@superwall/server 0.2.0 → 0.2.1

package/src/requires.test.ts

@@ -1,219 +0,0 @@
-import { afterEach, describe, expect, test } from "bun:test";
-import { Superwall } from "./superwall.ts";
-import type {
-  ConnectStyleNext,
-  ConnectStyleResponse,
-  FetchLike,
-} from "./types.ts";
-
-interface FakeRequest {
-  session?: { userId?: string };
-  params?: Record<string, string>;
-}
-
-interface ResponseLog {
-  statusCode: number | null;
-  body: unknown;
-}
-
-const realFetch = globalThis.fetch;
-const setFetch = (impl: FetchLike): void => {
-  (globalThis as unknown as { fetch: FetchLike }).fetch = impl;
-};
-
-afterEach(() => {
-  (globalThis as unknown as { fetch: typeof realFetch }).fetch = realFetch;
-});
-
-const makeRes = (): { res: ConnectStyleResponse; log: ResponseLog } => {
-  const log: ResponseLog = { statusCode: null, body: null };
-  const res: ConnectStyleResponse = {
-    status(code) {
-      log.statusCode = code;
-      return res;
-    },
-    json(body) {
-      log.body = body;
-      return res;
-    },
-  };
-  return { res, log };
-};
-
-const makeNext = (): {
-  next: ConnectStyleNext;
-  calls: Array<{ err?: unknown }>;
-} => {
-  const calls: Array<{ err?: unknown }> = [];
-  const next: ConnectStyleNext = (err) => {
-    calls.push(err === undefined ? {} : { err });
-  };
-  return { next, calls };
-};
-
-const okResponse = (
-  entitlements: Array<{ id: string; isActive: boolean }>,
-): Response =>
-  new Response(JSON.stringify({ entitlements }), {
-    status: 200,
-    headers: { "content-type": "application/json" },
-  });
-
-const urlOf = (input: string | URL | Request): string =>
-  typeof input === "string"
-    ? input
-    : input instanceof URL
-      ? input.toString()
-      : input.url;
-
-describe("sw.requires()", () => {
-  test("calls next() when entitled", async () => {
-    setFetch(async () => okResponse([{ id: "pro", isActive: true }]));
-    const sw = Superwall<FakeRequest>({
-      apiKey: "k",
-      userId: (r) => r.session?.userId ?? null,
-    });
-    const { res, log } = makeRes();
-    const { next, calls } = makeNext();
-    await sw.requires("pro")({ session: { userId: "u1" } }, res, next);
-    expect(calls).toHaveLength(1);
-    expect(calls[0]).toEqual({});
-    expect(log.statusCode).toBeNull();
-  });
-
-  test("default 403 when not entitled", async () => {
-    setFetch(async () => okResponse([{ id: "team", isActive: true }]));
-    const sw = Superwall<FakeRequest>({
-      apiKey: "k",
-      userId: (r) => r.session?.userId ?? null,
-    });
-    const { res, log } = makeRes();
-    const { next, calls } = makeNext();
-    await sw.requires("pro")({ session: { userId: "u1" } }, res, next);
-    expect(calls).toHaveLength(0);
-    expect(log.statusCode).toBe(403);
-    expect(log.body).toEqual({
-      error: "entitlement_required",
-      entitlement: "pro",
-    });
-  });
-
-  test("fail-closed when no userId can be extracted", async () => {
-    setFetch(async () => {
-      throw new Error("should not be called — extractor returned null");
-    });
-    const sw = Superwall<FakeRequest>({
-      apiKey: "k",
-      userId: (r) => r.session?.userId ?? null,
-    });
-    const { res, log } = makeRes();
-    const { next, calls } = makeNext();
-    await sw.requires("pro")({}, res, next);
-    expect(calls).toHaveLength(0);
-    expect(log.statusCode).toBe(403);
-  });
-
-  test("allowAnonymous lets the handler decide", async () => {
-    setFetch(async () => okResponse([]));
-    const sw = Superwall<FakeRequest>({
-      apiKey: "k",
-      userId: (r) => r.session?.userId ?? null,
-    });
-    const { res, log } = makeRes();
-    const { next, calls } = makeNext();
-    await sw.requires("pro", { allowAnonymous: true })({}, res, next);
-    expect(calls).toEqual([{}]);
-    expect(log.statusCode).toBeNull();
-  });
-
-  test("onUnauthorized override", async () => {
-    setFetch(async () => okResponse([]));
-    const seen: Array<{ reason: string; missing: ReadonlyArray<string> }> = [];
