@quenty/gameproductservice 14.51.1 → 14.52.0

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [14.52.0](https://github.com/Quenty/NevermoreEngine/compare/@quenty/gameproductservice@14.51.2...@quenty/gameproductservice@14.52.0) (2026-07-02)
+
+### Bug Fixes
+
+- Fix lint ([c9c1ed7](https://github.com/Quenty/NevermoreEngine/commit/c9c1ed7ee47bd464225c64baffbabbdeee6ddafe))
+- Fix property replication ([cbdf092](https://github.com/Quenty/NevermoreEngine/commit/cbdf092195a1f11f402aa22f53ce29d4f93eb00d))
+
+### Features
+
+- Add server-only purchasing mode to GameProductService ([af6551b](https://github.com/Quenty/NevermoreEngine/commit/af6551b2f8d3bf202cb8dfa98f10fd1885b31668))
+
+## [14.51.2](https://github.com/Quenty/NevermoreEngine/compare/@quenty/gameproductservice@14.51.1...@quenty/gameproductservice@14.51.2) (2026-06-03)
+
+**Note:** Version bump only for package @quenty/gameproductservice
+
 ## [14.51.1](https://github.com/Quenty/NevermoreEngine/compare/@quenty/gameproductservice@14.51.0...@quenty/gameproductservice@14.51.1) (2026-05-30)
 
 **Note:** Version bump only for package @quenty/gameproductservice

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quenty/gameproductservice",
-  "version": "14.51.1",
+  "version": "14.52.0",
   "description": "Generalized monetization system for handling products and purchases correctly.",
   "keywords": [
     "Roblox",
@@ -35,9 +35,9 @@
     "@quenty/baseobject": "10.13.0",
     "@quenty/binder": "14.36.1",
     "@quenty/brio": "14.30.1",
-    "@quenty/cmdrservice": "13.45.1",
+    "@quenty/cmdrservice": "13.45.2",
     "@quenty/enumutils": "3.4.6",
-    "@quenty/gameconfig": "12.49.1",
+    "@quenty/gameconfig": "12.49.2",
     "@quenty/instanceutils": "13.30.1",
     "@quenty/loader": "10.11.0",
     "@quenty/maid": "3.9.0",
@@ -60,5 +60,5 @@
     "@quenty/tie": "10.40.1",
     "@quenty/valueobject": "13.31.1"
   },
-  "gitHead": "598b2b62b36bdcbdbbd56f7db10c399831cc6eba"
+  "gitHead": "76cd9189962481d0932514d8348fb0ed2c0454d8"
 }

package/src/Client/GameProductServiceClient.lua

@@ -146,6 +146,17 @@ function GameProductServiceClient:PromisePromptPurchase(
 	return self._gameProductDataService:PromisePromptPurchase(player, assetType, idOrKey)
 end
 
+--[=[
+	Observes whether server-only prompting is enabled. When enabled,
+	[GameProductServiceClient:PromisePromptPurchase] rejects and prompts must be
+	initiated from the server. Useful for hiding or disabling buy buttons on the client.
+
+	@return Observable<boolean>
+]=]
+function GameProductServiceClient:ObserveServerOnlyPromptingEnabled(): Observable.Observable<boolean>
+	return self._gameProductDataService:ObserveServerOnlyPrompting(Players.LocalPlayer)
+end
+
 --[=[
 	Returns true if item has been purchased this session
 

package/src/Server/GameProductService.lua

@@ -249,6 +249,29 @@ function GameProductService.ObservePlayerOwnership(
 	return self._gameProductDataService:ObservePlayerOwnership(player, assetType, idOrKey)
 end
 
+--[=[
+	Restricts purchase prompting to the server. When enabled, clients can no longer
+	prompt purchases directly via [GameProductServiceClient:PromisePromptPurchase] (it
+	rejects); prompts must be initiated from the server, where the developer can validate
+	the asset id. Defaults to disabled.
+
+	@param enabled boolean
+]=]
+function GameProductService.SetServerOnlyPromptingEnabled(self: GameProductService, enabled: boolean)
+	assert(type(enabled) == "boolean", "Bad enabled")
+
+	self._gameProductDataService:SetServerOnlyPrompting(enabled)
+end
+
+--[=[
+	Returns true if server-only prompting is enabled.
+
+	@return boolean
+]=]
+function GameProductService.IsServerOnlyPromptingEnabled(self: GameProductService): boolean
+	return self._gameProductDataService:GetServerOnlyPromptingValue().Value
+end
+
 --[=[
 	Cleans up the game product service
 ]=]

