backend-manager 5.0.181 → 5.0.183

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/TODO-2.md +4 -0
  2. package/_zombie-sub-guard-wip/GAP.md +25 -0
  3. package/package.json +1 -1
  4. package/src/cli/commands/setup-tests/hosting-rewrites.js +1 -1
  5. package/src/manager/index.js +9 -0
  6. package/src/mcp/handler.js +6 -6
package/TODO-2.md CHANGED
@@ -10,6 +10,10 @@ payments/reactivate
10
10
  payments/upgrade
11
11
  * takes a subscription id and a new plan id and upgrades the user's subscription to the new plan. this can only be done if the user has an active subscription.
12
12
 
13
+ ---
14
+ GHOSTII REVAMP
15
+ * better logic for generating posts. better model? claude?
16
+
13
17
  -------
14
18
  UPSELL
15
19
  * products in BEM can have an UPSELL where you link another product ID and it allows you to add it to your cart OR shows you after checkout?
package/_zombie-sub-guard-wip/GAP.md ADDED
@@ -0,0 +1,25 @@
1
+ ## BEM Gap: Webhook overwrites user doc with stale subscription data
2
+
3
+ ### Problem
4
+ When a non-current subscription is cancelled on the provider (e.g. cancelling a zombie/duplicate PayPal sub), the provider fires a cancellation webhook. BEM processes it, finds the user by UID, and overwrites `subscription.*` on the user doc with the cancelled sub's data — even though the user has a different, active subscription.
5
+
6
+ ### Example
7
+ - User has active Chargebee sub (current) + old suspended PayPal sub (zombie)
8
+ - We cancel the PayPal sub → PayPal fires `BILLING.SUBSCRIPTION.CANCELLED`
9
+ - BEM finds user by UID → sets `subscription.status = 'cancelled'`, `subscription.payment.resourceId = <old PayPal sub>`
10
+ - User is now broken — their active Chargebee sub is invisible
11
+
12
+ ### Fix needed in `on-write.js`
13
+ Before writing the unified subscription data to the user doc, check:
14
+ ```
15
+ if (user.subscription.payment.resourceId !== webhook.resourceId) {
16
+ // This webhook is for a DIFFERENT subscription than the user's current one.
17
+ // Update the payments-orders doc only. Do NOT touch the user doc.
18
+ }
19
+ ```
20
+
21
+ ### Affected file
22
+ `backend-manager/src/manager/events/firestore/payments-webhooks/on-write.js` — the section that writes to `users/{uid}`
23
+
24
+ ### Impact
25
+ Without this fix, any cancellation/suspension of a non-current subscription (duplicate cleanup, provider-side cancellation of old subs) will corrupt the user doc. Currently requires manual restoration after each occurrence.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "backend-manager",
3
- "version": "5.0.181",
3
+ "version": "5.0.183",
4
4
  "description": "Quick tools for developing Firebase functions",
5
5
  "main": "src/manager/index.js",
6
6
  "bin": {
package/src/cli/commands/setup-tests/hosting-rewrites.js CHANGED
@@ -5,7 +5,7 @@ const _ = require('lodash');
5
5
  // The expected source pattern for bm_api hosting rewrite
6
6
  // Includes /backend-manager/* routes and root-level MCP OAuth paths
7
7
  // that Claude Chat sends directly (e.g. /authorize, /token, /.well-known/*)
8
- const BM_API_SOURCE = '{/backend-manager,/backend-manager/**,/.well-known/oauth-protected-resource,/.well-known/oauth-authorization-server}';
8
+ const BM_API_SOURCE = '{/backend-manager,/backend-manager/**,/.well-known/oauth-protected-resource,/.well-known/oauth-authorization-server,/authorize,/token}';
9
9
 
10
10
  class HostingRewritesTest extends BaseTest {
11
11
  getName() {
package/src/manager/index.js CHANGED
@@ -1218,6 +1218,15 @@ function resolveMcpRoutePath(routePath) {
1218
1218
  return routePath;
1219
1219
  }
1220
1220
 
1221
+ // Root-level OAuth paths — Claude Chat sends these directly
1222
+ // regardless of what the discovery endpoints return
1223
+ if (routePath === 'authorize') {
1224
+ return 'mcp/authorize';
1225
+ }
1226
+ if (routePath === 'token') {
1227
+ return 'mcp/token';
1228
+ }
1229
+
1221
1230
  return null;
1222
1231
  }
1223
1232
 
package/src/mcp/handler.js CHANGED
@@ -93,7 +93,7 @@ function handleAuthorize(req, res, options) {
93
93
  const Manager = options.Manager;
94
94
 
95
95
  // Auto-approve if client_id matches the BEM key
96
- if (isValidKey(client_id, Manager) && redirect_uri) {
96
+ if (isValidKey(client_id) && redirect_uri) {
97
97
  const url = new URL(redirect_uri);
98
98
  url.searchParams.set('code', client_id);
99
99
  if (state) {
@@ -151,7 +151,7 @@ function handleAuthorize(req, res, options) {
151
151
  const redirectUri = body.redirect_uri || '';
152
152
  const postState = body.state || '';
153
153
 
154
- if (!isValidKey(key, Manager)) {
154
+ if (!isValidKey(key)) {
155
155
  res.writeHead(403, { 'Content-Type': 'text/html' });
156
156
  res.end('<html><body style="background:#111;color:#e55;font-family:sans-serif;display:flex;align-items:center;justify-content:center;height:100vh"><h2>Invalid key. Go back and try again.</h2></body></html>');
157
157
  return;
@@ -188,7 +188,7 @@ function handleToken(req, res, options) {
188
188
  const Manager = options.Manager;
189
189
 
190
190
  // The code, client_secret, or client_id IS the backendManagerKey — validate any
191
- if (!isValidKey(code, Manager)) {
191
+ if (!isValidKey(code)) {
192
192
  return sendJson(res, 401, {
193
193
  error: 'invalid_grant',
194
194
  error_description: 'Invalid authorization code.',
@@ -213,7 +213,7 @@ async function handleMcpProtocol(req, res, options) {
213
213
  const authHeader = req.headers.authorization || '';
214
214
  const key = authHeader.replace(/^Bearer\s+/i, '');
215
215
 
216
- if (!isValidKey(key, Manager)) {
216
+ if (!isValidKey(key)) {
217
217
  // Return 401 with OAuth discovery hint
218
218
  const protocol = req.headers['x-forwarded-proto'] || req.protocol || 'https';
219
219
  const host = req.headers['x-forwarded-host'] || req.headers.host || '';
@@ -321,8 +321,8 @@ async function handleMcpProtocol(req, res, options) {
321
321
  * Validate a key against the configured backendManagerKey.
322
322
  * Returns false if either the key or the config key is empty/missing.
323
323
  */
324
- function isValidKey(key, Manager) {
325
- const configKey = Manager.config?.backendManagerKey;
324
+ function isValidKey(key) {
325
+ const configKey = process.env.BACKEND_MANAGER_KEY || '';
326
326
  return !!key && !!configKey && key === configKey;
327
327
  }
328
328