-    const sw = Superwall<FakeRequest>({
-      apiKey: "k",
-      userId: (r) => r.session?.userId ?? null,
-    });
-    const { res, log } = makeRes();
-    const { next, calls } = makeNext();
-    await sw.requires("pro", {
-      onUnauthorized: (_req, r, ctx) => {
-        seen.push({ reason: ctx.reason, missing: ctx.missing });
-        r.status(402).json({ paywall: ctx.entitlement });
-      },
-    })({ session: { userId: "u1" } }, res, next);
-    expect(calls).toHaveLength(0);
-    expect(log.statusCode).toBe(402);
-    expect(log.body).toEqual({ paywall: "pro" });
-    expect(seen).toEqual([{ reason: "not_entitled", missing: ["pro"] }]);
-  });
-
-  test("per-route userId override wins", async () => {
-    const observed: { queriedId: string | null } = { queriedId: null };
-    setFetch(async (input) => {
-      const m = urlOf(input).match(/\/users\/([^/]+)\/entitlements/);
-      observed.queriedId = m ? decodeURIComponent(m[1]!) : null;
-      return okResponse([{ id: "pro", isActive: true }]);
-    });
-    const sw = Superwall<FakeRequest>({
-      apiKey: "k",
-      userId: () => "default-user",
-    });
-    const { res } = makeRes();
-    const { next, calls } = makeNext();
-    await sw.requires("pro", {
-      userId: (r) => r.params?.userId ?? null,
-    })({ params: { userId: "explicit-user" } }, res, next);
-    expect(calls).toEqual([{}]);
-    expect(observed.queriedId).toBe("explicit-user");
-  });
-
-  test("network errors pass to next(err)", async () => {
-    setFetch(async () => new Response("oops", { status: 500 }));
-    const sw = Superwall<FakeRequest>({
-      apiKey: "k",
-      userId: () => "u1",
-    });
-    const { res, log } = makeRes();
-    const { next, calls } = makeNext();
-    await sw.requires("pro")({}, res, next);
-    expect(calls).toHaveLength(1);
-    expect(calls[0]?.err).toBeDefined();
-    expect(log.statusCode).toBeNull();
-  });
-
-  test("multiple-AND spec rejects when any missing", async () => {
-    setFetch(async () => okResponse([{ id: "pro", isActive: true }]));
-    const sw = Superwall<FakeRequest>({
-      apiKey: "k",
-      userId: () => "u1",
-    });
-    const { res, log } = makeRes();
-    const { next, calls } = makeNext();
-    await sw.requires(["pro", "team"])({}, res, next);
-    expect(calls).toHaveLength(0);
-    expect(log.statusCode).toBe(403);
-    expect((log.body as { entitlement: string }).entitlement).toBe("team");
-  });
-
-  test("ANY spec passes when one active", async () => {
-    setFetch(async () => okResponse([{ id: "team", isActive: true }]));
-    const sw = Superwall<FakeRequest>({
-      apiKey: "k",
-      userId: () => "u1",
-    });
-    const { res } = makeRes();
-    const { next, calls } = makeNext();
-    await sw.requires({ any: ["pro", "team"] })({}, res, next);
-    expect(calls).toEqual([{}]);
-  });
-
-  test("normalizes spec at registration time (fails loud)", () => {
-    setFetch(async () => okResponse([]));
-    const sw = Superwall<FakeRequest>({
-      apiKey: "k",
-      userId: () => "u1",
-    });
-    expect(() => sw.requires("")).toThrow(TypeError);
-    expect(() => sw.requires([])).toThrow(TypeError);
-  });
-});

package/src/requires.ts

@@ -1,118 +0,0 @@
-import type { Entitlements } from "@superwall/core";
-import { findMissing, normalizeSpec } from "./spec.ts";
-import type {
-  ConnectStyleNext,
-  ConnectStyleResponse,
-  EntitlementSpec,
-  RequestInfo,
-  RequiresOptions,
-  UserIdExtractor,
-} from "./types.ts";
-
-interface RequiresFactoryDeps<TReq> {
-  defaultUserIdExtractor: UserIdExtractor<TReq> | undefined;
-  loadEntitlements: (
-    userId: string,
-  ) => Promise<{ entitlements: Entitlements; cacheHit: boolean }>;
-  emitRequest: (info: RequestInfo) => void;
-}
-
-/**
- * Build the `sw.requires(spec, options?)` factory bound to the instance's
- * cache + extractor + telemetry. Returned middleware is connect-style
- * `(req, res, next)`, duck-typed so it works with Express directly and is
- * trivially adaptable to Hono / Bun.serve / Next via a thin wrapper.
