payment-kit 1.29.6 → 1.29.8

package/api/tests/integrations/app-store/native-api.spec.ts

@@ -0,0 +1,172 @@
+// Unit tests for the native App Store Server API client (Phase 2, Path B).
+// fetch is mocked — we never hit Apple. A real EC P-256 PKCS#8 key is generated
+// per-suite (Apple `.p8` keys are PKCS#8) to exercise the subtle pkcs8 sign path.
+
+import { generateKeyPairSync } from 'node:crypto';
+
+import { nativeGetAllSubscriptionStatuses } from '../../../src/integrations/app-store/native-api';
+import type { AppStoreApiCredentials } from '../../../src/integrations/app-store/signed-data-verifier';
+
+const { privateKey } = generateKeyPairSync('ec', { namedCurve: 'P-256' });
+const PKCS8_PEM = privateKey.export({ type: 'pkcs8', format: 'pem' }) as string;
+
+const creds = (over: Partial<AppStoreApiCredentials> = {}): AppStoreApiCredentials => ({
+  issuerId: 'iss_1',
+  keyId: 'KEY_ID_1',
+  privateKeyPem: PKCS8_PEM,
+  bundleId: 'com.example.app',
+  environment: 'sandbox',
+  ...over,
+});
+
+type FetchCapture = { url: string; init: RequestInit | undefined };
+let lastFetch: FetchCapture;
+
+function mockFetch(impl: () => { ok: boolean; status: number; json?: () => Promise<unknown> }): void {
+  global.fetch = jest.fn(async (url: unknown, init?: unknown) => {
+    lastFetch = { url: String(url), init: init as RequestInit };
+    const r = impl();
+    return { ok: r.ok, status: r.status, json: r.json ?? (async () => ({})) } as unknown as Response;
+  }) as unknown as typeof fetch;
+}
+
+const okStatusResponse = () => ({
+  ok: true,
+  status: 200,
+  json: async () => ({
+    data: [
+      {
+        subscriptionGroupIdentifier: 'g1',
+        lastTransactions: [{ originalTransactionId: 'orig_X', status: 1, signedTransactionInfo: 'inner.jws.sig' }],
+      },
+    ],
+  }),
+});
+
+function authHeader(): string {
+  return (lastFetch.init!.headers as Record<string, string>).Authorization ?? '';
+}
+
+function decodeJwt(header: string): { header: any; payload: any } {
+  const jwt = header.replace(/^Bearer /, '');
+  const [h, p] = jwt.split('.');
+  return {
+    header: JSON.parse(Buffer.from(h!, 'base64url').toString('utf8')),
+    payload: JSON.parse(Buffer.from(p!, 'base64url').toString('utf8')),
+  };
+}
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe('nativeGetAllSubscriptionStatuses — happy path', () => {
+  it('hits the sandbox host with a Bearer token and parses StatusResponse', async () => {
+    mockFetch(okStatusResponse);
+    const res = await nativeGetAllSubscriptionStatuses('orig_X', creds());
+    expect(new URL(lastFetch.url).host).toBe('api.storekit-sandbox.apple.com');
+    expect(new URL(lastFetch.url).pathname).toBe('/inApps/v1/subscriptions/orig_X');
+    const auth = authHeader();
+    expect(auth).toMatch(/^Bearer /);
+    expect(res.data?.[0]?.lastTransactions?.[0]?.originalTransactionId).toBe('orig_X');
+  });
+
+  it('hits the PRODUCTION host (no itunes) when environment=production', async () => {
+    mockFetch(okStatusResponse);
+    await nativeGetAllSubscriptionStatuses('orig_X', creds({ environment: 'production' }));
+    expect(new URL(lastFetch.url).host).toBe('api.storekit.apple.com');
+  });
+});
+
+describe('nativeGetAllSubscriptionStatuses — bad input', () => {
+  it('throws when issuer/key/pem are missing', async () => {
+    mockFetch(okStatusResponse);
+    await expect(nativeGetAllSubscriptionStatuses('orig_X', creds({ issuerId: '' }))).rejects.toThrow(
+      /issuer_id\/key_id\/private_key_pem/
+    );
+  });
+
+  it('throws on a malformed .p8 PEM (not a silent unsigned request)', async () => {
+    mockFetch(okStatusResponse);
+    await expect(
+      nativeGetAllSubscriptionStatuses(
+        'orig_X',
+        creds({ privateKeyPem: '-----BEGIN PRIVATE KEY-----\nGARBAGE\n-----END PRIVATE KEY-----' })
