@payloadcms/plugin-stripe 3.89.0-internal.95c9cba → 3.90.0

package/dist/routes/rest.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/routes/rest.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { addDataAndFileToRequest, Forbidden } from 'payload'\n\nimport type { StripePluginConfig } from '../types.js'\n\nimport { stripeProxy } from '../utilities/stripeProxy.js'\n\nexport const stripeREST = async (args: {\n  pluginConfig: StripePluginConfig\n  req: PayloadRequest\n}): Promise<any> => {\n  let responseStatus = 200\n  let responseJSON\n\n  const { pluginConfig, req } = args\n\n  await addDataAndFileToRequest(req)\n\n  const requestWithData = req\n  const { data, payload, user } = requestWithData\n\n  const { stripeSecretKey } = pluginConfig\n\n  try {\n    if (!user) {\n      // TODO: make this customizable from the config\n      throw new Forbidden(req.t)\n    }\n\n    responseJSON = await stripeProxy({\n      stripeArgs: data?.stripeArgs, // example: ['cus_MGgt3Tuj3D66f2'] or [{ limit: 100 }, { stripeAccount: 'acct_1J9Z4pKZ4Z4Z4Z4Z' }]\n      stripeMethod: data?.stripeMethod, // example: 'subscriptions.list',\n      stripeSecretKey,\n    })\n\n    const { status } = responseJSON\n    responseStatus = status\n  } catch (error: unknown) {\n    const message = `An error has occurred in the Stripe plugin REST handler: '${JSON.stringify(\n      error,\n    )}'`\n    payload.logger.error(message)\n    responseStatus = 500\n    responseJSON = {\n      message,\n    }\n  }\n\n  return Response.json(responseJSON, {\n    status: responseStatus,\n  })\n}\n"],"names":["addDataAndFileToRequest","Forbidden","stripeProxy","stripeREST","args","responseStatus","responseJSON","pluginConfig","req","requestWithData","data","payload","user","stripeSecretKey","t","stripeArgs","stripeMethod","status","error","message","JSON","stringify","logger","Response","json"],"mappings":"AAEA,SAASA,uBAAuB,EAAEC,SAAS,QAAQ,UAAS;AAI5D,SAASC,WAAW,QAAQ,8BAA6B;AAEzD,OAAO,MAAMC,aAAa,OAAOC;IAI/B,IAAIC,iBAAiB;IACrB,IAAIC;IAEJ,MAAM,EAAEC,YAAY,EAAEC,GAAG,EAAE,GAAGJ;IAE9B,MAAMJ,wBAAwBQ;IAE9B,MAAMC,kBAAkBD;IACxB,MAAM,EAAEE,IAAI,EAAEC,OAAO,EAAEC,IAAI,EAAE,GAAGH;IAEhC,MAAM,EAAEI,eAAe,EAAE,GAAGN;IAE5B,IAAI;QACF,IAAI,CAACK,MAAM;YACT,+CAA+C;YAC/C,MAAM,IAAIX,UAAUO,IAAIM,CAAC;QAC3B;QAEAR,eAAe,MAAMJ,YAAY;YAC/Ba,YAAYL,MAAMK;YAClBC,cAAcN,MAAMM;YACpBH;QACF;QAEA,MAAM,EAAEI,MAAM,EAAE,GAAGX;QACnBD,iBAAiBY;IACnB,EAAE,OAAOC,OAAgB;QACvB,MAAMC,UAAU,CAAC,0DAA0D,EAAEC,KAAKC,SAAS,CACzFH,OACA,CAAC,CAAC;QACJP,QAAQW,MAAM,CAACJ,KAAK,CAACC;QACrBd,iBAAiB;QACjBC,eAAe;YACba;QACF;IACF;IAEA,OAAOI,SAASC,IAAI,CAAClB,cAAc;QACjCW,QAAQZ;IACV;AACF,EAAC"}
+{"version":3,"sources":["../../src/routes/rest.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { addDataAndFileToRequest, canAccessAdmin, UnauthorizedError } from 'payload'\n\nimport type { SanitizedStripePluginConfig } from '../types.js'\n\nimport { stripeProxy } from '../utilities/stripeProxy.js'\n\nexport const stripeREST = async (args: {\n  pluginConfig: SanitizedStripePluginConfig\n  req: PayloadRequest\n}): Promise<Response> => {\n  const { pluginConfig, req } = args\n\n  try {\n    await addDataAndFileToRequest(req)\n  } catch (err) {\n    return unexpectedErrorResponse({ err, req })\n  }\n\n  if (!req.user) {\n    return errorResponse({ message: 'Unauthorized', status: 401 })\n  }\n\n  if (!pluginConfig.rest) {\n    return unexpectedErrorResponse({\n      err: new Error('Stripe REST handler called while disabled'),\n      req,\n    })\n  }\n\n  let hasAccess: boolean\n\n  if (pluginConfig.rest.access) {\n    try {\n      hasAccess = await pluginConfig.rest.access({ req })\n    } catch (err) {\n      return unexpectedErrorResponse({ err, req })\n    }\n  } else {\n    try {\n      hasAccess = await hasAdminAccess({ req })\n    } catch (err) {\n      return unexpectedErrorResponse({ err, req })\n    }\n  }\n\n  if (!hasAccess) {\n    return errorResponse({ message: 'Forbidden', status: 403 })\n  }\n\n  const { stripeArgs, stripeMethod } = req.data ?? {}\n\n  if (typeof stripeMethod !== 'string' || stripeMethod.trim().length === 0) {\n    return errorResponse({ message: 'Invalid request', status: 400 })\n  }\n\n  if (!pluginConfig.rest.allowedMethods.includes(stripeMethod)) {\n    return errorResponse({ message: 'Invalid request', status: 400 })\n  }\n\n  if (!Array.isArray(stripeArgs)) {\n    return errorResponse({ message: 'Invalid request', status: 400 })\n  }\n\n  try {\n    const responseJSON = await stripeProxy({\n      stripeArgs,\n      stripeMethod,\n      stripeSecretKey: pluginConfig.stripeSecretKey,\n    })\n\n    return Response.json(responseJSON, { status: responseJSON.status })\n  } catch (err) {\n    return unexpectedErrorResponse({ err, req })\n  }\n}\n\nconst hasAdminAccess = async ({ req }: { req: PayloadRequest }): Promise<boolean> => {\n  try {\n    await canAccessAdmin({ req })\n    return true\n  } catch (err) {\n    if (err instanceof UnauthorizedError) {\n      return false\n    }\n\n    throw err\n  }\n}\n\nconst errorResponse = ({ message, status }: { message: string; status: number }): Response =>\n  Response.json({ message }, { status })\n\nconst unexpectedErrorResponse = ({ err, req }: { err: unknown; req: PayloadRequest }): Response => {\n  req.payload.logger.error({\n    err,\n    msg: 'An unexpected error occurred in the Stripe plugin REST handler.',\n  })\n\n  return errorResponse({ message: 'Internal server error', status: 500 })\n}\n"],"names":["addDataAndFileToRequest","canAccessAdmin","UnauthorizedError","stripeProxy","stripeREST","args","pluginConfig","req","err","unexpectedErrorResponse","user","errorResponse","message","status","rest","Error","hasAccess","access","hasAdminAccess","stripeArgs","stripeMethod","data","trim","length","allowedMethods","includes","Array","isArray","responseJSON","stripeSecretKey","Response","json","payload","logger","error","msg"],"mappings":"AAEA,SAASA,uBAAuB,EAAEC,cAAc,EAAEC,iBAAiB,QAAQ,UAAS;AAIpF,SAASC,WAAW,QAAQ,8BAA6B;AAEzD,OAAO,MAAMC,aAAa,OAAOC;IAI/B,MAAM,EAAEC,YAAY,EAAEC,GAAG,EAAE,GAAGF;IAE9B,IAAI;QACF,MAAML,wBAAwBO;IAChC,EAAE,OAAOC,KAAK;QACZ,OAAOC,wBAAwB;YAAED;YAAKD;QAAI;IAC5C;IAEA,IAAI,CAACA,IAAIG,IAAI,EAAE;QACb,OAAOC,cAAc;YAAEC,SAAS;YAAgBC,QAAQ;QAAI;IAC9D;IAEA,IAAI,CAACP,aAAaQ,IAAI,EAAE;QACtB,OAAOL,wBAAwB;YAC7BD,KAAK,IAAIO,MAAM;YACfR;QACF;IACF;IAEA,IAAIS;IAEJ,IAAIV,aAAaQ,IAAI,CAACG,MAAM,EAAE;QAC5B,IAAI;YACFD,YAAY,MAAMV,aAAaQ,IAAI,CAACG,MAAM,CAAC;gBAAEV;YAAI;QACnD,EAAE,OAAOC,KAAK;YACZ,OAAOC,wBAAwB;gBAAED;gBAAKD;YAAI;QAC5C;IACF,OAAO;QACL,IAAI;YACFS,YAAY,MAAME,eAAe;gBAAEX;YAAI;QACzC,EAAE,OAAOC,KAAK;YACZ,OAAOC,wBAAwB;gBAAED;gBAAKD;YAAI;QAC5C;IACF;IAEA,IAAI,CAACS,WAAW;QACd,OAAOL,cAAc;YAAEC,SAAS;YAAaC,QAAQ;QAAI;IAC3D;IAEA,MAAM,EAAEM,UAAU,EAAEC,YAAY,EAAE,GAAGb,IAAIc,IAAI,IAAI,CAAC;IAElD,IAAI,OAAOD,iBAAiB,YAAYA,aAAaE,IAAI,GAAGC,MAAM,KAAK,GAAG;QACxE,OAAOZ,cAAc;YAAEC,SAAS;YAAmBC,QAAQ;QAAI;IACjE;IAEA,IAAI,CAACP,aAAaQ,IAAI,CAACU,cAAc,CAACC,QAAQ,CAACL,eAAe;QAC5D,OAAOT,cAAc;YAAEC,SAAS;YAAmBC,QAAQ;QAAI;IACjE;IAEA,IAAI,CAACa,MAAMC,OAAO,CAACR,aAAa;QAC9B,OAAOR,cAAc;YAAEC,SAAS;YAAmBC,QAAQ;QAAI;IACjE;IAEA,IAAI;QACF,MAAMe,eAAe,MAAMzB,YAAY;YACrCgB;YACAC;YACAS,iBAAiBvB,aAAauB,eAAe;QAC/C;QAEA,OAAOC,SAASC,IAAI,CAACH,cAAc;YAAEf,QAAQe,aAAaf,MAAM;QAAC;IACnE,EAAE,OAAOL,KAAK;QACZ,OAAOC,wBAAwB;YAAED;YAAKD;QAAI;IAC5C;AACF,EAAC;AAED,MAAMW,iBAAiB,OAAO,EAAEX,GAAG,EAA2B;IAC5D,IAAI;QACF,MAAMN,eAAe;YAAEM;QAAI;QAC3B,OAAO;IACT,EAAE,OAAOC,KAAK;QACZ,IAAIA,eAAeN,mBAAmB;YACpC,OAAO;QACT;QAEA,MAAMM;IACR;AACF;AAEA,MAAMG,gBAAgB,CAAC,EAAEC,OAAO,EAAEC,MAAM,EAAuC,GAC7EiB,SAASC,IAAI,CAAC;QAAEnB;IAAQ,GAAG;QAAEC;IAAO;AAEtC,MAAMJ,0BAA0B,CAAC,EAAED,GAAG,EAAED,GAAG,EAAyC;IAClFA,IAAIyB,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;QACvB1B;QACA2B,KAAK;IACP;IAEA,OAAOxB,cAAc;QAAEC,SAAS;QAAyBC,QAAQ;IAAI;AACvE"}

