@payloadcms/plugin-stripe 4.0.0-canary.33 → 4.0.0-canary.34

package/dist/routes/rest.spec.js

@@ -0,0 +1,275 @@
+import { UnauthorizedError } from 'payload';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const mocks = vi.hoisted(()=>({
+        addDataAndFileToRequest: vi.fn(),
+        canAccessAdmin: vi.fn(),
+        stripeProxy: vi.fn()
+    }));
+vi.mock('payload', async (importOriginal)=>{
+    const payload = await importOriginal();
+    return {
+        ...payload,
+        addDataAndFileToRequest: mocks.addDataAndFileToRequest,
+        canAccessAdmin: mocks.canAccessAdmin
+    };
+});
+vi.mock('../utilities/stripeProxy.js', ()=>({
+        stripeProxy: mocks.stripeProxy
+    }));
+import { stripeREST } from './rest.js';
+const loggerError = vi.fn();
+const createPluginConfig = ({ access } = {})=>({
+        rest: {
+            access,
+            allowedMethods: [
+                'subscriptions.list'
+            ]
+        },
+        stripeSecretKey: 'sk_test_example',
+        sync: []
+    });
+const createRequest = ({ stripeArgs = [], stripeMethod = 'subscriptions.list', user = {
+    collection: 'users',
+    id: 'user-1'
+} } = {})=>({
+        data: {
+            stripeArgs,
+            stripeMethod
+        },
+        payload: {
+            logger: {
+                error: loggerError
+            }
+        },
+        user
+    });
+describe('stripeREST', ()=>{
+    beforeEach(()=>{
+        vi.clearAllMocks();
+        mocks.addDataAndFileToRequest.mockResolvedValue(undefined);
+        mocks.canAccessAdmin.mockResolvedValue(undefined);
+        mocks.stripeProxy.mockResolvedValue({
+            data: {
+                id: 'sub_123'
+            },
+            status: 200
+        });
+    });
+    it('should return 401 for an anonymous request without invoking Stripe', async ()=>{
+        const req = createRequest({
+            user: null
+        });
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        expect(response.status).toBe(401);
+        expect(mocks.addDataAndFileToRequest).toHaveBeenCalledWith(req);
+        expect(mocks.canAccessAdmin).not.toHaveBeenCalled();
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    it('should return 403 when default admin access denies the user', async ()=>{
+        mocks.canAccessAdmin.mockRejectedValue(new UnauthorizedError());
+        const req = createRequest();
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        expect(response.status).toBe(403);
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    it('should return a generic 500 when default admin access throws unexpectedly', async ()=>{
+        const adminAccessError = new Error('sensitive admin access detail');
+        mocks.canAccessAdmin.mockRejectedValue(adminAccessError);
+        const req = createRequest();
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        const body = await response.json();
+        expect(response.status).toBe(500);
+        expect(body).toEqual({
+            message: 'Internal server error'
+        });
+        expect(JSON.stringify(body)).not.toContain('sensitive admin access detail');
+        expect(loggerError).toHaveBeenCalledWith({
+            err: adminAccessError,
+            msg: 'An unexpected error occurred in the Stripe plugin REST handler.'
+        });
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    it('should invoke an exactly listed method for an admin user', async ()=>{
+        const req = createRequest({
+            stripeArgs: [
+                {
+                    limit: 10
+                }
+            ]
+        });
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        expect(response.status).toBe(200);
+        expect(mocks.stripeProxy).toHaveBeenCalledWith({
+            stripeArgs: [
+                {
+                    limit: 10
+                }
+            ],
+            stripeMethod: 'subscriptions.list',
+            stripeSecretKey: 'sk_test_example'
+        });
+    });
+    it('should allow a non-admin when an asynchronous custom access callback permits it', async ()=>{
+        const access = vi.fn(async ()=>true);
+        const req = createRequest();
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig({
+                access
+            }),
+            req
+        });
+        expect(response.status).toBe(200);
+        expect(access).toHaveBeenCalledWith({
+            req
+        });
+        expect(mocks.canAccessAdmin).not.toHaveBeenCalled();
+    });
+    it('should return 403 when custom access denies the user', async ()=>{
+        const access = vi.fn(async ()=>false);
+        const req = createRequest();
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig({
+                access
+            }),
+            req
+        });
+        expect(response.status).toBe(403);
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    it('should return a generic 500 when custom access throws', async ()=>{
+        const access = vi.fn(async ()=>{
+            throw new Error('sensitive access detail');
+        });
+        const req = createRequest();
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig({
+                access
+            }),
+            req
+        });
+        const body = await response.text();
+        expect(response.status).toBe(500);
+        expect(body).not.toContain('sensitive access detail');
+        expect(loggerError).toHaveBeenCalledWith({
+            err: expect.any(Error),
+            msg: 'An unexpected error occurred in the Stripe plugin REST handler.'
+        });
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    it.each([
+        'customers.list',
+        'subscriptions.cancel',
+        'subscriptions.*'
+    ])('should return 400 for unlisted method %s without invoking Stripe', async (stripeMethod)=>{
+        const req = createRequest({
+            stripeMethod
+        });
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        expect(response.status).toBe(400);
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    it.each([
+        [
+            ''
+        ],
+        [
+            '   '
+        ],
+        [
+            123
+        ],
+        [
+            null
+        ]
+    ])('should return 400 for malformed method %s without invoking Stripe', async (stripeMethod)=>{
+        const req = createRequest({
+            stripeMethod
+        });
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        expect(response.status).toBe(400);
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    it('should return 400 for a missing method without invoking Stripe', async ()=>{
+        const req = createRequest();
+        delete req.data?.stripeMethod;
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        expect(response.status).toBe(400);
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    it('should return 400 for non-array Stripe arguments without invoking Stripe', async ()=>{
+        const req = createRequest({
+            stripeArgs: {
+                limit: 10
+            }
+        });
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        expect(response.status).toBe(400);
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    it('should evaluate access before revealing whether a method is listed', async ()=>{
+        mocks.canAccessAdmin.mockRejectedValue(new UnauthorizedError());
+        const req = createRequest({
+            stripeMethod: 'customers.delete'
+        });
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        expect(response.status).toBe(403);
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+    it('should preserve the Stripe proxy response status and body after all guards pass', async ()=>{
+        mocks.stripeProxy.mockResolvedValue({
+            message: 'Stripe request failed',
+            status: 404
+        });
+        const req = createRequest();
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        expect(response.status).toBe(404);
+        expect(await response.json()).toEqual({
+            message: 'Stripe request failed',
+            status: 404
+        });
+    });
+    it('should return a generic 500 when request parsing fails', async ()=>{
+        mocks.addDataAndFileToRequest.mockRejectedValue(new Error('sensitive parser detail'));
+        const req = createRequest();
+        const response = await stripeREST({
+            pluginConfig: createPluginConfig(),
+            req
+        });
+        const body = await response.text();
+        expect(response.status).toBe(500);
+        expect(body).not.toContain('sensitive parser detail');
+        expect(mocks.stripeProxy).not.toHaveBeenCalled();
+    });
+});
+
+//# sourceMappingURL=rest.spec.js.map