+      )
+    ).rejects.toThrow(/not a valid EC P-256 PKCS#8 key/);
+    expect(global.fetch).not.toHaveBeenCalled();
+  });
+});
+
+describe('nativeGetAllSubscriptionStatuses — security', () => {
+  it('signs an ES256 JWT with aud=appstoreconnect-v1 and exp−iat=300s', async () => {
+    mockFetch(okStatusResponse);
+    await nativeGetAllSubscriptionStatuses('orig_X', creds());
+    const { header, payload } = decodeJwt(authHeader());
+    expect(header.alg).toBe('ES256');
+    expect(header.kid).toBe('KEY_ID_1');
+    expect(payload.aud).toBe('appstoreconnect-v1');
+    expect(payload.iss).toBe('iss_1');
+    expect(payload.bid).toBe('com.example.app');
+    expect(payload.exp - payload.iat).toBe(300);
+  });
+
+  it('never leaks the private key into the URL or request body', async () => {
+    mockFetch(okStatusResponse);
+    await nativeGetAllSubscriptionStatuses('orig_X', creds());
+    expect(lastFetch.url).not.toContain('PRIVATE KEY');
+    expect(JSON.stringify(lastFetch.init)).not.toContain('PRIVATE KEY');
+    expect(lastFetch.init!.method).toBe('GET'); // no body at all
+  });
+
+  it.each(['../../v1/other', '..%2f..%2f', 'x@evil.host', 'x/../../', 'A'.repeat(4096)])(
+    'confines a crafted originalTransactionId %p to one path segment (SSRF guard)',
+    async (badId) => {
+      mockFetch(okStatusResponse);
+      await nativeGetAllSubscriptionStatuses(badId, creds());
+      const u = new URL(lastFetch.url);
+      expect(u.host).toBe('api.storekit-sandbox.apple.com');
+      // exactly the fixed prefix + ONE encoded segment, no extra slashes from the id
+      expect(u.pathname).toBe(`/inApps/v1/subscriptions/${encodeURIComponent(badId)}`);
+    }
+  );
+});
+
+describe('nativeGetAllSubscriptionStatuses — data loss', () => {
+  it('returns an empty response on 404 instead of throwing (does not drop a pending reconcile)', async () => {
+    mockFetch(() => ({ ok: false, status: 404 }));
+    const res = await nativeGetAllSubscriptionStatuses('orig_unknown', creds());
+    expect(res).toEqual({ data: [] });
+  });
+});
+
+describe('nativeGetAllSubscriptionStatuses — data damage', () => {
+  it('passes signedTransactionInfo through unmodified and keeps numeric field types', async () => {
+    mockFetch(() => ({
+      ok: true,
+      status: 200,
+      json: async () => ({
+        data: [{ lastTransactions: [{ originalTransactionId: 'o', status: 2, signedTransactionInfo: 'A.B.C' }] }],
+      }),
+    }));
+    const res = await nativeGetAllSubscriptionStatuses('o', creds());
+    const tx = res.data?.[0]?.lastTransactions?.[0];
+    expect(tx?.signedTransactionInfo).toBe('A.B.C');
+    expect(typeof (tx as { status?: number }).status).toBe('number');
+  });
+});
+
+describe('nativeGetAllSubscriptionStatuses — data leak', () => {
+  it('on 401/403 surfaces only the status, never the bearer JWT or .p8', async () => {
+    mockFetch(() => ({ ok: false, status: 401 }));
+    let caught: Error | undefined;
+    try {
+      await nativeGetAllSubscriptionStatuses('orig_X', creds());
+    } catch (e) {
+      caught = e as Error;
+    }
+    expect(caught?.message).toMatch(/HTTP 401/);
+    expect(caught?.message).not.toContain('Bearer');
+    expect(caught?.message).not.toContain('PRIVATE KEY');
+  });
+});

package/api/tests/integrations/app-store/native-integration.spec.ts

@@ -0,0 +1,78 @@
+// Integration (Phase 2): with APP_STORE_NATIVE_VERIFY=true and a mocked fetch,
+// AppStoreClient.getSubscriptionStatus drives the WHOLE native path —
+// native API client (Path B, ES256 JWT bearer + fetch) → the returned
+// signedTransactionInfo re-verified by the native JWS verifier (Path A) — using
+// the REAL Apple sandbox JWS as the inner transaction. No apple lib involved.
