "bigint":
       return `${value}n`;
-    case "string":
-      return BARE_VALUE.test(value) ? value : `"${escQuoted(value)}"`;
+    case "string": {
+      const safe = sanitize(value);
+      return BARE_VALUE.test(safe) ? safe : `"${escQuoted(safe)}"`;
+    }
     case "object":
       try {
-        return `"${escQuoted(JSON.stringify(value) ?? "null")}"`;
+        return `"${escQuoted(sanitize(JSON.stringify(value) ?? "null"))}"`;
       } catch {
         return '"[unserialisable]"';
       }
     default:
       try {
-        return `"${escQuoted(String(value))}"`;
+        return `"${escQuoted(sanitize(String(value)))}"`;
       } catch {
         return '"[unrenderable]"';
       }
@@ -1958,15 +1969,26 @@ var GOOGLE_FAILURE_MESSAGES = {
 function servesGoogle(config) {
   return getAppRegistry(config).apps.some((app) => !!app.google);
 }
+function googleWebhookIsAuthenticated(config) {
+  return getAppRegistry(config).apps.some((a) => a.google?.pushAudience);
+}
+function googleWebhookAllowsUnauthenticated(config) {
+  return getAppRegistry(config).apps.some((a) => a.google?.allowUnauthenticatedWebhook);
+}
 function warnIfGoogleWebhookOpen(config) {
   if (process.env["NODE_ENV"] !== "production") return;
   if (!servesGoogle(config)) return;
   const apps = getAppRegistry(config).apps;
-  const googleApps = apps.map((a) => a.google).filter((g) => !!g);
-  if (!googleApps.some((g) => g.pushAudience)) {
-    log.warn(
-      "[onesub] SECURITY: POST /onesub/webhook/google accepts unauthenticated requests \u2014 no configured app sets google.pushAudience, so the Pub/Sub OIDC token is never verified. A caller who knows a purchaseToken or orderId can cancel a subscription or delete a one-time purchase. Set google.pushAudience (and google.pushServiceAccountEmail)."
-    );
+  if (!googleWebhookIsAuthenticated(config)) {
+    if (googleWebhookAllowsUnauthenticated(config)) {
+      log.warn(
+        "[onesub] SECURITY: POST /onesub/webhook/google runs unauthenticated by explicit opt-in \u2014 google.allowUnauthenticatedWebhook is set and no app sets google.pushAudience. Anything that can reach this endpoint can cancel a subscription or delete a one-time purchase, so the request must already be authenticated in front of this server."
+      );
+    } else {
+      log.warn(
+        "[onesub] POST /onesub/webhook/google will reject every request with 401 \u2014 no configured app sets google.pushAudience, so the Pub/Sub OIDC token cannot be verified. Set google.pushAudience (and google.pushServiceAccountEmail), or set google.allowUnauthenticatedWebhook when something in front of this server already authenticates the request."
+      );
+    }
   }
   if (!apps.some((a) => a.google?.packageName)) {
     log.warn(
@@ -2095,7 +2117,12 @@ async function processGoogleNotification(work, config, store, purchaseStore) {
 }
 async function handleGoogleWebhook(req, res, config, store, purchaseStore, webhookEventStore, webhookQueue) {
   const pushIdentities = getAppRegistry(config).apps.map((app) => app.google).filter((g) => !!g?.pushAudience);
-  if (pushIdentities.length > 0) {
+  if (pushIdentities.length === 0) {
+    if (process.env["NODE_ENV"] === "production" && !googleWebhookAllowsUnauthenticated(config)) {
+      sendError(res, 401, shared.ONESUB_ERROR_CODE.UNAUTHORIZED, "Unauthorized");
+      return;
+    }
+  } else {
     let authenticated = false;
     for (const google of pushIdentities) {
       if (await verifyGooglePushToken(req, google.pushAudience, google.pushServiceAccountEmail)) {