@mpgd/capacitor-storekit 0.3.5 → 0.3.7

package/README.md

@@ -54,11 +54,15 @@ over `getProducts` (subscription lookups are empty without a native call);
 a non-UUID one with `STOREKIT_CONFIGURATION_ERROR`, and the store never
 opens), answering `purchased` with the transaction, `launched` for a pending
 Ask to Buy, and `cancelled` for a dismissed sheet; `getAvailablePurchases`
-over `getTransactions`, listing unfinished transactions once (a current
-non-consumable entitlement the native side marks `unfinished: false` is not
-listed, a `revokedAt` maps to `state: 'revoked'`, and one malformed
+over `getTransactions`, listing unfinished transactions and finished durables
+once (a current non-consumable entitlement the native side marks
+`unfinished: false` stays listed so a finish that raced the ledger grant can
+still be verified; the server ledger dedupes. A finished consumable is not
+listed. A `revokedAt` maps to `state: 'revoked'`, and one malformed
 transaction is reported as a `purchaseError` without blocking its siblings);
-`finishTransaction({ transactionId, ledgerEntryId })` over the native finish;
+`finishTransaction({ transactionId, ledgerEntryId })` resolves the session
+app account token and finishes only a listed, non-revoked transaction bound
+to that token;
 `restorePurchases` over `sync`; `transactionUpdated` as `purchaseUpdated`;
 and an availability probe as `getAvailability`, probing the configured
 SKUs batch by batch until one is sold. Every purchase carries the
@@ -161,12 +165,17 @@ Call the reconciler (`monetizationRecovery.reconcile()` from
 `@mpgd/game-services`) on startup, on resume, and after the iOS plugin emits
 `transactionUpdated` for a delayed transaction (Ask to Buy, an interrupted
 checkout, a transaction finished on another device): the events can be missed
-while the game is closed, so `getAvailablePurchases` (`Transaction.unfinished`)
-is the source of truth. The reconciler sends only transactions whose
+while the game is closed, so `getAvailablePurchases` (`Transaction.unfinished`,
+plus finished non-consumables still in `currentEntitlements`) is the source
+of truth. The reconciler sends only transactions whose
 `appAccountToken` matches the current authenticated game account, verifies
 each one on the backend under its original idempotency key or returns the
 existing ledger grant, and calls `finishTransaction` only after a verified
-response with a ledger entry id. Permanently rejected and account-mismatched
+response with a ledger entry id. The StoreKit SDK and the native plugin both
+refuse to finish a transaction whose app account token is missing or does
+not match that session. A caller who can read the token from the plugin can
+still present it with a forged ledger entry id; that remaining hole needs a
+signed server finish capability. Permanently rejected and account-mismatched
 transactions are not finished: the client cannot prove content delivery for
 them, so persist that terminal result in the game-owned operation journal and
 do not run an automatic retry loop for it. An unknown backend result stays

package/dist/definitions.d.ts

@@ -20,8 +20,9 @@ export interface StoreKitTransaction {
   /**
   * Present on `getTransactions` results: true for `Transaction.unfinished`
   * entries, false for current non-consumable entitlements that are already
-  * finished. Omitted by native builds predating the field and by
-  * `purchase` and `transactionUpdated` payloads.
+  * finished. The SDK lists `unfinished: false` durables so a finish that
+  * raced the ledger grant can still be verified. Omitted by native builds
+  * predating the field and by `purchase` and `transactionUpdated` payloads.
   */
   readonly unfinished?: boolean;
 }
@@ -51,17 +52,19 @@ export interface CapacitorStoreKitPlugin {
   }>;
   /**
   * Call only after the authenticated backend confirms the ledger grant.
-  * Native validation is intentionally shallow and finishing never grants
-  * anything. The commerce provider's `finishTransaction` is the only caller:
-  * the reconciler in `@mpgd/game-services` reaches it through
-  * `assertCommerceFinishAllowed` after the ledger grant, so games must not
-  * call this plugin method directly. That gate is not a trust boundary
-  * against code that controls the backend object given to the reconciler:
-  * the authenticated server-side verification is the real control.
+  * Finishing never grants. Native finishes only a verified, non-revoked,
+  * one-time transaction whose app account token matches `appAccountToken`.
+  * The StoreKit SDK injects the session token and applies the same match
+  * before this call, including for `commerce.v2.finishTransaction`. Games
+  * must not call this plugin method directly. The token match is not a
+  * signed server capability: a caller who can read `getTransactions` can
+  * still supply that token with a forged ledger entry id.
   */
   finishTransaction(input: {
     readonly transactionId: string;
     readonly ledgerEntryId: string;
+    /** Session app account token; must match the verified transaction. */
+    readonly appAccountToken: string;
   }): Promise<{
     readonly finished: boolean;
   }>;