package/dist/routes/rest.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/routes/rest.spec.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { UnauthorizedError } from 'payload'\nimport { beforeEach, describe, expect, it, vi } from 'vitest'\n\nimport type { SanitizedStripePluginConfig, StripeRESTAccess } from '../types.js'\n\nconst mocks = vi.hoisted(() => ({\n  addDataAndFileToRequest: vi.fn(),\n  canAccessAdmin: vi.fn(),\n  stripeProxy: vi.fn(),\n}))\n\nvi.mock('payload', async (importOriginal) => {\n  const payload = await importOriginal<typeof import('payload')>()\n\n  return {\n    ...payload,\n    addDataAndFileToRequest: mocks.addDataAndFileToRequest,\n    canAccessAdmin: mocks.canAccessAdmin,\n  }\n})\n\nvi.mock('../utilities/stripeProxy.js', () => ({\n  stripeProxy: mocks.stripeProxy,\n}))\n\nimport { stripeREST } from './rest.js'\n\nconst loggerError = vi.fn()\n\nconst createPluginConfig = ({\n  access,\n}: {\n  access?: StripeRESTAccess\n} = {}): SanitizedStripePluginConfig => ({\n  rest: {\n    access,\n    allowedMethods: ['subscriptions.list'],\n  },\n  stripeSecretKey: 'sk_test_example',\n  sync: [],\n})\n\nconst createRequest = ({\n  stripeArgs = [],\n  stripeMethod = 'subscriptions.list',\n  user = { collection: 'users', id: 'user-1' },\n}: {\n  stripeArgs?: unknown\n  stripeMethod?: unknown\n  user?: null | { collection: string; id: string }\n} = {}): PayloadRequest =>\n  ({\n    data: { stripeArgs, stripeMethod },\n    payload: {\n      logger: { error: loggerError },\n    },\n    user,\n  }) as unknown as PayloadRequest\n\ndescribe('stripeREST', () => {\n  beforeEach(() => {\n    vi.clearAllMocks()\n    mocks.addDataAndFileToRequest.mockResolvedValue(undefined)\n    mocks.canAccessAdmin.mockResolvedValue(undefined)\n    mocks.stripeProxy.mockResolvedValue({ data: { id: 'sub_123' }, status: 200 })\n  })\n\n  it('should return 401 for an anonymous request without invoking Stripe', async () => {\n    const req = createRequest({ user: null })\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(401)\n    expect(mocks.addDataAndFileToRequest).toHaveBeenCalledWith(req)\n    expect(mocks.canAccessAdmin).not.toHaveBeenCalled()\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  it('should return 403 when default admin access denies the user', async () => {\n    mocks.canAccessAdmin.mockRejectedValue(new UnauthorizedError())\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(403)\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  it('should return a generic 500 when default admin access throws unexpectedly', async () => {\n    const adminAccessError = new Error('sensitive admin access detail')\n\n    mocks.canAccessAdmin.mockRejectedValue(adminAccessError)\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n    const body = await response.json()\n\n    expect(response.status).toBe(500)\n    expect(body).toEqual({ message: 'Internal server error' })\n    expect(JSON.stringify(body)).not.toContain('sensitive admin access detail')\n    expect(loggerError).toHaveBeenCalledWith({\n      err: adminAccessError,\n      msg: 'An unexpected error occurred in the Stripe plugin REST handler.',\n    })\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  it('should invoke an exactly listed method for an admin user', async () => {\n    const req = createRequest({ stripeArgs: [{ limit: 10 }] })\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(200)\n    expect(mocks.stripeProxy).toHaveBeenCalledWith({\n      stripeArgs: [{ limit: 10 }],\n      stripeMethod: 'subscriptions.list',\n      stripeSecretKey: 'sk_test_example',\n    })\n  })\n\n  it('should allow a non-admin when an asynchronous custom access callback permits it', async () => {\n    const access = vi.fn(async () => true)\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig({ access }), req })\n\n    expect(response.status).toBe(200)\n    expect(access).toHaveBeenCalledWith({ req })\n    expect(mocks.canAccessAdmin).not.toHaveBeenCalled()\n  })\n\n  it('should return 403 when custom access denies the user', async () => {\n    const access = vi.fn(async () => false)\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig({ access }), req })\n\n    expect(response.status).toBe(403)\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  it('should return a generic 500 when custom access throws', async () => {\n    const access = vi.fn(async () => {\n      throw new Error('sensitive access detail')\n    })\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig({ access }), req })\n    const body = await response.text()\n\n    expect(response.status).toBe(500)\n    expect(body).not.toContain('sensitive access detail')\n    expect(loggerError).toHaveBeenCalledWith({\n      err: expect.any(Error),\n      msg: 'An unexpected error occurred in the Stripe plugin REST handler.',\n    })\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  it.each(['customers.list', 'subscriptions.cancel', 'subscriptions.*'])(\n    'should return 400 for unlisted method %s without invoking Stripe',\n    async (stripeMethod) => {\n      const req = createRequest({ stripeMethod })\n\n      const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n      expect(response.status).toBe(400)\n      expect(mocks.stripeProxy).not.toHaveBeenCalled()\n    },\n  )\n\n  it.each([[''], ['   '], [123], [null]])(\n    'should return 400 for malformed method %s without invoking Stripe',\n    async (stripeMethod) => {\n      const req = createRequest({ stripeMethod })\n\n      const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n      expect(response.status).toBe(400)\n      expect(mocks.stripeProxy).not.toHaveBeenCalled()\n    },\n  )\n\n  it('should return 400 for a missing method without invoking Stripe', async () => {\n    const req = createRequest()\n\n    delete req.data?.stripeMethod\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(400)\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  it('should return 400 for non-array Stripe arguments without invoking Stripe', async () => {\n    const req = createRequest({ stripeArgs: { limit: 10 } })\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(400)\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  it('should evaluate access before revealing whether a method is listed', async () => {\n    mocks.canAccessAdmin.mockRejectedValue(new