@onesub/server 0.26.0 → 0.27.0

package/dist/index.js

@@ -167,6 +167,8 @@ var APPLE_ROOT_CA_PEMS = [APPLE_ROOT_CA_G3_PEM];
 var LOG_CONTINUATION = "\n    | ";
 var BARE_VALUE = /^[\w.:/@+-]+$/;
 var LINE_TERMINATORS = /\r\n|\r|\n|\u2028|\u2029/;
+var MAX_VALUE_CHARS = 512;
+var PLAY_TOKEN_IN_URL = /\/tokens\/[^/:"'\s\\]+/g;
 var MAX_CAUSE_DEPTH = 2;
 var MAX_AGGREGATE_ERRORS = 3;
 function esc(value) {
@@ -175,6 +177,13 @@ function esc(value) {
 function escQuoted(value) {
   return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\r/g, "\\r").replace(/\n/g, "\\n").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
+function clamp(value) {
+  if (value.length <= MAX_VALUE_CHARS) return value;
+  return `${value.slice(0, MAX_VALUE_CHARS)}\u2026+${value.length - MAX_VALUE_CHARS} more`;
+}
+function sanitize(value) {
+  return clamp(value.replace(PLAY_TOKEN_IN_URL, "/tokens/[redacted]"));
+}
 function renderValue(value) {
   if (value === void 0) return void 0;
   if (value === null) return "null";
@@ -184,17 +193,19 @@ function renderValue(value) {
       return String(value);
     case "bigint":
       return `${value}n`;
-    case "string":
-      return BARE_VALUE.test(value) ? value : `"${escQuoted(value)}"`;
+    case "string": {
+      const safe = sanitize(value);
+      return BARE_VALUE.test(safe) ? safe : `"${escQuoted(safe)}"`;
+    }
     case "object":
       try {
-        return `"${escQuoted(JSON.stringify(value) ?? "null")}"`;
+        return `"${escQuoted(sanitize(JSON.stringify(value) ?? "null"))}"`;
       } catch {
         return '"[unserialisable]"';
       }
     default:
       try {
-        return `"${escQuoted(String(value))}"`;
+        return `"${escQuoted(sanitize(String(value)))}"`;
       } catch {
         return '"[unrenderable]"';
       }
@@ -1951,15 +1962,26 @@ var GOOGLE_FAILURE_MESSAGES = {
 function servesGoogle(config) {
   return getAppRegistry(config).apps.some((app) => !!app.google);
 }
+function googleWebhookIsAuthenticated(config) {
+  return getAppRegistry(config).apps.some((a) => a.google?.pushAudience);
+}
+function googleWebhookAllowsUnauthenticated(config) {
+  return getAppRegistry(config).apps.some((a) => a.google?.allowUnauthenticatedWebhook);
+}
 function warnIfGoogleWebhookOpen(config) {
   if (process.env["NODE_ENV"] !== "production") return;
   if (!servesGoogle(config)) return;
   const apps = getAppRegistry(config).apps;
-  const googleApps = apps.map((a) => a.google).filter((g) => !!g);
-  if (!googleApps.some((g) => g.pushAudience)) {
-    log.warn(
-      "[onesub] SECURITY: POST /onesub/webhook/google accepts unauthenticated requests \u2014 no configured app sets google.pushAudience, so the Pub/Sub OIDC token is never verified. A caller who knows a purchaseToken or orderId can cancel a subscription or delete a one-time purchase. Set google.pushAudience (and google.pushServiceAccountEmail)."
-    );
+  if (!googleWebhookIsAuthenticated(config)) {
+    if (googleWebhookAllowsUnauthenticated(config)) {
+      log.warn(
+        "[onesub] SECURITY: POST /onesub/webhook/google runs unauthenticated by explicit opt-in \u2014 google.allowUnauthenticatedWebhook is set and no app sets google.pushAudience. Anything that can reach this endpoint can cancel a subscription or delete a one-time purchase, so the request must already be authenticated in front of this server."
+      );
+    } else {
+      log.warn(
+        "[onesub] POST /onesub/webhook/google will reject every request with 401 \u2014 no configured app sets google.pushAudience, so the Pub/Sub OIDC token cannot be verified. Set google.pushAudience (and google.pushServiceAccountEmail), or set google.allowUnauthenticatedWebhook when something in front of this server already authenticates the request."
+      );
+    }
   }
   if (!apps.some((a) => a.google?.packageName)) {
     log.warn(
@@ -2088,7 +2110,12 @@ async function processGoogleNotification(work, config, store, purchaseStore) {
 }
 async function handleGoogleWebhook(req, res, config, store, purchaseStore, webhookEventStore, webhookQueue) {
   const pushIdentities = getAppRegistry(config).apps.map((app) => app.google).filter((g) => !!g?.pushAudience);
-  if (pushIdentities.length > 0) {
+  if (pushIdentities.length === 0) {
+    if (process.env["NODE_ENV"] === "production" && !googleWebhookAllowsUnauthenticated(config)) {
+      sendError(res, 401, ONESUB_ERROR_CODE.UNAUTHORIZED, "Unauthorized");
+      return;
+    }
+  } else {
     let authenticated = false;
     for (const google of pushIdentities) {
       if (await verifyGooglePushToken(req, google.pushAudience, google.pushServiceAccountEmail)) {