package/dist/store-sdk.js

@@ -244,6 +244,21 @@ export function createCapacitorStoreKitStoreSdk(input) {
     // Overlapping finishes for the same transaction and ledger entry share one
     // native call; the v2 reconciler is the gate that authorizes the call.
     const inFlightFinishes = new Map();
+    /**
+     * Mirrors the native finish gate: the transaction must be listed, not
+     * revoked, and bound to the session app account token. A missing list is
+     * an invalid response, not a quiet "not finished".
+     */
+    const finishPermitted = async (transactionId, appAccountToken) => {
+        const response = await sdk.getTransactions();
+        if (!isRecord(response) || !Array.isArray(response.transactions)) {
+            throw evidenceInvalid('StoreKit returned an invalid transaction list.');
+        }
+        const transaction = response.transactions.find((candidate) => isValidStoreKitTransaction(candidate) && candidate.transactionId === transactionId);
+        return transaction !== undefined
+            && transaction.revokedAt === undefined
+            && transaction.appAccountToken?.toLowerCase() === appAccountToken;
+    };
     return {
         store: appStoreStoreId,
         capabilities: storeKitStoreSdkCapabilities,
@@ -313,10 +328,16 @@ export function createCapacitorStoreKitStoreSdk(input) {
                     malformed(transaction);
                     continue;
                 }
-                // Available means unfinished: a current entitlement the native side
-                // marks finished is not listed. A build without the flag lists every
-                // transaction, which the backend answers idempotently.
-                if (transaction.unfinished === false || seen.has(transaction.transactionId)) {
+                // A finished durable stays in currentEntitlements with
+                // `unfinished: false`. Listing it lets the reconciler verify a finish
+                // that raced the ledger grant; the server ledger dedupes. A finished
+                // consumable is not an entitlement and is not listed. A build that
+                // omits the flag lists every transaction, which the backend answers
+                // idempotently.
+                if (seen.has(transaction.transactionId)) {
+                    continue;
+                }
+                if (transaction.unfinished === false && transaction.type !== 'non_consumable') {
                     continue;
                 }
                 seen.add(transaction.transactionId);
@@ -328,6 +349,9 @@ export function createCapacitorStoreKitStoreSdk(input) {
         },
         async finishTransaction(request) {
             requireIos();
+            // The session token is the binding. A bridge or plugin caller cannot
+            // substitute another account's token on this path.
+            const appAccountToken = await Promise.resolve(resolveAppAccountToken());
             const { transactionId, ledgerEntryId } = request;
             if (typeof transactionId !== 'string' || !transactionPattern.test(transactionId)
                 || typeof ledgerEntryId !== 'string' || ledgerEntryId.trim() === '') {
@@ -338,7 +362,16 @@ export function createCapacitorStoreKitStoreSdk(input) {
                 return active.promise;
             }
             const promise = (async () => {
-                const reported = await sdk.finishTransaction({ transactionId, ledgerEntryId });
+                // Same match the native plugin applies: missing, revoked, unbound, or
+                // another account never reaches `transaction.finish()`.
+                if (!(await finishPermitted(transactionId, appAccountToken))) {
+                    return { finished: false };
+                }
+                const reported = await sdk.finishTransaction({
+                    transactionId,
+                    ledgerEntryId,
+                    appAccountToken,
+                });
                 if (!isRecord(reported) || typeof reported.finished !== 'boolean') {
                     throw evidenceInvalid('StoreKit returned an invalid finish result.');
                 }