UnauthorizedError())\n    const req = createRequest({ stripeMethod: 'customers.delete' })\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(403)\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  it('should preserve the Stripe proxy response status and body after all guards pass', async () => {\n    mocks.stripeProxy.mockResolvedValue({ message: 'Stripe request failed', status: 404 })\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(404)\n    expect(await response.json()).toEqual({ message: 'Stripe request failed', status: 404 })\n  })\n\n  it('should return a generic 500 when request parsing fails', async () => {\n    mocks.addDataAndFileToRequest.mockRejectedValue(new Error('sensitive parser detail'))\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n    const body = await response.text()\n\n    expect(response.status).toBe(500)\n    expect(body).not.toContain('sensitive parser detail')\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n})\n"],"names":["UnauthorizedError","beforeEach","describe","expect","it","vi","mocks","hoisted","addDataAndFileToRequest","fn","canAccessAdmin","stripeProxy","mock","importOriginal","payload","stripeREST","loggerError","createPluginConfig","access","rest","allowedMethods","stripeSecretKey","sync","createRequest","stripeArgs","stripeMethod","user","collection","id","data","logger","error","clearAllMocks","mockResolvedValue","undefined","status","req","response","pluginConfig","toBe","toHaveBeenCalledWith","not","toHaveBeenCalled","mockRejectedValue","adminAccessError","Error","body","json","toEqual","message","JSON","stringify","toContain","err","msg","limit","text","any","each"],"mappings":"AAEA,SAASA,iBAAiB,QAAQ,UAAS;AAC3C,SAASC,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAI7D,MAAMC,QAAQD,GAAGE,OAAO,CAAC,IAAO,CAAA;QAC9BC,yBAAyBH,GAAGI,EAAE;QAC9BC,gBAAgBL,GAAGI,EAAE;QACrBE,aAAaN,GAAGI,EAAE;IACpB,CAAA;AAEAJ,GAAGO,IAAI,CAAC,WAAW,OAAOC;IACxB,MAAMC,UAAU,MAAMD;IAEtB,OAAO;QACL,GAAGC,OAAO;QACVN,yBAAyBF,MAAME,uBAAuB;QACtDE,gBAAgBJ,MAAMI,cAAc;IACtC;AACF;AAEAL,GAAGO,IAAI,CAAC,+BAA+B,IAAO,CAAA;QAC5CD,aAAaL,MAAMK,WAAW;IAChC,CAAA;AAEA,SAASI,UAAU,QAAQ,YAAW;AAEtC,MAAMC,cAAcX,GAAGI,EAAE;AAEzB,MAAMQ,qBAAqB,CAAC,EAC1BC,MAAM,EAGP,GAAG,CAAC,CAAC,GAAmC,CAAA;QACvCC,MAAM;YACJD;YACAE,gBAAgB;gBAAC;aAAqB;QACxC;QACAC,iBAAiB;QACjBC,MAAM,EAAE;IACV,CAAA;AAEA,MAAMC,gBAAgB,CAAC,EACrBC,aAAa,EAAE,EACfC,eAAe,oBAAoB,EACnCC,OAAO;IAAEC,YAAY;IAASC,IAAI;AAAS,CAAC,EAK7C,GAAG,CAAC,CAAC,GACH,CAAA;QACCC,MAAM;YAAEL;YAAYC;QAAa;QACjCX,SAAS;YACPgB,QAAQ;gBAAEC,OAAOf;YAAY;QAC/B;QACAU;IACF,CAAA;AAEFxB,SAAS,cAAc;IACrBD,WAAW;QACTI,GAAG2B,aAAa;QAChB1B,MAAME,uBAAuB,CAACyB,iBAAiB,CAACC;QAChD5B,MAAMI,cAAc,CAACuB,iBAAiB,CAACC;QACvC5B,MAAMK,WAAW,CAACsB,iBAAiB,CAAC;YAAEJ,MAAM;gBAAED,IAAI;YAAU;YAAGO,QAAQ;QAAI;IAC7E;IAEA/B,GAAG,sEAAsE;QACvE,MAAMgC,MAAMb,cAAc;YAAEG,MAAM;QAAK;QAEvC,MAAMW,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAME,uBAAuB,EAAEgC,oBAAoB,CAACJ;QAC3DjC,OAAOG,MAAMI,cAAc,EAAE+B,GAAG,CAACC,gBAAgB;QACjDvC,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAEAtC,GAAG,+DAA+D;QAChEE,MAAMI,cAAc,CAACiC,iBAAiB,CAAC,IAAI3C;QAC3C,MAAMoC,MAAMb;QAEZ,MAAMc,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAEAtC,GAAG,6EAA6E;QAC9E,MAAMwC,mBAAmB,IAAIC,MAAM;QAEnCvC,MAAMI,cAAc,CAACiC,iBAAiB,CAACC;QACvC,MAAMR,MAAMb;QAEZ,MAAMc,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAC5E,MAAMU,OAAO,MAAMT,SAASU,IAAI;QAEhC5C,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAO2C,MAAME,OAAO,CAAC;YAAEC,SAAS;QAAwB;QACxD9C,OAAO+C,KAAKC,SAAS,CAACL,OAAOL,GAAG,CAACW,SAAS,CAAC;QAC3CjD,OAAOa,aAAawB,oBAAoB,CAAC;YACvCa,KAAKT;YACLU,KAAK;QACP;QACAnD,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAEAtC,GAAG,4DAA4D;QAC7D,MAAMgC,MAAMb,cAAc;YAAEC,YAAY;gBAAC;oBAAE+B,OAAO;gBAAG;aAAE;QAAC;QAExD,MAAMlB,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE6B,oBAAoB,CAAC;YAC7ChB,YAAY;gBAAC;oBAAE+B,OAAO;gBAAG;aAAE;YAC3B9B,cAAc;YACdJ,iBAAiB;QACnB;IACF;IAEAjB,GAAG,mFAAmF;QACpF,MAAMc,SAASb,GAAGI,EAAE,CAAC,UAAY;QACjC,MAAM2B,MAAMb;QAEZ,MAAMc,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB,mBAAmB;gBAAEC;YAAO;YAAIkB;QAAI;QAEtFjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOe,QAAQsB,oBAAoB,CAAC;YAAEJ;QAAI;QAC1CjC,OAAOG,MAAMI,cAAc,EAAE+B,GAAG,CAACC,gBAAgB;IACnD;IAEAtC,GAAG,wDAAwD;QACzD,MAAMc,SAASb,GAAGI,EAAE,CAAC,UAAY;QACjC,MAAM2B,MAAMb;QAEZ,MAAMc,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB,mBAAmB;gBAAEC;YAAO;YAAIkB;QAAI;QAEtFjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAEAtC,GAAG,yDAAyD;QAC1D,MAAMc,SAASb,GAAGI,EAAE,CAAC;YACnB,MAAM,IAAIoC,MAAM;QAClB;QACA,MAAMT,MAAMb;QAEZ,MAAMc,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB,mBAAmB;gBAAEC;YAAO;YAAIkB;QAAI;QACtF,MAAMU,OAAO,MAAMT,SAASmB,IAAI;QAEhCrD,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAO2C,MAAML,GAAG,CAACW,SAAS,CAAC;QAC3BjD,OAAOa,aAAawB,oBAAoB,CAAC;YACvCa,KAAKlD,OAAOsD,GAAG,CAACZ;YAChBS,KAAK;QACP;QACAnD,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAEAtC,GAAGsD,IAAI,CAAC;QAAC;QAAkB;QAAwB;KAAkB,EACnE,oEACA,OAAOjC;QACL,MAAMW,MAAMb,cAAc;YAAEE;QAAa;QAEzC,MAAMY,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAGFtC,GAAGsD,IAAI,CAAC;QAAC;YAAC;SAAG;QAAE;YAAC;SAAM;QAAE;YAAC;SAAI;QAAE;YAAC;SAAK;KAAC,EACpC,qEACA,OAAOjC;QACL,MAAMW,MAAMb,cAAc;YAAEE;QAAa;QAEzC,MAAMY,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAGFtC,GAAG,kEAAkE;QACnE,MAAMgC,MAAMb;QAEZ,OAAOa,IAAIP,IAAI,EAAEJ;QAEjB,MAAMY,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAEAtC,GAAG,4EAA4E;QAC7E,MAAMgC,MAAMb,cAAc;YAAEC,YAAY;gBAAE+B,OAAO;YAAG;QAAE;QAEtD,MAAMlB,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAEAtC,GAAG,sEAAsE;QACvEE,MAAMI,cAAc,CAACiC,iBAAiB,CAAC,IAAI3C;QAC3C,MAAMoC,MAAMb,cAAc;YAAEE,cAAc;QAAmB;QAE7D,MAAMY,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAEAtC,GAAG,mFAAmF;QACpFE,MAAMK,WAAW,CAACsB,iBAAiB,CAAC;YAAEgB,SAAS;YAAyBd,QAAQ;QAAI;QACpF,MAAMC,MAAMb;QAEZ,MAAMc,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAO,MAAMkC,SAASU,IAAI,IAAIC,OAAO,CAAC;YAAEC,SAAS;YAAyBd,QAAQ;QAAI;IACxF;IAEA/B,GAAG,0DAA0D;QAC3DE,MAAME,uBAAuB,CAACmC,iBAAiB,CAAC,IAAIE,MAAM;QAC1D,MAAMT,MAAMb;QAEZ,MAAMc,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAC5E,MAAMU,OAAO,MAAMT,SAASmB,IAAI;QAEhCrD,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAO2C,MAAML,GAAG,CAACW,SAAS,CAAC;QAC3BjD,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;AACF"}