+
+/* eslint-disable import/first */
+process.env.APP_STORE_NATIVE_VERIFY = 'true';
+delete process.env.APP_STORE_SKIP_SIGNATURE_VERIFY;
+
+import { generateKeyPairSync } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+
+import { AppStoreClient } from '../../../src/integrations/app-store/client';
+
+const REAL_JWS = readFileSync(path.join(__dirname, 'fixtures', 'real-sandbox.jws'), 'utf8').trim();
+const REAL = JSON.parse(readFileSync(path.join(__dirname, 'fixtures', 'real-sandbox.json'), 'utf8')).decoded_payload;
+const { privateKey } = generateKeyPairSync('ec', { namedCurve: 'P-256' });
+const PKCS8_PEM = privateKey.export({ type: 'pkcs8', format: 'pem' }) as string;
+
+afterEach(() => jest.restoreAllMocks());
+afterAll(() => {
+  delete process.env.APP_STORE_NATIVE_VERIFY;
+});
+
+describe('AppStoreClient.getSubscriptionStatus — native end-to-end', () => {
+  it('signs a bearer, fetches statuses, and re-verifies the real signedTransactionInfo natively', async () => {
+    let fetchedUrl = '';
+    global.fetch = jest.fn(async (url: unknown) => {
+      fetchedUrl = String(url);
+      return {
+        ok: true,
+        status: 200,
+        json: async () => ({
+          data: [
+            {
+              lastTransactions: [
+                { originalTransactionId: REAL.originalTransactionId, signedTransactionInfo: REAL_JWS },
+              ],
+            },
+          ],
+        }),
+      } as unknown as Response;
+    }) as unknown as typeof fetch;
+
+    const client = AppStoreClient.fromSettings({
+      bundle_id: REAL.bundleId, // io.arcblock.ai.stro — must match the JWS or verify rejects
+      environment: 'sandbox',
+      issuer_id: 'iss_1',
+      key_id: 'KEY_ID_1',
+      private_key_pem: PKCS8_PEM,
+    });
+
+    const tx = await client.getSubscriptionStatus(REAL.originalTransactionId);
+
+    // Path B reached the sandbox API host (no itunes); Path A decoded the real txn.
+    expect(new URL(fetchedUrl).host).toBe('api.storekit-sandbox.apple.com');
+    expect(tx).not.toBeNull();
+    expect(tx!.transactionId).toBe(REAL.transactionId);
+    expect(tx!.bundleId).toBe('io.arcblock.ai.stro');
+    expect(tx!.productId).toBe(REAL.productId);
+  });
+
+  it('returns null when no transaction matches (404 path-through)', async () => {
+    global.fetch = jest.fn(
+      async () => ({ ok: false, status: 404, json: async () => ({}) }) as unknown as Response
+    ) as unknown as typeof fetch;
+    const client = AppStoreClient.fromSettings({
+      bundle_id: 'io.arcblock.ai.stro',
+      environment: 'sandbox',
+      issuer_id: 'iss_1',
+      key_id: 'KEY_ID_1',
+      private_key_pem: PKCS8_PEM,
+    });
+    expect(await client.getSubscriptionStatus('orig_unknown')).toBeNull();
+  });
+});

package/api/tests/integrations/app-store/native-jws.spec.ts

@@ -0,0 +1,219 @@
+// Unit tests for the native Apple JWS verifier (Phase 1, Path A).
+//
+// Synthetic chains (make-chain.ts) exercise the algorithm with an injected test
+// root; the committed REAL Apple sandbox JWS (real-sandbox.jws) proves the real
+// OID + 3-cert chain end-to-end (design §11). No env flag needed — verifyAppleJws
+// is pure (the flag only selects native vs legacy in signed-data-verifier).