package/src/Server/Manager/PlayerProductManager.lua

@@ -13,6 +13,7 @@ local Players = game:GetService("Players")
 
 local EnumUtils = require("EnumUtils")
 local GameConfigAssetTypes = require("GameConfigAssetTypes")
+local GameProductDataService = require("GameProductDataService")
 local PlayerBinder = require("PlayerBinder")
 local PlayerProductManagerBase = require("PlayerProductManagerBase")
 local PlayerProductManagerInterface = require("PlayerProductManagerInterface")
@@ -60,6 +61,11 @@ function PlayerProductManager.new(player: Player, serviceBag: ServiceBag.Service
 
 	-- Initialize attributes
 
+	local serverOnlyPrompting = self._serviceBag:GetService(GameProductDataService):GetServerOnlyPromptingValue()
+	self._maid:GiveTask(serverOnlyPrompting:Observe():Subscribe(function(value)
+		self._obj:SetAttribute(GameProductDataService.ServerOnlyPromptingAttribute, value)
+	end))
+
 	-- Implement
 	local impl = self._maid:Add(PlayerProductManagerInterface.Server:Implement(self._obj, self))
 	self:ExportMarketTrackers(impl:GetImplParent())

package/src/Shared/GameProductDataService.lua

@@ -13,19 +13,25 @@ local Observable = require("Observable")
 local PlayerProductManagerInterface = require("PlayerProductManagerInterface")
 local Promise = require("Promise")
 local Rx = require("Rx")
+local RxAttributeUtils = require("RxAttributeUtils")
 local RxBrioUtils = require("RxBrioUtils")
 local ServiceBag = require("ServiceBag")
 local Signal = require("Signal")
 local TieRealmService = require("TieRealmService")
+local TieRealms = require("TieRealms")
+local ValueObject = require("ValueObject")
 
 local GameProductDataService = {}
 GameProductDataService.ServiceName = "GameProductDataService"
 
+GameProductDataService.ServerOnlyPromptingAttribute = "GameProductServerOnlyPrompting"
+
 export type GameProductDataService = typeof(setmetatable(
 	{} :: {
 		_serviceBag: ServiceBag.ServiceBag,
 		_tieRealmService: TieRealmService.TieRealmService,
 		_maid: Maid.Maid,
+		_serverOnlyPrompting: ValueObject.ValueObject<boolean>,
 
 		GamePassPurchased: Signal.Signal<Player, number>,
 		ProductPurchased: Signal.Signal<Player, number>,
@@ -46,6 +52,12 @@ function GameProductDataService.Init(self: GameProductDataService, serviceBag: S
 
 	self._maid = Maid.new()
 
+	-- Source of truth for server-only prompting. On the server this is set via
+	-- [GameProductService:SetServerOnlyPromptingEnabled] and replicated to clients
+	-- through the PlayerProductManager tie. On the client we read the replicated
+	-- value to decide whether to refuse local prompts.
+	self._serverOnlyPrompting = self._maid:Add(ValueObject.new(false, "boolean"))
+
 	-- Configure
 	self.GamePassPurchased = self._maid:Add(Signal.new() :: any) -- :Fire(player, gamePassId)
 	self.ProductPurchased = self._maid:Add(Signal.new() :: any) -- :Fire(player, productId)
@@ -84,6 +96,111 @@ function GameProductDataService.Start(self: GameProductDataService)
 	)
 end
 