package/dist/types.d.ts

@@ -21,19 +21,26 @@ export type SyncConfig = {
     stripeResourceType: 'customers' | 'products';
     stripeResourceTypeSingular: 'customer' | 'product';
 };
+export type StripeRESTAccess = (args: {
+    req: PayloadRequest;
+}) => boolean | Promise<boolean>;
+export type StripeRESTConfig = {
+    access?: StripeRESTAccess;
+    allowedMethods: readonly string[];
+};
 export type StripePluginConfig = {
     isTestKey?: boolean;
     logs?: boolean;
-    /** @default false */
-    rest?: boolean;
+    rest?: StripeRESTConfig;
     stripeSecretKey: string;
     stripeWebhooksEndpointSecret?: string;
     sync?: SyncConfig[];
     webhooks?: StripeWebhookHandler | StripeWebhookHandlers;
 };
 export type SanitizedStripePluginConfig = {
+    rest?: StripeRESTConfig;
     sync: SyncConfig[];
-} & StripePluginConfig;
+} & Omit<StripePluginConfig, 'rest' | 'sync'>;
 export type StripeProxy = (args: {
     stripeArgs: any[];
     stripeMethod: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAC/F,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAEhC,MAAM,MAAM,oBAAoB,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,CAAC,CAAA;IACR,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AAE1B,MAAM,MAAM,qBAAqB,GAAG;IAClC,CAAC,WAAW,EAAE,MAAM,GAAG,oBAAoB,CAAA;CAC5C,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,EAAE,cAAc,CAAA;IAC1B,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,kBAAkB,EAAE,WAAW,GAAG,UAAU,CAAA;IAC5C,0BAA0B,EAAE,UAAU,GAAG,SAAS,CAAA;CACnD,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,qBAAqB;IACrB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;IACvB,4BAA4B,CAAC,EAAE,MAAM,CAAA;IACrC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAA;IACnB,QAAQ,CAAC,EAAE,oBAAoB,GAAG,qBAAqB,CAAA;CACxD,CAAA;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,UAAU,EAAE,CAAA;CACnB,GAAG,kBAAkB,CAAA;AAEtB,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE;IAC/B,UAAU,EAAE,GAAG,EAAE,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,EAAE,MAAM,CAAA;CACxB,KAAK,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,GAAG,CAAA;IACV,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf,CAAC,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAC/F,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAEhC,MAAM,MAAM,oBAAoB,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,CAAC,CAAA;IACR,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AAE1B,MAAM,MAAM,qBAAqB,GAAG;IAClC,CAAC,WAAW,EAAE,MAAM,GAAG,oBAAoB,CAAA;CAC5C,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,EAAE,cAAc,CAAA;IAC1B,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,kBAAkB,EAAE,WAAW,GAAG,UAAU,CAAA;IAC5C,0BAA0B,EAAE,UAAU,GAAG,SAAS,CAAA;CACnD,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE;IAAE,GAAG,EAAE,cAAc,CAAA;CAAE,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAE5F,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,IAAI,CAAC,EAAE,gBAAgB,CAAA;IACvB,eAAe,EAAE,MAAM,CAAA;IACvB,4BAA4B,CAAC,EAAE,MAAM,CAAA;IACrC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAA;IACnB,QAAQ,CAAC,EAAE,oBAAoB,GAAG,qBAAqB,CAAA;CACxD,CAAA;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,CAAC,EAAE,gBAAgB,CAAA;IACvB,IAAI,EAAE,UAAU,EAAE,CAAA;CACnB,GAAG,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,CAAC,CAAA;AAE7C,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE;IAC/B,UAAU,EAAE,GAAG,EAAE,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,EAAE,MAAM,CAAA;CACxB,KAAK,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,GAAG,CAAA;IACV,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf,CAAC,CAAA"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type { CollectionSlug, Payload, Config as PayloadConfig, PayloadRequest } from 'payload'\nimport type Stripe from 'stripe'\n\nexport type StripeWebhookHandler<T = any> = (args: {\n  config: PayloadConfig\n  event: T\n  payload: Payload\n  pluginConfig?: StripePluginConfig\n  req: PayloadRequest\n  stripe: Stripe\n}) => Promise<void> | void\n\nexport type StripeWebhookHandlers = {\n  [webhookName: string]: StripeWebhookHandler\n}\n\nexport type FieldSyncConfig = {\n  fieldPath: string\n  stripeProperty: string\n}\n\nexport type SyncConfig = {\n  collection: CollectionSlug\n  fields: FieldSyncConfig[]\n  stripeResourceType: 'customers' | 'products' // TODO: get this from Stripe types\n  stripeResourceTypeSingular: 'customer' | 'product' // TODO: there must be a better way to do this\n}\n\nexport type StripePluginConfig = {\n  isTestKey?: boolean\n  logs?: boolean\n  /** @default false */\n  rest?: boolean\n  stripeSecretKey: string\n  stripeWebhooksEndpointSecret?: string\n  sync?: SyncConfig[]\n  webhooks?: StripeWebhookHandler | StripeWebhookHandlers\n}\n\nexport type SanitizedStripePluginConfig = {\n  sync: SyncConfig[] // convert to required\n} & StripePluginConfig\n\nexport type StripeProxy = (args: {\n  stripeArgs: any[]\n  stripeMethod: string\n  stripeSecretKey: string\n}) => Promise<{\n  data?: any\n  message?: string\n  status: number\n}>\n"],"names":[],"mappings":"AA2CA,WAQE"}
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type { CollectionSlug, Payload, Config as PayloadConfig, PayloadRequest } from 'payload'\nimport type Stripe from 'stripe'\n\nexport type StripeWebhookHandler<T = any> = (args: {\n  config: PayloadConfig\n  event: T\n  payload: Payload\n  pluginConfig?: StripePluginConfig\n  req: PayloadRequest\n  stripe: Stripe\n}) => Promise<void> | void\n\nexport type StripeWebhookHandlers = {\n  [webhookName: string]: StripeWebhookHandler\n}\n\nexport type FieldSyncConfig = {\n  fieldPath: string\n  stripeProperty: string\n}\n\nexport type SyncConfig = {\n  collection: CollectionSlug\n  fields: FieldSyncConfig[]\n  stripeResourceType: 'customers' | 'products' // TODO: get this from Stripe types\n  stripeResourceTypeSingular: 'customer' | 'product' // TODO: there must be a better way to do this\n}\n\nexport type StripeRESTAccess = (args: { req: PayloadRequest }) => boolean | Promise<boolean>\n\nexport type StripeRESTConfig = {\n  access?: StripeRESTAccess\n  allowedMethods: readonly string[]\n}\n\nexport type StripePluginConfig = {\n  isTestKey?: boolean\n  logs?: boolean\n  rest?: StripeRESTConfig\n  stripeSecretKey: string\n  stripeWebhooksEndpointSecret?: string\n  sync?: SyncConfig[]\n  webhooks?: StripeWebhookHandler | StripeWebhookHandlers\n}\n\nexport type SanitizedStripePluginConfig = {\n  rest?: StripeRESTConfig\n  sync: SyncConfig[]\n} & Omit<StripePluginConfig, 'rest' | 'sync'>\n\nexport type StripeProxy = (args: {\n  stripeArgs: any[]\n  stripeMethod: string\n  stripeSecretKey: string\n}) => Promise<{\n  data?: any\n  message?: string\n  status: number\n}>\n"],"names":[],"mappings":"AAkDA,WAQE"}