package/dist/routes/rest.spec.js

@@ -0,0 +1,282 @@
+import { UnauthorizedError } from 'payload';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const mocks = vi.hoisted(()=>({
+        addDataAndFileToRequest: vi.fn(),
+        canAccessAdmin: vi.fn(),
+        stripeProxy: vi.fn()
+    }));
+vi.mock('payload', async (importOriginal)=>{
+    const payload = await importOriginal();
+    return {
+        ...payload,
+        addDataAndFileToRequest: mocks.addDataAndFileToRequest,
+        canAccessAdmin: mocks.canAccessAdmin
+    };
+});
+vi.mock('../utilities/stripeProxy.js', ()=>({
+        stripeProxy: mocks.stripeProxy
+    }));
+import { stripeREST } from './rest.js';
+const loggerError = vi.fn();
+const createPluginConfig = ({ access } = {})=>({
+        rest: access === undefined ? {
+            allowedMethods: [
+                'subscriptions.list'
+            ]
+        } : {
+            access,
+            allowedMethods: [
+                'subscriptions.list'
+            ]
+        },
+        stripeSecretKey: 'sk_test_example',
+        sync: []
+    });
+const createRequest = ({ stripeArgs = [], stripeMethod = 'subscriptions.list', user = {
+    collection: 'users',
+    id: 'user-1'
+} } = {})=>({
+        data: {
+            stripeArgs,
+            stripeMethod
+        },
+        payload: {
+            logger: {
+                error: loggerError
+            }
+        },
+        user
+    });
+describe('stripeREST', ()=>{
+    beforeEach(()=>{
+        vi.clearAllMocks();
+        mocks.addDataAndFileToRequest.mockResolvedValue(undefined);
+        mocks.canAccessAdmin.mockResolvedValue(undefined);
+        mocks.stripeProxy.mockResolvedValue({
+            data: {
+                id: 'sub_123'
+            },
+            status: 200
+        });
+    });
+    // Mutation caught: replacing the anonymous guard with a generic failure or forwarding anonymous requests.
+    it('should return 401 for an anonymous request without invoking Stripe', async ()=>{
+        const req = createRequest({
+            user: null
+        });
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        expect(response.status).toBe(401);
+        expect(mocks.canAccessAdmin).not.toHaveBeenCalled();
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    // Mutation caught: omitting the default admin access check for an authenticated request.
+    it('should return 403 when default admin access denies the user', async ()=>{
+        mocks.canAccessAdmin.mockRejectedValue(new UnauthorizedError());
+        const req = createRequest();
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        expect(response.status).toBe(403);
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    // Mutation caught: rejecting every configured method or bypassing the default admin authorization on success.
+    it('should invoke an exactly listed method for an authenticated admin user', async ()=>{
+        const req = createRequest({
+            stripeArgs: [
+                {
+                    limit: 10
+                }
+            ]
+        });
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        expect(response.status).toBe(200);
+        expect(mocks.canAccessAdmin).toHaveBeenCalledWith({
+            req
+        });
+        expect(mocks.stripeProxy).toHaveBeenCalledWith({
+            stripeArgs: [
+                {
+                    limit: 10
+                }
+            ],
+            stripeMethod: 'subscriptions.list',
+            stripeSecretKey: 'sk_test_example'
+        });
+    });
+    // Mutation caught: always running the default admin check instead of a configured custom access callback.
+    it('should use a custom access callback instead of the default admin check', async ()=>{
+        const access = vi.fn(async ()=>true);
+        const req = createRequest();
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig({
+                access
+            }),
+            req
+        });
+        expect(response.status).toBe(200);
+        expect(access).toHaveBeenCalledWith({
+            req
+        });
+        expect(mocks.canAccessAdmin).not.toHaveBeenCalled();
+        expect(mocks.stripeProxy).toHaveBeenCalledTimes(1);
+    });
+    // Mutation caught: ignoring a false result from a custom access callback.
+    it('should return 403 when custom access denies the authenticated user', async ()=>{
+        const access = vi.fn(async ()=>false);
+        const req = createRequest();
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig({
+                access
+            }),
+            req
+        });
+        expect(response.status).toBe(403);
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    // Mutation caught: forwarding an unlisted Stripe method to the proxy instead of rejecting it locally.
+    it('should return a generic invalid-request response for an unlisted method without invoking Stripe', async ()=>{
+        const req = createRequest({
+            stripeMethod: 'customers.list'
+        });
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        expect(response.status).toBe(400);
+        expect(await response.json()).toEqual({
+            message: 'Invalid request'
+        });
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    // Mutation caught: treating an empty allowlist as a wildcard.
+    it('should return a generic invalid-request response for an empty allowlist', async ()=>{
+        const req = createRequest();
+        const pluginConfig = {
+            ...createPluginConfig(),
+            rest: {
+                allowedMethods: []
+            }
+        };
+        const response = await stripeREST({
+            pluginConfig,
+            req
+        });
+        expect(response.status).toBe(400);
+        expect(await response.json()).toEqual({
+            message: 'Invalid request'
+        });
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    it.each([
+        [
+            ''
+        ],
+        [
+            '   '
+        ],
+        [
+            123
+        ],
+        [
+            null
+        ]
+    ])(// Mutation caught: passing malformed method input through to Stripe.
+    'should return 400 for malformed method %s without invoking Stripe', async (stripeMethod)=>{
+        const req = createRequest({
+            stripeMethod
+        });
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        expect(response.status).toBe(400);
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    // Mutation caught: forwarding non-array Stripe arguments to the Stripe proxy.
+    it('should return 400 for non-array Stripe arguments without invoking Stripe', async ()=>{
+        const req = createRequest({
+            stripeArgs: {
+                limit: 10
+            }
+        });
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        expect(response.status).toBe(400);
+        expect(await response.json()).toEqual({
+            message: 'Invalid request'
+        });
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    // Mutation caught: leaking request parser errors through the HTTP response.
+    it('should return a generic structured 500 when request parsing fails', async ()=>{
+        const parserError = new Error('sensitive parser detail');
+        const req = createRequest();
+        mocks.addDataAndFileToRequest.mockRejectedValue(parserError);
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        expect(response.status).toBe(500);
+        expect(await response.json()).toEqual({
+            message: 'Internal server error'
+        });
+        expect(loggerError).toHaveBeenCalledWith({
+            err: parserError,
+            msg: 'An unexpected error occurred in the Stripe plugin REST handler.'
+        });
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    // Mutation caught: leaking a custom access callback exception or continuing to Stripe.
+    it('should return a generic structured 500 when custom access throws', async ()=>{
+        const accessError = new Error('sensitive custom access detail');
+        const access = vi.fn(async ()=>{
+            throw accessError;
+        });
+        const req = createRequest();
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig({
+                access
+            }),
+            req
+        });
+        expect(response.status).toBe(500);
+        expect(await response.json()).toEqual({
+            message: 'Internal server error'
+        });
+        expect(loggerError).toHaveBeenCalledWith({
+            err: accessError,
+            msg: 'An unexpected error occurred in the Stripe plugin REST handler.'
+        });
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    // Mutation caught: treating an unexpected default admin access exception as a 403 or leaking it.
+    it('should return a generic structured 500 when default admin access throws unexpectedly', async ()=>{
+        const accessError = new Error('sensitive admin access detail');
+        const req = createRequest();
+        mocks.canAccessAdmin.mockRejectedValue(accessError);
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        expect(response.status).toBe(500);
+        expect(await response.json()).toEqual({
+            message: 'Internal server error'
+        });
+        expect(loggerError).toHaveBeenCalledWith({
+            err: accessError,
+            msg: 'An unexpected error occurred in the Stripe plugin REST handler.'
+        });
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+});
+
+//# sourceMappingURL=rest.spec.js.map

