@mpgd/game-services 0.31.0 → 0.33.0

package/dist/app-store-verifier.js

@@ -1,3 +1,4 @@
+import { createAppStoreGrantVerificationId, createAppStoreVerificationId, encodeVerificationIdSegment, } from './app-store-verification-id.js';
 export const appStoreServerApiBaseUrls = Object.freeze({
     Production: 'https://api.storekit.apple.com',
     Sandbox: 'https://api.storekit-sandbox.apple.com',
@@ -16,6 +17,42 @@ class AppStoreResponseTooLargeError extends Error {
         this.name = 'AppStoreResponseTooLargeError';
     }
 }
+/**
+ * A process-local `AppStoreRevocationRegistry` for tests and single-process
+ * hosts. It forgets everything on restart and is not shared between
+ * instances (a Worker isolate is one), so a deployment that verifies
+ * purchases offline needs a durable registry of its own.
+ */
+export function createInMemoryAppStoreRevocationRegistry() {
+    const records = new Map();
+    return {
+        async findRevocation(input) {
+            return records.get(input.verificationId);
+        },
+        async recordRevocation(input) {
+            assertNonEmptyString(input.record.verificationId, 'record.verificationId');
+            const kept = records.get(input.record.verificationId);
+            if (kept !== undefined && !isLaterRevocation(input.record, kept)) {
+                return { alreadyRecorded: true };
+            }
+            records.set(input.record.verificationId, { ...input.record });
+            return { alreadyRecorded: false };
+        },
+    };
+}
+/**
+ * Whether `record` revokes later than `kept`, the order a registry keeps
+ * records in. An unparseable `revokedAt` is the latest (it refuses every
+ * JWS), and one unparseable record never replaces another.
+ */
+function isLaterRevocation(record, kept) {
+    const recordMs = Date.parse(record.revokedAt);
+    const keptMs = Date.parse(kept.revokedAt);
+    if (!Number.isFinite(keptMs)) {
+        return false;
+    }
+    return !Number.isFinite(recordMs) || recordMs > keptMs;
+}
 /**
  * Evidence schema of a commerce v2 App Store purchase (RFC B3): the payload's
  * `signedTransaction` is the StoreKit-verified JWS the client received. The
@@ -158,9 +195,9 @@ async function verifyAppStorePurchase(input, options, now, clockSkewMs) {
     // Commerce v2 evidence carries the client's StoreKit-verified JWS. Its
     // signature establishes authenticity and binds the transaction id; the
     // grant decision is then taken on the transaction's current status from
-    // the Server API (default), or on the JWS alone within a freshness window
-    // (offline-only). Without evidence (current clients) the transaction is
-    // fetched by id as before.
+    // the Server API (default), or on the JWS within a freshness window and
+    // the revocations notifications recorded (offline-only). Without evidence
+    // (current clients) the transaction is fetched by id as before.
     const policy = options.signedTransactionEvidence ?? defaultSignedTransactionEvidencePolicy;
     const evidence = policy.mode === 'ignore'
         ? { status: 'absent' }
@@ -240,8 +277,8 @@ async function verifyAppStorePurchase(input, options, now, clockSkewMs) {
     if (offlineTransaction !== undefined
         && policy.mode === 'offline-only'
         && nowMs - transaction.signedDate > policy.maxSignedAgeMs) {
-        // Offline-only never sees a later refund; a JWS older than the window is
-        // not fresh enough to decide a grant on.
+        // The JWS never shows a refund Apple has not notified yet; a JWS older
+        // than the window is not fresh enough to decide a grant on.
         return { status: 'rejected', reason: 'APP_STORE_SIGNED_TRANSACTION_STALE' };
     }
     let rejection = validateTransaction(input, transaction, options.bundleId, environment, expectedAccountToken.value, nowMs, clockSkewMs);
@@ -250,21 +287,55 @@ async function verifyAppStorePurchase(input, options, now, clockSkewMs) {
     // when every other check passes: the backend's restore sharing policy
     // decides (RFC "Restore sharing"). The client's StoreKit-verified JWS is
     // required, so a transaction id alone never shares a purchase.
