@superwall/server 0.1.1 → 0.1.3

package/.turbo/turbo-test.log

@@ -2,72 +2,72 @@ $ bun test
 bun test v1.3.11 (af24e281)
 
 src/requires.test.ts:
-(pass) sw.requires() > calls next() when entitled [8.75ms]
-(pass) sw.requires() > default 403 when not entitled [0.37ms]
-(pass) sw.requires() > fail-closed when no userId can be extracted [0.11ms]
-(pass) sw.requires() > allowAnonymous lets the handler decide [0.09ms]
-(pass) sw.requires() > onUnauthorized override [0.20ms]
-(pass) sw.requires() > per-route userId override wins [1.41ms]
-(pass) sw.requires() > network errors pass to next(err) [0.84ms]
-(pass) sw.requires() > multiple-AND spec rejects when any missing [0.39ms]
-(pass) sw.requires() > ANY spec passes when one active [0.21ms]
-(pass) sw.requires() > normalizes spec at registration time (fails loud) [0.37ms]
+(pass) sw.requires() > calls next() when entitled [1.40ms]
+(pass) sw.requires() > default 403 when not entitled [0.13ms]
+(pass) sw.requires() > fail-closed when no userId can be extracted [0.06ms]
+(pass) sw.requires() > allowAnonymous lets the handler decide [0.05ms]
+(pass) sw.requires() > onUnauthorized override [1.02ms]
+(pass) sw.requires() > per-route userId override wins [0.24ms]
+(pass) sw.requires() > network errors pass to next(err) [0.14ms]
+(pass) sw.requires() > multiple-AND spec rejects when any missing [0.07ms]
+(pass) sw.requires() > ANY spec passes when one active [0.06ms]
+(pass) sw.requires() > normalizes spec at registration time (fails loud) [0.04ms]
 
 src/cache.test.ts:
-(pass) InMemoryCache > get returns null on miss [0.02ms]
-(pass) InMemoryCache > set + get returns the entry [0.10ms]
-(pass) InMemoryCache > expired entry is dropped on read [0.03ms]
-(pass) InMemoryCache > delete removes the entry [0.15ms]
-(pass) InMemoryCache > clear empties the cache [0.08ms]
-(pass) InMemoryCache > LRU evicts oldest when maxEntries exceeded [0.17ms]
-(pass) InMemoryCache > read refreshes LRU position so recent reads survive eviction [0.18ms]
+(pass) InMemoryCache > get returns null on miss
+(pass) InMemoryCache > set + get returns the entry [0.08ms]
+(pass) InMemoryCache > expired entry is dropped on read [0.04ms]
+(pass) InMemoryCache > delete removes the entry [0.03ms]
+(pass) InMemoryCache > clear empties the cache [0.03ms]
+(pass) InMemoryCache > LRU evicts oldest when maxEntries exceeded [0.12ms]
+(pass) InMemoryCache > read refreshes LRU position so recent reads survive eviction [0.04ms]
 
 src/superwall.test.ts:
-(pass) Superwall() factory > rejects missing apiKey [0.04ms]
-(pass) Superwall() factory > getEntitlements returns parsed bucket [0.19ms]
-(pass) Superwall() factory > userHas (string) returns true when entitlement is active [0.08ms]
-(pass) Superwall() factory > userHas (string) returns false when entitlement is inactive [0.03ms]
-(pass) Superwall() factory > userHas (array) requires all [0.07ms]
-(pass) Superwall() factory > userHas ({ any }) returns true when any active [0.04ms]
-(pass) Superwall() factory > caches subsequent reads for the same userId [0.14ms]
-(pass) Superwall() factory > invalidate forces a refetch [0.26ms]
-(pass) Superwall() factory > invalidateAll clears every entry [0.24ms]
-(pass) Superwall() factory > TTL expiry forces a refetch [9.06ms]
-(pass) Superwall() factory > onRequest fires with cache hit info [1.30ms]
+(pass) Superwall() factory > rejects missing apiKey [0.06ms]
+(pass) Superwall() factory > getEntitlements returns parsed bucket [0.29ms]
+(pass) Superwall() factory > userHas (string) returns true when entitlement is active [0.06ms]
+(pass) Superwall() factory > userHas (string) returns false when entitlement is inactive
+(pass) Superwall() factory > userHas (array) requires all [0.15ms]
+(pass) Superwall() factory > userHas ({ any }) returns true when any active [0.11ms]
+(pass) Superwall() factory > caches subsequent reads for the same userId [0.05ms]
+(pass) Superwall() factory > invalidate forces a refetch [0.09ms]
+(pass) Superwall() factory > invalidateAll clears every entry [0.09ms]
+(pass) Superwall() factory > TTL expiry forces a refetch [5.91ms]
+(pass) Superwall() factory > onRequest fires with cache hit info [0.15ms]
 (pass) Superwall() factory > onRequest throwing does not break the request [0.07ms]
 