package/dist/routes/rest.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/routes/rest.spec.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { UnauthorizedError } from 'payload'\nimport { beforeEach, describe, expect, it, vi } from 'vitest'\n\nimport type { SanitizedStripePluginConfig } from '../types.js'\n\nconst mocks = vi.hoisted(() => ({\n  addDataAndFileToRequest: vi.fn(),\n  canAccessAdmin: vi.fn(),\n  stripeProxy: vi.fn(),\n}))\n\nvi.mock('payload', async (importOriginal) => {\n  const payload = await importOriginal<typeof import('payload')>()\n\n  return {\n    ...payload,\n    addDataAndFileToRequest: mocks.addDataAndFileToRequest,\n    canAccessAdmin: mocks.canAccessAdmin,\n  }\n})\n\nvi.mock('../utilities/stripeProxy.js', () => ({\n  stripeProxy: mocks.stripeProxy,\n}))\n\nimport { stripeREST } from './rest.js'\n\nconst loggerError = vi.fn()\n\nconst createPluginConfig = ({\n  access,\n}: {\n  access?: ({ req }: { req: PayloadRequest }) => boolean | Promise<boolean>\n} = {}): SanitizedStripePluginConfig => ({\n  rest:\n    access === undefined\n      ? { allowedMethods: ['subscriptions.list'] }\n      : { access, allowedMethods: ['subscriptions.list'] },\n  stripeSecretKey: 'sk_test_example',\n  sync: [],\n})\n\nconst createRequest = ({\n  stripeArgs = [],\n  stripeMethod = 'subscriptions.list',\n  user = { collection: 'users', id: 'user-1' },\n}: {\n  stripeArgs?: unknown\n  stripeMethod?: unknown\n  user?: null | { collection: string; id: string }\n} = {}): PayloadRequest =>\n  ({\n    data: { stripeArgs, stripeMethod },\n    payload: {\n      logger: { error: loggerError },\n    },\n    user,\n  }) as unknown as PayloadRequest\n\ndescribe('stripeREST', () => {\n  beforeEach(() => {\n    vi.clearAllMocks()\n    mocks.addDataAndFileToRequest.mockResolvedValue(undefined)\n    mocks.canAccessAdmin.mockResolvedValue(undefined)\n    mocks.stripeProxy.mockResolvedValue({ data: { id: 'sub_123' }, status: 200 })\n  })\n\n  // Mutation caught: replacing the anonymous guard with a generic failure or forwarding anonymous requests.\n  it('should return 401 for an anonymous request without invoking Stripe', async () => {\n    const req = createRequest({ user: null })\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(401)\n    expect(mocks.canAccessAdmin).not.toHaveBeenCalled()\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  // Mutation caught: omitting the default admin access check for an authenticated request.\n  it('should return 403 when default admin access denies the user', async () => {\n    mocks.canAccessAdmin.mockRejectedValue(new UnauthorizedError())\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(403)\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  // Mutation caught: rejecting every configured method or bypassing the default admin authorization on success.\n  it('should invoke an exactly listed method for an authenticated admin user', async () => {\n    const req = createRequest({ stripeArgs: [{ limit: 10 }] })\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(200)\n    expect(mocks.canAccessAdmin).toHaveBeenCalledWith({ req })\n    expect(mocks.stripeProxy).toHaveBeenCalledWith({\n      stripeArgs: [{ limit: 10 }],\n      stripeMethod: 'subscriptions.list',\n      stripeSecretKey: 'sk_test_example',\n    })\n  })\n\n  // Mutation caught: always running the default admin check instead of a configured custom access callback.\n  it('should use a custom access callback instead of the default admin check', async () => {\n    const access = vi.fn(async () => true)\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig({ access }), req })\n\n    expect(response.status).toBe(200)\n    expect(access).toHaveBeenCalledWith({ req })\n    expect(mocks.canAccessAdmin).not.toHaveBeenCalled()\n    expect(mocks.stripeProxy).toHaveBeenCalledTimes(1)\n  })\n\n  // Mutation caught: ignoring a false result from a custom access callback.\n  it('should return 403 when custom access denies the authenticated user', async () => {\n    const access = vi.fn(async () => false)\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig({ access }), req })\n\n    expect(response.status).toBe(403)\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  // Mutation caught: forwarding an unlisted Stripe method to the proxy instead of rejecting it locally.\n  it('should return a generic invalid-request response for an unlisted method without invoking Stripe', async () => {\n    const req = createRequest({ stripeMethod: 'customers.list' })\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(400)\n    expect(await response.json()).toEqual({ message: 'Invalid request' })\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  // Mutation caught: treating an empty allowlist as a wildcard.\n  it('should return a generic invalid-request response for an empty allowlist', async () => {\n    const req = createRequest()\n    const pluginConfig = {\n      ...createPluginConfig(),\n      rest: { allowedMethods: [] },\n    }\n\n    const response = await stripeREST({ pluginConfig, req })\n\n    expect(response.status).toBe(400)\n    expect(await response.json()).toEqual({ message: 'Invalid request' })\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  it.each([[''], ['   '], [123], [null]])(\n    // Mutation caught: passing malformed method input through to Stripe.\n    'should return 400 for malformed method %s without invoking Stripe',\n    async (stripeMethod) => {\n      const req = createRequest({ stripeMethod })\n\n      const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n      expect(response.status).toBe(400)\n      expect(mocks.stripeProxy).not.toHaveBeenCalled()\n    },\n  )\n\n  // Mutation caught: forwarding non-array Stripe arguments to the Stripe proxy.\n  it('should return 400 for non-array Stripe arguments without invoking Stripe', async () => {\n    const req = createRequest({ stripeArgs: { limit: 10 } })\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(400)\n    expect(await response.json()).toEqual({ message: 'Invalid request' })\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  // Mutation caught: leaking request parser errors through the HTTP response.\n  it('should return a generic structured 500 when request parsing fails', async () => {\n    const parserError = new Error('sensitive parser detail')\n    const req = createRequest()\n\n    mocks.addDataAndFileToRequest.mockRejectedValue(parserError)\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(500)\n    expect(await response.json()).toEqual({ message: 'Internal server error' })\n    expect(loggerError).toHaveBeenCalledWith({\n      err: parserError,\n      msg: 'An unexpected error occurred in the Stripe plugin REST handler.',\n    })\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  // Mutation caught: leaking a custom access callback exception or continuing to Stripe.