+
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+
+import { buildJws, makeChain } from './fixtures/make-chain';
+import { AppleJwsVerifyError, verifyAppleJws } from '../../../src/integrations/app-store/native-jws';
+import type { JwsTransactionPayload } from '../../../src/integrations/app-store/native-jws';
+
+const FIXED_SIGNED_DATE = 1_700_000_000_000;
+
+/** A valid chain + the trustedRoots list that anchors it (the chain's own root). */
+function freshChainCtx(opts: Parameters<typeof makeChain>[0] = {}) {
+  const chain = makeChain({ signedDate: FIXED_SIGNED_DATE, ...opts });
+  const trustedRoots = [Buffer.from(chain.x5c[2]!, 'base64')];
+  return { chain, trustedRoots };
+}
+
+async function expectCode(promise: Promise<unknown>, code: string): Promise<void> {
+  await expect(promise).rejects.toMatchObject({ code });
+}
+
+describe('verifyAppleJws — happy path', () => {
+  it('decodes a synthetic chain when its root is trusted; fields match the signed payload', async () => {
+    const { chain, trustedRoots } = freshChainCtx({
+      payload: { productId: 'sub_happy', expiresDate: 1_900_000_000_000, appAccountToken: 'uuid-happy' },
+    });
+    const decoded = await verifyAppleJws<JwsTransactionPayload>(chain.jws, { trustedRoots });
+    expect(decoded.transactionId).toBe('txn_synth_1');
+    expect(decoded.productId).toBe('sub_happy');
+    expect(decoded.expiresDate).toBe(1_900_000_000_000);
+    expect(decoded.appAccountToken).toBe('uuid-happy');
+    expect(decoded.signedDate).toBe(FIXED_SIGNED_DATE);
+  });
+
+  it('verifies the REAL Apple sandbox JWS against the vendored Apple roots end-to-end', async () => {
+    const jws = readFileSync(path.join(__dirname, 'fixtures', 'real-sandbox.jws'), 'utf8').trim();
+    const meta = JSON.parse(readFileSync(path.join(__dirname, 'fixtures', 'real-sandbox.json'), 'utf8'));
+    // default trustedRoots = APPLE_ROOT_CERTS (the real chain anchors to Apple Root CA G3)
+    const decoded = await verifyAppleJws<JwsTransactionPayload>(jws);
+    expect(decoded.transactionId).toBe(meta.decoded_payload.transactionId);
+    expect(decoded.bundleId).toBe('io.arcblock.ai.stro');
+    expect(decoded.productId).toBe(meta.decoded_payload.productId);
+    expect(decoded.signedDate).toBe(meta.decoded_payload.signedDate);
+  });
+});
+
+describe('verifyAppleJws — bad input', () => {
+  it('rejects non-3-segment JWS', async () => {
+    await expectCode(verifyAppleJws('a.b'), 'FORMAT');
+  });
+
+  it('rejects x5c.length !== 3 with INVALID_CHAIN_LENGTH', async () => {
+    const { chain, trustedRoots } = freshChainCtx();
+    const { jws } = buildJws({ alg: 'ES256', x5c: chain.x5c.slice(0, 2) }, chain.payload, chain.keys.leafKeyPem);
+    await expectCode(verifyAppleJws(jws, { trustedRoots }), 'INVALID_CHAIN_LENGTH');
+  });
+
+  it('rejects a header that is not base64url JSON', async () => {
+    await expectCode(verifyAppleJws('!!!notjson.payload.sig'), 'HEADER');
+  });
+
+  it('rejects a payload that is not valid JSON (after a valid chain)', async () => {
+    const { chain, trustedRoots } = freshChainCtx();
+    const headerSeg = chain.jws.split('.')[0]!;
+    const badPayload = Buffer.from('not json at all').toString('base64url');
+    const jws = `${headerSeg}.${badPayload}.${chain.jws.split('.')[2]}`;
+    await expectCode(verifyAppleJws(jws, { trustedRoots }), 'PAYLOAD');