 src/fetcher.test.ts:
-(pass) fetchEntitlements > parses customerInfo.entitlements envelope [0.34ms]
-(pass) fetchEntitlements > parses top-level entitlements array [0.15ms]
-(pass) fetchEntitlements > encodes the userId in the URL path [1.20ms]
-(pass) fetchEntitlements > includes Authorization and X-App-User-ID headers [0.46ms]
-(pass) fetchEntitlements > 401 → SuperwallAuthError [0.25ms]
-(pass) fetchEntitlements > 403 → SuperwallAuthError [0.73ms]
-(pass) fetchEntitlements > 404 → SuperwallNotFoundError [0.09ms]
-(pass) fetchEntitlements > 500 → SuperwallNetworkError with status [0.19ms]
-(pass) fetchEntitlements > fetch throw → SuperwallNetworkError [0.28ms]
-(pass) fetchEntitlements > AbortError → SuperwallTimeoutError [6.79ms]
-(pass) fetchEntitlements > malformed JSON → SuperwallDecodingError [0.21ms]
-(pass) fetchEntitlements > uses the configured environment for the host [0.16ms]
+(pass) fetchEntitlements > parses customerInfo.entitlements envelope [0.28ms]
+(pass) fetchEntitlements > parses top-level entitlements array [0.10ms]
+(pass) fetchEntitlements > encodes the userId in the URL path [0.16ms]
+(pass) fetchEntitlements > includes Authorization and X-App-User-ID headers [0.25ms]
+(pass) fetchEntitlements > 401 → SuperwallAuthError [0.14ms]
+(pass) fetchEntitlements > 403 → SuperwallAuthError [0.10ms]
+(pass) fetchEntitlements > 404 → SuperwallNotFoundError [0.07ms]
+(pass) fetchEntitlements > 500 → SuperwallNetworkError with status [0.13ms]
+(pass) fetchEntitlements > fetch throw → SuperwallNetworkError [0.12ms]
+(pass) fetchEntitlements > AbortError → SuperwallTimeoutError [6.50ms]
+(pass) fetchEntitlements > malformed JSON → SuperwallDecodingError [0.16ms]
+(pass) fetchEntitlements > uses the configured environment for the host [0.05ms]
 
 src/spec.test.ts:
 (pass) normalizeSpec > string [0.02ms]
 (pass) normalizeSpec > array → all
-(pass) normalizeSpec > { all }
-(pass) normalizeSpec > { any } [0.03ms]
-(pass) normalizeSpec > rejects empty string [0.02ms]
-(pass) normalizeSpec > rejects empty array
-(pass) normalizeSpec > rejects empty all
-(pass) normalizeSpec > rejects empty any
-(pass) normalizeSpec > rejects malformed object [0.05ms]
-(pass) findMissing (mode: all) > returns empty when all entitlements active [0.02ms]
+(pass) normalizeSpec > { all } [0.02ms]
+(pass) normalizeSpec > { any } [0.02ms]
+(pass) normalizeSpec > rejects empty string [0.03ms]
+(pass) normalizeSpec > rejects empty array [0.03ms]
+(pass) normalizeSpec > rejects empty all [0.02ms]
+(pass) normalizeSpec > rejects empty any [0.02ms]
+(pass) normalizeSpec > rejects malformed object [0.04ms]
+(pass) findMissing (mode: all) > returns empty when all entitlements active [0.07ms]
 (pass) findMissing (mode: all) > returns the missing entitlement
-(pass) findMissing (mode: all) > ignores extra active entitlements
-(pass) findMissing (mode: all) > inactive entitlements are not counted
-(pass) findMissing (mode: any) > returns empty when any one is active
-(pass) findMissing (mode: any) > returns all listed when none active
+(pass) findMissing (mode: all) > ignores extra active entitlements [0.03ms]
+(pass) findMissing (mode: all) > inactive entitlements are not counted [0.03ms]
+(pass) findMissing (mode: any) > returns empty when any one is active [0.03ms]
+(pass) findMissing (mode: any) > returns all listed when none active [0.02ms]
 
  56 pass
  0 fail
  84 expect() calls
-Ran 56 tests across 5 files. [107.00ms]
+Ran 56 tests across 5 files. [42.00ms]

package/README.md

@@ -0,0 +1,53 @@
+# @superwall/server
+
+Server-side entitlement enforcement for the Superwall web SDK. The browser's
+subscription status is editable from devtools — this package gates real routes
+server-to-server against Superwall's `/entitlements` endpoint, with caching.
+
+Works on any runtime with `fetch` (Node 18+, Bun, Deno, Workers).
+
+```sh
+bun add @superwall/server   # or npm / pnpm / yarn
+```
+
+## Setup
+
+```ts
+import { Superwall } from "@superwall/server";
+
+const sw = Superwall({
+  apiKey: process.env.SUPERWALL_API_KEY!,        // required
+  userId: (req) => req.session?.userId ?? null,  // how to read the user per request
+  // environment: "release",
+  // cache: { ttlMs: 60_000, maxEntries: 10_000 },
+  // timeoutMs: 5_000,
+});
+```
+
+## Gate a route (Express-style middleware)
+
+```ts
+app.get("/api/export", sw.requires("pro"), exportHandler);
+// 403 if the user lacks the "pro" entitlement; calls next() if they have it.
+```
+
+`requires(entitlement, options?)` returns `(req, res, next)`. Pass a per-call
+`userId` extractor in `options` to override the default.
+
+## Check imperatively
+
+```ts
+if (await sw.userHas(userId, "pro")) {
+  // grant access
+}
+```
+
+## Offline verification
+
+For per-request checks without a network round-trip, verify the signed
+entitlements token the client holds (`sw.entitlementsToken` on the browser
+SDK) with [`@superwall/verify`](https://www.npmjs.com/package/@superwall/verify).
+
+## License
+
+MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superwall/server",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "type": "module",
   "license": "MIT",
   "exports": {
@@ -20,8 +20,8 @@
     "clean": "rm -rf node_modules .turbo *.tsbuildinfo"
   },
   "dependencies": {
-    "@superwall/core": "0.0.0",
-    "@superwall/verify": "0.0.0"
+    "@superwall/core": "^0.1.3",
+    "@superwall/verify": "^0.1.3"
   },
   "devDependencies": {
     "@types/bun": "latest",