\n  it('should return a generic structured 500 when custom access throws', async () => {\n    const accessError = new Error('sensitive custom access detail')\n    const access = vi.fn(async () => {\n      throw accessError\n    })\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig({ access }), req })\n\n    expect(response.status).toBe(500)\n    expect(await response.json()).toEqual({ message: 'Internal server error' })\n    expect(loggerError).toHaveBeenCalledWith({\n      err: accessError,\n      msg: 'An unexpected error occurred in the Stripe plugin REST handler.',\n    })\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  // Mutation caught: treating an unexpected default admin access exception as a 403 or leaking it.\n  it('should return a generic structured 500 when default admin access throws unexpectedly', async () => {\n    const accessError = new Error('sensitive admin access detail')\n    const req = createRequest()\n\n    mocks.canAccessAdmin.mockRejectedValue(accessError)\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(500)\n    expect(await response.json()).toEqual({ message: 'Internal server error' })\n    expect(loggerError).toHaveBeenCalledWith({\n      err: accessError,\n      msg: 'An unexpected error occurred in the Stripe plugin REST handler.',\n    })\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n})\n"],"names":["UnauthorizedError","beforeEach","describe","expect","it","vi","mocks","hoisted","addDataAndFileToRequest","fn","canAccessAdmin","stripeProxy","mock","importOriginal","payload","stripeREST","loggerError","createPluginConfig","access","rest","undefined","allowedMethods","stripeSecretKey","sync","createRequest","stripeArgs","stripeMethod","user","collection","id","data","logger","error","clearAllMocks","mockResolvedValue","status","req","response","pluginConfig","toBe","not","toHaveBeenCalled","mockRejectedValue","limit","toHaveBeenCalledWith","toHaveBeenCalledTimes","json","toEqual","message","each","parserError","Error","err","msg","accessError"],"mappings":"AAEA,SAASA,iBAAiB,QAAQ,UAAS;AAC3C,SAASC,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAI7D,MAAMC,QAAQD,GAAGE,OAAO,CAAC,IAAO,CAAA;QAC9BC,yBAAyBH,GAAGI,EAAE;QAC9BC,gBAAgBL,GAAGI,EAAE;QACrBE,aAAaN,GAAGI,EAAE;IACpB,CAAA;AAEAJ,GAAGO,IAAI,CAAC,WAAW,OAAOC;IACxB,MAAMC,UAAU,MAAMD;IAEtB,OAAO;QACL,GAAGC,OAAO;QACVN,yBAAyBF,MAAME,uBAAuB;QACtDE,gBAAgBJ,MAAMI,cAAc;IACtC;AACF;AAEAL,GAAGO,IAAI,CAAC,+BAA+B,IAAO,CAAA;QAC5CD,aAAaL,MAAMK,WAAW;IAChC,CAAA;AAEA,SAASI,UAAU,QAAQ,YAAW;AAEtC,MAAMC,cAAcX,GAAGI,EAAE;AAEzB,MAAMQ,qBAAqB,CAAC,EAC1BC,MAAM,EAGP,GAAG,CAAC,CAAC,GAAmC,CAAA;QACvCC,MACED,WAAWE,YACP;YAAEC,gBAAgB;gBAAC;aAAqB;QAAC,IACzC;YAAEH;YAAQG,gBAAgB;gBAAC;aAAqB;QAAC;QACvDC,iBAAiB;QACjBC,MAAM,EAAE;IACV,CAAA;AAEA,MAAMC,gBAAgB,CAAC,EACrBC,aAAa,EAAE,EACfC,eAAe,oBAAoB,EACnCC,OAAO;IAAEC,YAAY;IAASC,IAAI;AAAS,CAAC,EAK7C,GAAG,CAAC,CAAC,GACH,CAAA;QACCC,MAAM;YAAEL;YAAYC;QAAa;QACjCZ,SAAS;YACPiB,QAAQ;gBAAEC,OAAOhB;YAAY;QAC/B;QACAW;IACF,CAAA;AAEFzB,SAAS,cAAc;IACrBD,WAAW;QACTI,GAAG4B,aAAa;QAChB3B,MAAME,uBAAuB,CAAC0B,iBAAiB,CAACd;QAChDd,MAAMI,cAAc,CAACwB,iBAAiB,CAACd;QACvCd,MAAMK,WAAW,CAACuB,iBAAiB,CAAC;YAAEJ,MAAM;gBAAED,IAAI;YAAU;YAAGM,QAAQ;QAAI;IAC7E;IAEA,0GAA0G;IAC1G/B,GAAG,sEAAsE;QACvE,MAAMgC,MAAMZ,cAAc;YAAEG,MAAM;QAAK;QAEvC,MAAMU,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMI,cAAc,EAAE8B,GAAG,CAACC,gBAAgB;QACjDtC,OAAOG,MAAMK,WAAW,EAAE6B,GAAG,CAACC,gBAAgB;IAChD;IAEA,yFAAyF;IACzFrC,GAAG,+DAA+D;QAChEE,MAAMI,cAAc,CAACgC,iBAAiB,CAAC,IAAI1C;QAC3C,MAAMoC,MAAMZ;QAEZ,MAAMa,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE6B,GAAG,CAACC,gBAAgB;IAChD;IAEA,8GAA8G;IAC9GrC,GAAG,0EAA0E;QAC3E,MAAMgC,MAAMZ,cAAc;YAAEC,YAAY;gBAAC;oBAAEkB,OAAO;gBAAG;aAAE;QAAC;QAExD,MAAMN,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMI,cAAc,EAAEkC,oBAAoB,CAAC;YAAER;QAAI;QACxDjC,OAAOG,MAAMK,WAAW,EAAEiC,oBAAoB,CAAC;YAC7CnB,YAAY;gBAAC;oBAAEkB,OAAO;gBAAG;aAAE;YAC3BjB,cAAc;YACdJ,iBAAiB;QACnB;IACF;IAEA,0GAA0G;IAC1GlB,GAAG,0EAA0E;QAC3E,MAAMc,SAASb,GAAGI,EAAE,CAAC,UAAY;QACjC,MAAM2B,MAAMZ;QAEZ,MAAMa,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB,mBAAmB;gBAAEC;YAAO;YAAIkB;QAAI;QAEtFjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOe,QAAQ0B,oBAAoB,CAAC;YAAER;QAAI;QAC1CjC,OAAOG,MAAMI,cAAc,EAAE8B,GAAG,CAACC,gBAAgB;QACjDtC,OAAOG,MAAMK,WAAW,EAAEkC,qBAAqB,CAAC;IAClD;IAEA,0EAA0E;IAC1EzC,GAAG,sEAAsE;QACvE,MAAMc,SAASb,GAAGI,EAAE,CAAC,UAAY;QACjC,MAAM2B,MAAMZ;QAEZ,MAAMa,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB,mBAAmB;gBAAEC;YAAO;YAAIkB;QAAI;QAEtFjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE6B,GAAG,CAACC,gBAAgB;IAChD;IAEA,sGAAsG;IACtGrC,GAAG,mGAAmG;QACpG,MAAMgC,MAAMZ,cAAc;YAAEE,cAAc;QAAiB;QAE3D,MAAMW,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAO,MAAMkC,SAASS,IAAI,IAAIC,OAAO,CAAC;YAAEC,SAAS;QAAkB;QACnE7C,OAAOG,MAAMK,WAAW,EAAE6B,GAAG,CAACC,gBAAgB;IAChD;IAEA,8DAA8D;IAC9DrC,GAAG,2EAA2E;QAC5E,MAAMgC,MAAMZ;QACZ,MAAMc,eAAe;YACnB,GAAGrB,oBAAoB;YACvBE,MAAM;gBAAEE,gBAAgB,EAAE;YAAC;QAC7B;QAEA,MAAMgB,WAAW,MAAMtB,WAAW;YAAEuB;YAAcF;QAAI;QAEtDjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAO,MAAMkC,SAASS,IAAI,IAAIC,OAAO,CAAC;YAAEC,SAAS;QAAkB;QACnE7C,OAAOG,MAAMK,WAAW,EAAE6B,GAAG,CAACC,gBAAgB;IAChD;IAEArC,GAAG6C,IAAI,CAAC;QAAC;YAAC;SAAG;QAAE;YAAC;SAAM;QAAE;YAAC;SAAI;QAAE;YAAC;SAAK;KAAC,EACpC,qEAAqE;IACrE,qEACA,OAAOvB;QACL,MAAMU,MAAMZ,cAAc;YAAEE;QAAa;QAEzC,MAAMW,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE6B,GAAG,CAACC,gBAAgB;IAChD;IAGF,8EAA8E;IAC9ErC,GAAG,4EAA4E;QAC7E,MAAMgC,MAAMZ,cAAc;YAAEC,YAAY;gBAAEkB,OAAO;YAAG;QAAE;QAEtD,MAAMN,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAO,MAAMkC,SAASS,IAAI,IAAIC,OAAO,CAAC;YAAEC,SAAS;QAAkB;QACnE7C,OAAOG,MAAMK,WAAW,EAAE6B,GAAG,CAACC,gBAAgB;IAChD;IAEA,4EAA4E;IAC5ErC,GAAG,qEAAqE;QACtE,MAAM8C,cAAc,IAAIC,MAAM;QAC9B,MAAMf,MAAMZ;QAEZlB,MAAME,uBAAuB,CAACkC,iBAAiB,CAACQ;QAEhD,MAAMb,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAO,MAAMkC,SAASS,IAAI,IAAIC,OAAO,CAAC;YAAEC,SAAS;QAAwB;QACzE7C,OAAOa,aAAa4B,oBAAoB,CAAC;YACvCQ,KAAKF;YACLG,KAAK;QACP;QACAlD,OAAOG,MAAMK,WAAW,EAAE6B,GAAG,CAACC,gBAAgB;IAChD;IAEA,uFAAuF;IACvFrC,GAAG,oEAAoE;QACrE,MAAMkD,cAAc,IAAIH,MAAM;QAC9B,MAAMjC,SAASb,GAAGI,EAAE,CAAC;YACnB,MAAM6C;QACR;QACA,MAAMlB,MAAMZ;QAEZ,MAAMa,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB,mBAAmB;gBAAEC;YAAO;YAAIkB;QAAI;QAEtFjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAO,MAAMkC,SAASS,IAAI,IAAIC,OAAO,CAAC;YAAEC,SAAS;QAAwB;QACzE7C,OAAOa,aAAa4B,oBAAoB,CAAC;YACvCQ,KAAKE;YACLD,KAAK;QACP;QACAlD,OAAOG,MAAMK,WAAW,EAAE6B,GAAG,CAACC,gBAAgB;IAChD;IAEA,iGAAiG;IACjGrC,GAAG,wFAAwF;QACzF,MAAMkD,cAAc,IAAIH,MAAM;QAC9B,MAAMf,MAAMZ;QAEZlB,MAAMI,cAAc,CAACgC,iBAAiB,CAACY;QAEvC,MAAMjB,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAO,MAAMkC,SAASS,IAAI,IAAIC,OAAO,CAAC;YAAEC,SAAS;QAAwB;QACzE7C,OAAOa,aAAa4B,oBAAoB,CAAC;YACvCQ,KAAKE;YACLD,KAAK;QACP;QACAlD,OAAOG,MAAMK,WAAW,EAAE6B,GAAG,CAACC,gBAAgB;IAChD;AACF"}