package/ios/Sources/CapacitorStoreKit/CapacitorStoreKitPlugin.swift

@@ -120,8 +120,10 @@ public class CapacitorStoreKitPlugin: CAPPlugin, CAPBridgedPlugin {
                     byId[id] = payload
                 }
             }
-            // Current non-consumable entitlements are listed too;
-            // `unfinished: false` lets the commerce SDK exclude them.
+            // Current non-consumable entitlements are listed too.
+            // `unfinished: false` means StoreKit already finished them; the SDK
+            // still lists those durables so a finish that raced the ledger
+            // grant can be verified. The server ledger dedupes.
             for await result in Transaction.currentEntitlements {
                 if var payload = Self.verifiedPayload(result),
                    payload["type"] as? String == "non_consumable",
@@ -147,19 +149,34 @@ public class CapacitorStoreKitPlugin: CAPPlugin, CAPBridgedPlugin {
     }
 
     @objc func finishTransaction(_ call: CAPPluginCall) {
+        // The ledger id is still a client string. The token match is the local
+        // gate: finish only a verified, non-revoked, one-time transaction whose
+        // app account token equals the one the caller supplies. The StoreKit
+        // SDK supplies the session token and applies the same match before
+        // calling. A signed server finish capability is still required to stop
+        // a webview caller who read the token from `getTransactions`.
         guard let rawId = call.getString("transactionId"), let id = UInt64(rawId),
               let ledgerEntryId = call.getString("ledgerEntryId"),
-              !ledgerEntryId.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty else {
-            call.reject("A transaction ID and confirmed ledger entry are required.",
-                        "STOREKIT_FINISH_REQUIRES_GRANT")
+              !ledgerEntryId.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty,
+              let rawAccountToken = call.getString("appAccountToken"),
+              let accountToken = UUID(uuidString: rawAccountToken),
+              accountToken.uuidString.lowercased()
+                != "00000000-0000-0000-0000-000000000000" else {
+            call.reject(
+                "A transaction ID, confirmed ledger entry, and app account token are required.",
+                "STOREKIT_FINISH_REQUIRES_GRANT"
+            )
             return
         }
+        let expectedToken = accountToken.uuidString.lowercased()
         Task {
             for await result in Transaction.all {
                 guard case .verified(let transaction) = result,
                       transaction.id == id,
                       transaction.revocationDate == nil,
-                      Self.oneTimeType(transaction.productType) != nil else { continue }
+                      Self.oneTimeType(transaction.productType) != nil,
+                      transaction.appAccountToken?.uuidString.lowercased() == expectedToken
+                else { continue }
                 await transaction.finish()
                 call.resolve(["finished": true])
                 return

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/capacitor-storekit",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "description": "Opt-in StoreKit 2 one-time purchase collector and commerce v2 provider for mpgd Capacitor games.",
   "license": "MIT",
   "repository": {
@@ -39,17 +39,17 @@
   "peerDependencies": {
     "@capacitor/core": "^8.5.1",
     "@mpgd/adapter-capacitor": "^0.12.0",
-    "@mpgd/bridge": "^0.14.0",
+    "@mpgd/bridge": "^0.15.0",
     "@mpgd/platform": "^0.27.0"
   },
   "devDependencies": {
     "@capacitor/core": "8.5.2",
     "ttsc": "0.32.1",
     "typescript": "7.0.2",
-    "@mpgd/adapter-capacitor": "0.12.1",
-    "@mpgd/bridge": "0.14.2",
-    "@mpgd/platform": "0.27.0",
-    "@mpgd/game-services": "0.27.0"
+    "@mpgd/game-services": "0.27.2",
+    "@mpgd/platform": "0.27.2",
+    "@mpgd/adapter-capacitor": "0.12.3",
+    "@mpgd/bridge": "0.15.0"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",