- */
-export const makeRequires = <TReq>(deps: RequiresFactoryDeps<TReq>) => {
-  return (spec: EntitlementSpec, options: RequiresOptions<TReq> = {}) => {
-    // Normalize once at registration time; validation errors surface at
-    // app boot, not at first request.
-    const normalized = normalizeSpec(spec);
-    const extractor = options.userId ?? deps.defaultUserIdExtractor;
-    const allowAnonymous = options.allowAnonymous ?? false;
-
-    return async (
-      req: TReq,
-      res: ConnectStyleResponse,
-      next: ConnectStyleNext,
-    ): Promise<void> => {
-      const start = Date.now();
-      let userId: string | null = null;
-      if (extractor) {
-        const extracted = await extractor(req);
-        if (typeof extracted === "string" && extracted.length > 0) {
-          userId = extracted;
-        }
-      }
-
-      if (!userId) {
-        if (allowAnonymous) {
-          next();
-          return;
-        }
-        await rejectUnauthorized(req, res, options, {
-          userId: null,
-          entitlement: normalized.entitlements[0] ?? "",
-          missing: normalized.entitlements,
-          reason: "no_user_id",
-        });
-        return;
-      }
-
-      let ents: Entitlements;
-      let cacheHit: boolean;
-      try {
-        const loaded = await deps.loadEntitlements(userId);
-        ents = loaded.entitlements;
-        cacheHit = loaded.cacheHit;
-      } catch (err) {
-        // Surfaced to the framework's error handler. Default Express
-        // behavior is a 500; consumers can intercept via their own
-        // error middleware.
-        next(err);
-        return;
-      }
-
-      const missing = findMissing(normalized, ents);
-      deps.emitRequest({
-        userId,
-        entitlements: ents.active.map((e) => e.id),
-        cacheHit,
-        durationMs: Date.now() - start,
-      });
-
-      if (missing.length === 0) {
-        next();
-        return;
-      }
-
-      await rejectUnauthorized(req, res, options, {
-        userId,
-        entitlement: missing[0] ?? normalized.entitlements[0] ?? "",
-        missing,
-        reason: "not_entitled",
-      });
-    };
-  };
-};
-
-const rejectUnauthorized = async <TReq>(
-  req: TReq,
-  res: ConnectStyleResponse,
-  options: RequiresOptions<TReq>,
-  ctx: {
-    userId: string | null;
-    entitlement: string;
-    missing: ReadonlyArray<string>;
-    reason: "no_user_id" | "not_entitled";
-  },
-): Promise<void> => {
-  if (options.onUnauthorized) {
-    await options.onUnauthorized(req, res, ctx);
-    return;
-  }
-  res.status(403).json({
-    error: "entitlement_required",
-    entitlement: ctx.entitlement,
-  });
-};

package/src/spec.test.ts

@@ -1,121 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import type { Entitlement, Entitlements } from "@superwall/core";
-import { findMissing, normalizeSpec } from "./spec.ts";
-
-const ent = (id: string, isActive = true): Entitlement => ({
-  id,
-  type: "SERVICE_LEVEL",
-  isActive,
-  productIds: [],
-});
-
-const ents = (...active: string[]): Entitlements => {
-  const items = active.map((id) => ent(id, true));
-  return { active: items, inactive: [], all: items };