-    const foreignBinding = rejection === 'APP_STORE_ACCOUNT_TOKEN_MISMATCH'
+    const tokenMismatch = rejection === 'APP_STORE_ACCOUNT_TOKEN_MISMATCH';
+    if (tokenMismatch) {
+        // Every other check still decides: only a purchase that passes them all
+        // is reported as restorable or as another account's.
+        rejection = validateTransaction(input, transaction, options.bundleId, environment, undefined, nowMs, clockSkewMs);
+    }
+    const foreignBinding = tokenMismatch
         && input.request.intent === 'restore'
         && input.product.type === 'non_consumable'
         && offlineTransaction !== undefined;
-    if (foreignBinding) {
-        rejection = validateTransaction(input, transaction, options.bundleId, environment, undefined, nowMs, clockSkewMs);
-    }
     if (rejection !== undefined) {
         return { status: 'rejected', reason: rejection };
     }
+    const verificationId = createAppStoreGrantVerificationId(transaction);
+    if (offlineTransaction !== undefined && policy.mode === 'offline-only') {
+        // The client JWS cannot show a refund after it was signed: a refund the
+        // backend already heard of refuses a JWS signed before it, as a fresh
+        // Server API status would. A refund before the first grant has no ledger
+        // grant to reverse, so without this check it would grant with nothing
+        // behind it. A JWS signed after it without a `revocationDate` shows that
+        // Apple reversed the refund, and passes. It runs before the account
+        // binding answers, so a refund refuses every presenter, as the Server
+        // API's `revocationDate` does.
+        const revocation = await findRecordedRevocation(policy.revocations, verificationId, transaction, clockSkewMs, input.signal);
+        if (revocation !== undefined) {
+            return revocation;
+        }
+    }
+    if (tokenMismatch && !foreignBinding) {
+        // A transaction without an appAccountToken (bought outside the app, or
+        // by a build that set none) is no account's: refused for every player.
+        // One with another token is that account's, which can still recover it
+        // (RFC "Another account's purchase").
+        return transaction.appAccountToken === undefined
+            ? { status: 'rejected', reason: 'APP_STORE_ACCOUNT_TOKEN_MISSING' }
+            : { status: 'rejected', reason: 'APP_STORE_ACCOUNT_TOKEN_MISMATCH', anotherAccount: true };
+    }
     return {
         ...(foreignBinding
-            ? { status: 'restorable', reason: 'APP_STORE_ACCOUNT_TOKEN_MISMATCH' }
+            ? {
+                status: 'restorable',
+                // Bound to no account, or to another one: the backend refuses the
+                // former for good when no share covers it.
+                reason: transaction.appAccountToken === undefined
+                    ? 'APP_STORE_ACCOUNT_TOKEN_MISSING'
+                    : 'APP_STORE_ACCOUNT_TOKEN_MISMATCH',
+            }
             : { status: 'verified' }),
-        verificationId: createVerificationId(transaction),
+        verificationId,
         verifiedAt: new Date(nowMs).toISOString(),
         payload: {
             appStoreBundleId: transaction.bundleId,
@@ -280,6 +351,42 @@ async function verifyAppStorePurchase(input, options, now, clockSkewMs) {
 const defaultSignedTransactionEvidencePolicy = {
     mode: 'server-api',
 };
+/**
+ * The offline-only refusal for a revocation the backend recorded, or
+ * `undefined` when none applies. A record refuses a JWS signed at or before
+ * its `revokedAt` (widened by `clockSkewMs`, so skew errs toward refusing):
+ * that JWS is a snapshot from before the refund. A JWS signed later already
+ * shows the revocation in its own `revocationDate` (refused by the payload
+ * checks), unless Apple reversed the refund, so it passes. A record whose
+ * `revokedAt` does not parse refuses every JWS.