package/dist/utilities/deepen.d.ts

@@ -1,2 +1,8 @@
+import type { FieldSyncConfig } from '../types.js';
 export declare const deepen: (obj: Record<string, any>) => Record<string, any>;
+export declare const getSyncedFields: ({ data, fields, source, }: {
+    data: object;
+    fields: FieldSyncConfig[];
+    source: 'payload' | 'stripe';
+}) => Record<string, unknown>;
 //# sourceMappingURL=deepen.d.ts.map

package/dist/utilities/deepen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deepen.d.ts","sourceRoot":"","sources":["../../src/utilities/deepen.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,MAAM,QAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAiBnE,CAAA"}
+{"version":3,"file":"deepen.d.ts","sourceRoot":"","sources":["../../src/utilities/deepen.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,eAAO,MAAM,MAAM,QAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAwBnE,CAAA;AAED,eAAO,MAAM,eAAe,8BAIzB;IACD,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAA;CAC7B,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAczB,CAAA"}

package/dist/utilities/deepen.js

@@ -1,21 +1,51 @@
 // converts an object of dot notation keys to a nested object
 // i.e. { 'price.stripePriceID': '123' } to { price: { stripePriceID: '123' } }
+import { hasUnsupportedFieldPathSegment, setOwnProperty } from 'payload/shared';
 export const deepen = (obj)=>{
     const result = {};
-    for(const key in obj){
+    for (const key of Object.keys(obj)){
         const value = obj[key];
         const keys = key.split('.');
+        if (hasUnsupportedFieldPathSegment({
+            segments: keys
+        })) {
+            throw new Error('Invalid field path.');
+        }
         let current = result;
         keys.forEach((k, index)=>{
             if (index === keys.length - 1) {
-                current[k] = value;
+                setOwnProperty({
+                    key: k,
+                    target: current,
+                    value
+                });
             } else {
-                current[k] = current[k] || {};
+                if (!Object.hasOwn(current, k) || current[k] === null || typeof current[k] !== 'object') {
+                    setOwnProperty({
+                        key: k,
+                        target: current,
+                        value: {}
+                    });
+                }
                 current = current[k];
             }
         });
     }
     return result;
 };
+export const getSyncedFields = ({ data, fields, source })=>{
+    const flattened = Object.create(null);
+    for (const { fieldPath, stripeProperty } of fields){
+        const sourceProperty = source === 'payload' ? fieldPath : stripeProperty;
+        const targetProperty = source === 'payload' ? stripeProperty : fieldPath;
+        const value = Object.hasOwn(data, sourceProperty) ? data[sourceProperty] : undefined;
+        setOwnProperty({
+            key: targetProperty,
+            target: flattened,
+            value
+        });
+    }
+    return deepen(flattened);
+};
 