+  });
+});
+
+describe('verifyAppleJws — security', () => {
+  it('rejects a tampered payload (signature no longer matches)', async () => {
+    const { chain, trustedRoots } = freshChainCtx();
+    const [h, , s] = chain.jws.split('.');
+    const tampered = Buffer.from(JSON.stringify({ ...chain.payload, productId: 'EVIL' })).toString('base64url');
+    await expectCode(verifyAppleJws(`${h}.${tampered}.${s}`, { trustedRoots }), 'SIGNATURE');
+  });
+
+  it('rejects a tampered signature', async () => {
+    const { chain, trustedRoots } = freshChainCtx();
+    const [h, p] = chain.jws.split('.');
+    const sigBytes = Buffer.from(chain.jws.split('.')[2]!, 'base64url');
+    sigBytes[0] = sigBytes[0]! ^ 0xff;
+    await expectCode(verifyAppleJws(`${h}.${p}.${sigBytes.toString('base64url')}`, { trustedRoots }), 'SIGNATURE');
+  });
+
+  it('rejects alg: "none" and alg: "RS256" (alg whitelist)', async () => {
+    const none = freshChainCtx({ alg: 'none' });
+    await expectCode(verifyAppleJws(none.chain.jws, { trustedRoots: none.trustedRoots }), 'ALG');
+    const rs = freshChainCtx({ alg: 'RS256' });
+    await expectCode(verifyAppleJws(rs.chain.jws, { trustedRoots: rs.trustedRoots }), 'ALG');
+  });
+
+  it('rejects when the presented root is NOT a trusted anchor', async () => {
+    const { chain } = freshChainCtx();
+    // default APPLE_ROOT_CERTS does NOT contain the synthetic root
+    await expectCode(verifyAppleJws(chain.jws), 'ANCHOR');
+  });
+
+  it('rejects a cross-signed leaf (chain break) before signature', async () => {
+    const { chain, trustedRoots } = freshChainCtx();
+    const header = { alg: 'ES256', x5c: [chain.crossSignedLeaf, chain.x5c[1], chain.x5c[2]] };
+    const { jws } = buildJws(header, chain.payload, chain.keys.leafKeyPem);
+    await expectCode(verifyAppleJws(jws, { trustedRoots }), 'CHAIN');
+  });
+
+  it('rejects when the leaf is missing the Apple OID', async () => {
+    const { chain, trustedRoots } = freshChainCtx({ leafOid: false });
+    await expectCode(verifyAppleJws(chain.jws, { trustedRoots }), 'OID');
+  });
+
+  it('rejects when the intermediate is missing the Apple OID', async () => {
+    const { chain, trustedRoots } = freshChainCtx({ intOid: false });
+    await expectCode(verifyAppleJws(chain.jws, { trustedRoots }), 'OID');
+  });
+
+  it('does not pollute Object.prototype from a hostile __proto__ payload', async () => {
+    const { chain, trustedRoots } = freshChainCtx();
+    const headerSeg = chain.jws.split('.')[0]!;
+    // own __proto__ key via JSON.parse, then sign it so the chain is valid
+    const hostile = JSON.parse(
+      '{"__proto__":{"polluted":true},"transactionId":"t","productId":"p","signedDate":1700000000000}'
+    );
+    const { jws } = buildJws(
+      JSON.parse(Buffer.from(headerSeg, 'base64url').toString('utf8')),
+      hostile,
+      chain.keys.leafKeyPem
+    );
+    const decoded = await verifyAppleJws<Record<string, unknown>>(jws, { trustedRoots });
+    expect(({} as Record<string, unknown>).polluted).toBeUndefined();
+    expect(Object.prototype.hasOwnProperty.call(decoded, '__proto__')).toBe(false);
+  });
+});
+
+describe('verifyAppleJws — validity & clock skew (±60s, all 3 certs)', () => {
+  // boundary: reject if validTo < effectiveDate − 60s; pass at exactly −60s.