+ */
+async function findRecordedRevocation(revocations, verificationId, transaction, clockSkewMs, signal) {
+    let record;
+    try {
+        record = await revocations.findRevocation({
+            verificationId,
+            environment: transaction.environment,
+            bundleId: transaction.bundleId,
+            transactionId: transaction.transactionId,
+            originalTransactionId: transaction.originalTransactionId,
+            signal,
+        });
+    }
+    catch (error) {
+        if (!(error instanceof AppStoreDependencyUnavailableError)) {
+            throw error;
+        }
+        return { status: 'pending', reason: 'APP_STORE_REVOCATION_LOOKUP_UNAVAILABLE' };
+    }
+    if (record === undefined) {
+        return undefined;
+    }
+    const revokedAtMs = typeof record.revokedAt === 'string' ? Date.parse(record.revokedAt) : NaN;
+    if (Number.isFinite(revokedAtMs) && transaction.signedDate > revokedAtMs + clockSkewMs) {
+        return undefined;
+    }
+    return { status: 'rejected', reason: 'APP_STORE_TRANSACTION_REVOKED' };
+}
 function readSandboxGrantPolicy(options) {
     return options.environment === 'Production' && options.sandboxPurchases?.mode === 'grant'
         ? options.sandboxPurchases
@@ -377,6 +484,14 @@ function assertSignedTransactionEvidencePolicy(input) {
     }
     if (input.mode === 'offline-only') {
         readPositiveSafeInteger(input.maxSignedAgeMs, 'signedTransactionEvidence.maxSignedAgeMs');
+        if (typeof input.revocations !== 'object'
+            || input.revocations === null
+            || typeof input.revocations.findRevocation
+                !== 'function') {
+            // A client JWS cannot show a later refund; without the recorded
+            // revocations a refund before the first grant would still grant.
+            throw new Error('signedTransactionEvidence.revocations must implement findRevocation for offline-only.');
+        }
         return;
     }
     throw new Error('signedTransactionEvidence.mode must be ignore, server-api, or offline-only.');
@@ -492,24 +607,7 @@ expectedAccountToken, nowMs, clockSkewMs) {
     }
     return undefined;
 }
-function createVerificationId(transaction) {
-    const grantTransactionId = transaction.type === 'Non-Consumable'
-        ? transaction.originalTransactionId
-        : transaction.transactionId;
-    return createAppStoreVerificationId({
-        environment: transaction.environment,
-        bundleId: transaction.bundleId,
-        transactionId: grantTransactionId,
-    });
-}
-export function createAppStoreVerificationId(input) {
-    return [
-        'app-store',
-        input.environment,
-        input.bundleId,
-        input.transactionId,
-    ].map(encodeVerificationIdSegment).join(':');
-}
+export { createAppStoreVerificationId };
 /** Identify IDs emitted by this verifier without duplicating its encoding format. */
 export function isAppStoreVerificationId(verificationId) {
     const parts = verificationId.split(':');
@@ -541,9 +639,6 @@ export function isAppStoreVerificationId(verificationId) {
         && typeof values[2] === 'string' && values[2].length > 0
         && typeof values[3] === 'string' && /^[1-9][0-9]{0,19}$/u.test(values[3]);
 }
-function encodeVerificationIdSegment(value) {
-    return `${value.length}:${encodeURIComponent(value)}`;
-}
 function toCatalogProductType(type) {
     switch (type) {
         case 'Consumable':

package/dist/client.js

@@ -165,7 +165,9 @@ export function createGameServicesClient(input) {
                         }
                     };
                     const unsubscribe = reconciler.subscribe((event) => {
-                        if (event.type === 'failure' || event.record.idempotencyKey !== key) {
+                        if (event.type === 'failure'
+                            || event.type === 'revoked-finish'
+                            || event.record.idempotencyKey !== key) {
                             return;
                         }
                         if (event.type === 'transition') {
@@ -191,7 +193,8 @@ export function createGameServicesClient(input) {
                         }
                         else if (!serverResulted) {
                             serverResulted = true;
-                            progress.serverResult(event.response.verified);
+                            // Another account's purchase is a server answer with no grant.
