@pylonsync/stripe 0.3.287 → 0.3.289

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.3.287",
+  "version": "0.3.289",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",
@@ -12,8 +12,8 @@
     "check": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@pylonsync/sdk": "0.3.287",
-    "@pylonsync/functions": "0.3.287"
+    "@pylonsync/sdk": "0.3.289",
+    "@pylonsync/functions": "0.3.289"
   },
   "peerDependencies": {
     "bun-types": "*"

package/src/handlers/webhook.test.ts

@@ -0,0 +1,20 @@
+import { expect, test } from "bun:test";
+
+import type { StripeConfig } from "../types";
+import { stripeWebhookHandler } from "./webhook";
+
+// Regression for the high-severity "billing silently never syncs" bug: Stripe
+// POSTs the webhook anonymously, so the handler MUST declare auth:"public".
+// With the default auth:"user", every delivery to /api/fn/stripeWebhook is
+// rejected with 401 AUTH_REQUIRED before the signature check runs, so no
+// subscription/credit row is ever written. The signature verification inside
+// the handler (STRIPE_WEBHOOK_SECRET) is the real auth boundary, not a session.
+test("stripeWebhookHandler is public (Stripe POSTs anonymously)", () => {
+  const cfg = {
+    referenceType: "org",
+    plans: [],
+  } as unknown as StripeConfig;
+
+  const handler = stripeWebhookHandler(cfg);
+  expect(handler.auth).toBe("public");
+});

package/src/handlers/webhook.ts

@@ -31,6 +31,12 @@ import { resolveWebhookSecret } from "./internal";
  */
 export function stripeWebhookHandler(cfg: StripeConfig) {
 	return action({
+		// Webhook receivers are unauthenticated by nature: Stripe POSTs
+		// anonymously, so the default `auth: "user"` 401s every delivery
+		// before the handler runs. The real auth boundary is the signature
+		// check below (verifyStripeSignature against STRIPE_WEBHOOK_SECRET),
+		// not a user session.
+		auth: "public",
 		args: {},
 		async handler(ctx: HandlerCtx) {
 			if (!ctx.request) {

package/src/manifest.ts

@@ -117,6 +117,10 @@ export function buildStripeManifest(
 			action("restoreSubscription", {
 				input: [{ name: "referenceId", type: "string", optional: true }],
 			}),
+			// Public-by-handler: the handler factory declares `auth: "public"`
+			// (Stripe POSTs anonymously; the signature check is the real auth
+			// boundary). The manifest action() builder carries input shapes
+			// only — auth lives on the handler, which the runtime gates on.
 			action("stripeWebhook"),
 		],
 	};