+  it('passes at the expiry boundary (effectiveDate = validTo + 60s) and rejects 1ms past it', async () => {
+    const validTo = new Date(FIXED_SIGNED_DATE);
+    const ctxPass = freshChainCtx({ certValidTo: validTo, signedDate: FIXED_SIGNED_DATE + 60_000 });
+    await expect(verifyAppleJws(ctxPass.chain.jws, { trustedRoots: ctxPass.trustedRoots })).resolves.toBeDefined();
+    const ctxFail = freshChainCtx({ certValidTo: validTo, signedDate: FIXED_SIGNED_DATE + 60_000 + 1 });
+    await expectCode(verifyAppleJws(ctxFail.chain.jws, { trustedRoots: ctxFail.trustedRoots }), 'CERT_EXPIRED');
+  });
+
+  it('passes at the not-yet-valid boundary (effectiveDate = validFrom − 60s) and rejects 1ms before it', async () => {
+    const validFrom = new Date(FIXED_SIGNED_DATE);
+    const ctxPass = freshChainCtx({ certValidFrom: validFrom, signedDate: FIXED_SIGNED_DATE - 60_000 });
+    await expect(verifyAppleJws(ctxPass.chain.jws, { trustedRoots: ctxPass.trustedRoots })).resolves.toBeDefined();
+    const ctxFail = freshChainCtx({ certValidFrom: validFrom, signedDate: FIXED_SIGNED_DATE - 60_000 - 1 });
+    await expectCode(verifyAppleJws(ctxFail.chain.jws, { trustedRoots: ctxFail.trustedRoots }), 'CERT_NOT_YET_VALID');
+  });
+
+  it('rejects when ONLY the intermediate is expired (proves int is checked, not just leaf)', async () => {
+    const { chain, trustedRoots } = freshChainCtx({
+      certWindows: { intermediate: { to: new Date(FIXED_SIGNED_DATE - 3_600_000) } },
+    });
+    await expectCode(verifyAppleJws(chain.jws, { trustedRoots }), 'CERT_EXPIRED');
+  });
+
+  it('rejects when ONLY the root is expired (proves root is checked)', async () => {
+    const { chain, trustedRoots } = freshChainCtx({
+      certWindows: { root: { to: new Date(FIXED_SIGNED_DATE - 3_600_000) } },
+    });
+    await expectCode(verifyAppleJws(chain.jws, { trustedRoots }), 'CERT_EXPIRED');
+  });
+});
+
+describe('verifyAppleJws — data loss (concurrency / statelessness)', () => {
+  it('resolves all concurrent verifications correctly (no shared mutable state)', async () => {
+    const { chain, trustedRoots } = freshChainCtx();
+    const results = await Promise.all(
+      Array.from({ length: 12 }, () => verifyAppleJws<JwsTransactionPayload>(chain.jws, { trustedRoots }))
+    );
+    for (const r of results) expect(r.transactionId).toBe('txn_synth_1');
+  });
+});
+
+describe('verifyAppleJws — data damage (type/encoding fidelity)', () => {
+  it('keeps numbers as numbers and round-trips unicode byte-faithfully', async () => {
+    const { chain, trustedRoots } = freshChainCtx({
+      payload: { productId: '产品_🎉', expiresDate: 1_888_888_888_888, appAccountToken: 'uuid-😀' },
+    });
+    const decoded = await verifyAppleJws<JwsTransactionPayload>(chain.jws, { trustedRoots });
+    expect(decoded.productId).toBe('产品_🎉');
+    expect(decoded.appAccountToken).toBe('uuid-😀');
+    expect(typeof decoded.expiresDate).toBe('number');
+    expect(decoded.expiresDate).toBe(1_888_888_888_888);
+  });
+
+  it('leaves a missing expiresDate as undefined (never coerced to 0/null)', async () => {
+    const { chain, trustedRoots } = freshChainCtx(); // default payload has no expiresDate
+    const decoded = await verifyAppleJws<JwsTransactionPayload>(chain.jws, { trustedRoots });
+    expect('expiresDate' in decoded).toBe(false);
+    expect(decoded.expiresDate).toBeUndefined();
+  });
+});
+
+describe('verifyAppleJws — data leak (errors name the failure, not secrets)', () => {
+  it('throws AppleJwsVerifyError with a code and never echoes the raw cert/JWS material', async () => {
+    const { chain } = freshChainCtx();
+    try {
+      await verifyAppleJws(chain.jws); // ANCHOR (synthetic root not trusted)
+      throw new Error('should have rejected');
+    } catch (err) {
+      expect(err).toBeInstanceOf(AppleJwsVerifyError);
+      const message = (err as Error).message;
+      expect((err as AppleJwsVerifyError).code).toBe('ANCHOR');
+      // the long base64 cert/jws material must not leak into the message
+      expect(message).not.toContain(chain.x5c[0]!.slice(0, 40));
+      expect(message).not.toContain(chain.jws.split('.')[2]!.slice(0, 20));
+    }
+  });
+});

package/api/tests/integrations/app-store/native-receipt.spec.ts

@@ -0,0 +1,161 @@
+// Unit tests for native StoreKit 1 receipt verification (Phase 3, Path C).
