Closer/functions/dist/billing/revenueCatWebhook.js

"use strict";
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    var desc = Object.getOwnPropertyDescriptor(m, k);
    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
      desc = { enumerable: true, get: function() { return m[k]; } };
    }
    Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
    Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
    o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
    var ownKeys = function(o) {
        ownKeys = Object.getOwnPropertyNames || function (o) {
            var ar = [];
            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
            return ar;
        };
        return ownKeys(o);
    };
    return function (mod) {
        if (mod && mod.__esModule) return mod;
        var result = {};
        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
        __setModuleDefault(result, mod);
        return result;
    };
})();
Object.defineProperty(exports, "__esModule", { value: true });
exports.revenueCatWebhook = void 0;
const crypto = __importStar(require("crypto"));
const functions = __importStar(require("firebase-functions"));
const entitlementLogic_1 = require("./entitlementLogic");
/**
 * RevenueCat webhook handler.
 *
 * Path: POST /revenueCatWebhook (registered as an HTTPS function)
 * Triggered by RevenueCat server-to-server events.
 *
 * Authentication:
 * - Verifies the Ed25519 signature in the X-Signature request header.
 * - REVENUECAT_SIGNING_KEY must be set to the base64-encoded DER/SPKI Ed25519
 *   public key from your RevenueCat project dashboard.
 * - Missing key → 500 (our config error). Invalid/absent signature → 401.
 *
 * Processing:
 * - Parses the RevenueCat event payload.
 * - Writes entitlement state to Firestore at users/{userId}/entitlements.
 */
exports.revenueCatWebhook = functions.https.onRequest(async (req, res) => {
    var _a;
    if (req.method !== 'POST') {
        res.status(405).json({ error: 'method_not_allowed' });
        return;
    }
    try {
        verifySignature(req);
    }
    catch (err) {
        if (err instanceof ConfigError) {
            console.error('[revenueCatWebhook] configuration error:', err.message);
            res.status(500).json({ error: 'internal_error' });
            return;
        }
        res.status(401).json({ error: 'unauthorized' });
        return;
    }
    const event = (_a = req.body) === null || _a === void 0 ? void 0 : _a.event;
    if (!event || !event.type || !event.app_user_id) {
        res.status(400).json({ error: 'malformed_payload' });
        return;
    }
    // Security review Batch 2: process BEFORE acking. Previously we returned 200 up front
    // and only logged failures, so a failed entitlement sync was silently dropped (no retry).
    // RevenueCat retries on non-2xx, and applyEntitlementEvent is idempotent (it sets state),
    // so returning 500 on failure recovers the event safely.
    try {
        await (0, entitlementLogic_1.applyEntitlementEvent)(event);
    }
    catch (err) {
        console.error('[revenueCatWebhook] entitlement sync failed:', err);
        res.status(500).json({ error: 'processing_failed' });
        return;
    }
    res.status(200).json({ received: true });
});
class ConfigError extends Error {
}
class AuthError extends Error {
}
/**
 * Verifies the Ed25519 signature RevenueCat sends in the X-Signature header.
 *
 * Throws ConfigError when REVENUECAT_SIGNING_KEY is absent or malformed —
 * these are deployment problems, not auth failures.
 * Throws AuthError for any missing or invalid signature — these are 401s.
 */
function verifySignature(req) {
    const signingKey = process.env.REVENUECAT_SIGNING_KEY;
    if (!signingKey) {
        throw new ConfigError('REVENUECAT_SIGNING_KEY environment variable is not set');
    }
    // Firebase Functions expose the raw request body as req.rawBody (Buffer).
    const rawBody = req.rawBody;
    if (!rawBody || rawBody.length === 0) {
        throw new AuthError('request body missing');
    }
    const sigHeader = req.headers['x-signature'];
    const signature = Array.isArray(sigHeader) ? sigHeader[0] : sigHeader;
    if (!signature) {
        throw new AuthError('x-signature header missing');
    }
    let publicKey;
    try {
        publicKey = crypto.createPublicKey({
            key: Buffer.from(signingKey, 'base64'),
            format: 'der',
            type: 'spki',
        });
    }
    catch (_a) {
        throw new ConfigError('REVENUECAT_SIGNING_KEY is malformed — expected base64-encoded DER/SPKI Ed25519 public key');
    }
    let sigBuffer;
    try {
        sigBuffer = Buffer.from(signature, 'base64');
    }
    catch (_b) {
        throw new AuthError('x-signature is not valid base64');
    }
    let valid;
    try {
        valid = crypto.verify(null, rawBody, publicKey, sigBuffer);
    }
    catch (_c) {
        throw new AuthError('signature verification failed');
    }
    if (!valid) {
        throw new AuthError('signature mismatch');
    }
}
//# sourceMappingURL=revenueCatWebhook.js.map