 //# sourceMappingURL=deepen.js.map

package/dist/utilities/deepen.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/deepen.ts"],"sourcesContent":["// converts an object of dot notation keys to a nested object\n// i.e. { 'price.stripePriceID': '123' } to { price: { stripePriceID: '123' } }\n\nexport const deepen = (obj: Record<string, any>): Record<string, any> => {\n  const result: Record<string, any> = {}\n\n  for (const key in obj) {\n    const value = obj[key]\n    const keys = key.split('.')\n    let current = result\n    keys.forEach((k, index) => {\n      if (index === keys.length - 1) {\n        current[k] = value\n      } else {\n        current[k] = current[k] || {}\n        current = current[k]\n      }\n    })\n  }\n  return result\n}\n"],"names":["deepen","obj","result","key","value","keys","split","current","forEach","k","index","length"],"mappings":"AAAA,6DAA6D;AAC7D,+EAA+E;AAE/E,OAAO,MAAMA,SAAS,CAACC;IACrB,MAAMC,SAA8B,CAAC;IAErC,IAAK,MAAMC,OAAOF,IAAK;QACrB,MAAMG,QAAQH,GAAG,CAACE,IAAI;QACtB,MAAME,OAAOF,IAAIG,KAAK,CAAC;QACvB,IAAIC,UAAUL;QACdG,KAAKG,OAAO,CAAC,CAACC,GAAGC;YACf,IAAIA,UAAUL,KAAKM,MAAM,GAAG,GAAG;gBAC7BJ,OAAO,CAACE,EAAE,GAAGL;YACf,OAAO;gBACLG,OAAO,CAACE,EAAE,GAAGF,OAAO,CAACE,EAAE,IAAI,CAAC;gBAC5BF,UAAUA,OAAO,CAACE,EAAE;YACtB;QACF;IACF;IACA,OAAOP;AACT,EAAC"}
+{"version":3,"sources":["../../src/utilities/deepen.ts"],"sourcesContent":["// converts an object of dot notation keys to a nested object\n// i.e. { 'price.stripePriceID': '123' } to { price: { stripePriceID: '123' } }\n\nimport { hasUnsupportedFieldPathSegment, setOwnProperty } from 'payload/shared'\n\nimport type { FieldSyncConfig } from '../types.js'\n\nexport const deepen = (obj: Record<string, any>): Record<string, any> => {\n  const result: Record<string, any> = {}\n\n  for (const key of Object.keys(obj)) {\n    const value = obj[key]\n    const keys = key.split('.')\n\n    if (hasUnsupportedFieldPathSegment({ segments: keys })) {\n      throw new Error('Invalid field path.')\n    }\n\n    let current = result\n    keys.forEach((k, index) => {\n      if (index === keys.length - 1) {\n        setOwnProperty({ key: k, target: current, value })\n      } else {\n        if (!Object.hasOwn(current, k) || current[k] === null || typeof current[k] !== 'object') {\n          setOwnProperty({ key: k, target: current, value: {} })\n        }\n        current = current[k]\n      }\n    })\n  }\n  return result\n}\n\nexport const getSyncedFields = ({\n  data,\n  fields,\n  source,\n}: {\n  data: object\n  fields: FieldSyncConfig[]\n  source: 'payload' | 'stripe'\n}): Record<string, unknown> => {\n  const flattened = Object.create(null) as Record<string, unknown>\n\n  for (const { fieldPath, stripeProperty } of fields) {\n    const sourceProperty = source === 'payload' ? fieldPath : stripeProperty\n    const targetProperty = source === 'payload' ? stripeProperty : fieldPath\n    const value = Object.hasOwn(data, sourceProperty)\n      ? (data as Record<string, unknown>)[sourceProperty]\n      : undefined\n\n    setOwnProperty({ key: targetProperty, target: flattened, value })\n  }\n\n  return deepen(flattened)\n}\n"],"names":["hasUnsupportedFieldPathSegment","setOwnProperty","deepen","obj","result","key","Object","keys","value","split","segments","Error","current","forEach","k","index","length","target","hasOwn","getSyncedFields","data","fields","source","flattened","create","fieldPath","stripeProperty","sourceProperty","targetProperty","undefined"],"mappings":"AAAA,6DAA6D;AAC7D,+EAA+E;AAE/E,SAASA,8BAA8B,EAAEC,cAAc,QAAQ,iBAAgB;AAI/E,OAAO,MAAMC,SAAS,CAACC;IACrB,MAAMC,SAA8B,CAAC;IAErC,KAAK,MAAMC,OAAOC,OAAOC,IAAI,CAACJ,KAAM;QAClC,MAAMK,QAAQL,GAAG,CAACE,IAAI;QACtB,MAAME,OAAOF,IAAII,KAAK,CAAC;QAEvB,IAAIT,+BAA+B;YAAEU,UAAUH;QAAK,IAAI;YACtD,MAAM,IAAII,MAAM;QAClB;QAEA,IAAIC,UAAUR;QACdG,KAAKM,OAAO,CAAC,CAACC,GAAGC;YACf,IAAIA,UAAUR,KAAKS,MAAM,GAAG,GAAG;gBAC7Bf,eAAe;oBAAEI,KAAKS;oBAAGG,QAAQL;oBAASJ;gBAAM;YAClD,OAAO;gBACL,IAAI,CAACF,OAAOY,MAAM,CAACN,SAASE,MAAMF,OAAO,CAACE,EAAE,KAAK,QAAQ,OAAOF,OAAO,CAACE,EAAE,KAAK,UAAU;oBACvFb,eAAe;wBAAEI,KAAKS;wBAAGG,QAAQL;wBAASJ,OAAO,CAAC;oBAAE;gBACtD;gBACAI,UAAUA,OAAO,CAACE,EAAE;YACtB;QACF;IACF;IACA,OAAOV;AACT,EAAC;AAED,OAAO,MAAMe,kBAAkB,CAAC,EAC9BC,IAAI,EACJC,MAAM,EACNC,MAAM,EAKP;IACC,MAAMC,YAAYjB,OAAOkB,MAAM,CAAC;IAEhC,KAAK,MAAM,EAAEC,SAAS,EAAEC,cAAc,EAAE,IAAIL,OAAQ;QAClD,MAAMM,iBAAiBL,WAAW,YAAYG,YAAYC;QAC1D,MAAME,iBAAiBN,WAAW,YAAYI,iBAAiBD;QAC/D,MAAMjB,QAAQF,OAAOY,MAAM,CAACE,MAAMO,kBAC9B,AAACP,IAAgC,CAACO,eAAe,GACjDE;QAEJ5B,eAAe;YAAEI,KAAKuB;YAAgBX,QAAQM;YAAWf;QAAM;IACjE;IAEA,OAAON,OAAOqB;AAChB,EAAC"}

package/dist/utilities/deepen.spec.js

@@ -0,0 +1,110 @@
+import { describe, expect, it } from 'vitest';
+import { deepen, getSyncedFields } from './deepen.js';
+describe('Stripe field mappings', ()=>{
+    it('should build constrained mappings from owned values', ()=>{
+        const marker = 'constrainedStripeMapping';
+        const inheritedSource = 'constrainedStripeSource';
+        const originalDescriptor = Object.getOwnPropertyDescriptor(Object.prototype, marker);
+        let inheritedGetterCalls = 0;
+        let processStateChanged = false;
+        let nestedMapping;
+        let syncedMapping;
+        let webhookMapping;
+        try {
+            expect(()=>deepen({
+                    [`__proto__.${marker}`]: 'value'
+                })).toThrow('Invalid field path.');
+            nestedMapping = deepen(Object.assign(Object.create({
+                'ignored.value': 'inherited'
+            }), {
+                [`constructor.prototype.${marker}`]: 'local',
+                'profile.displayName': 'Ada'
+            }));
+            const data = Object.create({
+                get [inheritedSource] () {
+                    inheritedGetterCalls += 1;
+                    return 'inherited';
+                }
+            });
+            data.displayName = 'Ada';
+            syncedMapping = getSyncedFields({
+                data,
+                fields: [
+                    {
+                        fieldPath: inheritedSource,
+                        stripeProperty: 'metadata.inherited'
+                    },
+                    {
+                        fieldPath: 'constructor',
+                        stripeProperty: 'constructor'
+                    },
+                    {
+                        fieldPath: 'displayName',
+                        stripeProperty: `constructor.prototype.${marker}`
+                    }
+                ],
+                source: 'payload'
+            });
+            const stripeData = Object.create({
+                get [inheritedSource] () {
+                    inheritedGetterCalls += 1;
+                    return 'inherited';
+                }
+            });
+            stripeData.name = 'Ada';
+            webhookMapping = getSyncedFields({
+                data: stripeData,
+                fields: [
+                    {
+                        fieldPath: 'profile.inherited',
+                        stripeProperty: inheritedSource
+                    },
+                    {
+                        fieldPath: 'profile.displayName',
+                        stripeProperty: 'name'
+                    }
+                ],
+                source: 'stripe'
+            });
+            processStateChanged = Object.hasOwn(Object.prototype, marker);
+        } finally{
+            if (originalDescriptor) {
+                Object.defineProperty(Object.prototype, marker, originalDescriptor);
+            } else {
+                delete Object.prototype[marker];
+            }
+        }
+        expect(processStateChanged).toBe(false);
+        expect(inheritedGetterCalls).toBe(0);
+        expect(Object.getOwnPropertyDescriptor(Object.prototype, marker)).toEqual(originalDescriptor);
+        expect(nestedMapping).toEqual({
+            constructor: {
+                prototype: {
+                    [marker]: 'local'
+                }
+            },
+            profile: {
+                displayName: 'Ada'
+            }
+        });
+        expect(Object.hasOwn(nestedMapping, 'ignored')).toBe(false);
+        expect(syncedMapping).toEqual({
+            constructor: {
+                prototype: {
+                    [marker]: 'Ada'
+                }
+            },
+            metadata: {
+                inherited: undefined
+            }
+        });
+        expect(webhookMapping).toEqual({
+            profile: {
+                displayName: 'Ada',
+                inherited: undefined
+            }
+        });
+    });
+});
+
+//# sourceMappingURL=deepen.spec.js.map