package/dist/types.d.ts

@@ -21,19 +21,26 @@ export type SyncConfig = {
     stripeResourceType: 'customers' | 'products';
     stripeResourceTypeSingular: 'customer' | 'product';
 };
+export type StripeRESTAccess = (args: {
+    req: PayloadRequest;
+}) => boolean | Promise<boolean>;
+export type StripeRESTConfig = {
+    access?: StripeRESTAccess;
+    allowedMethods: readonly string[];
+};
 export type StripePluginConfig = {
     isTestKey?: boolean;
     logs?: boolean;
-    /** @default false */
-    rest?: boolean;
+    rest?: StripeRESTConfig;
     stripeSecretKey: string;
     stripeWebhooksEndpointSecret?: string;
     sync?: SyncConfig[];
     webhooks?: StripeWebhookHandler | StripeWebhookHandlers;
 };
 export type SanitizedStripePluginConfig = {
+    rest?: StripeRESTConfig;
     sync: SyncConfig[];
-} & StripePluginConfig;
+} & Omit<StripePluginConfig, 'rest' | 'sync'>;
 export type StripeProxy = (args: {
     stripeArgs: any[];
     stripeMethod: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAC/F,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAEhC,MAAM,MAAM,oBAAoB,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,CAAC,CAAA;IACR,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AAE1B,MAAM,MAAM,qBAAqB,GAAG;IAClC,CAAC,WAAW,EAAE,MAAM,GAAG,oBAAoB,CAAA;CAC5C,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,EAAE,cAAc,CAAA;IAC1B,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,kBAAkB,EAAE,WAAW,GAAG,UAAU,CAAA;IAC5C,0BAA0B,EAAE,UAAU,GAAG,SAAS,CAAA;CACnD,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,qBAAqB;IACrB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;IACvB,4BAA4B,CAAC,EAAE,MAAM,CAAA;IACrC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAA;IACnB,QAAQ,CAAC,EAAE,oBAAoB,GAAG,qBAAqB,CAAA;CACxD,CAAA;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,UAAU,EAAE,CAAA;CACnB,GAAG,kBAAkB,CAAA;AAEtB,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE;IAC/B,UAAU,EAAE,GAAG,EAAE,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,EAAE,MAAM,CAAA;CACxB,KAAK,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,GAAG,CAAA;IACV,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf,CAAC,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAC/F,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAEhC,MAAM,MAAM,oBAAoB,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,CAAC,CAAA;IACR,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AAE1B,MAAM,MAAM,qBAAqB,GAAG;IAClC,CAAC,WAAW,EAAE,MAAM,GAAG,oBAAoB,CAAA;CAC5C,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,EAAE,cAAc,CAAA;IAC1B,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,kBAAkB,EAAE,WAAW,GAAG,UAAU,CAAA;IAC5C,0BAA0B,EAAE,UAAU,GAAG,SAAS,CAAA;CACnD,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE;IAAE,GAAG,EAAE,cAAc,CAAA;CAAE,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAE5F,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,IAAI,CAAC,EAAE,gBAAgB,CAAA;IACvB,eAAe,EAAE,MAAM,CAAA;IACvB,4BAA4B,CAAC,EAAE,MAAM,CAAA;IACrC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAA;IACnB,QAAQ,CAAC,EAAE,oBAAoB,GAAG,qBAAqB,CAAA;CACxD,CAAA;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,CAAC,EAAE,gBAAgB,CAAA;IACvB,IAAI,EAAE,UAAU,EAAE,CAAA;CACnB,GAAG,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,CAAC,CAAA;AAE7C,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE;IAC/B,UAAU,EAAE,GAAG,EAAE,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,EAAE,MAAM,CAAA;CACxB,KAAK,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,GAAG,CAAA;IACV,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf,CAAC,CAAA"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type { CollectionSlug, Payload, Config as PayloadConfig, PayloadRequest } from 'payload'\nimport type Stripe from 'stripe'\n\nexport type StripeWebhookHandler<T = any> = (args: {\n  config: PayloadConfig\n  event: T\n  payload: Payload\n  pluginConfig?: StripePluginConfig\n  req: PayloadRequest\n  stripe: Stripe\n}) => Promise<void> | void\n\nexport type StripeWebhookHandlers = {\n  [webhookName: string]: StripeWebhookHandler\n}\n\nexport type FieldSyncConfig = {\n  fieldPath: string\n  stripeProperty: string\n}\n\nexport type SyncConfig = {\n  collection: CollectionSlug\n  fields: FieldSyncConfig[]\n  stripeResourceType: 'customers' | 'products' // TODO: get this from Stripe types\n  stripeResourceTypeSingular: 'customer' | 'product' // TODO: there must be a better way to do this\n}\n\nexport type StripePluginConfig = {\n  isTestKey?: boolean\n  logs?: boolean\n  /** @default false */\n  rest?: boolean\n  stripeSecretKey: string\n  stripeWebhooksEndpointSecret?: string\n  sync?: SyncConfig[]\n  webhooks?: StripeWebhookHandler | StripeWebhookHandlers\n}\n\nexport type SanitizedStripePluginConfig = {\n  sync: SyncConfig[] // convert to required\n} & StripePluginConfig\n\nexport type StripeProxy = (args: {\n  stripeArgs: any[]\n  stripeMethod: string\n  stripeSecretKey: string\n}) => Promise<{\n  data?: any\n  message?: string\n  status: number\n}>\n"],"names":[],"mappings":"AA2CA,WAQE"}
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type { CollectionSlug, Payload, Config as PayloadConfig, PayloadRequest } from 'payload'\nimport type Stripe from 'stripe'\n\nexport type StripeWebhookHandler<T = any> = (args: {\n  config: PayloadConfig\n  event: T\n  payload: Payload\n  pluginConfig?: StripePluginConfig\n  req: PayloadRequest\n  stripe: Stripe\n}) => Promise<void> | void\n\nexport type StripeWebhookHandlers = {\n  [webhookName: string]: StripeWebhookHandler\n}\n\nexport type FieldSyncConfig = {\n  fieldPath: string\n  stripeProperty: string\n}\n\nexport type SyncConfig = {\n  collection: CollectionSlug\n  fields: FieldSyncConfig[]\n  stripeResourceType: 'customers' | 'products' // TODO: get this from Stripe types\n  stripeResourceTypeSingular: 'customer' | 'product' // TODO: there must be a better way to do this\n}\n\nexport type StripeRESTAccess = (args: { req: PayloadRequest }) => boolean | Promise<boolean>\n\nexport type StripeRESTConfig = {\n  access?: StripeRESTAccess\n  allowedMethods: readonly string[]\n}\n\nexport type StripePluginConfig = {\n  isTestKey?: boolean\n  logs?: boolean\n  rest?: StripeRESTConfig\n  stripeSecretKey: string\n  stripeWebhooksEndpointSecret?: string\n  sync?: SyncConfig[]\n  webhooks?: StripeWebhookHandler | StripeWebhookHandlers\n}\n\nexport type SanitizedStripePluginConfig = {\n  rest?: StripeRESTConfig\n  sync: SyncConfig[]\n} & Omit<StripePluginConfig, 'rest' | 'sync'>\n\nexport type StripeProxy = (args: {\n  stripeArgs: any[]\n  stripeMethod: string\n  stripeSecretKey: string\n}) => Promise<{\n  data?: any\n  message?: string\n  status: number\n}>\n"],"names":[],"mappings":"AAkDA,WAQE"}