-};
-
-describe("normalizeSpec", () => {
-  test("string", () => {
-    expect(normalizeSpec("pro")).toEqual({ mode: "all", entitlements: ["pro"] });
-  });
-
-  test("array → all", () => {
-    expect(normalizeSpec(["pro", "team"])).toEqual({
-      mode: "all",
-      entitlements: ["pro", "team"],
-    });
-  });
-
-  test("{ all }", () => {
-    expect(normalizeSpec({ all: ["pro", "team"] })).toEqual({
-      mode: "all",
-      entitlements: ["pro", "team"],
-    });
-  });
-
-  test("{ any }", () => {
-    expect(normalizeSpec({ any: ["pro", "team"] })).toEqual({
-      mode: "any",
-      entitlements: ["pro", "team"],
-    });
-  });
-
-  test("rejects empty string", () => {
-    expect(() => normalizeSpec("")).toThrow(TypeError);
-  });
-
-  test("rejects empty array", () => {
-    expect(() => normalizeSpec([])).toThrow(TypeError);
-  });
-
-  test("rejects empty all", () => {
-    expect(() => normalizeSpec({ all: [] })).toThrow(TypeError);
-  });
-
-  test("rejects empty any", () => {
-    expect(() => normalizeSpec({ any: [] })).toThrow(TypeError);
-  });
-
-  test("rejects malformed object", () => {
-    expect(() =>
-      normalizeSpec({ foo: ["pro"] } as unknown as Parameters<typeof normalizeSpec>[0]),
-    ).toThrow(TypeError);
-  });
-});
-
-describe("findMissing (mode: all)", () => {
-  test("returns empty when all entitlements active", () => {
-    const missing = findMissing(
-      { mode: "all", entitlements: ["pro", "team"] },
-      ents("pro", "team"),
-    );
-    expect(missing).toEqual([]);
-  });
-
-  test("returns the missing entitlement", () => {
-    const missing = findMissing(
-      { mode: "all", entitlements: ["pro", "team"] },
-      ents("pro"),
-    );
-    expect(missing).toEqual(["team"]);
-  });
-
-  test("ignores extra active entitlements", () => {
-    const missing = findMissing(
-      { mode: "all", entitlements: ["pro"] },
-      ents("pro", "extra"),
-    );
-    expect(missing).toEqual([]);
-  });
-
-  test("inactive entitlements are not counted", () => {
-    const proInactive: Entitlements = {
-      active: [],
-      inactive: [ent("pro", false)],
-      all: [ent("pro", false)],
-    };
-    const missing = findMissing(
-      { mode: "all", entitlements: ["pro"] },
-      proInactive,
-    );
-    expect(missing).toEqual(["pro"]);
-  });
-});
-
-describe("findMissing (mode: any)", () => {
-  test("returns empty when any one is active", () => {
-    const missing = findMissing(
-      { mode: "any", entitlements: ["pro", "team"] },
-      ents("team"),
-    );
-    expect(missing).toEqual([]);
-  });
-
-  test("returns all listed when none active", () => {
-    const missing = findMissing(
-      { mode: "any", entitlements: ["pro", "team"] },
-      ents("other"),
-    );
-    expect(missing).toEqual(["pro", "team"]);
-  });
-});

package/src/spec.ts

@@ -1,63 +0,0 @@
-import type { Entitlements } from "@superwall/core";
-import type { EntitlementSpec } from "./types.ts";
-
-export interface NormalizedSpec {
-  readonly mode: "all" | "any";
-  readonly entitlements: ReadonlyArray<string>;
-}
-
-/**
- * Normalize any accepted spec shape into `{ mode, entitlements }`.