package/dist/utilities/deepen.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/deepen.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport { deepen, getSyncedFields } from './deepen.js'\n\ndescribe('Stripe field mappings', () => {\n  it('should build constrained mappings from owned values', () => {\n    const marker = 'constrainedStripeMapping'\n    const inheritedSource = 'constrainedStripeSource'\n    const originalDescriptor = Object.getOwnPropertyDescriptor(Object.prototype, marker)\n    let inheritedGetterCalls = 0\n    let processStateChanged = false\n    let nestedMapping: Record<string, unknown> | undefined\n    let syncedMapping: Record<string, unknown> | undefined\n    let webhookMapping: Record<string, unknown> | undefined\n\n    try {\n      expect(() => deepen({ [`__proto__.${marker}`]: 'value' })).toThrow('Invalid field path.')\n\n      nestedMapping = deepen(\n        Object.assign(Object.create({ 'ignored.value': 'inherited' }), {\n          [`constructor.prototype.${marker}`]: 'local',\n          'profile.displayName': 'Ada',\n        }),\n      )\n\n      const data = Object.create({\n        get [inheritedSource]() {\n          inheritedGetterCalls += 1\n          return 'inherited'\n        },\n      }) as Record<string, unknown>\n      data.displayName = 'Ada'\n\n      syncedMapping = getSyncedFields({\n        data,\n        fields: [\n          { fieldPath: inheritedSource, stripeProperty: 'metadata.inherited' },\n          { fieldPath: 'constructor', stripeProperty: 'constructor' },\n          {\n            fieldPath: 'displayName',\n            stripeProperty: `constructor.prototype.${marker}`,\n          },\n        ],\n        source: 'payload',\n      })\n\n      const stripeData = Object.create({\n        get [inheritedSource]() {\n          inheritedGetterCalls += 1\n          return 'inherited'\n        },\n      }) as Record<string, unknown>\n      stripeData.name = 'Ada'\n\n      webhookMapping = getSyncedFields({\n        data: stripeData,\n        fields: [\n          { fieldPath: 'profile.inherited', stripeProperty: inheritedSource },\n          { fieldPath: 'profile.displayName', stripeProperty: 'name' },\n        ],\n        source: 'stripe',\n      })\n      processStateChanged = Object.hasOwn(Object.prototype, marker)\n    } finally {\n      if (originalDescriptor) {\n        Object.defineProperty(Object.prototype, marker, originalDescriptor)\n      } else {\n        delete (Object.prototype as Record<string, unknown>)[marker]\n      }\n    }\n\n    expect(processStateChanged).toBe(false)\n    expect(inheritedGetterCalls).toBe(0)\n    expect(Object.getOwnPropertyDescriptor(Object.prototype, marker)).toEqual(originalDescriptor)\n    expect(nestedMapping).toEqual({\n      constructor: {\n        prototype: {\n          [marker]: 'local',\n        },\n      },\n      profile: {\n        displayName: 'Ada',\n      },\n    })\n    expect(Object.hasOwn(nestedMapping as object, 'ignored')).toBe(false)\n    expect(syncedMapping).toEqual({\n      constructor: {\n        prototype: {\n          [marker]: 'Ada',\n        },\n      },\n      metadata: {\n        inherited: undefined,\n      },\n    })\n    expect(webhookMapping).toEqual({\n      profile: {\n        displayName: 'Ada',\n        inherited: undefined,\n      },\n    })\n  })\n})\n"],"names":["describe","expect","it","deepen","getSyncedFields","marker","inheritedSource","originalDescriptor","Object","getOwnPropertyDescriptor","prototype","inheritedGetterCalls","processStateChanged","nestedMapping","syncedMapping","webhookMapping","toThrow","assign","create","data","displayName","fields","fieldPath","stripeProperty","source","stripeData","name","hasOwn","defineProperty","toBe","toEqual","profile","metadata","inherited","undefined"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,MAAM,EAAEC,eAAe,QAAQ,cAAa;AAErDJ,SAAS,yBAAyB;IAChCE,GAAG,uDAAuD;QACxD,MAAMG,SAAS;QACf,MAAMC,kBAAkB;QACxB,MAAMC,qBAAqBC,OAAOC,wBAAwB,CAACD,OAAOE,SAAS,EAAEL;QAC7E,IAAIM,uBAAuB;QAC3B,IAAIC,sBAAsB;QAC1B,IAAIC;QACJ,IAAIC;QACJ,IAAIC;QAEJ,IAAI;YACFd,OAAO,IAAME,OAAO;oBAAE,CAAC,CAAC,UAAU,EAAEE,QAAQ,CAAC,EAAE;gBAAQ,IAAIW,OAAO,CAAC;YAEnEH,gBAAgBV,OACdK,OAAOS,MAAM,CAACT,OAAOU,MAAM,CAAC;gBAAE,iBAAiB;YAAY,IAAI;gBAC7D,CAAC,CAAC,sBAAsB,EAAEb,QAAQ,CAAC,EAAE;gBACrC,uBAAuB;YACzB;YAGF,MAAMc,OAAOX,OAAOU,MAAM,CAAC;gBACzB,IAAI,CAACZ,gBAAgB,IAAG;oBACtBK,wBAAwB;oBACxB,OAAO;gBACT;YACF;YACAQ,KAAKC,WAAW,GAAG;YAEnBN,gBAAgBV,gBAAgB;gBAC9Be;gBACAE,QAAQ;oBACN;wBAAEC,WAAWhB;wBAAiBiB,gBAAgB;oBAAqB;oBACnE;wBAAED,WAAW;wBAAeC,gBAAgB;oBAAc;oBAC1D;wBACED,WAAW;wBACXC,gBAAgB,CAAC,sBAAsB,EAAElB,QAAQ;oBACnD;iBACD;gBACDmB,QAAQ;YACV;YAEA,MAAMC,aAAajB,OAAOU,MAAM,CAAC;gBAC/B,IAAI,CAACZ,gBAAgB,IAAG;oBACtBK,wBAAwB;oBACxB,OAAO;gBACT;YACF;YACAc,WAAWC,IAAI,GAAG;YAElBX,iBAAiBX,gBAAgB;gBAC/Be,MAAMM;gBACNJ,QAAQ;oBACN;wBAAEC,WAAW;wBAAqBC,gBAAgBjB;oBAAgB;oBAClE;wBAAEgB,WAAW;wBAAuBC,gBAAgB;oBAAO;iBAC5D;gBACDC,QAAQ;YACV;YACAZ,sBAAsBJ,OAAOmB,MAAM,CAACnB,OAAOE,SAAS,EAAEL;QACxD,SAAU;YACR,IAAIE,oBAAoB;gBACtBC,OAAOoB,cAAc,CAACpB,OAAOE,SAAS,EAAEL,QAAQE;YAClD,OAAO;gBACL,OAAO,AAACC,OAAOE,SAAS,AAA4B,CAACL,OAAO;YAC9D;QACF;QAEAJ,OAAOW,qBAAqBiB,IAAI,CAAC;QACjC5B,OAAOU,sBAAsBkB,IAAI,CAAC;QAClC5B,OAAOO,OAAOC,wBAAwB,CAACD,OAAOE,SAAS,EAAEL,SAASyB,OAAO,CAACvB;QAC1EN,OAAOY,eAAeiB,OAAO,CAAC;YAC5B,aAAa;gBACXpB,WAAW;oBACT,CAACL,OAAO,EAAE;gBACZ;YACF;YACA0B,SAAS;gBACPX,aAAa;YACf;QACF;QACAnB,OAAOO,OAAOmB,MAAM,CAACd,eAAyB,YAAYgB,IAAI,CAAC;QAC/D5B,OAAOa,eAAegB,OAAO,CAAC;YAC5B,aAAa;gBACXpB,WAAW;oBACT,CAACL,OAAO,EAAE;gBACZ;YACF;YACA2B,UAAU;gBACRC,WAAWC;YACb;QACF;QACAjC,OAAOc,gBAAgBe,OAAO,CAAC;YAC7BC,SAAS;gBACPX,aAAa;gBACba,WAAWC;YACb;QACF;IACF;AACF"}