package/dist/utilities/deepen.d.ts

@@ -1,2 +1,8 @@
+import type { FieldSyncConfig } from '../types.js';
 export declare const deepen: (obj: Record<string, any>) => Record<string, any>;
+export declare const getSyncedFields: ({ data, fields, source, }: {
+    data: object;
+    fields: FieldSyncConfig[];
+    source: "payload" | "stripe";
+}) => Record<string, unknown>;
 //# sourceMappingURL=deepen.d.ts.map

package/dist/utilities/deepen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deepen.d.ts","sourceRoot":"","sources":["../../src/utilities/deepen.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,MAAM,QAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAiBnE,CAAA"}
+{"version":3,"file":"deepen.d.ts","sourceRoot":"","sources":["../../src/utilities/deepen.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,eAAO,MAAM,MAAM,QAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAwBnE,CAAA;AAED,eAAO,MAAM,eAAe,8BAIzB;IACD,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAA;CAC7B,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAczB,CAAA"}

package/dist/utilities/deepen.js

@@ -1,21 +1,51 @@
 // converts an object of dot notation keys to a nested object
 // i.e. { 'price.stripePriceID': '123' } to { price: { stripePriceID: '123' } }
+import { hasUnsupportedFieldPathSegment, setOwnProperty } from 'payload/shared';
 export const deepen = (obj)=>{
     const result = {};
-    for(const key in obj){
+    for (const key of Object.keys(obj)){
         const value = obj[key];
         const keys = key.split('.');
+        if (hasUnsupportedFieldPathSegment({
+            segments: keys
+        })) {
+            throw new Error('Invalid field path.');
+        }
         let current = result;
         keys.forEach((k, index)=>{
             if (index === keys.length - 1) {
-                current[k] = value;
+                setOwnProperty({
+                    key: k,
+                    target: current,
+                    value
+                });
             } else {
-                current[k] = current[k] || {};
+                if (!Object.hasOwn(current, k) || current[k] === null || typeof current[k] !== 'object') {
+                    setOwnProperty({
+                        key: k,
+                        target: current,
+                        value: {}
+                    });
+                }
                 current = current[k];
             }
         });
     }
     return result;
 };
+export const getSyncedFields = ({ data, fields, source })=>{
+    const flattened = Object.create(null);
+    for (const { fieldPath, stripeProperty } of fields){
+        const sourceProperty = source === 'payload' ? fieldPath : stripeProperty;
+        const targetProperty = source === 'payload' ? stripeProperty : fieldPath;
+        const value = Object.hasOwn(data, sourceProperty) ? data[sourceProperty] : undefined;
+        setOwnProperty({
+            key: targetProperty,
+            target: flattened,
+            value
+        });
+    }
+    return deepen(flattened);
+};
 
 //# sourceMappingURL=deepen.js.map

package/dist/utilities/deepen.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/deepen.ts"],"sourcesContent":["// converts an object of dot notation keys to a nested object\n// i.e. { 'price.stripePriceID': '123' } to { price: { stripePriceID: '123' } }\n\nexport const deepen = (obj: Record<string, any>): Record<string, any> => {\n  const result: Record<string, any> = {}\n\n  for (const key in obj) {\n    const value = obj[key]\n    const keys = key.split('.')\n    let current = result\n    keys.forEach((k, index) => {\n      if (index === keys.length - 1) {\n        current[k] = value\n      } else {\n        current[k] = current[k] || {}\n        current = current[k]\n      }\n    })\n  }\n  return result\n}\n"],"names":["deepen","obj","result","key","value","keys","split","current","forEach","k","index","length"],"mappings":"AAAA,6DAA6D;AAC7D,+EAA+E;AAE/E,OAAO,MAAMA,SAAS,CAACC;IACrB,MAAMC,SAA8B,CAAC;IAErC,IAAK,MAAMC,OAAOF,IAAK;QACrB,MAAMG,QAAQH,GAAG,CAACE,IAAI;QACtB,MAAME,OAAOF,IAAIG,KAAK,CAAC;QACvB,IAAIC,UAAUL;QACdG,KAAKG,OAAO,CAAC,CAACC,GAAGC;YACf,IAAIA,UAAUL,KAAKM,MAAM,GAAG,GAAG;gBAC7BJ,OAAO,CAACE,EAAE,GAAGL;YACf,OAAO;gBACLG,OAAO,CAACE,EAAE,GAAGF,OAAO,CAACE,EAAE,IAAI,CAAC;gBAC5BF,UAAUA,OAAO,CAACE,EAAE;YACtB;QACF;IACF;IACA,OAAOP;AACT,EAAC"}
+{"version":3,"sources":["../../src/utilities/deepen.ts"],"sourcesContent":["// converts an object of dot notation keys to a nested object\n// i.e. { 'price.stripePriceID': '123' } to { price: { stripePriceID: '123' } }\n\nimport { hasUnsupportedFieldPathSegment, setOwnProperty } from 'payload/shared'\n\nimport type { FieldSyncConfig } from '../types.js'\n\nexport const deepen = (obj: Record<string, any>): Record<string, any> => {\n  const result: Record<string, any> = {}\n\n  for (const key of Object.keys(obj)) {\n    const value = obj[key]\n    const keys = key.split('.')\n\n    if (hasUnsupportedFieldPathSegment({ segments: keys })) {\n      throw new Error('Invalid field path.')\n    }\n\n    let current = result\n    keys.forEach((k, index) => {\n      if (index === keys.length - 1) {\n        setOwnProperty({ key: k, target: current, value })\n      } else {\n        if (!Object.hasOwn(current, k) || current[k] === null || typeof current[k] !== 'object') {\n          setOwnProperty({ key: k, target: current, value: {} })\n        }\n        current = current[k]\n      }\n    })\n  }\n  return result\n}\n\nexport const getSyncedFields = ({\n  data,\n  fields,\n  source,\n}: {\n  data: object\n  fields: FieldSyncConfig[]\n  source: 'payload' | 'stripe'\n}): Record<string, unknown> => {\n  const flattened = Object.create(null) as Record<string, unknown>\n\n  for (const { fieldPath, stripeProperty } of fields) {\n    const sourceProperty = source === 'payload' ? fieldPath : stripeProperty\n    const targetProperty = source === 'payload' ? stripeProperty : fieldPath\n    const value = Object.hasOwn(data, sourceProperty)\n      ? (data as Record<string, unknown>)[sourceProperty]\n      : undefined\n\n    setOwnProperty({ key: targetProperty, target: flattened, value })\n  }\n\n  return deepen(flattened)\n}\n"],"names":["hasUnsupportedFieldPathSegment","setOwnProperty","deepen","obj","result","key","Object","keys","value","split","segments","Error","current","forEach","k","index","length","target","hasOwn","getSyncedFields","data","fields","source","flattened","create","fieldPath","stripeProperty","sourceProperty","targetProperty","undefined"],"mappings":"AAAA,6DAA6D;AAC7D,+EAA+E;AAE/E,SAASA,8BAA8B,EAAEC,cAAc,QAAQ,iBAAgB;AAI/E,OAAO,MAAMC,SAAS,CAACC;IACrB,MAAMC,SAA8B,CAAC;IAErC,KAAK,MAAMC,OAAOC,OAAOC,IAAI,CAACJ,KAAM;QAClC,MAAMK,QAAQL,GAAG,CAACE,IAAI;QACtB,MAAME,OAAOF,IAAII,KAAK,CAAC;QAEvB,IAAIT,+BAA+B;YAAEU,UAAUH;QAAK,IAAI;YACtD,MAAM,IAAII,MAAM;QAClB;QAEA,IAAIC,UAAUR;QACdG,KAAKM,OAAO,CAAC,CAACC,GAAGC;YACf,IAAIA,UAAUR,KAAKS,MAAM,GAAG,GAAG;gBAC7Bf,eAAe;oBAAEI,KAAKS;oBAAGG,QAAQL;oBAASJ;gBAAM;YAClD,OAAO;gBACL,IAAI,CAACF,OAAOY,MAAM,CAACN,SAASE,MAAMF,OAAO,CAACE,EAAE,KAAK,QAAQ,OAAOF,OAAO,CAACE,EAAE,KAAK,UAAU;oBACvFb,eAAe;wBAAEI,KAAKS;wBAAGG,QAAQL;wBAASJ,OAAO,CAAC;oBAAE;gBACtD;gBACAI,UAAUA,OAAO,CAACE,EAAE;YACtB;QACF;IACF;IACA,OAAOV;AACT,EAAC;AAED,OAAO,MAAMe,kBAAkB,CAAC,EAC9BC,IAAI,EACJC,MAAM,EACNC,MAAM,EAKP;IACC,MAAMC,YAAYjB,OAAOkB,MAAM,CAAC;IAEhC,KAAK,MAAM,EAAEC,SAAS,EAAEC,cAAc,EAAE,IAAIL,OAAQ;QAClD,MAAMM,iBAAiBL,WAAW,YAAYG,YAAYC;QAC1D,MAAME,iBAAiBN,WAAW,YAAYI,iBAAiBD;QAC/D,MAAMjB,QAAQF,OAAOY,MAAM,CAACE,MAAMO,kBAC9B,AAACP,IAAgC,CAACO,eAAe,GACjDE;QAEJ5B,eAAe;YAAEI,KAAKuB;YAAgBX,QAAQM;YAAWf;QAAM;IACjE;IAEA,OAAON,OAAOqB;AAChB,EAAC"}