- * Throws on empty / malformed input — fail loud at config time, not
- * at request time.
- */
-export const normalizeSpec = (spec: EntitlementSpec): NormalizedSpec => {
-  if (typeof spec === "string") {
-    if (spec.length === 0) {
-      throw new TypeError("Entitlement spec cannot be an empty string.");
-    }
-    return { mode: "all", entitlements: [spec] };
-  }
-  if (Array.isArray(spec)) {
-    if (spec.length === 0) {
-      throw new TypeError("Entitlement spec array cannot be empty.");
-    }
-    return { mode: "all", entitlements: spec };
-  }
-  if (typeof spec === "object" && spec !== null) {
-    if ("all" in spec) {
-      if (!Array.isArray(spec.all) || spec.all.length === 0) {
-        throw new TypeError("`{ all: [...] }` must be a non-empty string array.");
-      }
-      return { mode: "all", entitlements: spec.all };
-    }
-    if ("any" in spec) {
-      if (!Array.isArray(spec.any) || spec.any.length === 0) {
-        throw new TypeError("`{ any: [...] }` must be a non-empty string array.");
-      }
-      return { mode: "any", entitlements: spec.any };
-    }
-  }
-  throw new TypeError(
-    `Unrecognized entitlement spec: ${JSON.stringify(spec)}. Expected string, string[], { all: string[] }, or { any: string[] }.`,
-  );
-};
-
-/**
- * Returns the entitlement IDs from `spec` that are NOT active on `ents`.
- * If `mode === "all"`, this is the set of unmet entitlements. If
- * `mode === "any"`, returns empty when at least one is met, otherwise
- * returns all listed entitlements (none satisfied).
- */
-export const findMissing = (
-  spec: NormalizedSpec,
-  ents: Entitlements,
-): ReadonlyArray<string> => {
-  const activeIds = new Set(ents.active.map((e) => e.id));
-  if (spec.mode === "all") {
-    return spec.entitlements.filter((id) => !activeIds.has(id));
-  }
-  // any
-  const anyMet = spec.entitlements.some((id) => activeIds.has(id));
-  return anyMet ? [] : spec.entitlements;
-};

package/src/superwall.test.ts

@@ -1,151 +0,0 @@
-import { afterEach, describe, expect, test } from "bun:test";
-import { Superwall } from "./superwall.ts";
-import type { FetchLike } from "./types.ts";
-
-const realFetch = globalThis.fetch;
-const setFetch = (impl: FetchLike): void => {
-  (globalThis as unknown as { fetch: FetchLike }).fetch = impl;
-};
-
-const okResponse = (
-  entitlements: Array<{ id: string; isActive: boolean }>,
-): Response =>
-  new Response(JSON.stringify({ entitlements }), {
-    status: 200,
-    headers: { "content-type": "application/json" },
-  });
-
-afterEach(() => {
-  (globalThis as unknown as { fetch: typeof realFetch }).fetch = realFetch;
-});
-
-describe("Superwall() factory", () => {
-  test("rejects missing apiKey", () => {
-    expect(() => Superwall({ apiKey: "" })).toThrow(TypeError);
-  });
-
-  test("getEntitlements returns parsed bucket", async () => {
-    setFetch(async () =>
-      okResponse([
-        { id: "pro", isActive: true },
-        { id: "team", isActive: false },
-      ]),
-    );
-    const sw = Superwall({ apiKey: "k" });
-    const ents = await sw.getEntitlements("u1");
-    expect(ents.active.map((e) => e.id)).toEqual(["pro"]);
-    expect(ents.inactive.map((e) => e.id)).toEqual(["team"]);
-  });
-
-  test("userHas (string) returns true when entitlement is active", async () => {
-    setFetch(async () => okResponse([{ id: "pro", isActive: true }]));
-    const sw = Superwall({ apiKey: "k" });
-    expect(await sw.userHas("u", "pro")).toBe(true);