package/dist/utilities/sanitizeStripeRESTConfig.d.ts

@@ -0,0 +1,5 @@
+import type { StripeRESTConfig } from '../types.js';
+export declare const sanitizeStripeRESTConfig: ({ rest, }: {
+    rest: unknown;
+}) => StripeRESTConfig | undefined;
+//# sourceMappingURL=sanitizeStripeRESTConfig.d.ts.map

package/dist/utilities/sanitizeStripeRESTConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizeStripeRESTConfig.d.ts","sourceRoot":"","sources":["../../src/utilities/sanitizeStripeRESTConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoB,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAKrE,eAAO,MAAM,wBAAwB,cAElC;IACD,IAAI,EAAE,OAAO,CAAA;CACd,KAAG,gBAAgB,GAAG,SA8BtB,CAAA"}

package/dist/utilities/sanitizeStripeRESTConfig.js

@@ -0,0 +1,25 @@
+const migrationError = 'The Stripe REST endpoint now requires an object with a non-empty allowedMethods array of exact method names.';
+export const sanitizeStripeRESTConfig = ({ rest })=>{
+    if (rest === undefined || rest === false) {
+        return undefined;
+    }
+    if (typeof rest !== 'object' || rest === null || Array.isArray(rest) || !('allowedMethods' in rest) || !Array.isArray(rest.allowedMethods)) {
+        throw new Error(migrationError);
+    }
+    const access = 'access' in rest ? rest.access : undefined;
+    if (rest.allowedMethods.length === 0 || rest.allowedMethods.some((method)=>typeof method !== 'string' || method.trim().length === 0 || method.includes('*')) || access !== undefined && !isStripeRESTAccess(access)) {
+        throw new Error(migrationError);
+    }
+    const allowedMethods = Object.freeze([
+        ...new Set(rest.allowedMethods)
+    ]);
+    return access === undefined ? {
+        allowedMethods
+    } : {
+        access,
+        allowedMethods
+    };
+};
+const isStripeRESTAccess = (access)=>typeof access === 'function';
+
+//# sourceMappingURL=sanitizeStripeRESTConfig.js.map

package/dist/utilities/sanitizeStripeRESTConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/sanitizeStripeRESTConfig.ts"],"sourcesContent":["import type { StripeRESTAccess, StripeRESTConfig } from '../types.js'\n\nconst migrationError =\n  'The Stripe REST endpoint now requires an object with a non-empty allowedMethods array of exact method names.'\n\nexport const sanitizeStripeRESTConfig = ({\n  rest,\n}: {\n  rest: unknown\n}): StripeRESTConfig | undefined => {\n  if (rest === undefined || rest === false) {\n    return undefined\n  }\n\n  if (\n    typeof rest !== 'object' ||\n    rest === null ||\n    Array.isArray(rest) ||\n    !('allowedMethods' in rest) ||\n    !Array.isArray(rest.allowedMethods)\n  ) {\n    throw new Error(migrationError)\n  }\n\n  const access = 'access' in rest ? rest.access : undefined\n\n  if (\n    rest.allowedMethods.length === 0 ||\n    rest.allowedMethods.some(\n      (method) => typeof method !== 'string' || method.trim().length === 0 || method.includes('*'),\n    ) ||\n    (access !== undefined && !isStripeRESTAccess(access))\n  ) {\n    throw new Error(migrationError)\n  }\n\n  const allowedMethods = Object.freeze([...new Set(rest.allowedMethods)])\n\n  return access === undefined ? { allowedMethods } : { access, allowedMethods }\n}\n\nconst isStripeRESTAccess = (access: unknown): access is StripeRESTAccess =>\n  typeof access === 'function'\n"],"names":["migrationError","sanitizeStripeRESTConfig","rest","undefined","Array","isArray","allowedMethods","Error","access","length","some","method","trim","includes","isStripeRESTAccess","Object","freeze","Set"],"mappings":"AAEA,MAAMA,iBACJ;AAEF,OAAO,MAAMC,2BAA2B,CAAC,EACvCC,IAAI,EAGL;IACC,IAAIA,SAASC,aAAaD,SAAS,OAAO;QACxC,OAAOC;IACT;IAEA,IACE,OAAOD,SAAS,YAChBA,SAAS,QACTE,MAAMC,OAAO,CAACH,SACd,CAAE,CAAA,oBAAoBA,IAAG,KACzB,CAACE,MAAMC,OAAO,CAACH,KAAKI,cAAc,GAClC;QACA,MAAM,IAAIC,MAAMP;IAClB;IAEA,MAAMQ,SAAS,YAAYN,OAAOA,KAAKM,MAAM,GAAGL;IAEhD,IACED,KAAKI,cAAc,CAACG,MAAM,KAAK,KAC/BP,KAAKI,cAAc,CAACI,IAAI,CACtB,CAACC,SAAW,OAAOA,WAAW,YAAYA,OAAOC,IAAI,GAAGH,MAAM,KAAK,KAAKE,OAAOE,QAAQ,CAAC,SAEzFL,WAAWL,aAAa,CAACW,mBAAmBN,SAC7C;QACA,MAAM,IAAID,MAAMP;IAClB;IAEA,MAAMM,iBAAiBS,OAAOC,MAAM,CAAC;WAAI,IAAIC,IAAIf,KAAKI,cAAc;KAAE;IAEtE,OAAOE,WAAWL,YAAY;QAAEG;IAAe,IAAI;QAAEE;QAAQF;IAAe;AAC9E,EAAC;AAED,MAAMQ,qBAAqB,CAACN,SAC1B,OAAOA,WAAW"}