package/dist/utilities/deepen.spec.js

@@ -0,0 +1,110 @@
+import { describe, expect, it } from 'vitest';
+import { deepen, getSyncedFields } from './deepen.js';
+describe('Stripe field mappings', ()=>{
+    it('should build constrained mappings from owned values', ()=>{
+        const marker = 'constrainedStripeMapping';
+        const inheritedSource = 'constrainedStripeSource';
+        const originalDescriptor = Object.getOwnPropertyDescriptor(Object.prototype, marker);
+        let inheritedGetterCalls = 0;
+        let processStateChanged = false;
+        let nestedMapping;
+        let syncedMapping;
+        let webhookMapping;
+        try {
+            expect(()=>deepen({
+                    [`__proto__.${marker}`]: 'value'
+                })).toThrow('Invalid field path.');
+            nestedMapping = deepen(Object.assign(Object.create({
+                'ignored.value': 'inherited'
+            }), {
+                [`constructor.prototype.${marker}`]: 'local',
+                'profile.displayName': 'Ada'
+            }));
+            const data = Object.create({
+                get [inheritedSource] () {
+                    inheritedGetterCalls += 1;
+                    return 'inherited';
+                }
+            });
+            data.displayName = 'Ada';
+            syncedMapping = getSyncedFields({
+                data,
+                fields: [
+                    {
+                        fieldPath: inheritedSource,
+                        stripeProperty: 'metadata.inherited'
+                    },
+                    {
+                        fieldPath: 'constructor',
+                        stripeProperty: 'constructor'
+                    },
+                    {
+                        fieldPath: 'displayName',
+                        stripeProperty: `constructor.prototype.${marker}`
+                    }
+                ],
+                source: 'payload'
+            });
+            const stripeData = Object.create({
+                get [inheritedSource] () {
+                    inheritedGetterCalls += 1;
+                    return 'inherited';
+                }
+            });
+            stripeData.name = 'Ada';
+            webhookMapping = getSyncedFields({
+                data: stripeData,
+                fields: [
+                    {
+                        fieldPath: 'profile.inherited',
+                        stripeProperty: inheritedSource
+                    },
+                    {
+                        fieldPath: 'profile.displayName',
+                        stripeProperty: 'name'
+                    }
+                ],
+                source: 'stripe'
+            });
+            processStateChanged = Object.hasOwn(Object.prototype, marker);
+        } finally{
+            if (originalDescriptor) {
+                Object.defineProperty(Object.prototype, marker, originalDescriptor);
+            } else {
+                delete Object.prototype[marker];
+            }
+        }
+        expect(processStateChanged).toBe(false);
+        expect(inheritedGetterCalls).toBe(0);
+        expect(Object.getOwnPropertyDescriptor(Object.prototype, marker)).toEqual(originalDescriptor);
+        expect(nestedMapping).toEqual({
+            constructor: {
+                prototype: {
+                    [marker]: 'local'
+                }
+            },
+            profile: {
+                displayName: 'Ada'
+            }
+        });
+        expect(Object.hasOwn(nestedMapping, 'ignored')).toBe(false);
+        expect(syncedMapping).toEqual({
+            constructor: {
+                prototype: {
+                    [marker]: 'Ada'
+                }
+            },
+            metadata: {
+                inherited: undefined
+            }
+        });
+        expect(webhookMapping).toEqual({
+            profile: {
+                displayName: 'Ada',
+                inherited: undefined
+            }
+        });
+    });
+});
+
+//# sourceMappingURL=deepen.spec.js.map