+// fetch is mocked — we never hit Apple. Asserts parity with the evicted
+// node-apple-receipt-verify: hosts, body, sandbox fallback, output shape.
+
+import { verifyAppleReceiptNative } from '../../../src/integrations/app-store/native-receipt';
+
+type Call = { url: string; body: any };
+let calls: Call[] = [];
+
+/** Mock fetch with one response per call (for the production→sandbox retry). */
+function mockFetchSequence(responses: Array<{ ok?: boolean; status: number; json: object }>): void {
+  let i = 0;
+  calls = [];
+  global.fetch = jest.fn(async (url: unknown, init?: unknown) => {
+    const reqInit = init as RequestInit;
+    calls.push({ url: String(url), body: JSON.parse(String(reqInit.body)) });
+    const r = responses[Math.min(i, responses.length - 1)]!;
+    i += 1;
+    return { ok: r.ok ?? true, status: 200, json: async () => r.json } as unknown as Response;
+  }) as unknown as typeof fetch;
+}
+
+const item = (over: Record<string, unknown> = {}) => ({
+  product_id: 'sub_06',
+  transaction_id: 'txn_1',
+  original_transaction_id: 'orig_1',
+  purchase_date_ms: '1700000000000',
+  expires_date_ms: '1800000000000',
+  web_order_line_item_id: 'wo_1',
+  ...over,
+});
+
+const appleOk = (items: object[], bundleId = 'com.example.app') => ({
+  status: 0,
+  receipt: { bundle_id: bundleId, in_app: items },
+  latest_receipt_info: items,
+});
+
+afterEach(() => jest.restoreAllMocks());
+
+describe('verifyAppleReceiptNative — happy path', () => {
+  it('maps Apple latest_receipt_info to the normalized shape (snake→camel, ms→Number)', async () => {
+    mockFetchSequence([{ status: 200, json: appleOk([item()]) }]);
+    const result = await verifyAppleReceiptNative({ receipt: 'b64', sharedSecret: 'sk' });
+    expect(result).toEqual([
+      {
+        productId: 'sub_06',
+        transactionId: 'txn_1',
+        originalTransactionId: 'orig_1',
+        purchaseDate: 1700000000000,
+        expirationDate: 1800000000000,
+        bundleId: 'com.example.app',
+        webOrderLineItemId: 'wo_1',
+      },
+    ]);
+    expect(typeof result[0]!.expirationDate).toBe('number');
+  });
+
+  it('falls back to receipt.in_app when latest_receipt_info is absent', async () => {
+    mockFetchSequence([
+      { status: 200, json: { status: 0, receipt: { bundle_id: 'com.example.app', in_app: [item()] } } },
+    ]);
+    const result = await verifyAppleReceiptNative({ receipt: 'b64', sharedSecret: 'sk' });
+    expect(result[0]!.transactionId).toBe('txn_1');
+  });
+});
+
+describe('verifyAppleReceiptNative — bad input', () => {
+  it('returns [] when both latest_receipt_info and in_app are empty', async () => {
+    mockFetchSequence([{ status: 200, json: { status: 0, receipt: { bundle_id: 'x', in_app: [] } } }]);
+    expect(await verifyAppleReceiptNative({ receipt: 'b64', sharedSecret: 'sk' })).toEqual([]);
+  });
+
+  it('handles a non-numeric expires_date_ms as undefined (no NaN leak)', async () => {
+    mockFetchSequence([{ status: 200, json: appleOk([item({ expires_date_ms: 'not-a-number' })]) }]);
+    const result = await verifyAppleReceiptNative({ receipt: 'b64', sharedSecret: 'sk' });
+    expect(result[0]!.expirationDate).toBeUndefined();
+  });
+});
+
+describe('verifyAppleReceiptNative — security', () => {
+  it('POSTs password + exclude-old-transactions to the production Apple host only', async () => {
+    mockFetchSequence([{ status: 200, json: appleOk([item()]) }]);
