backend-manager 5.0.117 → 5.0.119

package/CHANGELOG.md

@@ -14,6 +14,34 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `Fixed` for any bug fixes.
 - `Security` in case of vulnerabilities.
 
+# [5.0.119] - 2026-03-07
+### Added
+- `POST /marketing/email-preferences` route for unsubscribe/resubscribe via SendGrid ASM suppression groups
+- HMAC signature verification (`UNSUBSCRIBE_HMAC_KEY`) on unsubscribe links to prevent forged requests
+- HMAC signature generation in email library when building unsubscribe URLs
+- `UNSUBSCRIBE_HMAC_KEY` environment variable in template `.env`
+- Test suite for email-preferences endpoint (10 tests covering sig verification, validation, auth)
+
+### Changed
+- Unsubscribe URL in emails no longer includes `appName` and `appUrl` params (replaced by HMAC sig)
+
+# [5.0.118] - 2026-03-06
+### Added
+- Chargebee payment processor with full pipeline support (intent, webhook, cancel, refund, portal).
+- Chargebee shared library (`payment/processors/chargebee.js`) with raw HTTP API wrapper, unified subscription/one-time transformers, and both Items model (new) and Plans model (legacy) product resolution.
+- Chargebee webhook processor supporting subscription lifecycle events (`subscription_created`, `subscription_cancelled`, `subscription_renewed`, `payment_failed`, `payment_refunded`, etc.) and one-time invoice events.
+- Chargebee intent processor for hosted page checkout (subscriptions and one-time purchases) with deterministic item price IDs (`{itemId}-{frequency}`).
+- Chargebee cancel processor with immediate cancellation during trials and end-of-term cancellation otherwise.
+- Chargebee refund processor with 7-day full/prorated refund logic (matching Stripe/PayPal behavior).
+- Chargebee portal processor for self-service subscription management via Chargebee Portal Sessions.
+- Backwards compatibility for legacy Chargebee subscriptions: reads `cf_clientorderid`/`cf_uid` custom fields alongside new `meta_data` JSON format.
+- Chargebee test suite: `to-unified-subscription`, `to-unified-one-time`, and `parse-webhook` group tests with fixtures covering all status mappings, product resolution (Items + legacy Plans), and edge cases.
+- Chargebee customer name extraction from `shipping_address`/`billing_address` in webhook on-write pipeline.
+- `chargebee` config keys in product templates (`itemId`, `legacyPlanIds`).
+
+### Changed
+- `CHARGEBEE_SITE` environment variable is now set from config in Manager init (matching PayPal pattern), so the Chargebee library doesn't need a Manager reference.
+
 # [5.0.111] - 2026-03-05
 ### Changed
 - PayPal client ID is now read from `backend-manager-config.json` (`payment.processors.paypal.clientId`) instead of requiring a `PAYPAL_CLIENT_ID` environment variable.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-manager",
-  "version": "5.0.117",
+  "version": "5.0.119",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
   "bin": {

package/src/manager/events/firestore/payments-webhooks/on-write.js

@@ -321,7 +321,17 @@ function extractCustomerName(resource, resourceType) {
     }
   }
 
-  // Subscriptions only have customer ID, no name
+  // Chargebee subscriptions carry shipping_address / billing_address with first_name + last_name
+  if (resourceType === 'subscription') {
+    const addr = resource.shipping_address || resource.billing_address;
+    if (addr?.first_name) {
+      const { capitalize } = require('../../../libraries/infer-contact.js');
+      return {
+        first: capitalize(addr.first_name) || null,
+        last: capitalize(addr.last_name) || null,
+      };
+    }
+  }
 
   if (!fullName) {
     return null;

package/src/manager/index.js

@@ -141,6 +141,9 @@ Manager.prototype.init = function (exporter, options) {
   // Set PAYPAL_CLIENT_ID from config (clientId is public, not a secret — lives in config, not .env)
   process.env.PAYPAL_CLIENT_ID = process.env.PAYPAL_CLIENT_ID || self.config?.payment?.processors?.paypal?.clientId || '';
 
+  // Set CHARGEBEE_SITE from config (site is public, not a secret — lives in config, not .env)
+  process.env.CHARGEBEE_SITE = process.env.CHARGEBEE_SITE || self.config?.payment?.processors?.chargebee?.site || '';
+
   // Resolve legacy paths
   // TODO: Remove this in future versions (after we migrate to removing app.id from config)
   self.config.app = self.config.app || {};

package/src/manager/libraries/email.js

@@ -161,7 +161,11 @@ Email.prototype.build = async function (settings) {
   const sendAt = normalizeSendAt(settings.sendAt);
 
   // Build unsubscribe URL
-  const unsubscribeUrl = `${Manager.project.websiteUrl}/portal/account/email-preferences?email=${encode(to[0].email)}&asmId=${encode(groupId)}&templateId=${encode(templateId)}&appName=${brandData.name}&appUrl=${brandData.url}`;
+  // Generate HMAC signature for unsubscribe link verification
+  const crypto = require('crypto');
+  const unsubSig = crypto.createHmac('sha256', process.env.UNSUBSCRIBE_HMAC_KEY).update(to[0].email.toLowerCase()).digest('hex');
+
+  const unsubscribeUrl = `${Manager.project.websiteUrl}/portal/email-preferences?email=${encode(to[0].email)}&asmId=${encode(groupId)}&templateId=${encode(templateId)}&sig=${unsubSig}`;
 
   // Build signoff
   const signoff = settings?.data?.signoff || {};