+                            progress.serverResult(event.type === 'verify-result' && event.response.verified);
                         }
                     });
                     try {
@@ -235,7 +238,9 @@ export function createGameServicesClient(input) {
                                     alreadyProcessed: result.verification?.alreadyProcessed,
                                     reason: result.status === 'pending'
                                         ? 'purchase_pending'
-                                        : (result.verification?.reason ?? record?.error?.code),
+                                        : (result.verification?.reason
+                                            ?? record?.anotherAccount?.reason
+                                            ?? record?.error?.code),
                                 },
                             });
                         }

package/dist/commerce-reconciler.d.ts

@@ -55,6 +55,23 @@ export interface CommercePurchaseOperationRecord {
   /** A retryable error on `requested` means the provider proved checkout never started. */
   readonly error?: CommerceErrorInfo;
   readonly revokedBy?: string;
+  /**
+  * The backend answered that the store binds this purchase to another
+  * account than this record's player (RFC "Another account's purchase"):
+  * `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT`, or a `rejected` receipt with a
+  * store binding mismatch reason from a backend before that answer. The
+  * record is parked in `verifying`: never sent again automatically, not
+  * listed among the player's recoverable records, summarized as `rejected`
+  * for this player, and its shared key no longer refuses another player
+  * of the install, who journals the purchase under its own player-scoped
+  * key. Only this player's Restore Purchases, when the store reports the
+  * purchase again, sends it once more.
+  */
+  readonly anotherAccount?: {
+    /** The store's binding mismatch, for example `GOOGLE_PLAY_ACCOUNT_MISMATCH`. */
+    readonly reason: string;
+    readonly reportedAt: string;
+  };
 }
 /**
 * The store key of a commerce v2 purchase record: one namespace per ledger
@@ -65,8 +82,20 @@ export interface CommercePurchaseOperationRecord {
 */
 export declare function createCommercePurchaseOperationKey(target: string, idempotencyKey: string, playerId?: string): string;
 export declare function isCommercePurchaseOperationRecord(record: unknown): record is CommercePurchaseOperationRecord;
-/** Summary status of a record: the RFC mapping, with `revoked` kept distinct. */
+/**
+* Summary status of a record: the RFC mapping, with `revoked` kept distinct.
+* A record parked as another account's purchase is `rejected` for its
+* player: nothing was granted to it, and nothing will be.
+*/
 export declare function summarizeCommercePurchaseOperation(record: CommercePurchaseOperationRecord): CommercePurchaseSummaryStatus;
+/** A `verifying` record the backend answered as another account's purchase. */
+export declare function isParkedForAnotherAccount(record: CommercePurchaseOperationRecord): boolean;
+/**
+* Backend refusals that answer for a revoked purchase: the App Store verifier
+* read the refund (`APP_STORE_TRANSACTION_REVOKED`), or the ledger had
+* already reversed the grant this request names (`LEDGER_GRANT_REVERSED`).
+*/
+export declare const commerceRevokedRejectionReasons: ReadonlySet<string>;
 /**
 * Only `granted` and `finishing` records that hold the backend's ledger entry
 * id and a store transaction may be finished. The StoreKit SDK keeps no
@@ -104,6 +133,31 @@ export type CommerceReconcilerEvent = {
   readonly type: 'verify-result';
   readonly record: CommercePurchaseOperationRecord;
   readonly response: VerifyPurchaseResponse;
+} | {
+  /**
+  * The backend answered the record's verify as another account's
+  * purchase (RFC "Another account's purchase"): the record is parked,
+  * nothing was granted, and it is not a failure. `response` is the
+  * receipt of a backend before that answer (`rejected` with a store
+  * binding mismatch reason); absent for the 409 answer.
+  */
+  readonly type: 'another-account';
+  readonly record: CommercePurchaseOperationRecord;
+  readonly reason: string;
+  readonly response?: VerifyPurchaseResponse;
+} | {
+  /**
+  * A transaction the store revoked (refunded) while it was unfinished
+  * was asked to finish without a grant (`FinishTransactionInput.revoked`),
+  * and the store answered `finished`. `idempotencyKey` names this
+  * player's record the backend answered for; absent, the reconciler
+  * held no record of it, and the store's own-account revoked consumable
+  * was finished without a verify (nothing is journaled or granted).
+  */
+  readonly type: 'revoked-finish';
+  readonly transactionId: string;
+  readonly idempotencyKey?: string;
+  readonly finished: boolean;
 } | {
   readonly type: 'failure';
   readonly stage: CommerceReconcilerFailureStage;