+    await verifyAppleReceiptNative({ receipt: 'RECEIPT_B64', sharedSecret: 'sk_secret' });
+    expect(calls).toHaveLength(1);
+    expect(calls[0]!.url).toBe('https://buy.itunes.apple.com/verifyReceipt');
+    expect(calls[0]!.body).toEqual({
+      'receipt-data': 'RECEIPT_B64',
+      password: 'sk_secret',
+      'exclude-old-transactions': true,
+    });
+  });
+
+  it('only ever talks to the two Apple verifyReceipt hosts (no host injection)', async () => {
+    mockFetchSequence([
+      { status: 200, json: { status: 21007 } },
+      { status: 200, json: appleOk([item()]) },
+    ]);
+    await verifyAppleReceiptNative({ receipt: 'b64', sharedSecret: 'sk' });
+    const hosts = calls.map((c) => new URL(c.url).host);
+    expect(hosts).toEqual(['buy.itunes.apple.com', 'sandbox.itunes.apple.com']);
+  });
+});
+
+describe('verifyAppleReceiptNative — data loss (sandbox fallback + concurrency)', () => {
+  it.each([21007, 21002])('retries sandbox on status %i and returns the sandbox result', async (prodStatus) => {
+    mockFetchSequence([
+      { status: 200, json: { status: prodStatus } },
+      { status: 200, json: appleOk([item({ transaction_id: 'sandbox_txn' })]) },
+    ]);
+    const result = await verifyAppleReceiptNative({ receipt: 'b64', sharedSecret: 'sk' });
+    expect(calls).toHaveLength(2);
+    expect(calls[1]!.url).toBe('https://sandbox.itunes.apple.com/verifyReceipt');
+    expect(result[0]!.transactionId).toBe('sandbox_txn');
+  });
+
+  it('two concurrent calls with different secrets each POST their OWN secret (no shared state)', async () => {
+    const seen: string[] = [];
+    global.fetch = jest.fn(async (_url: unknown, init?: unknown) => {
+      const body = JSON.parse(String((init as RequestInit).body));
+      seen.push(body.password);
+      return { ok: true, status: 200, json: async () => appleOk([item()]) } as unknown as Response;
+    }) as unknown as typeof fetch;
+    await Promise.all([
+      verifyAppleReceiptNative({ receipt: 'r1', sharedSecret: 'secret_A' }),
+      verifyAppleReceiptNative({ receipt: 'r2', sharedSecret: 'secret_B' }),
+    ]);
+    expect(seen.sort()).toEqual(['secret_A', 'secret_B']);
+  });
+});
+
+describe('verifyAppleReceiptNative — data damage', () => {
+  it('returns all multi-item entries (client.ts picks the latest-expiry one)', async () => {
+    mockFetchSequence([
+      {
+        status: 200,
+        json: appleOk([
+          item({ transaction_id: 'old', expires_date_ms: '1500000000000' }),
+          item({ transaction_id: 'new', expires_date_ms: '1800000000000' }),
+        ]),
+      },
+    ]);
+    const result = await verifyAppleReceiptNative({ receipt: 'b64', sharedSecret: 'sk' });
+    expect(result.map((r) => r.transactionId)).toEqual(['old', 'new']);
+    expect(result.every((r) => typeof r.expirationDate === 'number')).toBe(true);
+  });
+});
+
+describe('verifyAppleReceiptNative — data leak', () => {
+  it('throws on a non-retryable non-zero status with the code but NOT the shared secret', async () => {
+    mockFetchSequence([{ status: 200, json: { status: 21004 } }]);
+    let caught: Error | undefined;
+    try {
+      await verifyAppleReceiptNative({ receipt: 'b64', sharedSecret: 'super_secret_value' });
+    } catch (e) {
+      caught = e as Error;
+    }
+    expect(caught?.message).toMatch(/21004/);
+    expect(caught?.message).not.toContain('super_secret_value');
+  });
+});