package/dist/utilities/deepen.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/deepen.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport { deepen, getSyncedFields } from './deepen.js'\n\ndescribe('Stripe field mappings', () => {\n  it('should build constrained mappings from owned values', () => {\n    const marker = 'constrainedStripeMapping'\n    const inheritedSource = 'constrainedStripeSource'\n    const originalDescriptor = Object.getOwnPropertyDescriptor(Object.prototype, marker)\n    let inheritedGetterCalls = 0\n    let processStateChanged = false\n    let nestedMapping: Record<string, unknown> | undefined\n    let syncedMapping: Record<string, unknown> | undefined\n    let webhookMapping: Record<string, unknown> | undefined\n\n    try {\n      expect(() => deepen({ [`__proto__.${marker}`]: 'value' })).toThrow('Invalid field path.')\n\n      nestedMapping = deepen(\n        Object.assign(Object.create({ 'ignored.value': 'inherited' }), {\n          [`constructor.prototype.${marker}`]: 'local',\n          'profile.displayName': 'Ada',\n        }),\n      )\n\n      const data = Object.create({\n        get [inheritedSource]() {\n          inheritedGetterCalls += 1\n          return 'inherited'\n        },\n      }) as Record<string, unknown>\n      data.displayName = 'Ada'\n\n      syncedMapping = getSyncedFields({\n        data,\n        fields: [\n          { fieldPath: inheritedSource, stripeProperty: 'metadata.inherited' },\n          { fieldPath: 'constructor', stripeProperty: 'constructor' },\n          {\n            fieldPath: 'displayName',\n            stripeProperty: `constructor.prototype.${marker}`,\n          },\n        ],\n        source: 'payload',\n      })\n\n      const stripeData = Object.create({\n        get [inheritedSource]() {\n          inheritedGetterCalls += 1\n          return 'inherited'\n        },\n      }) as Record<string, unknown>\n      stripeData.name = 'Ada'\n\n      webhookMapping = getSyncedFields({\n        data: stripeData,\n        fields: [\n          { fieldPath: 'profile.inherited', stripeProperty: inheritedSource },\n          { fieldPath: 'profile.displayName', stripeProperty: 'name' },\n        ],\n        source: 'stripe',\n      })\n      processStateChanged = Object.hasOwn(Object.prototype, marker)\n    } finally {\n      if (originalDescriptor) {\n        Object.defineProperty(Object.prototype, marker, originalDescriptor)\n      } else {\n        delete (Object.prototype as Record<string, unknown>)[marker]\n      }\n    }\n\n    expect(processStateChanged).toBe(false)\n    expect(inheritedGetterCalls).toBe(0)\n    expect(Object.getOwnPropertyDescriptor(Object.prototype, marker)).toEqual(originalDescriptor)\n    expect(nestedMapping).toEqual({\n      constructor: {\n        prototype: {\n          [marker]: 'local',\n        },\n      },\n      profile: {\n        displayName: 'Ada',\n      },\n    })\n    expect(Object.hasOwn(nestedMapping as object, 'ignored')).toBe(false)\n    expect(syncedMapping).toEqual({\n      constructor: {\n        prototype: {\n          [marker]: 'Ada',\n        },\n      },\n      metadata: {\n        inherited: undefined,\n      },\n    })\n    expect(webhookMapping).toEqual({\n      profile: {\n        displayName: 'Ada',\n        inherited: undefined,\n      },\n    })\n  })\n})\n"],"names":["describe","expect","it","deepen","getSyncedFields","marker","inheritedSource","originalDescriptor","Object","getOwnPropertyDescriptor","prototype","inheritedGetterCalls","processStateChanged","nestedMapping","syncedMapping","webhookMapping","toThrow","assign","create","data","displayName","fields","fieldPath","stripeProperty","source","stripeData","name","hasOwn","defineProperty","toBe","toEqual","profile","metadata","inherited","undefined"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,MAAM,EAAEC,eAAe,QAAQ,cAAa;AAErDJ,SAAS,yBAAyB;IAChCE,GAAG,uDAAuD;QACxD,MAAMG,SAAS;QACf,MAAMC,kBAAkB;QACxB,MAAMC,qBAAqBC,OAAOC,wBAAwB,CAACD,OAAOE,SAAS,EAAEL;QAC7E,IAAIM,uBAAuB;QAC3B,IAAIC,sBAAsB;QAC1B,IAAIC;QACJ,IAAIC;QACJ,IAAIC;QAEJ,IAAI;YACFd,OAAO,IAAME,OAAO;oBAAE,CAAC,CAAC,UAAU,EAAEE,QAAQ,CAAC,EAAE;gBAAQ,IAAIW,OAAO,CAAC;YAEnEH,gBAAgBV,OACdK,OAAOS,MAAM,CAACT,OAAOU,MAAM,CAAC;gBAAE,iBAAiB;YAAY,IAAI;gBAC7D,CAAC,CAAC,sBAAsB,EAAEb,QAAQ,CAAC,EAAE;gBACrC,uBAAuB;YACzB;YAGF,MAAMc,OAAOX,OAAOU,MAAM,CAAC;gBACzB,IAAI,CAACZ,gBAAgB,IAAG;oBACtBK,wBAAwB;oBACxB,OAAO;gBACT;YACF;YACAQ,KAAKC,WAAW,GAAG;YAEnBN,gBAAgBV,gBAAgB;gBAC9Be;gBACAE,QAAQ;oBACN;wBAAEC,WAAWhB;wBAAiBiB,gBAAgB;oBAAqB;oBACnE;wBAAED,WAAW;wBAAeC,gBAAgB;oBAAc;oBAC1D;wBACED,WAAW;wBACXC,gBAAgB,CAAC,sBAAsB,EAAElB,QAAQ;oBACnD;iBACD;gBACDmB,QAAQ;YACV;YAEA,MAAMC,aAAajB,OAAOU,MAAM,CAAC;gBAC/B,IAAI,CAACZ,gBAAgB,IAAG;oBACtBK,wBAAwB;oBACxB,OAAO;gBACT;YACF;YACAc,WAAWC,IAAI,GAAG;YAElBX,iBAAiBX,gBAAgB;gBAC/Be,MAAMM;gBACNJ,QAAQ;oBACN;wBAAEC,WAAW;wBAAqBC,gBAAgBjB;oBAAgB;oBAClE;wBAAEgB,WAAW;wBAAuBC,gBAAgB;oBAAO;iBAC5D;gBACDC,QAAQ;YACV;YACAZ,sBAAsBJ,OAAOmB,MAAM,CAACnB,OAAOE,SAAS,EAAEL;QACxD,SAAU;YACR,IAAIE,oBAAoB;gBACtBC,OAAOoB,cAAc,CAACpB,OAAOE,SAAS,EAAEL,QAAQE;YAClD,OAAO;gBACL,OAAO,AAACC,OAAOE,SAAS,AAA4B,CAACL,OAAO;YAC9D;QACF;QAEAJ,OAAOW,qBAAqBiB,IAAI,CAAC;QACjC5B,OAAOU,sBAAsBkB,IAAI,CAAC;QAClC5B,OAAOO,OAAOC,wBAAwB,CAACD,OAAOE,SAAS,EAAEL,SAASyB,OAAO,CAACvB;QAC1EN,OAAOY,eAAeiB,OAAO,CAAC;YAC5B,aAAa;gBACXpB,WAAW;oBACT,CAACL,OAAO,EAAE;gBACZ;YACF;YACA0B,SAAS;gBACPX,aAAa;YACf;QACF;QACAnB,OAAOO,OAAOmB,MAAM,CAACd,eAAyB,YAAYgB,IAAI,CAAC;QAC/D5B,OAAOa,eAAegB,OAAO,CAAC;YAC5B,aAAa;gBACXpB,WAAW;oBACT,CAACL,OAAO,EAAE;gBACZ;YACF;YACA2B,UAAU;gBACRC,WAAWC;YACb;QACF;QACAjC,OAAOc,gBAAgBe,OAAO,CAAC;YAC7BC,SAAS;gBACPX,aAAa;gBACba,WAAWC;YACb;QACF;IACF;AACF"}

package/dist/utilities/sanitizeStripeRESTConfig.d.ts

@@ -0,0 +1,5 @@
+import type { StripeRESTConfig } from '../types.js';
+export declare const sanitizeStripeRESTConfig: ({ rest, }: {
+    rest: unknown;
+}) => StripeRESTConfig | undefined;
+//# sourceMappingURL=sanitizeStripeRESTConfig.d.ts.map

package/dist/utilities/sanitizeStripeRESTConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizeStripeRESTConfig.d.ts","sourceRoot":"","sources":["../../src/utilities/sanitizeStripeRESTConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoB,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAKrE,eAAO,MAAM,wBAAwB,cAElC;IACD,IAAI,EAAE,OAAO,CAAA;CACd,KAAG,gBAAgB,GAAG,SA8BtB,CAAA"}

package/dist/utilities/sanitizeStripeRESTConfig.js

@@ -0,0 +1,25 @@
+const migrationError = 'The Stripe REST endpoint now requires an object with a non-empty allowedMethods array of exact method names.';
+export const sanitizeStripeRESTConfig = ({ rest })=>{
+    if (rest === undefined || rest === false) {
+        return undefined;
+    }
+    if (typeof rest !== 'object' || rest === null || Array.isArray(rest) || !('allowedMethods' in rest) || !Array.isArray(rest.allowedMethods)) {
+        throw new Error(migrationError);
+    }
+    const access = 'access' in rest ? rest.access : undefined;
+    if (rest.allowedMethods.length === 0 || rest.allowedMethods.some((method)=>typeof method !== 'string' || method.trim().length === 0 || method.includes('*')) || access !== undefined && !isStripeRESTAccess(access)) {
+        throw new Error(migrationError);
+    }
+    const allowedMethods = Object.freeze([
+        ...new Set(rest.allowedMethods)
+    ]);
+    return access === undefined ? {
+        allowedMethods
+    } : {
+        access,
+        allowedMethods
+    };
+};
+const isStripeRESTAccess = (access)=>typeof access === 'function';
+
+//# sourceMappingURL=sanitizeStripeRESTConfig.js.map