-  });
-
-  test("userHas (string) returns false when entitlement is inactive", async () => {
-    setFetch(async () => okResponse([{ id: "pro", isActive: false }]));
-    const sw = Superwall({ apiKey: "k" });
-    expect(await sw.userHas("u", "pro")).toBe(false);
-  });
-
-  test("userHas (array) requires all", async () => {
-    setFetch(async () =>
-      okResponse([
-        { id: "pro", isActive: true },
-        { id: "team", isActive: true },
-      ]),
-    );
-    const sw = Superwall({ apiKey: "k" });
-    expect(await sw.userHas("u", ["pro", "team"])).toBe(true);
-    expect(await sw.userHas("u", ["pro", "missing"])).toBe(false);
-  });
-
-  test("userHas ({ any }) returns true when any active", async () => {
-    setFetch(async () => okResponse([{ id: "team", isActive: true }]));
-    const sw = Superwall({ apiKey: "k" });
-    expect(await sw.userHas("u", { any: ["pro", "team"] })).toBe(true);
-  });
-
-  test("caches subsequent reads for the same userId", async () => {
-    let calls = 0;
-    setFetch(async () => {
-      calls++;
-      return okResponse([{ id: "pro", isActive: true }]);
-    });
-    const sw = Superwall({ apiKey: "k" });
-    await sw.getEntitlements("u1");
-    await sw.getEntitlements("u1");
-    await sw.userHas("u1", "pro");
-    expect(calls).toBe(1);
-  });
-
-  test("invalidate forces a refetch", async () => {
-    let calls = 0;
-    setFetch(async () => {
-      calls++;
-      return okResponse([{ id: "pro", isActive: true }]);
-    });
-    const sw = Superwall({ apiKey: "k" });
-    await sw.getEntitlements("u1");
-    await sw.invalidate("u1");
-    await sw.getEntitlements("u1");
-    expect(calls).toBe(2);
-  });
-
-  test("invalidateAll clears every entry", async () => {
-    let calls = 0;
-    setFetch(async () => {
-      calls++;
-      return okResponse([{ id: "pro", isActive: true }]);
-    });
-    const sw = Superwall({ apiKey: "k" });
-    await sw.getEntitlements("a");
-    await sw.getEntitlements("b");
-    await sw.invalidateAll();
-    await sw.getEntitlements("a");
-    await sw.getEntitlements("b");
-    expect(calls).toBe(4);
-  });
-
-  test("TTL expiry forces a refetch", async () => {
-    let calls = 0;
-    setFetch(async () => {
-      calls++;
-      return okResponse([{ id: "pro", isActive: true }]);
-    });
-    const sw = Superwall({ apiKey: "k", cache: { ttlMs: 1 } });
-    await sw.getEntitlements("u1");
-    await new Promise((r) => setTimeout(r, 5));
-    await sw.getEntitlements("u1");
-    expect(calls).toBe(2);
-  });
-
-  test("onRequest fires with cache hit info", async () => {
-    const calls: Array<{ cacheHit: boolean; userId: string }> = [];
-    setFetch(async () => okResponse([{ id: "pro", isActive: true }]));
-    const sw = Superwall({
-      apiKey: "k",
-      onRequest: (info) =>
-        calls.push({ cacheHit: info.cacheHit, userId: info.userId }),
-    });
-    await sw.getEntitlements("u1");
-    await sw.getEntitlements("u1");
-    expect(calls).toEqual([
-      { cacheHit: false, userId: "u1" },
-      { cacheHit: true, userId: "u1" },
-    ]);
-  });
-
-  test("onRequest throwing does not break the request", async () => {
-    setFetch(async () => okResponse([{ id: "pro", isActive: true }]));
-    const sw = Superwall({
-      apiKey: "k",
-      onRequest: () => {
-        throw new Error("boom");
-      },
-    });
-    const ents = await sw.getEntitlements("u1");
-    expect(ents.active).toHaveLength(1);
-  });
-});