+--[=[
+	Sets whether prompting is restricted to the server. When enabled, clients can no
+	longer prompt purchases directly via [GameProductDataService:PromisePromptPurchase];
+	prompts must be initiated from the server. Can only be set from the server.
+
+	@param serverOnly boolean
+]=]
+function GameProductDataService.SetServerOnlyPrompting(self: GameProductDataService, serverOnly: boolean): ()
+	assert(type(serverOnly) == "boolean", "Bad serverOnly")
+	assert(
+		self._tieRealmService:GetTieRealm() ~= TieRealms.CLIENT,
+		"[GameProductDataService] - Server-only prompting can only be configured from the server"
+	)
+
+	self._serverOnlyPrompting.Value = serverOnly
+end
+
+--[=[
+	Returns the server-authoritative server-only prompting [ValueObject]. This is
+	exported through the PlayerProductManager tie so it replicates to clients.
+
+	@return ValueObject<boolean>
+]=]
+function GameProductDataService.GetServerOnlyPromptingValue(
+	self: GameProductDataService
+): ValueObject.ValueObject<boolean>
+	return self._serverOnlyPrompting
+end
+
+--[=[
+	Returns true if server-only prompting is currently enabled. On the client this
+	reads the value replicated from the server for the local player.
+
+	@param player Player
+	@return Observable<boolean>
+]=]
+function GameProductDataService.ObserveServerOnlyPrompting(
+	_self: GameProductDataService,
+	player: Player
+): Observable.Observable<boolean>
+	assert(typeof(player) == "Instance" and player:IsA("Player"), "Bad player")
+
+	-- Always read the server-authoritative value (the server implementation), which
+	-- replicates down to clients as an attribute on the PlayerProductManager folder.
+	return RxAttributeUtils.observeAttribute(
+			player,
+			GameProductDataService.ServerOnlyPromptingAttribute,
+			false
+		)
+			:Pipe({
+				Rx.map(function(value: any)
+					return value == true
+				end) :: any,
+				Rx.distinct() :: any,
+			}) :: any
+end
+
+--[=[
+	Resolves if the caller is allowed to prompt a purchase, rejecting if server-only
+	prompting is enabled and we are on the client. The server is always authorized.
+
+	@param player Player
+	@return Promise
+]=]
+function GameProductDataService._promiseServerOnlyPromptingGuard(
+	self: GameProductDataService,
+	player: Player
+): Promise.Promise<()>
+	-- The server (and a single shared realm) is the authority and may always prompt.
+	if self._tieRealmService:GetTieRealm() ~= TieRealms.CLIENT then
+		return Promise.resolved()
+	end
+
+	return Rx.toPromise(self:ObserveServerOnlyPrompting(player) :: any):Then(function(serverOnly)
+		if serverOnly then
+			return Promise.rejected(
+				"[GameProductDataService] - Server-only prompting is enabled. The client cannot prompt purchases "
+					.. "directly; prompts must be initiated from the server."
+			)
+		end
+
+		return nil
+	end)
+end
+
+--[=[
+	Applies the server-only prompting guard and then prompts the purchase. Used by all
+	prompt entry points so the guard is enforced consistently.
+
+	@param player Player
+	@param assetTracker PlayerAssetMarketTracker
+	@param idOrKey string | number
+	@return Promise<boolean>
+]=]
+function GameProductDataService._promiseGuardedPromptPurchase(
+	self: GameProductDataService,
+	player: Player,
+	assetTracker: any,
+	idOrKey: string | number
+): Promise.Promise<boolean>
+	return self:_promiseServerOnlyPromptingGuard(player):Then(function()
+		return assetTracker:PromisePromptPurchase(idOrKey)
+	end)
+end
+
 --[=[
 	Returns true if item has been purchased this session
 
@@ -132,7 +249,7 @@ function GameProductDataService.PromisePromptPurchase(
 
 	return self:_promisePlayerProductManager(player):Then(function(playerProductManager)
 		local assetTracker = playerProductManager:GetAssetTrackerOrError(assetType)
-		return assetTracker:PromisePromptPurchase(idOrKey)
+		return self:_promiseGuardedPromptPurchase(player, assetTracker, idOrKey)
 	end)
 end
 
@@ -350,7 +467,7 @@ function GameProductDataService.PromisePlayerOwnershipOrPrompt(
 				if ownsAsset then
 					return true
 				else
-					return assetTracker:PromisePromptPurchase(idOrKey)
+					return self:_promiseGuardedPromptPurchase(player, assetTracker, idOrKey) :: any
 				end
 			end)
 		else
@@ -359,7 +476,7 @@ function GameProductDataService.PromisePlayerOwnershipOrPrompt(
 				return Promise.resolved(true)
 			end
 
-			return assetTracker:PromisePromptPurchase(idOrKey)
+			return self:_promiseGuardedPromptPurchase(player, assetTracker, idOrKey)
 		end
 	end)
 end